refactor(server): extract the settings routes into routers/settings.py (R3) [needs device round-trip]

[byrongamatos]

⚠️ BEHAVIORAL — needs an on-device settings export→import round-trip before merge. Do not merge on green CI alone.

GET/POST /api/settings, /api/settings/reset, and the two-phase atomic export/import bundle (/api/settings/export|import) → lib/routers/settings.py, with their exclusive helpers (relpath-allowlist validator, the atomic writer, the library-DB snapshot + sqlite integrity gate, the config-type validator, the bundle schema).

Bodies verbatim except @app→@router and the seam reads: meta_db→appstate.meta_db, CONFIG_DIR→appstate.config_dir, _running_version→appstate.running_version(), and _default_settings→appstate.default_settings (the canonical defaults builder stays in server.py — the scan + artist-links code share it — injected as a new seam callable).

server.py: 5,539 → 4,478 (−1,061).

Verification

• Route table IDENTICAL (143); pyflakes clean bar the pre-existing File/safe_join/tuning_name/ET.
• Full pytest 2397 passed — incl the 154 settings cases: the export→import round-trip, library-DB snapshot/restore, and the relpath-allowlist SSRF/traversal guards (retargeted onto the settings module). npm run lint 0; Codex 0 findings.

On-device round-trip to run before merge

1. Open Settings, change a few values (e.g. reference pitch, a toggle), Save.
2. Export settings → downloads a bundle.
3. Change those values again to something different.
4. Import the bundle → confirm the values revert to the exported state, the library DB/covers restore, and no error toast.
5. Reset settings → confirm defaults come back.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Added settings management endpoints for viewing, updating, resetting, exporting, and importing configuration.
  • Added secure settings bundles including server configuration, plugin files, database snapshots, playlist covers, and avatars.
  • Added validation, atomic saving, backup restoration, DLC detection, and clear error reporting.

• Refactor

  • Moved settings functionality into a dedicated router while preserving existing behavior.

• Documentation

  • Updated release and size-tracking documentation for the latest router extraction.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: fb29d26f-d2a4-4050-ab97-6afe0e1d8a92

📥 Commits

Reviewing files that changed from the base of the PR and between 73127d5 and d1cd1b3.

📒 Files selected for processing (9)

• CHANGELOG.md
• docs/size-exemptions.md
• lib/appstate.py
• lib/routers/settings.py
• server.py
• tests/test_feedpak_extension.py
• tests/test_settings_api.py
• tests/test_settings_export.py
• tests/test_settings_export_library_db.py

---

📝 Walkthrough

Walkthrough

The Settings API, settings export/import logic, and related helpers move from server.py into lib/routers/settings.py. Shared default settings are exposed through appstate, and tests now target the extracted router.

Changes

Settings router extraction

Layer / File(s)	Summary
Router seam and application wiring lib/appstate.py, server.py, CHANGELOG.md, docs/size-exemptions.md	Adds the default_settings appstate slot, mounts the Settings router, removes the former server implementations, and updates extraction metadata.
Settings retrieval, save, and reset lib/routers/settings.py	Implements settings loading, validated partial saves, atomic persistence, DLC warnings, profile handling, and whitelisted resets.
Settings bundle export and import lib/routers/settings.py	Adds bundle validation, secure path handling, database snapshots, file encoding, export generation, and staged atomic import.
Router-focused test coverage tests/test_feedpak_extension.py, tests/test_settings_api.py, tests/test_settings_export.py, tests/test_settings_export_library_db.py	Updates endpoint calls, helper references, schema constants, and monkeypatch targets to use the extracted router.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant SettingsRouter
  participant ConfigFile
  participant PluginFiles
  participant LibraryDB
  Client->>SettingsRouter: Request settings or bundle operation
  SettingsRouter->>ConfigFile: Load or atomically persist configuration
  SettingsRouter->>PluginFiles: Export or stage plugin files
  SettingsRouter->>LibraryDB: Snapshot or validate library database
  SettingsRouter-->>Client: Return settings, bundle, or import status

Loading

Possibly related PRs

• got-feedBack/feedBack#858: Uses the same appstate.configure() router-seam pattern for tuning providers.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 57.14% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: extracting server settings routes into routers/settings.py.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch refactor/r3-router-settings

---

_{Comment @coderabbitai help to get the list of available commands.}