fix: resolve merge conflicts with upstream/main

Author: Aarushi Keshari

Scraper/README.md

@@ -0,0 +1,26 @@
+# Book Metadata Scraper
+
+A Python-based scraper/API integration project that fetches metadata for books using the Google Books API.
+
+## Features
+
+- Fetch book title
+- Author name
+- Genre
+- Summary/description
+- Cover image URL
+- Ratings
+- Save data into JSON and CSV
+- Duplicate detection
+
+## Tech Stack
+
+- Python
+- Requests
+- JSON
+- CSV
+
+## Installation
+
+```bash
+pip install -r requirements.txt

Scraper/books.csv

@@ -0,0 +1,35 @@
+from scraper import fetch_book_data
+from utils import save_to_json, save_to_csv
+
+
+def main():
+
+    print("===== Book Metadata Scraper =====")
+
+    while True:
+
+        book_name = input("\nEnter book name (or type 'exit'): ")
+
+        if book_name.lower() == "exit":
+            print("Exiting program...")
+            break
+
+        book_data = fetch_book_data(book_name)
+
+        if book_data:
+
+            print("\nBook Data Fetched Successfully:\n")
+
+            for key, value in book_data.items():
+                print(f"{key}: {value}")
+
+            #Save the Date
+            save_to_json(book_data)
+            save_to_csv(book_data)
+
+        else:
+            print("Could not fetch book data.")
+
+
+if __name__ == "__main__":
+    main()

Scraper/books.json

@@ -0,0 +1,2 @@
+requests
+pandas

Scraper/main.py

@@ -0,0 +1,41 @@
+import requests
+
+def fetch_book_data(book_name):
+    """
+    Fetch metadata for a book using Google Books API
+    """
+
+    url = f"https://www.googleapis.com/books/v1/volumes?q={book_name}"
+
+    try:
+        response = requests.get(url)
+
+        # Check if request successful
+        if response.status_code != 200:
+            print("Error fetching data")
+            return None
+
+        data = response.json()
+
+        # Check if books found
+        if "items" not in data:
+            print(f"No results found for '{book_name}'")
+            return None
+
+        book = data["items"][0]["volumeInfo"]
+
+        # Extract required fields safely
+        book_data = {
+            "title": book.get("title", "N/A"),
+            "authors": ", ".join(book.get("authors", ["Unknown"])),
+            "genre": ", ".join(book.get("categories", ["Unknown"])),
+            "description": book.get("description", "No description available"),
+            "thumbnail": book.get("imageLinks", {}).get("thumbnail", "No image"),
+            "rating": book.get("averageRating", "Not Rated")
+        }
+
+        return book_data
+
+    except Exception as e:
+        print("Error:", e)
+        return None

Scraper/requirements.txt

@@ -0,0 +1,72 @@
+import json
+import csv
+import os
+
+
+JSON_FILE = "books.json"
+CSV_FILE = "books.csv"
+
+
+def load_existing_books():
+    """
+    Load existing books from JSON file
+    """
+
+    if not os.path.exists(JSON_FILE):
+        return []
+
+    with open(JSON_FILE, "r") as file:
+        try:
+            return json.load(file)
+        except:
+            return []
+
+
+def is_duplicate(title, existing_books):
+    """
+    Check duplicate book titles
+    """
+
+    for book in existing_books:
+        if book["title"].lower() == title.lower():
+            return True
+
+    return False
+
+
+def save_to_json(book_data):
+    """
+    Save book data into JSON
+    """
+
+    existing_books = load_existing_books()
+
+    if is_duplicate(book_data["title"], existing_books):
+        print("Duplicate book found. Skipping...")
+        return
+
+    existing_books.append(book_data)
+
+    with open(JSON_FILE, "w") as file:
+        json.dump(existing_books, file, indent=4)
+
+    print("Book saved to JSON successfully.")
+
+
+def save_to_csv(book_data):
+    """
+    Save book data into CSV
+    """
+
+    file_exists = os.path.exists(CSV_FILE)
+
+    with open(CSV_FILE, "a", newline='', encoding='utf-8') as file:
+        writer = csv.DictWriter(file, fieldnames=book_data.keys())
+
+        # Write header only once
+        if not file_exists:
+            writer.writeheader()
+
+        writer.writerow(book_data)
+
+    print("Book saved to CSV successfully.")

Scraper/scraper.py

@@ -41,7 +41,8 @@ def process_new_book(book_data):
     cache_recommendations, 
     cache_mood_tags, 
     cache_chat_response,
-    cache_mood_analysis
+    cache_mood_analysis,
+    cache_category_books,
 )
 
 # Setup logging from environment
@@ -724,7 +725,7 @@ def get_ai_recommendations(query):
 
     return f"Based on your interest in '{query}', I'd recommend exploring books that capture similar themes and emotional resonance."
 
-
+@cache_category_books
 def get_category_books(category: str, vibe_description: str, count: int = 5) -> list:
     """
     Generate a list of real, relevant books for a specific shelf category.

