cineworld_uk 4.1.0-x86_64-linux-gnu

data/README.md

@@ -0,0 +1,225 @@
+# CineworldUk
+
+A gem to retrieve [Cineworld UK](https://www.cineworld.co.uk) cinemas and showtimes using the Vista API.
+
+[![Gem Version](https://badge.fury.io/rb/cineworld_uk.svg)](https://badge.fury.io/rb/cineworld_uk)
+[![Tests](https://github.com/andycroll/cineworld_uk/actions/workflows/.travis.yml/badge.svg)](https://github.com/andycroll/cineworld_uk/actions)
+
+## Installation
+
+Add this line to your application's Gemfile:
+
+    gem 'cineworld_uk'
+
+And then execute:
+
+    $ bundle
+
+Or install it yourself as:
+
+    $ gem install cineworld_uk
+
+## Usage
+
+The gem conforms to the API set down in the `cinebase` gem, [andycroll/cinebase](https://github.com/andycroll/cinebase), which provides a lot of useful base vocabulary and repetitive code for this series of cinema focussed gems.
+
+Performance titles are sanitized as much as possible, removing 'screening type' information and 'dimension' as well as standardising all the theatre/cultural event naming (NT Live, Royal Opera House etc).
+
+### Authentication
+
+Acquire a guest JWT explicitly before retrieving data:
+
+```ruby
+require 'cineworld_uk'
+
+CineworldUk.acquire_token!
+CineworldUk::Cinema.all
+```
+
+This shells out to **`curl-impersonate`**, not ordinary system `curl`, using its
+Chrome 150 TLS/HTTP profile. No Python, Chrome, JavaScript execution or browser
+cookies are needed. Platform-specific gem packages include the pinned
+`curl-impersonate` 2.2.3 executable and its upstream licence notices. RubyGems
+and Bundler automatically select the matching package for:
+
+- glibc Linux: x86-64 and ARM64 (`x86_64-linux-gnu`, `aarch64-linux-gnu`)
+- macOS: Intel and Apple Silicon (`x86_64-darwin`, `arm64-darwin`)
+
+The executable runs directly from the installed gem. There are no separate
+installation commands, PATH changes, or runtime downloads on these platforms.
+
+When installing from Git, forcing the source (`ruby`) gem, or using another
+platform (including Alpine/musl and Windows), install a compatible
+[curl-impersonate release](https://github.com/lexiforest/curl-impersonate/releases/tag/v2.2.3)
+with `--impersonate chrome150` support yourself. For an x86-64 Linux checkout:
+
+```sh
+mkdir -p "$HOME/.local/bin"
+curl -fL https://github.com/lexiforest/curl-impersonate/releases/download/v2.2.3/curl-impersonate-v2.2.3.x86_64-linux-gnu.tar.gz \
+  | tar -xz -C "$HOME/.local/bin" curl-impersonate
+export PATH="$HOME/.local/bin:$PATH"
+```
+
+Other platforms have separate assets on the release page. You can also specify
+the executable path:
+
+```ruby
+CineworldUk.acquire_token!(curl: '/opt/curl-impersonate/curl-impersonate')
+```
+
+The method returns the token and sets `CineworldUk.token` in memory. It reads
+`__NEXT_DATA__.props.pageProps.environment.gasToken` from the ticketing site's
+root page, even when the page displays a 404. It checks the declared expiry,
+but decoding the JWT does not verify its signature. A blocked page, expired or
+missing token, missing executable, or failed command raises
+`CineworldUk::AuthenticationError` and leaves any previous token unchanged.
+Requests time out after 30 seconds. Certificate verification remains enabled;
+redirects are not followed, and subprocess arguments are passed without a shell.
+Cloudflare may still block requests on other networks or after website changes.
+
+Alternatively, supply your own current guest JWT without the `Bearer ` prefix;
+this requires no external executable:
+
+```ruby
+CineworldUk.token = ENV.fetch('CINEWORLD_TOKEN')
+```
+
+The gem sends `Authorization: Bearer ...` and `Connect-Region-Code: GB` to
+`digital-api.cineworld.co.uk`. Normal API calls never acquire or renew a token
+automatically.
+
+Missing tokens and HTTP 401 responses raise `CineworldUk::AuthenticationError`.
+Call `CineworldUk.acquire_token!` again, or set `CineworldUk.token` with a fresh
+token, before retrying. Tokens are never persisted by the gem. Other HTTP
+failures raise an error rather than returning an empty schedule. Redirects are
