Files.com 1.6.480__tar.gz → 1.6.482__tar.gz

{files_com-1.6.480/files_com.egg-info → files_com-1.6.482}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: files_com
-Version: 1.6.480
+Version: 1.6.482
 Summary: Python bindings for the Files.com API
 License: MIT
 Requires-Python: >=3.5

files_com-1.6.482/_VERSION

@@ -0,0 +1 @@
+1.6.482

{files_com-1.6.480 → files_com-1.6.482/files_com.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: files_com
-Version: 1.6.480
+Version: 1.6.482
 Summary: Python bindings for the Files.com API
 License: MIT
 Requires-Python: >=3.5

{files_com-1.6.480 → files_com-1.6.482}/files_com.egg-info/SOURCES.txt

@@ -268,6 +268,7 @@ tests/test_preview.py
 tests/test_public_hosting_request_log.py
 tests/test_public_ip_address.py
 tests/test_public_key.py
+tests/test_redirect_auth.py
 tests/test_remote_bandwidth_snapshot.py
 tests/test_remote_mount_backend.py
 tests/test_remote_server.py

{files_com-1.6.480 → files_com-1.6.482}/files_sdk/__init__.py

@@ -320,7 +320,7 @@ source_ip = None
 workspace_id = None
 base_url = "https://app.files.com"
 base_path = "api/rest/v1"
-version = "1.6.480"
+version = "1.6.482"
 
 __version__ = version
 

{files_com-1.6.480 → files_com-1.6.482}/files_sdk/api_client.py

@@ -2,7 +2,7 @@ import json
 import random
 import requests
 import time
-from urllib.parse import urljoin
+from urllib.parse import urljoin, urlparse
 from decimal import Decimal
 
 import files_sdk
@@ -16,6 +16,31 @@ import files_sdk.util as util
 from requests_toolbelt.adapters import source
 
 
+FILES_AUTH_HEADERS = (
+    "X-FilesAPI-Key",
+    "X-FilesAPI-Auth",
+    "X-Files-Workspace-Id",
+)
+
+
+def _url_origin(url):
+    parsed = urlparse(url)
+    port = parsed.port
+    if port is None:
+        port = 443 if parsed.scheme.lower() == "https" else 80
+    return parsed.scheme.lower(), (parsed.hostname or "").lower(), port
+
+
+class FilesSession(requests.Session):
+    def rebuild_auth(self, prepared_request, response):
+        super().rebuild_auth(prepared_request, response)
+        if _url_origin(response.request.url) != _url_origin(
+            prepared_request.url
+        ):
+            for header in FILES_AUTH_HEADERS:
+                prepared_request.headers.pop(header, None)
+
+
 class ApiClient:
     """
     The Files.com API Client.
@@ -24,7 +49,7 @@ class ApiClient:
     def __init__(self):
         pass
 
-        self.session = requests.Session()
+        self.session = FilesSession()
 
         if (
             files_sdk.get_source_ip() is not None

{files_com-1.6.480 → files_com-1.6.482}/files_sdk/models/bundle.py

@@ -19,7 +19,7 @@ class Bundle:
         "color_top_text": None,  # string - Top bar text color
         "url": None,  # string - Public URL of Share Link
         "description": None,  # string - Public description
-        "expires_at": None,  # date-time - Bundle expiration date/time
+        "expires_at": None,  # date-time - Explicit Bundle expiration date/time. If not set, the site-wide expiration setting may apply.
         "password_protected": None,  # boolean - Is this bundle password protected?
         "permissions": None,  # string - Permissions that apply to Folders in this Share Link.
         "preview_only": None,  # boolean
@@ -38,6 +38,7 @@ class Bundle:
         "deleted": None,  # boolean - Indicates if the bundle has been deleted.
         "deleted_at": None,  # date-time - Bundle deleted at date/time
         "dont_separate_submissions_by_folder": None,  # boolean - Do not create subfolders for files uploaded to this share. Note: there are subtle security pitfalls with allowing anonymous uploads from multiple users to live in the same folder. We strongly discourage use of this option unless absolutely required.
+        "effective_expires_at": None,  # date-time - Read-only expiration date/time, using the explicit expiration or the site-wide setting when applicable. Null when the Share Link does not expire.
         "max_uses": None,  # int64 - Maximum number of times bundle can be accessed
         "internal_name": None,  # string - Internal name for identifying this Share Link.
         "note": None,  # string - Bundle internal note
@@ -133,7 +134,7 @@ class Bundle:
     #   create_snapshot - boolean - If true, create a snapshot of this bundle's contents.
     #   description - string - Public description
     #   dont_separate_submissions_by_folder - boolean - Do not create subfolders for files uploaded to this share. Note: there are subtle security pitfalls with allowing anonymous uploads from multiple users to live in the same folder. We strongly discourage use of this option unless absolutely required.
-    #   expires_at - string - Bundle expiration date/time
+    #   expires_at - string - Explicit Bundle expiration date/time. If not set, the site-wide expiration setting may apply.
     #   finalize_snapshot - boolean - If true, finalize the snapshot of this bundle's contents. Note that `create_snapshot` must also be true.
     #   inbox_id - int64 - ID of the associated inbox, if available.
     #   max_uses - int64 - Maximum number of times bundle can be accessed
@@ -387,7 +388,7 @@ def get(id, params=None, options=None):
 #   form_field_set_id - int64 - Id of Form Field Set to use with this bundle
 #   create_snapshot - boolean - If true, create a snapshot of this bundle's contents.
 #   dont_separate_submissions_by_folder - boolean - Do not create subfolders for files uploaded to this share. Note: there are subtle security pitfalls with allowing anonymous uploads from multiple users to live in the same folder. We strongly discourage use of this option unless absolutely required.
-#   expires_at - string - Bundle expiration date/time
+#   expires_at - string - Explicit Bundle expiration date/time. If not set, the site-wide expiration setting may apply.
 #   finalize_snapshot - boolean - If true, finalize the snapshot of this bundle's contents. Note that `create_snapshot` must also be true.
 #   max_uses - int64 - Maximum number of times bundle can be accessed
 #   group_id - int64 - Owning group ID. If set, members of this group can view, edit, and share this Share Link.
@@ -608,7 +609,7 @@ def share(id, params=None, options=None):
 #   create_snapshot - boolean - If true, create a snapshot of this bundle's contents.
 #   description - string - Public description
 #   dont_separate_submissions_by_folder - boolean - Do not create subfolders for files uploaded to this share. Note: there are subtle security pitfalls with allowing anonymous uploads from multiple users to live in the same folder. We strongly discourage use of this option unless absolutely required.
-#   expires_at - string - Bundle expiration date/time
+#   expires_at - string - Explicit Bundle expiration date/time. If not set, the site-wide expiration setting may apply.
 #   finalize_snapshot - boolean - If true, finalize the snapshot of this bundle's contents. Note that `create_snapshot` must also be true.
 #   inbox_id - int64 - ID of the associated inbox, if available.
 #   max_uses - int64 - Maximum number of times bundle can be accessed