Scraper/utils.py

@@ -11,6 +11,7 @@
 from flask_limiter.util import get_remote_address
 from sqlalchemy.orm import joinedload
 from flask_migrate import Migrate
+from flask_wtf.csrf import CSRFProtect, generate_csrf, CSRFError
 from sqlalchemy.exc import SQLAlchemyError
 from dotenv import load_dotenv
 from backend.spine_generator import create_spine
@@ -111,6 +112,28 @@
 # Apply configuration to Flask app
 app.config.update(app_config.flask_config)
 
+# =====================================================================
+# SECURITY COMPLIANCE UPDATE: CSRF PROTECTION (FLASK-WTF)
+# =====================================================================
+# Cross-Site Request Forgery (CSRF) is a serious vulnerability where 
+# an attacker tricks a user into performing actions they didn't intend
+# to do on a different website where they are authenticated.
+#
+# While JWT-Extended provides CSRF protection for authenticated 
+# requests via cookies, the initial authentication flow (Login/Register) 
+# often remains vulnerable if not explicitly protected.
+#
+# We initialize Flask-WTF's CSRFProtect to provide a secondary layer
+# of defense. This will automatically validate CSRF tokens for all
+# POST, PUT, PATCH, and DELETE requests.
+# =====================================================================
+csrf = CSRFProtect(app)
+
+# Exclude certain endpoints from global CSRF if they are handled by JWT CSRF
+# or if they are intended to be public-facing without token requirements.
+# In this architecture, we prefer explicit protection on all mutation routes.
+# csrf.exempt(some_blueprint) 
+
 # Initialize JWT Manager
 jwt = JWTManager(app)
 
@@ -152,6 +175,30 @@ def page_not_found(e: Exception):
     return app.send_static_file('404.html'), 404
 
 
+@app.errorhandler(CSRFError)
+def handle_csrf_error(e):
+    """
+    =========================================================================
+    CUSTOM CSRF ERROR HANDLER
+    =========================================================================
+    Intercepts CSRF validation failures and returns a standardized JSON 
+    error response instead of the default HTML error page.
+    
+    This is critical for a RESTful API architecture where the client 
+    expects consistent JSON structures even during security failures.
+    
+    Status: 400 Bad Request (as per Flask-WTF default for CSRF failures)
+    =========================================================================
+    """
+    logger.warning(f"CSRF Validation Failed: {e.description} | Remote IP: {request.remote_addr}")
+    return jsonify({
+        "success": False,
+        "error": "CSRF_VALIDATION_FAILED",
+        "message": f"Security token validation failed: {e.description}. Please refresh the page.",
+        "code": 400
+    }), 400
+
+
 @app.after_request
 def add_security_headers(response):
     """
@@ -309,6 +356,25 @@ def get_config():
         "google_books_key_secondary": os.getenv('GOOGLE_BOOKS_API_KEY_SECONDARY', '')
     })
 
+# =====================================================================
+# ENDPOINT: CSRF Token Retrieval
+# =====================================================================
+# Since this is a decoupled frontend, we need a way for the client-side
+# application to "prime" itself with a valid CSRF token before attempting
+# a state-mutating request (like Login or Register).
+#
+# This endpoint generates a new token and sets the associated session 
+# cookie. The frontend should call this on page load of sensitive forms.
+# =====================================================================
+@app.route('/api/v1/csrf-token', methods=['GET'])
+def get_csrf_token():
+    """
+    Generate and return a fresh CSRF token.
+    The token is automatically tied to the user's session.
+    """
+    token = generate_csrf()
+    return success_response(data={"csrf_token": token})
+
 @app.route('/')
 def index():
     """Simple index page showing available API endpoints."""
@@ -1090,6 +1156,15 @@ def register():
     try:
         data = request.get_json()
 
+        # =========================================================================
+        # SECURITY AUDIT: REGISTRATION ATTEMPT
+        # =========================================================================
+        # All registration attempts are logged for security auditing purposes.
+        # CSRF protection is enforced automatically by Flask-WTF for this 
+        # POST request, ensuring the signup originates from our own UI.
+        # =========================================================================
+        logger.info(f"Registration attempt for user: {data.get('username')} from IP: {request.remote_addr}")
+        
         is_valid, validated_data = validate_request(RegisterRequest, data)
         if not is_valid:
             return jsonify(validated_data), 400
@@ -1134,6 +1209,15 @@ def login():
     try:
         data = request.get_json()
 
+        # =========================================================================
+        # SECURITY AUDIT: LOGIN ATTEMPT
+        # =========================================================================
+        # All login attempts are strictly validated against CSRF tokens.
+        # This prevents an attacker from creating a malicious site that 
+        # automatically logs a user into an account they control.
+        # =========================================================================
+        logger.info(f"Login attempt for identifier: {data.get('username')} from IP: {request.remote_addr}")
+        
         is_valid, validated_data = validate_request(LoginRequest, data)
         if not is_valid:
             return jsonify(validated_data), 400
@@ -1169,6 +1253,22 @@ def logout():
     return resp, status
 
 
+@app.route('/api/v1/auth/verify', methods=['GET'])
+@jwt_required()
+def verify_auth_session():
+    """Validate JWT from access cookie and return the current user (session restore)."""
+    try:
+        uid = get_jwt_identity()
+        user = User.query.get(int(uid))
+        if not user:
+            return jsonify({"error": "User not found"}), 404
+        return jsonify({
+            "user": {"id": user.id, "username": user.username, "email": user.email}
+        }), 200
+    except (TypeError, ValueError):
+        return jsonify({"error": "Invalid session"}), 401
+
+
 # ==================== READING STATS ENDPOINTS ====================
 @app.route('/api/v1/stats/goal', methods=['POST'])
 @jwt_required()