fix(livetennisapi): address review — clamp limit, guard malformed payloads, dark-mode icon, more tests

- Clamp the limit input to the API's documented 1-200 range before the
  request instead of forwarding out-of-range values.
- Validate decoded 200 payloads (object with a 'data' list / score object)
  so malformed responses surface as friendly error rows instead of
  AttributeError/TypeError escaping the component.
- Icon: complete the isDark contract — index.tsx reads the dark store and
  passes isDark; the SVG uses it for the tile color and omits it from the
  DOM spread (Valkey pattern).
- Tests: player-search API-error, fixtures non-timeout HTTP error,
  malformed-payload and limit-clamp cases for each component; docstrings.

The free-tier quota text (30 requests/minute, 100/day) is correct per the
API's OpenAPI description — 1,000/day is the BASIC tier — so it is
deliberately unchanged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: bensynapse

src/backend/tests/unit/components/bundles/livetennisapi/test_fixtures.py

@@ -88,3 +88,37 @@ def test_timeout_returns_error_data(self, component_class, default_kwargs, mock_
 
         assert len(results) == 1
         assert "error" in results[0].data
+
+    def test_http_error_returns_error_data(self, component_class, default_kwargs, mock_httpx_client):
+        """An API error (e.g. 401) comes back as a single error Data row, not an exception."""
+        component = component_class(**default_kwargs)
+        mock_response = mock_httpx_client.return_value.__enter__.return_value.get.return_value
+        mock_response.status_code = 401
+        mock_response.text = '{"error":"unauthorized"}'
+        mock_response.raise_for_status.side_effect = httpx.HTTPStatusError(
+            "401", request=MagicMock(), response=mock_response
+        )
+
+        results = component.fetch_fixtures()
+
+        assert len(results) == 1
+        assert "error" in results[0].data
+
+    def test_malformed_payload_returns_error_data(self, component_class, default_kwargs, mock_httpx_client):
+        """A 200 response whose body is not the documented shape yields an error Data row."""
+        component = component_class(**default_kwargs)
+        mock_httpx_client.return_value.__enter__.return_value.get.return_value.json.return_value = None
+
+        results = component.fetch_fixtures()
+
+        assert len(results) == 1
+        assert "error" in results[0].data
+
+    def test_limit_is_clamped_to_api_range(self, component_class, default_kwargs, mock_httpx_client):
+        """Out-of-range limit values are clamped to the API's 1-200 range."""
+        component = component_class(**{**default_kwargs, "limit": 0})
+
+        component.fetch_fixtures()
+
+        _, kwargs = mock_httpx_client.return_value.__enter__.return_value.get.call_args
+        assert kwargs["params"]["limit"] == 1

src/backend/tests/unit/components/bundles/livetennisapi/test_live_matches.py

@@ -114,3 +114,22 @@ def test_http_error_returns_error_data(self, component_class, default_kwargs, mo
 
         assert len(results) == 1
         assert "error" in results[0].data
+
+    def test_malformed_payload_returns_error_data(self, component_class, default_kwargs, mock_httpx_client):
+        """A 200 response whose body is not the documented shape yields an error Data row."""
+        component = component_class(**default_kwargs)
+        mock_httpx_client.return_value.__enter__.return_value.get.return_value.json.return_value = {"data": "nope"}
+
+        results = component.fetch_matches()
+
+        assert len(results) == 1
+        assert "error" in results[0].data
+
+    def test_limit_is_clamped_to_api_range(self, component_class, default_kwargs, mock_httpx_client):
+        """Out-of-range limit values are clamped to the API's 1-200 range."""
+        component = component_class(**{**default_kwargs, "limit": -5})
+
+        component.fetch_matches()
+
+        _, kwargs = mock_httpx_client.return_value.__enter__.return_value.get.call_args
+        assert kwargs["params"]["limit"] == 1

src/backend/tests/unit/components/bundles/livetennisapi/test_match_score.py

@@ -89,3 +89,12 @@ def test_not_found_returns_friendly_error(self, component_class, default_kwargs,
 
