v2.0.0 — TGTG 0.19.0 migration, PIN login & distroless image

BargainBites v2.0.0 is a major release built on the migration to the Too Good To Go API client tgtg 0.19.0. It replaces the old email-link login with a PIN-based flow, adds substantial anti-detection and reliability hardening, and ships as a rootless distroless container deployed via Docker Compose.

⚠️ Breaking release. The login flow, configuration, and deployment model have all changed. See Upgrade notes below before updating.

✨ Highlights

• TGTG 0.19.0 migration — upgraded the Too Good To Go client and removed the brittle user-agent monkeypatch.
• PIN-based login — replaces the old email-link flow. Bare /login, /relogin, /start, and the PIN step are now conversational: the bot prompts and waits for your next message (one-shot forms still work).
• Distroless, rootless container — multi-stage image running as non-root UID 65532, deployed Compose-first.
• All dependencies updated to their latest releases; dev tooling (black, pytest) moved out of the production image.

🔐 Login & commands

• PIN-based login flow with conversational prompts for /login, /relogin, /start, and the PIN step.
• New /relogin command.
• Per-user TGTG clients — removes the shared-client race that caused 401 refresh failures.
• Fixed invite: /generate_token now sends /start <token> (the previously referenced /authorize command never existed).

🛡️ Anti-detection & reliability

• Day/night poll cadence (5–8 min daytime, 45–90 min between 01:00–06:59 local) with jitter.
• Per-user captcha cooldown (30–60 min) instead of a global pause.
• Skip empty-favourite users with periodic re-probe; skip users with no active notifications.
• Proactively refresh access tokens before the 4h expiry; persist rotated TGTG/Datadome cookies.
• Reset the consecutive-error counter after a successful fetch; reuse the post-login client for a fast first /info.
• Daily captcha/401 telemetry counters and per-cycle duration logging.

🐛 Correctness fixes

• Price parsing — read bag price from item_price (the correct API field), fixing the 0.00 bug; honour the API-provided decimals.
• Set the container timezone so pickup times and night mode use local time.
• Prune stale available_items_favorites rows (and actually delete them); tolerate missing item fields.

📦 Packaging & ops

• Distroless, rootless (UID 65532) multi-stage Docker image.
• Docker Compose as the primary deployment path.
• .env-based configuration (dropped config.ini and python-dotenv); configurable LOG_LEVEL.
• Upgraded the full dependency set (aiohttp 3.13.5, aiodns 4.0.4, aiohttp_socks 0.11.0, pyTelegramBotAPI 4.33.0, requests 2.34.2); moved black/pytest to requirements-dev.txt so the production image no longer ships dev tooling.
• logger.exception for stack traces; structured startup logging.

📚 Docs & tests

• README rewritten for v2.0.0 (PIN login, Compose-first, current command reference).
• pytest infrastructure with 27 tests covering formatting, login/PIN flow, polling cadence, cooldowns, cookie persistence, DB helpers, and conversational-state helpers.

⬆️ Upgrade notes

• Re-login required. The email-link flow is gone — existing sessions use the new PIN-based login.
• Reconfigure via .env. config.ini is no longer used; move your settings to environment variables (see .env.example). LOG_LEVEL is now configurable.
• Deploy with Docker Compose. The image is distroless and runs as non-root (UID 65532); ensure mounted logs/ and database/ directories are writable by that UID.
• Set your timezone (TZ) so pickup times and night-mode cadence are correct.

---

🤖 Generated with Claude Code

v1.7

feat: add /relogin command and improve TGTG client handling

- Implemented new /relogin command in Telegram bot
- Updated TooGoodToGo class to support forced re-login
- Added more robust error handling for TGTG client connections
- Updated TGTG user agents to latest version
- Improved retry and delay mechanisms for API calls
- Bumped tgtg package to version 0.18.2

v1.5.0

• Multi-User Support: Multiple users can log in and use the bot simultaneously.
• Private Chat and Token Access: Authorise private access using admin-generated tokens.
• Admin Features: Includes admin-only commands for managing users and tokens.
• Interactive Blacklist Management: Users can blacklist or unblacklist stores.

v1.0.2

feat: dockerisation