Merge pull request 'feat(ext): verify cookies in-browser before uploading (1.0.7)' (#57) from dev into main

Pre-upload verify request: after capturing the live browser cookies,
hit a known authenticated endpoint with credentials:'include' from the
extension's background context. If the platform reports we're not
logged in, abort the upload so we don't overwrite FC-side credentials
with stale data.

- platforms.js: add `verify` config per cookie-auth platform
  - hentaifoundry: HEAD /?enterAgree=1 (mirrors gallery-dl's HF
    _init_site_filters; same 401 path the operator hit 2026-06-03)
  - patreon: GET /api/current_user (clean 401 when logged out)
  - subscribestar, deviantart: no stable auth endpoint, skip verify
- cookies.js: verifyCookiesForPlatform() returns {ok, status, reason}.
  ok=true/false/null tri-state — null = verify not configured, caller
  treats as "proceed".
- background.js EXPORT_COOKIES + EXPORT_ALL_COOKIES: verify gates the
  upload; failures bubble up with the platform's name + reason.
- popup.js: success message now appends "(verified ✓)" when applicable.
- manifest + package.json: 1.0.6 → 1.0.7.

backend/app/services/ml/suggestions.py

@@ -4,7 +4,7 @@ threshold-filtered, category-grouped, ranked suggestions for one image.
 
 from dataclasses import dataclass, field
 
-from sqlalchemy import select
+from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from ...models import (
@@ -16,6 +16,7 @@ from ...models import (
 from ...models.tag import image_tag
 from .aliases import AliasService
 from .centroids import CentroidService
+from .tag_name import normalize as normalize_tag_name
 from .tagger import SURFACED_CATEGORIES
 
 
@@ -84,7 +85,12 @@ class SuggestionService:
         )
 
         # --- Camie predictions ---
-        candidates: list[tuple[str, str, float]] = []
+        # candidates carry (raw_name, display_name, category, confidence).
+        # raw_name = the booru-formatted vocab key, kept for alias_map
+        # lookup since alias rows are hand-curated against raw keys.
+        # display_name = normalize_tag_name(raw_name) — what the operator
+        # sees AND what gets written to tag.name on Accept.
+        candidates: list[tuple[str, str, str, float]] = []
         for name, p in predictions.items():
             category = p.get("category", "general")
             if category not in SURFACED_CATEGORIES:
@@ -92,10 +98,14 @@ class SuggestionService:
             conf = float(p.get("confidence", 0.0))
             if conf < self._threshold_for(settings, category):
                 continue
-            candidates.append((name, category, conf))
+            display = normalize_tag_name(name)
+            if display is None:
+                # emoticon / pure-punctuation vocab entry — drop entirely
+                continue
+            candidates.append((name, display, category, conf))
 
         alias_map = await self.aliases.resolve_many(
-            [(n, c) for n, c, _ in candidates]
+            [(raw, c) for raw, _disp, c, _conf in candidates]
         )
 
         merged: dict[object, Suggestion] = {}
@@ -116,8 +126,8 @@ class SuggestionService:
                     creates_new_tag=existing.creates_new_tag,
                 )
 
-        for name, category, conf in candidates:
+        for raw, display, category, conf in candidates:
-            canonical = alias_map.get((name, category))
+            canonical = alias_map.get((raw, category))
             if canonical is not None:
                 if canonical.id in applied or canonical.id in rejected:
                     continue
@@ -133,9 +143,17 @@ class SuggestionService:
                     ),
                 )
             else:
+                # Case-insensitive match on BOTH the raw camie key AND
+                # the normalized form — covers legacy underscore-named
+                # Tag rows accepted before normalization shipped, AND
+                # any tag the operator created with the human form.
                 existing_tag = (
                     await self.session.execute(
-                        select(Tag).where(Tag.name == name)
+                        select(Tag).where(
+                            func.lower(Tag.name).in_(
+                                [raw.lower(), display.lower()]
+                            )
+                        )
                     )
                 ).scalars().first()
                 if existing_tag is not None:
@@ -157,10 +175,10 @@ class SuggestionService:
                     )
                 else:
                     _merge(
-                        f"raw:{name}:{category}",
+                        f"raw:{display}:{category}",
                         Suggestion(
                             canonical_tag_id=None,
-                            display_name=name,
+                            display_name=display,
                             category=category,
                             score=conf,
                             source="tagger",