         assert "error" in result.data
         assert "not found" in result.text
+
+    def test_malformed_payload_returns_error_data(self, component_class, default_kwargs, mock_httpx_client):
+        """A 200 response whose body is not a score object yields an error Data result."""
+        component = component_class(**default_kwargs)
+        mock_httpx_client.return_value.__enter__.return_value.get.return_value.json.return_value = [1, 2, 3]
+
+        result = component.fetch_score()
+
+        assert "error" in result.data

src/backend/tests/unit/components/bundles/livetennisapi/test_player_search.py

@@ -1,5 +1,6 @@
 from unittest.mock import MagicMock, patch
 
+import httpx
 import pytest
 
 pytest.importorskip("lfx_bundles")
@@ -85,3 +86,37 @@ def test_empty_search_omits_param(self, component_class, default_kwargs, mock_ht
 
         _, kwargs = mock_httpx_client.return_value.__enter__.return_value.get.call_args
         assert "search" not in kwargs["params"]
+
+    def test_http_error_returns_error_data(self, component_class, default_kwargs, mock_httpx_client):
+        """An API error (e.g. 401) comes back as a single error Data row, not an exception."""
+        component = component_class(**default_kwargs)
+        mock_response = mock_httpx_client.return_value.__enter__.return_value.get.return_value
+        mock_response.status_code = 401
+        mock_response.text = '{"error":"unauthorized"}'
+        mock_response.raise_for_status.side_effect = httpx.HTTPStatusError(
+            "401", request=MagicMock(), response=mock_response
+        )
+
+        results = component.fetch_players()
+
+        assert len(results) == 1
+        assert "error" in results[0].data
+
+    def test_malformed_payload_returns_error_data(self, component_class, default_kwargs, mock_httpx_client):
+        """A 200 response whose body is not the documented shape yields an error Data row."""
+        component = component_class(**default_kwargs)
+        mock_httpx_client.return_value.__enter__.return_value.get.return_value.json.return_value = ["not", "a", "dict"]
+
+        results = component.fetch_players()
+
+        assert len(results) == 1
+        assert "error" in results[0].data
+
+    def test_limit_is_clamped_to_api_range(self, component_class, default_kwargs, mock_httpx_client):
+        """Out-of-range limit values are clamped to the API's 1-200 range."""
+        component = component_class(**{**default_kwargs, "limit": 999})
+
+        component.fetch_players()
+
+        _, kwargs = mock_httpx_client.return_value.__enter__.return_value.get.call_args
+        assert kwargs["params"]["limit"] == 200

src/bundles/lfx-bundles/src/lfx_bundles/livetennisapi/fixtures.py

@@ -8,6 +8,21 @@
 
 BASE_URL = "https://api.livetennisapi.com/api/public/v1"
 HTTP_TOO_MANY_REQUESTS = 429
+MIN_LIMIT = 1
+MAX_LIMIT = 200
+DEFAULT_LIMIT = 50
+
+
+def _validated_items(payload: object) -> list[dict]:
+    """Return the list under ``data``, or raise ``TypeError`` on a malformed 200 payload."""
+    if not isinstance(payload, dict) or not isinstance(payload.get("data"), list):
+        msg = "Live Tennis API returned an unexpected response shape (expected an object with a 'data' list)."
+        raise TypeError(msg)
+    items = payload["data"]
+    if not all(isinstance(item, dict) for item in items):
+        msg = "Live Tennis API returned a malformed 'data' entry (expected objects)."
+        raise TypeError(msg)
+    return items
 
 
 class LiveTennisFixturesComponent(Component):
@@ -37,7 +52,7 @@ class LiveTennisFixturesComponent(Component):
         IntInput(
             name="limit",
             display_name="Max Results",
-            info="Maximum number of fixtures to return (1-200).",
+            info="Maximum number of fixtures to return (1-200). Out-of-range values are clamped.",
             value=50,
             advanced=True,
         ),
@@ -47,9 +62,18 @@ class LiveTennisFixturesComponent(Component):
         Output(display_name="Fixtures", name="fixtures", method="fetch_fixtures_dataframe"),
     ]
 
