calmlens 0.23.0 → 0.23.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f31d8d0e9739bebd69a0bab938d60914fb7173c8543b5521bcd5ac97e441311a
-  data.tar.gz: c85ad7397dd68637309b17204ff12dc7d52ec1e6415d66c42bacb7a000b9e9cf
+  metadata.gz: 0707eda417af2a9021104b813fecc82ca3a4cddbcc420d92fcd22642f844d61f
+  data.tar.gz: c834ec6d48c5815e93d1af413efbd2c8cab0b4fb67071d2da17ac9d97ffab018
 SHA512:
-  metadata.gz: 7fb2274df7c0dfa834c97e786ab3b37816ec447c5d7694a293866a75882f11e4a052e684c3c1559a477a7e7419a02144a2af232291bf21f868bffa9fada5eed8
-  data.tar.gz: '090730bd39a5d48f41a7d7cfdbda56538166304f1af6cf6b22c9046997135f15a66384054a9e02751d168696b46c5a811b01abf825fc77f8a1f04b808da1c8d1'
+  metadata.gz: cfa54ba17a0a73abea37f1b34a76df43a2172ffa93e6801f0ae1cd671b40970516675fdcca7014fed69a8acf686a542f78e101fc7000580cc1c11f31c07ac095
+  data.tar.gz: 71a628e67b7887807d5c241913b4125836bf5493b6bb54558d9321bb47a4331ea54079dd94d4161dcb02dcc79c798d5653bd891f9c1b3ff3d8848f7cebac9bbd

data/lib/calmlens/assets.rb

@@ -359,24 +359,31 @@ module CalmLens
     def poll_for_decision(asset_id, request_options, timeout)
       deadline = @session.monotonic + timeout
       delay = DECISION_POLL_FIRST_DELAY
+      processing = moderation = nil
       loop do
-        asset = retrieve('assetId' => asset_id, 'request_options' => request_options)
+        remaining = deadline - @session.monotonic
+        break if timeout.positive? && !remaining.positive?
+
+        # The outer deadline covers transport retries and the entire response read.
+        asset = ::Timeout.timeout(timeout.zero? ? nil : remaining) do
+          retrieve('assetId' => asset_id, 'request_options' => request_options)
+        end
+        remaining = deadline - @session.monotonic
+        break if timeout.positive? && !remaining.positive?
+
         processing = asset.dig('classification', 'status')
         moderation = asset.dig('classification', 'moderation', 'status')
         return asset if SETTLED_STATUSES.include?(processing)
-
-        remaining = deadline - @session.monotonic
-        unless remaining.positive?
-          raise TimeoutError.new(SdkErrorCodes::TIMEOUT,
-                                 "Asset #{asset['id']} was not settled after #{timeout}s " \
-                                 "(processing #{processing}, moderation #{moderation})",
-                                 details: { 'assetId' => asset['id'], 'classificationStatus' => processing,
-                                            'moderationStatus' => moderation })
-        end
+        break unless remaining.positive?
 
         sleep([delay, remaining].min)
         delay = [delay * DECISION_POLL_FACTOR, DECISION_POLL_MAX_DELAY].min
       end
+      raise ::Timeout::Error
+    rescue ::Timeout::Error
+      raise TimeoutError.new(SdkErrorCodes::TIMEOUT, "Asset #{asset_id} was not settled after #{timeout}s",
+                             details: { 'assetId' => asset_id, 'classificationStatus' => processing,
+                                        'moderationStatus' => moderation })
     end
 
     def submit(options, request_options, wait)

data/lib/calmlens/testing/fake_api.rb

@@ -1782,8 +1782,8 @@ module CalmLens
       # Answers like the CDN (serveAssetResource.ts): `original` is the upload; `rendered` the image,
       # PDF, video or audio file `content.rendered` describes; `preview` the still `content.preview`
       # describes; `hls` the adaptive stream's files, which the mock never prepares; `embed` a small
-      # page standing in for the embed page of any asset; and `placeholder` the preview's ThumbHash as a PNG, public
-      # whatever the asset's visibility or moderation. A safety hold refuses every resource. Other resources pass delivery checks first,
+      # page standing in for the embed page of any asset; and `placeholder` the preview's ThumbHash as a PNG.
+      # A safety hold refuses every resource. Other resources pass delivery checks first,
       # which refuse everyone (content still uploading, blocked or purged, failed processing, removed
       # content), then an age-restricted asset needs `viewerClaims.ageConfirmed=true` whatever the key,
       # and a private asset needs an API key with `assets:download` for its folder. The mock converts
@@ -1809,21 +1809,21 @@ module CalmLens
         authorised = !grant.nil? || can_download?(item['folderId'], headers)
         return info(method, item, authorised, params) if resource == 'info'
         return not_available if item['content']['safetyHold']
-        return placeholder(method, item) if resource == 'placeholder'
+        return placeholder(method, item, authorised) if resource == 'placeholder'
 
         deliver(method, item, resource, params, selected ? options || {} : nil, authorised)
       end
 
