yrtria/theme-song-booth
Archived
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: Hermes prompt callback endpoint + API key management

Browse source 
- Add /api/prompt/<rid> callback endpoint with dual auth:
  per-request signed URL token + Bearer API key.
- Add HERMES_API_KEY config and runtime key helpers in app.py.
- Update admin request page to copy request details + callback URL.
- Add API key management to admin settings: regenerate, mask, show-once.
- Update .env.example, docker-compose.yml, README, REVIEW docs.
This commit is contained in:
Troll (Hermes Agent) 2026-08-03 17:16:56 +00:00
parent e46893e0b4
commit 6a60aa686c
8 changed files with 242 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

24
REVIEW.md
View file

@ -27,13 +27,13 @@ Flask app that lets convention attendees request custom AI-generated theme songs
| File | Notes |
|---|---|
| `app.py` | All routes, helpers, email function, status labels, runtime settings, MP3 tagging, rate limiting, DB health. |
| `config.py` | Env vars. `ADMIN_PASSWORD` is plain text. |
| `app.py` | All routes, helpers, email function, status labels, runtime settings, MP3 tagging, rate limiting, DB health, and the `/api/prompt/<id>` Hermes callback endpoint. |
| `config.py` | Env vars. `ADMIN_PASSWORD` is plain text. `HERMES_API_KEY` can be overridden at runtime. |
| `models.py` | SQLite schema + CRUD. `player_token` is a secret URL-safe token. |
| `init_db.py` | Run once after deploy: `python init_db.py`. |
| `templates/admin/request.html` | Biggest template; prompt copy helpers and JS live here. Customer email and operator notes are editable here. |
| `templates/admin/dashboard.html` | Queue table + filters + auto-refresh + topbar Reset System button. |
| `templates/admin/settings.html` | SMTP config, MP3 metadata defaults, DB backup/restore, health check, reset. |
| `templates/admin/settings.html` | SMTP config, MP3 metadata defaults, DB backup/restore, health check, reset, and Hermes API key management. |
| `templates/faq.html` | Customer FAQ page. |
| `templates/status.html` | Customer order status lookup. |
| `templates/closed.html` | Message shown on `/request` when the booth is marked closed. |
@ -52,13 +52,14 @@ pending → prompt_ready → songs_uploaded → awaiting_payment → paid → de
1. Customer fills `/request`.
2. Open `/admin`, click request row (or filter by status).
3. On `/admin/request/<id>`, fix the customer's email if needed, then click **Copy customer info for Hermes**, paste result to Hermes.
4. Paste Hermes response (Title/Style/Lyrics format) into the fields and click **Save Prompt**.
5. Copy Style/Lyrics into Suno Custom Mode, generate two versions.
6. Upload Version A and B MP3s.
7. Click **Send Preview Link**.
8. Customer receives email, visits player, picks version.
9. Operator collects Square payment, enters reference, clicks **Mark Paid & Deliver**.
10. Customer receives MP3 attachment(s) by email.
4. Hermes POSTs Title/Style/Lyrics back to the signed callback URL; the request becomes **Prompt Ready**.
5. If the callback fails, paste Hermes' response into the Title/Style/Lyrics fields and click **Save Prompt**.
6. Copy Style/Lyrics into Suno Custom Mode, generate two versions.
7. Upload Version A and B MP3s.
8. Click **Send Preview Link**.
9. Customer receives email, visits player, picks version.
10. Operator collects Square payment, enters reference, clicks **Mark Paid & Deliver**.
11. Customer receives MP3 attachment(s) by email.
## Environment variables that matter
@ -71,6 +72,7 @@ BOOTH_NAME
HOST_PORT
INTERNAL_PORT
MAX_REVISIONS
HERMES_API_KEY
```
Most can be overridden at runtime from `/admin/settings` and stored in `booth_settings.json`.
@ -84,6 +86,8 @@ Most can be overridden at runtime from `/admin/settings` and stored in `booth_se
- Runtime settings are stored in the persistent uploads volume (`booth_settings.json`).
- The `booth_open` setting controls whether `/request` shows the form or the closed banner.
- Container cannot read host paths; all static assets used at runtime (logo, banner, favicons, closed banner) must be in the repo or a mounted volume.
- The Hermes callback URL is signed with `APP_SECRET_KEY` and expires after 1 hour.
- If you regenerate the Hermes API key, update the Hermes skill/config immediately; old key requests will 401.
## How to redeploy