+    def _clamped_limit(self) -> int:
+        """Clamp the limit input to the API's documented 1-200 range."""
+        try:
+            limit = int(self.limit)
+        except (TypeError, ValueError):
+            return DEFAULT_LIMIT
+        return max(MIN_LIMIT, min(MAX_LIMIT, limit))
+
     def fetch_fixtures(self) -> list[Data]:
+        """Call ``GET /fixtures`` and return one ``Data`` row per fixture, or a single error row."""
         try:
-            params: dict = {"limit": self.limit}
+            params: dict = {"limit": self._clamped_limit()}
             if self.tour and self.tour != "all":
                 params["tour"] = self.tour
 
@@ -60,10 +84,9 @@ def fetch_fixtures(self) -> list[Data]:
                     headers={"X-API-Key": self.api_key, "accept": "application/json"},
                 )
             response.raise_for_status()
-            payload = response.json()
 
             results = []
-            for fixture in payload.get("data", []):
+            for fixture in _validated_items(response.json()):
                 row = {
                     "id": fixture.get("id"),
                     "event_date": fixture.get("event_date"),
@@ -91,7 +114,7 @@ def fetch_fixtures(self) -> list[Data]:
                 error_message = "Rate limited. The free tier allows 30 requests/minute and 100/day."
             logger.error(error_message)
             return [Data(text=error_message, data={"error": error_message})]
-        except (httpx.RequestError, ValueError) as exc:
+        except (httpx.RequestError, ValueError, TypeError) as exc:
             error_message = f"Request error occurred: {exc}"
             logger.error(error_message)
             return [Data(text=error_message, data={"error": error_message})]
@@ -100,5 +123,6 @@ def fetch_fixtures(self) -> list[Data]:
             return results
 
     def fetch_fixtures_dataframe(self) -> DataFrame:
+        """Return the fixtures as a ``DataFrame`` (one row per fixture)."""
         data = self.fetch_fixtures()
         return DataFrame(data)

src/bundles/lfx-bundles/src/lfx_bundles/livetennisapi/live_matches.py

@@ -9,6 +9,21 @@
 BASE_URL = "https://api.livetennisapi.com/api/public/v1"
 HTTP_TOO_MANY_REQUESTS = 429
 PLAYERS_PER_MATCH = 2
+MIN_LIMIT = 1
+MAX_LIMIT = 200
+DEFAULT_LIMIT = 50
+
+
+def _validated_items(payload: object) -> list[dict]:
+    """Return the list under ``data``, or raise ``TypeError`` on a malformed 200 payload."""
+    if not isinstance(payload, dict) or not isinstance(payload.get("data"), list):
+        msg = "Live Tennis API returned an unexpected response shape (expected an object with a 'data' list)."
+        raise TypeError(msg)
+    items = payload["data"]
+    if not all(isinstance(item, dict) for item in items):
+        msg = "Live Tennis API returned a malformed 'data' entry (expected objects)."
+        raise TypeError(msg)
+    return items
 
 
 class LiveTennisMatchesComponent(Component):
@@ -53,7 +68,7 @@ class LiveTennisMatchesComponent(Component):
         IntInput(
             name="limit",
             display_name="Max Results",
-            info="Maximum number of matches to return (1-200).",
+            info="Maximum number of matches to return (1-200). Out-of-range values are clamped.",
             value=50,
             advanced=True,
         ),
@@ -63,7 +78,16 @@ class LiveTennisMatchesComponent(Component):
         Output(display_name="Matches", name="matches", method="fetch_matches_dataframe"),
     ]
 