{files_com-1.6.480 → files_com-1.6.482}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "files_com"
-version = "1.6.480"
+version = "1.6.482"
 description = "Python bindings for the Files.com API"
 readme = "README.md"
 license = { text = "MIT" }

files_com-1.6.482/tests/test_redirect_auth.py

@@ -0,0 +1,92 @@
+import threading
+import unittest
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+
+import files_sdk
+from files_sdk.api_client import ApiClient
+
+
+class RedirectHandler(BaseHTTPRequestHandler):
+    def do_GET(self):
+        if self.path == "/api/rest/v1/cross-origin":
+            self.send_response(302)
+            self.send_header("Location", self.server.cross_origin_url + "/download")
+            self.end_headers()
+            return
+        if self.path == "/api/rest/v1/same-origin":
+            self.send_response(302)
+            self.send_header("Location", "/api/rest/v1/final")
+            self.end_headers()
+            return
+
+        self.server.received_headers.append(self.headers)
+        self.send_response(204)
+        self.end_headers()
+
+    def log_message(self, *args):
+        pass
+
+
+class TestRedirectAuth(unittest.TestCase):
+    def setUp(self):
+        self.api_server = ThreadingHTTPServer(("127.0.0.1", 0), RedirectHandler)
+        self.storage_server = ThreadingHTTPServer(("127.0.0.1", 0), RedirectHandler)
+        self.api_server.received_headers = []
+        self.storage_server.received_headers = []
+        self.api_url = "http://127.0.0.1:{}".format(self.api_server.server_port)
+        self.storage_url = "http://127.0.0.1:{}".format(
+            self.storage_server.server_port
+        )
+        self.api_server.cross_origin_url = self.storage_url
+        self.storage_server.cross_origin_url = self.api_url
+        self.threads = [
+            threading.Thread(target=self.api_server.serve_forever),
+            threading.Thread(target=self.storage_server.serve_forever),
+        ]
+        for thread in self.threads:
+            thread.start()
+
+        self.original_base_url = files_sdk.base_url
+        files_sdk.base_url = self.api_url
+
+    def tearDown(self):
+        files_sdk.base_url = self.original_base_url
+        files_sdk.set_workspace_id(None)
+        for server in (self.api_server, self.storage_server):
+            server.shutdown()
+            server.server_close()
+        for thread in self.threads:
+            thread.join()
+
+    def test_cross_origin_redirect_strips_files_auth_headers(self):
+        client = ApiClient()
+        client.send_request(
+            "GET",
+            "/cross-origin",
+            session_id="testsession",
+            workspace_id=123,
+            params={},
+        )
+
+        redirected_headers = self.storage_server.received_headers[0]
+        self.assertNotIn("X-FilesAPI-Key", redirected_headers)
+        self.assertNotIn("X-FilesAPI-Auth", redirected_headers)
+        self.assertNotIn("X-Files-Workspace-Id", redirected_headers)
+
+    def test_same_origin_redirect_keeps_files_auth_headers(self):
+        client = ApiClient()
+        client.send_request(
+            "GET",
+            "/same-origin",
+            api_key="testkey",
+            workspace_id=123,
+            params={},
+        )
+
+        redirected_headers = self.api_server.received_headers[0]
+        self.assertEqual("testkey", redirected_headers["X-FilesAPI-Key"])
+        self.assertEqual("123", redirected_headers["X-Files-Workspace-Id"])
+
+
+if __name__ == "__main__":
+    unittest.main()

files_com-1.6.480/_VERSION

@@ -1 +0,0 @@
-1.6.480