+not followed, so credentials are not forwarded to another host.
+
+There is no verified fixed token lifetime. Its declared lifetime is `exp - iat`
+seconds. The website reloads to renew after 90% of that interval. To inspect
+your token locally without printing it (decoding does not verify its signature):
+
+```ruby
+require 'base64'
+payload = CineworldUk.token.split('.').fetch(1)
+claims = JSON.parse(Base64.urlsafe_decode64(payload))
+puts "Lifetime: #{claims.fetch('exp') - claims.fetch('iat')} seconds"
+puts "Expires: #{Time.at(claims.fetch('exp')).utc}"
+```
+
+### Cinema
+
+``` ruby
+CineworldUk::Cinema.all
+#=> [<CineworldUK::Cinema ...>, <CineworldUK::Cinema ...>, ...]
+
+cinema = CineworldUk::Cinema.new(14)
+#=> <CineworldUK::Cinema ...>
+
+cinema.adr
+#=> {
+  street_address:   'Brighton Marina Village',
+  extended_address: nil,
+  locality:         'Brighton',
+  region:           'East Sussex',
+  postal_code:      'BN2 5UF',
+  country:          'United Kingdom'
+}
+
+cinema.brand
+#=> 'Cineworld'
+
+cinema.full_name
+#=> 'Cineworld Brighton'
+
+cinema.id
+#=> 14
+
+cinema.postal_code
+#=> 'BN2 5UF'
+```
+
+### Performances
+
+`at` accepts a numeric Vista cinema ID (`14`, `'14'` or `'014'` for Brighton),
+not a Boxoffice ID such as `X079B`. Dates are inclusive **business dates**.
+Without dates, it fetches today in London and the following 13 days; it does not
+discover every future screening date.
+
+```ruby
+day = Date.new(2026, 10, 14)
+performances = CineworldUk::Performance.at(14, from: day, to: day)
+```
+
+This makes **one HTTP request per cinema per requested day**, including empty
+days. Cinema names, film titles and attributes come from the same response—no
+extra cinema or film lookups are needed. `Cinema.all` separately fetches and
+caches the cinema list in memory, shared by name and address lookups. Performance
+responses are not cached across calls, so reuse the returned array when possible.
+
+Advertised session times (`startsAt`), not feature start times (`filmStartsAt`),
+are converted to UTC using the offsets supplied by Vista. Recognized session
+attributes populate the existing dimension and variant fields; unknown attributes
+are ignored. No seat-availability or booking operations are performed.
+
+``` ruby
+CineworldUk::Performance.at(14)
+#=> [<CineworldUK::Performance ...>, <CineworldUK::Performance ...>, ...]
+
+performance = performances.first
+#=> <CineworldUK::Performance ...>
+
+performance.film_name
+#=> 'Other Mommy'
+
+performance.dimension
+#=> '2d'
+
+performance.variant
+#=> ['audio_described']
+
+performance.starting_at
+#=> 2026-10-14 14:40:00 UTC
+
+performance.showing_on
+#=> Date.new(2026, 10, 14)
+
+performance.booking_url
+#=> "https://web.cineworld.co.uk/order/showtimes/014-165507/seats"
+
+performance.cinema_name
+#=> 'Brighton'
+
+performance.cinema_id
+#=> 14
+```
+
+## Building release packages
+
+```sh
+bundle exec rake build         # Portable source gem; external curl-impersonate required
+bundle exec rake package:all   # Four platform gems with bundled executables
+```
+
+To build and check just one platform on a matching host:
+
+```sh
+bundle exec rake 'package:native[x86_64-linux-gnu]'
+CINEWORLD_PACKAGE=pkg/cineworld_uk-4.1.0-x86_64-linux-gnu.gem bundle exec ruby test/package_test.rb
+```
+
+Native packaging downloads pinned upstream archives at **build time**, verifies
+their SHA-256 digests, and includes the executable, licence files and source
+provenance. Archives and built gems stay in ignored `pkg/`, not Git. CI builds
+and installation-tests each platform on its corresponding runner and saves the
+gems as workflow artifacts; it does not publish them. Publish the source and
+platform gems together for automatic platform selection to work for users.
+
+## Contributing
+
+1. Fork it
+2. Create your feature branch (`git checkout -b my-new-feature`)
+3. Commit your changes (`git commit -am 'Add some feature'`)
+4. Push to the branch (`git push origin my-new-feature`)
+5. Create new Pull Request
+
+Note that contributors assign all rights to the owner, Andy Croll ([github](http://github.com/andycroll)), of this gem.