+    def _clamped_limit(self) -> int:
+        """Clamp the limit input to the API's documented 1-200 range."""
+        try:
+            limit = int(self.limit)
+        except (TypeError, ValueError):
+            return DEFAULT_LIMIT
+        return max(MIN_LIMIT, min(MAX_LIMIT, limit))
+
     def _flatten_match(self, match: dict) -> dict:
+        """Flatten one match object into a single-level row for the DataFrame output."""
         players = match.get("players") or {}
         p1 = players.get("p1") or {}
         p2 = players.get("p2") or {}
@@ -102,8 +126,9 @@ def _flatten_match(self, match: dict) -> dict:
         }
 
     def fetch_matches(self) -> list[Data]:
+        """Call ``GET /matches`` and return one ``Data`` row per match, or a single error row."""
         try:
-            params: dict = {"status": self.match_status, "limit": self.limit}
+            params: dict = {"status": self.match_status, "limit": self._clamped_limit()}
             if self.tour and self.tour != "all":
                 params["tour"] = self.tour
 
@@ -114,10 +139,9 @@ def fetch_matches(self) -> list[Data]:
                     headers={"X-API-Key": self.api_key, "accept": "application/json"},
                 )
             response.raise_for_status()
-            payload = response.json()
 
             results = []
-            for match in payload.get("data", []):
+            for match in _validated_items(response.json()):
                 row = self._flatten_match(match)
                 summary = f"{row.get('player1')} vs {row.get('player2')} — {row.get('tournament')}"
                 results.append(Data(text=summary, data=row))
@@ -131,7 +155,7 @@ def fetch_matches(self) -> list[Data]:
                 error_message = "Rate limited. The free tier allows 30 requests/minute and 100/day."
             logger.error(error_message)
             return [Data(text=error_message, data={"error": error_message})]
-        except (httpx.RequestError, ValueError) as exc:
+        except (httpx.RequestError, ValueError, TypeError) as exc:
             error_message = f"Request error occurred: {exc}"
             logger.error(error_message)
             return [Data(text=error_message, data={"error": error_message})]
@@ -140,5 +164,6 @@ def fetch_matches(self) -> list[Data]:
             return results
 
     def fetch_matches_dataframe(self) -> DataFrame:
+        """Return the matches as a ``DataFrame`` (one row per match)."""
         data = self.fetch_matches()
         return DataFrame(data)

src/bundles/lfx-bundles/src/lfx_bundles/livetennisapi/match_score.py

@@ -11,6 +11,14 @@
 PLAYERS_PER_MATCH = 2
 
 
+def _validated_score(payload: object) -> dict:
+    """Return the decoded score object, or raise ``TypeError`` on a malformed 200 payload."""
+    if not isinstance(payload, dict):
+        msg = "Live Tennis API returned an unexpected response shape (expected a score object)."
+        raise TypeError(msg)
+    return payload
+
+
 class LiveTennisMatchScoreComponent(Component):
     display_name = "Match Score"
     description = "Get the current score of one match — sets, games, in-game points and who is serving."
@@ -42,6 +50,7 @@ class LiveTennisMatchScoreComponent(Component):
     ]
 
     def fetch_score(self) -> Data:
+        """Call ``GET /matches/{id}/score`` and return the score snapshot as ``Data``."""
         try:
             match_id = int(str(self.match_id).strip())
         except (TypeError, ValueError):
@@ -56,7 +65,7 @@ def fetch_score(self) -> Data:
                     headers={"X-API-Key": self.api_key, "accept": "application/json"},
                 )
             response.raise_for_status()
-            score = response.json()
+            score = _validated_score(response.json())
 
             games = score.get("games") or []
             games_str = None
@@ -83,7 +92,7 @@ def fetch_score(self) -> Data:
                 error_message = "Rate limited. The free tier allows 30 requests/minute and 100/day."
             logger.error(error_message)
             return Data(text=error_message, data={"error": error_message})
-        except (httpx.RequestError, ValueError) as exc:
+        except (httpx.RequestError, ValueError, TypeError) as exc:
             error_message = f"Request error occurred: {exc}"
             logger.error(error_message)
             return Data(text=error_message, data={"error": error_message})