backend/app/services/ml/tag_name.py

@@ -0,0 +1,62 @@
+"""Camie vocabulary -> human-readable tag-name normalization.
+
+Camie v2's ~57k tag vocabulary is booru-derived and arrives as raw
+strings like `uchiha_sasuke_(naruto)`, `#unicus_(idolmaster)`,
+`1000-nen_ikiteru_(vocaloid)`, or `:/`. We want the operator to see
+"Uchiha Sasuke", "Unicus", "1000-Nen Ikiteru", or to never see the
+emoticon at all — and we want the same clean string to be what lands
+in `tag.name` when the suggestion is accepted, so Accept matches the
+existing-tag convention (`tag_service.find_or_create`).
+
+Rules (operator-approved 2026-06-03):
+  1. Strip leading junk chars (#, ., +, ;, ~, _, whitespace)
+  2. Drop trailing `_(disambiguator)` block(s), iteratively
+  3. Strip wrapping single/double quotes (after disambig removal so
+     `"foo_em_up"_(series)` -> `"foo_em_up"` -> `foo_em_up`)
+  4. Replace remaining `_` with space; collapse runs of whitespace
+  5. Add a space after any `:` (namespace:tag -> namespace: tag)
+  6. Preserve hyphens (booru hyphens often carry meaning)
+  7. Title-case each space-separated word (first character only —
+     apostrophes, digits, hyphens stay)
+  8. If no letters AND no digits remain, return None (drops emoticons
+     like `:/` or `^_^`; preserves bare digit tags like `2005`)
+  9. No surname/givenname swap — no reliable signal in the vocab
+"""
+
+import re
+
+_LEADING_JUNK = re.compile(r"^[#.+;~_\s]+")
+_TRAILING_DISAMBIG = re.compile(r"_\([^)]*\)\s*$")
+_MULTISPACE = re.compile(r"\s+")
+_COLON_NOSPACE = re.compile(r":(?=\S)")
+_HAS_ALPHANUMERIC = re.compile(r"[A-Za-z0-9]")
+
+
+def _strip_wrapping_quotes(s: str) -> str:
+    if len(s) >= 2 and s[0] == s[-1] and s[0] in ('"', "'"):
+        return s[1:-1]
+    return s
+
+
+def _title_word(w: str) -> str:
+    return w[:1].upper() + w[1:] if w else w
+
+
+def normalize(raw: str) -> str | None:
+    """Return the human-readable form of a raw Camie tag, or None if the
+    string is junk (emoticon, empty after stripping)."""
+    if not raw:
+        return None
+    s = _LEADING_JUNK.sub("", raw)
+    while True:
+        new = _TRAILING_DISAMBIG.sub("", s)
+        if new == s:
+            break
+        s = new
+    s = _strip_wrapping_quotes(s)
+    s = s.replace("_", " ")
+    s = _COLON_NOSPACE.sub(": ", s)
+    s = _MULTISPACE.sub(" ", s).strip()
+    if not s or not _HAS_ALPHANUMERIC.search(s):
+        return None
+    return " ".join(_title_word(w) for w in s.split(" "))

extension/background/background.js

@@ -194,9 +194,20 @@ browser.runtime.onMessage.addListener(async (msg) => {
         if (platform.authType === 'cookies') {
           const cookies = await extractCookiesForPlatform(key);
           if (cookies.length === 0) return { error: 'No cookies found — log in first.' };
+          // Verify the captured cookies are actually live BEFORE
+          // uploading. Skips upload on confirmed-stale sessions so we
+          // don't overwrite FC-side credentials with garbage. Platforms
+          // without a verify config (verify.ok === null) fall through
+          // to upload as before.
+          const v = await verifyCookiesForPlatform(key);
+          if (v.ok === false) {
+            return {
+              error: `Captured ${cookies.length} ${platform.name} cookies but they don't appear authenticated (${v.reason}). Log in again in this browser, then retry.`,
+            };
+          }
           const data = toNetscapeFormat(cookies);
           await api.uploadCredentials(key, 'cookies', data);
-          return { success: true, cookieCount: cookies.length };
+          return { success: true, cookieCount: cookies.length, verified: v.ok === true };
         }
         if (key === 'discord') {
           if (!discordToken) return { error: 'Open discord.com to capture a token first.' };
@@ -229,8 +240,13 @@ browser.runtime.onMessage.addListener(async (msg) => {
             results[key] = { skipped: true, reason: 'no cookies' };
             continue;
           }
+          const v = await verifyCookiesForPlatform(key);
+          if (v.ok === false) {
+            results[key] = { error: `verify failed: ${v.reason}` };
+            continue;
+          }
           await api.uploadCredentials(key, 'cookies', toNetscapeFormat(cookies));
-          results[key] = { success: true, cookieCount: cookies.length };
+          results[key] = { success: true, cookieCount: cookies.length, verified: v.ok === true };
         } catch (e) {
           results[key] = { error: e.message };
         }