data/Rakefile

@@ -0,0 +1,59 @@
+#!/usr/bin/env rake
+require "bundler/gem_tasks"
+
+require 'rake/testtask'
+load File.expand_path('tasks/package.rake', __dir__)
+
+Rake::TestTask.new do |t|
+  t.libs << 'lib/cineworld_uk'
+  t.test_files = FileList[
+    'test/lib/cineworld_uk/*_test.rb',
+    'test/lib/cineworld_uk/internal/*_test.rb',
+    'test/lib/cineworld_uk/internal/parser/api/*_test.rb'
+  ]
+  t.verbose = true
+end
+
+Rake::TestTask.new do |t|
+  t.libs << 'lib/cineworld_uk'
+  t.name = :live
+  t.test_files = FileList[
+    'test/live/*_test.rb'
+  ]
+  t.verbose = true
+end
+
+desc 'console'
+# http://erniemiller.org/2014/02/05/7-lines-every-gems-rakefile-should-have/
+task :console do
+  require 'irb'
+  require 'irb/completion'
+  require 'cineworld_uk'
+  ARGV.clear
+  IRB.start
+end
+
+desc 'Recreate test fixtures'
+task :fixtures do
+  require 'cineworld_uk'
+  CineworldUk.token = ENV.fetch("CINEWORLD_TOKEN")
+
+  def js_fixture(name)
+    File.expand_path("../test/fixtures/#{name}.json", __FILE__)
+  end
+
+  api = CineworldUk::Internal::ApiResponse.new
+
+  File.open(js_fixture('api/cinema-list'), 'w') do |file|
+    puts '* API Cinema List'
+    file.write api.cinema_list
+  end
+
+  File.open(js_fixture('api/performances-tomorrow-14'), 'w') do |file|
+    puts '* API Performances in Brighton Tomorrow'
+    file.write api.performances(14, Date.today + 1)
+  end
+
+end
+
+task :default => :test

data/cineworld_uk.gemspec

@@ -0,0 +1,30 @@
+lib = File.expand_path('../lib', __FILE__)
+$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
+require 'cineworld_uk/version'
+
+Gem::Specification.new do |spec|
+  spec.name          = 'cineworld_uk'
+  spec.version       = CineworldUk::VERSION
+  spec.authors       = ['Andy Croll']
+  spec.email         = ['andy@goodscary.com']
+  spec.description   = 'Pull movie & cinema information from the Cineworld iOS API'
+  spec.summary       = "It's a scraper, but a nice one"
+  spec.homepage      = 'https://github.com/andycroll/cineworld_uk'
+  spec.licenses      = %w(AGPL MIT)
+
+  spec.files         = `git ls-files`.split("\n")
+  spec.executables   = spec.files.grep(%r{^bin/}) { |f| File.basename(f) }
+  spec.test_files    = spec.files.grep(%r{^(test|spec|features)/})
+  spec.require_paths = ['lib']
+
+  spec.add_development_dependency 'bundler', '>= 2.0'
+  spec.add_development_dependency 'minitest-mock'
+  spec.add_development_dependency 'minitest-reporters'
+  spec.add_development_dependency 'rake'
+  spec.add_development_dependency 'simplecov', '< 1'
+  spec.add_development_dependency 'webmock'
+
+  spec.add_runtime_dependency 'base64', '~> 0.3'
+  spec.add_runtime_dependency 'cinebase', '~> 5.0'
+  spec.add_runtime_dependency 'nokogiri', '>= 1.11'
+end

