Self-Hosted Solution

[abutlerboudakian]

Are there any plans at the moment to make this a self-hosted webapp (i.e. purchasing a domain and hosting a web version of this)? Having this tool available will be great for weeding out spammers but a lot of youtubers might not want to go through all the effort of generating their own API keys and running the console application manually, as well as possibly getting sussed out by all the security warnings that come up when downloading the compiled exe.

[ThioJoe]

I thought about it, and it definitely would be way easier to use, but I'd have to do a lot of research to figure out how to do that. Also the YouTube API has a relatively low initial quota and I'm not sure how hard it would be to get it increased sufficiently. I'll look into it, but don't really have any plans for it at the moment.

[arjun-dureja]

FYI, I've gotten my YouTube API quota increased from 25K per month to 500K per month pretty easily. I just had to submit a request explaining what my app did (mine was a simple sub count tracker) and why I needed a higher quota. They took about 3 weeks to get back to me.

[joaogelado]

I thought about it, and it definitely would be way easier to use, but I'd have to do a lot of research to figure out how to do that. Also the YouTube API has a relatively low initial quota and I'm not sure how hard it would be to get it increased sufficiently. I'll look into it, but don't really have any plans for it at the moment.

If you do so, I recommend using vercel. It's like plug and play and it has a free plan that is good enough for starter projects. Also I like Next js (that is also from Vercel), but for this you will need learn JavaScript. Anyways, this is not a paid comment, it is just my opinion as a developer. Also, I am a programmer and use js for my projects. If you think I may help with something, you can try to call me out.

Also, if I can make one, I will share my example here so you can see it.

[ArjixWasTaken]

FYI, I've gotten my YouTube API quota increased from 25K per month to 500K per month pretty easily. I just had to submit a request explaining what my app did (mine was a simple sub count tracker) and why I needed a higher quota. They took about 3 weeks to get back to me.

Easy solution is to use multiple API keys from multiple google cloud console projects.

[deidyomega]

If you decide you want to go down that route, I'd be happy to help you do it. I've built more than a few webapps.

[SevastianGit]

Easy solution is to use multiple API keys from multiple google cloud console projects.

Hmm, if that works and does increase the quota, maybe we should make a new issue to request this as a feature?

[TechStudent10]

@ThioJoe It's actually pretty easy when you think about it. At first. Since you are using Python, using something like Flask would work. All you would have to do is figure out some way to manage users AND how to send them a sign-in link. What I mean in the first one (just to avoid confusion) is how are you going to distinguish different users? If you use something like Flask-Dance, then yeah it's possible. However, Google, for whatever reason, decided to go out and make their own library instead of just allowing us to get a simple Client ID and Secret and then allowing us to make requests to an API where you can delete the comments. I guess it's for security purposes...

[abutlerboudakian]

@TechStudent11 That stuff's already implemented in the fork, it's not pretty at the moment but it is functional. The package I'm using is called django-google-api, which generates a migration for a GoogleAuth model which keeps track of each token that gets generated through a redirect-uri after authenticating. Right now I only have localhost set up as the callback-url since I'm testing it for hosting yet, but it can autheticate and return tokens correctly.

[abutlerboudakian]

Here's the snippet that's doing most of the work:

from django_google.flow import DjangoFlow, CLIENT_SECRET_FILE, SCOPES
from django_google.models import GoogleAuth
from django.contrib.auth import get_user_model

def not_broken_constructor(self, oauth2session, client_type, client_config, redirect_uri=None, code_verifier=None, autogenerate_code_verifier=None):
    os.environ['OAUTHLIB_RELAX_TOKEN_SCOPE'] = '1'
    super(DjangoFlow, self).__init__(oauth2session, client_type, client_config,  redirect_uri, code_verifier, autogenerate_code_verifier)

DjangoFlow.__init__ = not_broken_constructor

User = get_user_model()
flow = DjangoFlow.from_client_secrets_file(client_secrets_file=CLIENT_SECRET_FILE, scopes=SCOPES)

def oAuthView(request):
        callback_url=reverse("oauth2callback") # callback Url (oAuth2CallBackView URL)
        return redirect(flow.get_auth_url(request, callback_url=callback_url))

# Google Authentication Call Back VIEW (Using Without Javascript)
def oAuth2CallBackView(request):
    success_url = "/dashboard/"  # redirection URL on Success reverse() can b use here

    # Library a little sus if the public api has mispelled methods
    creds = flow.get_credentails_from_response_url(response_url=request.build_absolute_uri())
    
    userinfo = flow.get_userinfo(creds=creds)
    try:
        user = User.objects.get(email=userinfo['email'])
    except User.DoesNotExist:
        user = User.objects.create(
            email=userinfo['email'],
            username=userinfo['email'],
            first_name=userinfo['given_name'],
            last_name=userinfo['family_name']
        )
    finally:
        try:
            gauth = GoogleAuth.objects.get(user=user)
        except GoogleAuth.DoesNotExist:
            gauth = GoogleAuth.objects.create(user=user, creds=creds)

[abutlerboudakian]

Some of that is copy-pasted from the library quickstart, but it routes correctly and generates a token, then stores it through the GoogleAuth model provided with the package, with hooks in the model code to auto-refresh when necessary

[TechStudent10]

@abutlerboudakian Ah okay. Impressive...

[TechStudent10]

I'm more of a Flask expert or guy rather than Django. But I guess it makes sense here.

[ThioJoe]

I'll first look into just hosting the Google Cloud project, where I'm imagining the user would still run the script locally and store the credentials on their own computer. Because security-wise, I'm very hesitant to have to maintain custody of login credentials of users myself and host the actual script on my own site, so I would have to spend a lot of time making sure I do that properly.

But I think a good balance for now would be if no one had to go through the steps to set up their own cloud dashboard project and could just use one centralized one and I could request bigger quotas, but they'd still run the script locally, it would just call my API project instead of their own.

The one thing I have to look up is how they would be authorized to access the project. Right now obviously the user logs into the cloud dashboard and downloads their own client_secrets file, but I have to assume it's a different process for a public project.

[TechStudent10]

@ThioJoe Aw shoot. First, Google makes getting a damn client ID and secret very complicated, and now getting approval from Google so that a self-hosted solution works even more complicated?! I take back everything I said about security and why Google makes these processes so complicated for the developer. If I wanted to add a "Sign In with Google" button to my website using Flask, I would not only have to get a client ID and secret but rewrite most of the Python 2.7 code that Google, for some reason, still uses on their site. Why Google, why?

Edit: Oh shoot I just pinged Google!

[abutlerboudakian]

Have not had time this week to look at this much, 9-5 took out most of my energy. Will have some time this weekend and next week.

[TechStudent10]

@abutlerboudakian alright! good luck!

[Kurdakov]

btw with community moderators feature which is scheduled to appear it might look like this: youtube channel owner grants community moderator rights to anti spam account after that the only thing he/she needs to provide is a link to their video for clean up

[TechStudent10]

@Kurdakov not a bad idea.

[KendallDoesCoding]

@ThioJoe this indeed would be cool, and much user-friendly. But as you mentioned it will take some research. For people that want to run it without downloading, in the browser any software though, I made a pull request #118 , it's mainly for unsupported devices, android users but it can work for anyone really. I just need @ThioJoe to check it out and to consider merging it in!