extension/lib/cookies.js

@@ -76,3 +76,38 @@ async function getCookieCount(platformKey) {
     return 0;
   }
 }
+
+/**
+ * Verify cookies are live by hitting an authenticated endpoint with the
+ * browser's current cookie jar. Returns:
+ *   { ok: true,  status }      — verified
+ *   { ok: false, status, reason } — endpoint said we're not logged in
+ *   { ok: null,  reason }      — no verify config for this platform; caller
+ *                                should treat as "verify not available,
+ *                                proceed with upload"
+ *
+ * Implementation note: extensions with `host_permissions` for the target
+ * domain get the user's cookies auto-attached to fetch() — same set
+ * gallery-dl will later use on the backend.
+ */
+async function verifyCookiesForPlatform(platformKey) {
+  const platform = PLATFORMS[platformKey];
+  if (!platform) return { ok: false, reason: `Unknown platform: ${platformKey}` };
+  if (!platform.verify) return { ok: null, reason: 'verify-not-configured' };
+
+  const { url, method, okStatuses } = platform.verify;
+  let resp;
+  try {
+    resp = await fetch(url, { method, credentials: 'include', cache: 'no-store' });
+  } catch (e) {
+    return { ok: false, reason: `Verify request failed: ${e.message}` };
+  }
+  if (okStatuses.includes(resp.status)) {
+    return { ok: true, status: resp.status };
+  }
+  return {
+    ok: false,
+    status: resp.status,
+    reason: `${url} returned HTTP ${resp.status} — session looks stale or logged out`,
+  };
+}

extension/lib/platforms.js

@@ -13,6 +13,13 @@ const PLATFORMS = {
     authType: 'cookies',
     color: '#FF424D',
     urlPattern: /^https?:\/\/(www\.)?patreon\.com/,
+    // Patreon's `/api/current_user` returns 200 + the logged-in user
+    // when authenticated, 401 otherwise. Cheapest definitive check.
+    verify: {
+      url: 'https://www.patreon.com/api/current_user',
+      method: 'GET',
+      okStatuses: [200],
+    },
   },
   subscribestar: {
     name: 'SubscribeStar',
@@ -26,6 +33,9 @@ const PLATFORMS = {
     authType: 'cookies',
     color: '#FFD700',
     urlPattern: /^https?:\/\/(www\.)?subscribestar\.(com|adult)/,
+    // No known stable auth-required endpoint that returns a definitive
+    // status code; skipping verify so we don't false-positive-fail
+    // good cookies. Operator can add later if a clean endpoint surfaces.
   },
   hentaifoundry: {
     name: 'Hentai Foundry',
@@ -33,6 +43,14 @@ const PLATFORMS = {
     authType: 'cookies',
     color: '#9C27B0',
     urlPattern: /^https?:\/\/(www\.)?hentai-foundry\.com/,
+    // Mirror gallery-dl's _init_site_filters: HEAD on `?enterAgree=1`.
+    // Logged in → 200, logged out → 401. Catches the exact failure mode
+    // the backend extractor would hit later.
+    verify: {
+      url: 'https://www.hentai-foundry.com/?enterAgree=1',
+      method: 'HEAD',
+      okStatuses: [200],
+    },
   },
   discord: {
     name: 'Discord',
@@ -56,6 +74,9 @@ const PLATFORMS = {
     authType: 'cookies',
     color: '#05CC47',
     urlPattern: /^https?:\/\/(www\.)?deviantart\.com/,
+    // DA's logged-in-only endpoints sit behind their internal _napi
+    // namespace which shifts; skipping verify until a stable check
+    // surfaces. Same posture as SubscribeStar.
   },
 };
 

extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "FabledCurator",
-  "version": "1.0.6",
+  "version": "1.0.7",
   "description": "Export cookies from supported platforms to FabledCurator and add creators as sources in one click.",
 