data/lib/cineworld_uk/cinema.rb

@@ -0,0 +1,168 @@
+module CineworldUk
+  # The object representing a cinema on the Cineworld UK website
+  class Cinema < Cinebase::Cinema
+    # @!attribute [r] id
+    #   @return [Integer] the numeric id of the cinema on the Cineworld website
+
+    # Constructor
+    # @param [Integer, String] id cinema id
+    # @return [CineworldUk::Cinema]
+    def initialize(id)
+      @id = id.to_i
+    end
+
+    # Return basic cinema information for all cinemas
+    # @return [Array<CineworldUk::Cinema>]
+    # @example
+    #   CineworldUk::Cinema.all
+    #   #=> [<CineworldUk::Cinema>, <CineworldUk::Cinema>, ...]
+    def self.all
+      id_names_hash.map { |id, _| new id }
+    end
+
+    # @api private
+    # called from instance methods
+    # @return [Hash<Integer => String>]
+    def self.id_names_hash
+      @id_names_hash ||= cinema_list_json.each_with_object({}) do |hash, result|
+        name = hash['displayName']
+        id_key = hash['id'].to_i
+        result[id_key] = name.gsub('London - ', '').gsub(' - ', ': ') if name
+      end
+    end
+
+    # @!method address
+    #   Address of the cinema
+    #   @return [Hash] of different address parts
+    #   @see #adr
+
+    # Address of the cinema
+    # @return [Hash] of different address parts
+    # @example
+    #   cinema = CineworldUk::Cinema.new(3)
+    #   cinema.adr
+    #   #=> {
+    #         street_address: '44-47 Gardner Street',
+    #         extended_address: 'North Laine',
+    #         locality: 'Brighton',
+    #         postal_code: 'BN1 1UN',
+    #         country_name: 'United Kingdom'
+    #       }
+    # @note Uses the standard method naming as at http://microformats.org/wiki/adr
+    def adr
+      CineworldUk::Internal::Parser::Api::CinemaAddress.new(
+        @id, self.class.send(:cinema_list_json)
+      ).to_hash
+    end
+
+    # Brand of the cinema
+    # @return [String] which will always be 'Cineworld'
+    # @example
+    #   cinema = CineworldUk::Cinema.new(3)
+    #   cinema.brand
+    #   #=> 'Cineworld'
+    def brand
+      'Cineworld'.freeze
+    end
+
+    # @!method country_name
+    #   Country of the cinema
+    #   @return [String] which will always be 'United Kingdom'
+    #   @example
+    #     cinema = CineworldUk::Cinema.new(3)
+    #     cinema.country_name
+    #     #=> 'United Kingdom'
+
+    # @!method extended_address
+    #   The second address line of the cinema
+    #   @return [String]
+    #   @example
+    #     cinema = CineworldUk::Cinema.new(10)
+    #     cinema.extended_address
+    #     #=> 'Chelsea'
+    #
+    #     cinema = CineworldUk::Cinema.new(3)
+    #     cinema.extended_address
+    #     #=> ''
+
+    # @!method full_name
+    #   The name of the cinema including the brand
+    #   @return [String]
+    #   @example
+    #     cinema = CineworldUk::Cinema.new(88)
+    #     cinema.full_name
+    #     #=> 'Cineworld Glasgow: IMAX at GSC'
+
+    # @!method locality
+    #   The locality (town) of the cinema
+    #   @return [String]
+    #   @example
+    #     cinema = CineworldUk::Cinema.new(3)
+    #     cinema.locality
+    #     #=> 'Brighton'
+
+    # The name of the cinema
+    # @return [String]
+    # @example
+    #   cinema = CineworldUk::Cinema.new(3)
+    #   cinema.name
+    #   #=> 'Brighton'
+    def name
+      @name ||= self.class.id_names_hash[id]
+    end
+
+    # @!method postal_code
+    #   Post code of the cinema
+    #   @return [String]
+    #   @example
+    #     cinema = CineworldUk::Cinema.new(3)
+    #     cinema.postal_code
+    #     #=> 'BN2 5UF'
+
+    # @!method region
+    #   The region (county) of the cinema if provided
+    #   @return [String]
+    #   @example
+    #     cinema = CineworldUk::Cinema.new(3)
+    #     cinema.region
+    #     #=> 'East Sussex'
+
+    # @!method slug
+    #   The URL-able slug of the cinema
+    #   @return [String]
+    #   @example
+    #     cinema = CineworldUk::Cinema.new(3)
+    #     cinema.slug
+    #     #=> 'odeon-brighton'
+
+    # @!method street_address
+    #   The street address of the cinema
+    #   @return [String]
+    #   @example
+    #     cinema = CineworldUk::Cinema.new(3)
+    #     cinema.street_address
+    #     #=> 'Brighton Marina'
+    #   @note Uses the standard method naming as at http://microformats.org/wiki/adr
+
+    # The url of the cinema on the Cineworld website
+    # @return [String]
+    def url
+      "http://www.cineworld.co.uk/cinemas/#{@id}/information"
+    end
+
+    # private
+
+    # @api private
+    def self.api
+      @api ||= CineworldUk::Internal::ApiResponse.new
+    end
+    private_class_method :api
+
+    # @api private
+    def self.cinema_list_json
+      @cinema_list_json ||=
+        JSON.parse(api.cinema_list)['body']['cinemas']
+    end
+    private_class_method :cinema_list_json
+  end
+end