       # What a grant doesn't cover, or, like the CDN, a private asset for anyone without a grant or the
       # project's API key: it answers as an unknown asset does, whatever its state, except for its
-      # public placeholder and its info, which has its own rule. An error response, or nil.
+      # info, which has its own rule. An error response, or nil.
       def refuse_viewer(item, resource, grant, headers)
         if resource == 'original' && grant && !grant[:original]
           return error(ErrorCodes::SIGNED_URL_ORIGINAL_NOT_GRANTED, "This signed asset URL doesn't grant the original file", status: 403)
         end
         return if grant || item['visibility'] == 'public' || header(headers, 'X-Api-Key') == @api_key
 
-        asset_not_found unless %w[placeholder info].include?(resource)
+        asset_not_found unless resource == 'info'
       end
 
       # Whether the path after the resource selects a lens or transform, and its options; nil when the
@@ -1866,12 +1866,15 @@ module CalmLens
         restricted = item['visibility'] != 'public'
         return asset_not_found if restricted && !authorised
 
+        restricted ||= %w[blocked purged].include?(item['classification']['moderation']['status'])
+        return not_available if restricted && !authorised
+
         claims = JSON.parse(params.fetch('viewerClaims', '{}'))
         body = { 'id' => item['id'], 'projectId' => item['projectId'], 'type' => item['type'], 'externalUrl' => item['externalUrl'],
                  'content' => item['content'].slice(*%w[format width height durationSeconds pageCount rendered preview hls]),
                  'availability' => availability(item, claims.is_a?(Hash) && claims['ageConfirmed'] == true) }
         cdn_response(method, JSON.generate(body), { 'content-type' => 'application/json',
-                                                    'cache-control' => "#{restricted ? 'private' : 'public'}, max-age=60",
+                                                    'cache-control' => restricted ? 'private, no-store' : 'public, no-cache',
                                                     'cache-tag' => "asset-#{item['id']}" })
       rescue JSON::ParserError
         error(ErrorCodes::INVALID_VIEWER_CLAIMS, 'Invalid viewer claims', status: 400)
@@ -1980,15 +1983,18 @@ module CalmLens
 
       def not_available = error('asset/not-available', 'Asset is not available', status: 403)
 
-      # Like the CDN's placeholder handler: the preview's ThumbHash, public whatever the asset's
-      # visibility or moderation; refused for purged assets and assets without one (not yet
-      # processed, without a preview, or content removed).
-      def placeholder(method, item)
+      # A preview requires access for private or blocked assets and disappears with its content.
+      def placeholder(method, item, authorised)
+        private_asset = item['visibility'] != 'public'
+        blocked = item['classification']['moderation']['status'] == 'blocked'
+        return asset_not_found if private_asset && !authorised
+        return not_available if blocked && !authorised
+
         thumbhash = item.dig('content', 'preview', 'thumbhash')
         return not_available if thumbhash.nil? || item['classification']['moderation']['status'] == 'purged'
 
         cdn_response(method, Placeholder.png(thumbhash),
-                     'content-type' => 'image/png', 'cache-control' => 'public, max-age=3600',
+                     'content-type' => 'image/png', 'cache-control' => private_asset || blocked ? 'private, no-store' : 'public, no-cache',
                      'cache-tag' => "asset-#{item['id']}", 'etag' => "\"#{thumbhash}\"")
       end
 

data/lib/calmlens/version.rb

@@ -2,5 +2,5 @@
 
 module CalmLens
   # The gem version. The gemspec and the User-Agent header read it from here.
-  VERSION = '0.23.0'
+  VERSION = '0.23.1'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: calmlens
 version: !ruby/object:Gem::Version
-  version: 0.23.0
+  version: 0.23.1
 platform: ruby
 authors:
 - CalmLens
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-11-09 00:00:00.000000000 Z
+date: 2026-11-10 00:00:00.000000000 Z
 dependencies: []
 description: 'Server-side client for the CalmLens API: moderation, uploads, events,
   webhooks and CDN delivery.'