CoolFace
Apppublic

nifty-coder/stemsplit-backend

sourceHugging Faceupdated 8mo agoView on Hugging Face
0likes
App README

AI Music App Backend

A FastAPI backend for processing audio files and YouTube videos to separate them into individual stems (drums, bass, vocals, etc.) using the Demucs AI model.

Features

  • —YouTube Audio Processing: Download and separate audio from YouTube videos
  • —File Upload Processing: Upload and separate audio files
  • —Stem Separation: Separate audio into drums, bass, vocals, and other instruments
  • —ZIP Download: Download separated stems as a ZIP file
  • —Secure Profile Management: User profile management with Firebase authentication and Supabase storage

API Endpoints

Audio Processing

  • —GET / - Health check endpoint
  • —POST /youtube - Process YouTube video audio
  • —POST /upload - Process uploaded audio file

Profile Management (Requires Firebase Authentication)

  • —GET /api/profile - Get user profile
  • —POST /api/profile - Create new user profile
  • —PUT /api/profile - Update user profile
  • —DELETE /api/profile - Delete user profile

Running the Server

bash
python -m uvicorn main:app --reload --host 0.0.0.0 --port 8000

Usage

Process YouTube Video

bash
curl -X POST "http://localhost:8000/youtube" \
     -H "Content-Type: application/json" \
     -d '{"youtube_url": "https://www.youtube.com/watch?v=VIDEO_ID"}'

Upload Audio File

bash
curl -X POST "http://localhost:8000/upload" \
     -F "file=@audio_file.mp3"

Profile Management API Usage

All profile endpoints require Firebase authentication. Include the Firebase ID token in the Authorization header:

Get User Profile

bash
curl -X GET "http://localhost:8000/api/profile" \
     -H "Authorization: Bearer YOUR_FIREBASE_ID_TOKEN"

Create User Profile

bash
curl -X POST "http://localhost:8000/api/profile" \
     -H "Authorization: Bearer YOUR_FIREBASE_ID_TOKEN" \
     -H "Content-Type: application/json" \
     -d '{
       "display_name": "John Doe",
       "profile_picture": "https://example.com/avatar.jpg"
     }'

Update User Profile

bash
curl -X PUT "http://localhost:8000/api/profile" \
     -H "Authorization: Bearer YOUR_FIREBASE_ID_TOKEN" \
     -H "Content-Type: application/json" \
     -d '{
       "display_name": "John Smith"
     }'

Delete User Profile

bash
curl -X DELETE "http://localhost:8000/api/profile" \
     -H "Authorization: Bearer YOUR_FIREBASE_ID_TOKEN"

Troubleshooting

Torchaudio Backend Error

If you encounter the error:

RuntimeError: Couldn't find appropriate backend to handle uri ... and format None.

This was fixed by:

  1. 1.Adding soundfile to requirements.txt
  2. 2.Ensuring proper audio backend dependencies are installed
  3. 3.Adding better error handling and logging

Dependencies

  • —fastapi - Web framework
  • —uvicorn - ASGI server
  • —pydantic - Data validation
  • —ffmpeg-python - Audio processing
  • —python-multipart - File upload handling
  • —demucs - AI audio separation
  • —torchaudio - Audio processing backend
  • —soundfile - Audio file I/O
  • —yt-dlp - YouTube downloader
  • —firebase-admin - Firebase authentication
  • —supabase - Supabase database client
  • —slowapi - Rate limiting
  • —python-jose[cryptography] - JWT token handling
  • —python-dotenv - Environment variable management

Error Handling

The application now includes comprehensive error handling:

  • —Subprocess error capture and logging
  • —File existence checks
  • —Detailed error messages
  • —Proper HTTP status codes

Logging

The application uses structured logging to help debug issues:

  • —Download progress logging
  • —Processing step logging
  • —Error logging with stack traces

Security Features

The profile management system includes comprehensive security measures:

Authentication & Authorization

  • —Firebase ID Token Validation: All profile endpoints require valid Firebase ID tokens
  • —User Isolation: Users can only access and modify their own profiles
  • —Token Audience Validation: Ensures tokens are issued for the correct Firebase project

Rate Limiting

  • —GET /api/profile: 30 requests per minute
  • —POST /api/profile: 10 requests per minute
  • —PUT /api/profile: 20 requests per minute
  • —DELETE /api/profile: 5 requests per minute

Input Validation

  • —Display Name: Maximum 100 characters, cannot be empty
  • —Profile Picture URL: Maximum 500 characters
  • —Email Validation: Automatically populated from Firebase user data
  • —Data Sanitization: All input is validated and sanitized

Error Handling

  • —Secure Error Messages: No sensitive information leaked in error responses
  • —Comprehensive Logging: All errors are logged for monitoring
  • —Proper HTTP Status Codes: Appropriate status codes for different error scenarios

Database Security

  • —Service Role Access: Uses Supabase service role key for secure database operations
  • —User ID Validation: All database operations are scoped to the authenticated user
  • —Data Integrity: Proper validation and constraints on all profile data

Firebase Admin (production) vs Dev Bypass (local testing)

The profile endpoints require firebase-admin to verify Firebase ID tokens. There are two recommended ways to run and test locally:

1) Production-like (recommended): configure firebase-admin with a service account

  • —Download a service account JSON from the Firebase Console (Project Settings -> Service accounts -> Generate new private key).
  • —In PowerShell, set the environment variable and start the server (current terminal session):
powershell
           $env:GOOGLE_APPLICATION_CREDENTIALS = 'C:\path\to\service-account.json'
           uvicorn main:app --reload
  • —Or set it permanently (Windows) and restart your shell / service:
powershell
           setx GOOGLE_APPLICATION_CREDENTIALS "C:\path\to\service-account.json"
  • —Once firebase-admin can initialize, the backend will verify real Firebase ID tokens sent by the frontend.

2) Dev bypass (only for local development): enable DEV_ALLOW_PROFILE_NO_AUTH

  • —This bypass exists to let you iterate on frontend/profile UI quickly without configuring a service account. It MUST NOT be used in production.
  • —Enable the bypass and start the server (current terminal session):
powershell
           $env:DEV_ALLOW_PROFILE_NO_AUTH = '1'
           uvicorn main:app --reload
  • —The backend will accept Authorization headers in the form Bearer alice:alice@example.com and use them as the dev user id/email. If the token does not contain a :, it will default to a dev user id/email.
  • —Example curl using the dev token:
bash
           curl -X GET "http://localhost:8000/api/profile" \
                -H "Authorization: Bearer alice:alice@example.com"
  • —Frontend dev flow: you can set a Vite env variable in your frontend dev environment to use the dev token automatically:
  • —In tune-layers-explorer-main/.env.local (create if missing):
env
                VITE_API_BASE_URL=http://localhost:8000
                VITE_DEV_PROFILE_TOKEN=alice:alice@example.com
  • —Restart the frontend dev server. The frontend hook will use VITE_DEV_PROFILE_TOKEN when no Firebase user is present.

Security note: The DEV_ALLOW_PROFILE_NO_AUTH bypass is intentionally gated and logs a warning when used. Do not set this in any non-local environment.