data/lib/cineworld_uk/internal/api_response.rb

@@ -0,0 +1,116 @@
+# frozen_string_literal: true
+
+require "net/http"
+require "json"
+require "date"
+require "time"
+
+module CineworldUk
+  module Internal
+    # Adapts Vista responses to the parsers' cinema/film/event vocabulary.
+    class ApiResponse
+      BASE_URL = "https://digital-api.cineworld.co.uk/ocapi/v1/"
+      ATTRIBUTES = {
+        "3D" => "3d", "IMAX" => "imax", "AD" => "audio-described",
+        "Subtitled" => "subbed", "Subtitles" => "subbed",
+        "Autism Friendly" => "autism-friendly",
+        "Movies for Juniors" => "junior",
+        "Unlimited Screening" => "unlimited-screening", "Q&A" => "qa"
+      }.freeze
+
+      def cinema_list
+        cinemas = fetch("sites").fetch("sites").map do |site|
+          address = site.fetch("contactDetails", {}).fetch("addressV2", {})
+          {
+            "id" => site.fetch("id"),
+            "displayName" => site.fetch("name").fetch("text"),
+            "addressInfo" => {
+              "address1" => address.dig("line1", "text"),
+              "city" => address.dig("line2", "text"),
+              "state" => address.dig("line3", "text"),
+              "postalCode" => address.dig("line4", "text")
+            }
+          }
+        end
+        JSON.generate("body" => { "cinemas" => cinemas })
+      end
+
+      def performances(cinema_id, date)
+        site_id = cinema_id.to_s.rjust(3, "0")
+        response = fetch("showtimes/by-business-date/#{date.iso8601}",
+                         "siteIds" => site_id)
+        related = response.fetch("relatedData")
+        films = related.fetch("films").to_h { |film| [film.fetch("id"), film] }
+        attributes = related.fetch("attributes").to_h do |attr|
+          [attr.fetch("id"), attr]
+        end
+        normalized_films = []
+        events = response.fetch("showtimes").map do |showtime|
+          film = films.fetch(showtime.fetch("filmId"))
+          attrs = showtime.fetch("attributeIds", []).filter_map do |id|
+            attribute = attributes.fetch(id)
+            ATTRIBUTES[attribute.dig("shortName", "text")] ||
+              ATTRIBUTES[attribute.dig("name", "text")]
+          end
+          attrs << "3d" if showtime["requires3dGlasses"]
+          # Formats belong to a session, not to the film as a whole.
+          id = showtime.fetch("id")
+          normalized_films << {
+            "id" => id,
+            "name" => film.fetch("title").fetch("text"),
+            "attributeIds" => attrs
+          }
+          starts_at = showtime.fetch("schedule").fetch("startsAt")
+          {
+            "filmId" => id, "attributeIds" => attrs,
+            "eventDateTime" => Time.iso8601(starts_at).utc.iso8601,
+            "bookingLink" =>
+              "https://web.cineworld.co.uk/order/showtimes/#{id}/seats"
+          }
+        end
+        site = related.fetch("sites").detect do |item|
+          item.fetch("id") == site_id
+        end
+        JSON.generate(
+          "body" => {
+            "films" => normalized_films, "events" => events,
+            "cinemaName" => site&.dig("name", "text")
+          }
+        )
+      end
+
+      private
+
+      def fetch(path, query = {})
+        token = CineworldUk.token
+        if !token.is_a?(String) || token.strip.empty?
+          raise AuthenticationError,
+                "Set CineworldUk.token to a current guest JWT " \
+                "before fetching data"
+        end
+        uri = URI(BASE_URL + path)
+        uri.query = URI.encode_www_form(query) unless query.empty?
+        request = Net::HTTP::Get.new(uri)
+        request["Authorization"] = "Bearer #{token}"
+        request["Connect-Region-Code"] = "GB"
+        request["Accept"] = "application/json"
+        response = Net::HTTP.start(
+          uri.host, uri.port, use_ssl: true, open_timeout: 10, read_timeout: 30
+        ) do |http|
+          http.request(request)
+        end
+        case response
+        when Net::HTTPSuccess
+          JSON.parse(response.body)
+        when Net::HTTPUnauthorized
+          raise AuthenticationError,
+                "Vista rejected the guest token; " \
+                "supply a fresh token with CineworldUk.token="
+        else
+          # Omit response bodies and never redirect credentials to another host.
+          raise "Vista HTTP error #{response.code}"
+        end
+      end
+    end
+  end
+end