   "browser_specific_settings": {

extension/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fabledcurator-extension",
-  "version": "1.0.6",
+  "version": "1.0.7",
   "private": true,
   "description": "Firefox extension for FabledCurator",
   "scripts": {

extension/popup/popup.js

@@ -132,8 +132,9 @@ async function exportPlatformCookies(key, card) {
     if (r.error) showError(r.error);
     else {
       const n = r.cookieCount ?? null;
+      const verifiedSuffix = r.verified ? ' (verified ✓)' : '';
       const msg = n !== null
-        ? `${PLATFORMS[key].name}: ${n} cookies exported`
+        ? `${PLATFORMS[key].name}: ${n} cookies exported${verifiedSuffix}`
         : `${PLATFORMS[key].name}: token exported`;
       showSuccess(msg);
       await loadPlatformStatus();

tests/test_ml_suggestions.py

@@ -39,8 +39,9 @@ async def test_threshold_filters_low_confidence_general(db):
     await db.flush()
     sl = await SuggestionService(db).for_image(img.id)
     names = [s.display_name for s in sl.by_category.get("general", [])]
-    assert "sword" in names
+    # display_name is normalized (tag_name.normalize) before surfacing.
-    assert "lowconf" not in names
+    assert "Sword" in names
+    assert "Lowconf" not in names
 
 
 @pytest.mark.asyncio
@@ -84,7 +85,9 @@ async def test_raw_tag_creates_new(db):
     await db.flush()
     sl = await SuggestionService(db).for_image(img.id)
     chars = sl.by_category["character"]
-    assert chars[0].display_name == "brand_new_tag"
+    # display_name is the normalized Camie name (underscores -> spaces,
+    # title-cased), not the raw vocab key.
+    assert chars[0].display_name == "Brand New Tag"
     assert chars[0].creates_new_tag is True
     assert chars[0].canonical_tag_id is None
 

tests/test_ml_tag_name.py

@@ -0,0 +1,53 @@
+import pytest
+
+from backend.app.services.ml.tag_name import normalize
+
+
+@pytest.mark.parametrize(
+    "raw, expected",
+    [
+        # Rule 4: underscores -> spaces; rule 7: title case
+        ("light_purple_hair", "Light Purple Hair"),
+        ("no_pants", "No Pants"),
+        ("year_2005", "Year 2005"),
+        # Single-word still title-cased
+        ("sword", "Sword"),
+        # Rule 3: drop trailing _(disambiguator)
+        ("uchiha_sasuke_(naruto)", "Uchiha Sasuke"),
+        ("apple_(fruit)", "Apple"),
+        ("kirby_(series)", "Kirby"),
+        # Repeated trailing disambig blocks
+        ("foo_(bar)_(baz)", "Foo"),
+        # Rule 1: leading junk chars
+        ("#unicus_(idolmaster)", "Unicus"),
+        (".52_gal_(splatoon)", "52 Gal"),
+        ("+_+_smile_(emote)", "Smile"),
+        # Rule 5: space after colon
+        ("nier:automata", "Nier: Automata"),
+        # Already-spaced colon left alone
+        ("nier: automata", "Nier: Automata"),
+        # Rule 6: hyphens preserved
+        ("1000-nen_ikiteru_(vocaloid)", "1000-nen Ikiteru"),
+        ("well-known_face", "Well-known Face"),
+        # Rule 2: wrapping quotes
+        ('"pile_em_up"_(genshin_impact)', "Pile Em Up"),
+        ("'foo_bar'", "Foo Bar"),
+        # Rule 8: emoticons -> None
+        (":/", None),
+        (";)", None),
+        ("+_+", None),
+        ("^_^", None),
+        # Empty / whitespace-only
+        ("", None),
+        ("   ", None),
+        ("___", None),
+        # Apostrophe inside word — preserved, not title-cased
+        ("it's_okay", "It's Okay"),
+        # Digit-only still surfaces (year tags)
+        ("2005", "2005"),
+        # Multi-space collapse
+        ("foo___bar", "Foo Bar"),
+    ],
+)
+def test_normalize(raw, expected):
+    assert normalize(raw) == expected