caltechdata-api 2.2.3__tar.gz → 2.2.4__tar.gz

{caltechdata_api-2.2.3 → caltechdata_api-2.2.4}/PKG-INFO

@@ -1,9 +1,9 @@
 Metadata-Version: 2.4
 Name: caltechdata_api
-Version: 2.2.3
+Version: 2.2.4
 Summary: Python wrapper for CaltechDATA API.
 Author: Rohan Bhattarai, Elizabeth Won
-Author-email: Thomas E Morrell <tmorrell@caltech.edu>, Alexander A Abakah <aabakah@caltech.edu>, Kshemaahna Nagi <knagi@caltech.edu>
+Author-email: Thomas E Morrell <tmorrell@caltech.edu>, Alexander A Abakah <aabakah@caltech.edu>, Kshemaahna Nagi <knagi@caltech.edu>, Robert Doiel <rsdoiel@caltech.edu>
 Maintainer-email: Thomas E Morrell <tmorrell@caltech.edu>
 License-Expression: BSD-3-Clause
 Project-URL: Homepage, https://github.com/caltechlibrary/caltechdata_api

{caltechdata_api-2.2.3 → caltechdata_api-2.2.4}/caltechdata_api/caltechdata_edit.py

@@ -14,7 +14,7 @@ def caltechdata_unembargo(token, ids, production=False):
     print("caltechdaua_unembargo is not yet re-implemented")
 
 
-def caltechdata_accept(ids, token=None, production=False):
+def caltechdata_accept(ids, token=None, production=False, verify=True):
     # Accept a record into a community. Only accepts the first community
     # request
 
@@ -34,11 +34,15 @@ def caltechdata_accept(ids, token=None, production=False):
 
     for idv in ids:
         result = requests.get(
-            url + "/api/records/" + idv + "/draft/review", headers=headers
+            url + "/api/records/" + idv + "/draft/review",
+            headers=headers,
+            verify=verify,
         )
         if result.status_code != 200:
             result = requests.get(
-                url + "/api/records/" + idv + "/requests", headers=headers
+                url + "/api/records/" + idv + "/requests",
+                headers=headers,
+                verify=verify,
             )
             if result.status_code != 200:
                 raise Exception(result.text)
@@ -51,7 +55,7 @@ def caltechdata_accept(ids, token=None, production=False):
                 "format": "html",
             }
         }
-        result = requests.post(accept_link, json=data, headers=headers)
+        result = requests.post(accept_link, json=data, headers=headers, verify=verify)
         if result.status_code != 200:
             raise Exception(result.text)
 
@@ -117,6 +121,7 @@ def caltechdata_edit(
     keepfiles=False,
     return_id=False,
     local=False,
+    verify=True,
 ):
     # Make a copy of the metadata to make sure our local changes don't leak
     metadata = copy.deepcopy(metadata)
@@ -159,28 +164,32 @@ def caltechdata_edit(
             url + "/api/records/" + idv + "/communities",
             headers=headers,
             data=json.dumps({"communities": [{"id": community}]}),
+            verify=verify,
         )
         if result.status_code != 200:
             print(result.url)
             raise Exception(result.text)
-        caltechdata_accept([idv], token, production)
+        caltechdata_accept([idv], token, production, verify=verify)
 
     # Check status
     existing = requests.get(
         url + "/api/records/" + idv,
         headers=headers,
+        verify=verify,
     )
     if existing.status_code != 200:
         # Might have a draft
         existing = requests.get(
             url + "/api/records/" + idv + "/draft",
             headers=headers,
+            verify=verify,
         )
         if existing.status_code != 200:
             # Try back again to the record
             existing = requests.get(
                 url + "/api/records/" + idv,
                 headers=headers,
+                verify=verify,
             )
 
             if existing.status_code != 200:
@@ -202,6 +211,7 @@ def caltechdata_edit(
         result = requests.post(
             url + "/api/records/" + idv + "/versions",
             headers=headers,
+            verify=verify,
         )
         if result.status_code != 201:
             raise Exception(result.text)
@@ -304,12 +314,14 @@ def caltechdata_edit(
     result = requests.get(
         url + "/api/records/" + idv + "/draft",
         headers=headers,
+        verify=verify,
     )
     if result.status_code != 200:
         # We make a draft
         result = requests.post(
             url + "/api/records/" + idv + "/draft",
             headers=headers,
+            verify=verify,
         )
         if result.status_code != 201:
             raise Exception(result.text)
@@ -324,16 +336,28 @@ def caltechdata_edit(
             url + "/api/records/" + idv + "/draft",
             headers=headers,
             json=data,
+            verify=verify,
         )
         if result.status_code != 200:
             raise Exception(result.text)
         file_upload_link = result.json()["links"]["files"]
         if files:
             write_files_rdm(
-                files, file_upload_link, headers, f_headers, keepfiles=keepfiles
+                files,
+                file_upload_link,
+                headers,
+                f_headers,
+                keepfiles=keepfiles,
+                verify=verify,
             )
         if file_links:
-            add_file_links(file_upload_link, file_links, headers, keepfiles=keepfiles)
+            add_file_links(
+                file_upload_link,
+                file_links,
+                headers,
+                keepfiles=keepfiles,
+                verify=verify,
+            )
 
