From e62a07af3717de7b771c4054da21f482f4041930 Mon Sep 17 00:00:00 2001
From: Colin Powell <colin@unbl.ink>
Date: Tue, 28 Oct 2025 14:38:36 -0400
Subject: [PATCH] [boardgames] Add auth to BGG API call

---
 vrobbler/apps/boardgames/bgg.py | 12 +++++++-----
 vrobbler/settings.py            |  1 +
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/vrobbler/apps/boardgames/bgg.py b/vrobbler/apps/boardgames/bgg.py
index b2e436a..86fdb19 100644
--- a/vrobbler/apps/boardgames/bgg.py
+++ b/vrobbler/apps/boardgames/bgg.py
@@ -6,6 +6,7 @@ from typing import TYPE_CHECKING, Optional
 import requests
 from bs4 import BeautifulSoup
 from django.contrib.auth import get_user_model
+from django.conf import settings
 
 User = get_user_model()
 if TYPE_CHECKING:
@@ -17,6 +18,8 @@ SEARCH_ID_URL = (
     "https://boardgamegeek.com/xmlapi/search?search={query}&exact=1"
 )
 GAME_ID_URL = "https://boardgamegeek.com/xmlapi/boardgame/{id}"
+BGG_ACCESS_TOKEN = getattr(settings, "BGG_ACCESS_TOKEN", "")
+BASE_HEADERS = {"User-Agent": "Vrobbler 31.0", "Authorization": f"Bearer {BGG_ACCESS_TOKEN}"}
 
 
 def take_first(thing: Optional[list]) -> str:
@@ -37,10 +40,9 @@ def take_first(thing: Optional[list]) -> str:
 
 def lookup_boardgame_id_from_bgg(title: str) -> Optional[int]:
     soup = None
-    headers = {"User-Agent": "Vrobbler 0.11.12"}
     game_id = None
     url = SEARCH_ID_URL.format(query=title)
-    r = requests.get(url, headers=headers)
+    r = requests.get(url, headers=BASE_HEADERS)
     if r.status_code == 200:
         soup = BeautifulSoup(r.text, "xml")
 
@@ -57,7 +59,6 @@ def lookup_boardgame_id_from_bgg(title: str) -> Optional[int]:
 def lookup_boardgame_from_bgg(lookup_id: str) -> dict:
     soup = None
     game_dict = {}
-    headers = {"User-Agent": "Vrobbler 0.11.12"}
 
     title = ""
     bgg_id = None
@@ -73,7 +74,7 @@ def lookup_boardgame_from_bgg(lookup_id: str) -> dict:
         bgg_id = lookup_boardgame_id_from_bgg(title)
 
     url = GAME_ID_URL.format(id=bgg_id)
-    r = requests.get(url, headers=headers)
+    r = requests.get(url, headers=BASE_HEADERS)
     if r.status_code == 200:
         soup = BeautifulSoup(r.text, "xml")
 
@@ -109,7 +110,8 @@ def push_scrobble_to_bgg(scrobble: "Scrobble", user: User) -> Optional[bool]:
     login_payload = {
         "credentials": {"username": bgg_username, "password": bgg_password}
     }
-    headers = {"content-type": "application/json"}
+    headers = BASE_HEADERS
+    headers["content-type"] = "application/json"
 
     # TODO Look up past plays for scrobble.media_obj.bggeek_id, and make sure we haven't scrobbled this before
 
diff --git a/vrobbler/settings.py b/vrobbler/settings.py
index 45d94e2..7afd4e2 100644
--- a/vrobbler/settings.py
+++ b/vrobbler/settings.py
@@ -68,6 +68,7 @@ LASTFM_SECRET_KEY = os.getenv("VROBBLER_LASTFM_SECRET_KEY")
 IGDB_CLIENT_ID = os.getenv("VROBBLER_IGDB_CLIENT_ID")
 IGDB_CLIENT_SECRET = os.getenv("VROBBLER_IGDB_CLIENT_SECRET")
 COMICVINE_API_KEY = os.getenv("VROBBLER_COMICVINE_API_KEY")
+BGG_ACCESS_TOKEN = os.getenv("VROBBLER_BGG_ACCESS_TOKEN", "")
 GEOLOC_ACCURACY = os.getenv("VROBBLER_GEOLOC_ACCURACY", 3)
 GEOLOC_PROXIMITY = os.getenv("VROBBLER_GEOLOC_PROXIMITY", "0.0001")
 POINTS_FOR_MOVEMENT_HISTORY = os.getenv(