data/lib/cineworld_uk/internal/guest_token.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+require "base64"
+require "json"
+require "nokogiri"
+require "open3"
+
+module CineworldUk
+  module Internal
+    # Retrieves the public guest token without running a browser.
+    class GuestToken
+      def initialize(curl:)
+        @curl = curl || default_curl
+      end
+
+      def fetch
+        token = extract_token(request_page)
+        validate_expiry!(token)
+        token
+      rescue JSON::ParserError, ArgumentError, IndexError, TypeError, NoMethodError
+        raise AuthenticationError, "Guest token page data is missing or invalid", cause: nil
+      end
+
+      private
+
+      def default_curl
+        bundled = File.expand_path("../../../vendor/curl-impersonate/bin/curl-impersonate", __dir__)
+        File.executable?(bundled) ? bundled : "curl-impersonate"
+      end
+
+      def curl_command
+        [@curl, "--disable", "--impersonate", "chrome150",
+         "--compressed", "--silent", "--show-error",
+         "--connect-timeout", "10", "--max-time", "30",
+         "--write-out", "\n%{http_code}", "https://web.cineworld.co.uk/"]
+      end
+
+      def request_page
+        output, _stderr, result = Open3.capture3(*curl_command)
+        unless result.success?
+          raise AuthenticationError,
+                "Guest token request failed (curl exit #{result.exitstatus})"
+        end
+
+        html, _, status = output.rpartition("\n")
+        unless %w[200 404].include?(status)
+          raise AuthenticationError, "Guest token page returned HTTP #{status}"
+        end
+        html
+      rescue Errno::ENOENT
+        raise AuthenticationError,
+              "Install curl-impersonate or pass its executable path with curl:"
+      end
+
+      def extract_token(html)
+        script = Nokogiri::HTML(html).at_css("script#__NEXT_DATA__")
+        data = JSON.parse(script ? script.content : "")
+        token = data.dig("props", "pageProps", "environment", "gasToken")
+        unless token.is_a?(String) && !token.empty?
+          raise AuthenticationError, "Guest token is missing from the page"
+        end
+        token
+      end
+
+      def validate_expiry!(token)
+        claims = JSON.parse(Base64.urlsafe_decode64(token.split(".").fetch(1)))
+        if Integer(claims.fetch("exp")) <= Time.now.to_i
+          raise AuthenticationError, "Guest token supplied by the page has expired"
+        end
+      end
+    end
+  end
+end