     else:
         # We want files to stay the same as the existing record
@@ -345,6 +369,7 @@ def caltechdata_edit(
             url + "/api/records/" + idv + "/draft",
             headers=headers,
             json=data,
+            verify=verify,
         )
         if result.status_code != 200:
             time.sleep(3)
@@ -352,16 +377,17 @@ def caltechdata_edit(
                 url + "/api/records/" + idv + "/draft",
                 headers=headers,
                 json=data,
+                verify=verify,
             )
             if result.status_code != 200:
                 raise Exception(result.text)
 
     if publish:
         publish_link = f"{url}/api/records/{idv}/draft/actions/publish"
-        result = requests.post(publish_link, headers=headers)
+        result = requests.post(publish_link, headers=headers, verify=verify)
         if result.status_code != 202:
             time.sleep(3)
-            result = requests.post(publish_link, headers=headers)
+            result = requests.post(publish_link, headers=headers, verify=verify)
             if result.status_code != 202:
                 raise Exception(result.text)
         if return_id:

{caltechdata_api-2.2.3 → caltechdata_api-2.2.4}/caltechdata_api/caltechdata_write.py

@@ -67,7 +67,7 @@ def write_files_rdm(
                     raise Exception(result.text)
 
 
-def add_file_links(file_upload_link, file_links, headers, keepfiles=False):
+def add_file_links(file_upload_link, file_links, headers, keepfiles=False, verify=True):
     # Currently configured for S3 links, assuming all are at the same endpoint
     # Links are urls, or (file name, url) pairs when the url file names are not
     # unique across the bucket
@@ -90,21 +90,27 @@ def add_file_links(file_upload_link, file_links, headers, keepfiles=False):
             {"key": file, "size": size, "transfer": {"type": "R", "url": link}}
         )
     # Now we see if any existing files need to be replaced
-    result = requests.get(file_upload_link, headers=headers)
+    result = requests.get(file_upload_link, headers=headers, verify=verify)
     if result.status_code == 200:
         ex_files = result.json()["entries"]
         for ex in ex_files:
             if ex["key"] in f_list:
-                result = requests.delete(ex["links"]["self"], headers=headers)
+                result = requests.delete(
+                    ex["links"]["self"], headers=headers, verify=verify
+                )
                 if result.status_code != 204:
                     raise Exception(result.text)
             else:
                 if keepfiles == False:
-                    result = requests.delete(ex["links"]["self"], headers=headers)
+                    result = requests.delete(
+                        ex["links"]["self"], headers=headers, verify=verify
+                    )
                     if result.status_code != 204:
                         raise Exception(result.text)
 
-    result = requests.post(file_upload_link, headers=headers, json=file_json)
+    result = requests.post(
+        file_upload_link, headers=headers, json=file_json, verify=verify
+    )
     if result.status_code != 201:
         raise Exception(result.text)
 

{caltechdata_api-2.2.3 → caltechdata_api-2.2.4}/caltechdata_api/download_from_record.py

@@ -19,7 +19,9 @@ from urllib.parse import urlsplit
 from typing import Any, Dict, Optional, Sequence
 
 
-def get_base_url(production: bool = True, authors: bool = False) -> str:
+def get_base_url(
+    production: bool = True, authors: bool = False, local: bool = False
+) -> str:
     """Get the base URL of the repository to download from.
 
     Parameters
@@ -31,6 +33,11 @@ def get_base_url(production: bool = True, authors: bool = False) -> str:
     authors
         Whether to use CaltechAUTHORS instead of CaltechDATA.
 
+    local
+        Whether to use a local instance, at ``https://127.0.0.1:5000``,
+        instead of the test (development) instance. Ignored when
+        ``production`` is ``True``, as in :func:`caltechdata_write`.
+
     Returns
     -------
     str
@@ -40,6 +47,8 @@ def get_base_url(production: bool = True, authors: bool = False) -> str:
         if authors:
             return "https://authors.library.caltech.edu"
         return "https://data.caltech.edu"
+    elif local:
+        return "https://127.0.0.1:5000"
     else:
         if authors:
             return "https://authors.caltechlibrary.dev"
@@ -51,6 +60,8 @@ def get_files_from_record(
     production: bool = True,
     authors: bool = False,
     token: Optional[str] = None,
+    local: bool = False,
+    verify: bool = True,
 ) -> Dict[str, Any]:
     """Get a dictionary of files associated with a record.
 
@@ -74,25 +85,37 @@ def get_files_from_record(
         token is given and the published record is not found, the
         record's draft is tried as well.
 
+    local
+        Whether to query a local instance, at ``https://127.0.0.1:5000``,
+        instead of the test (development) instance.
+
+    verify
+        Whether to verify the server's TLS certificate. Use ``False``
+        for a local instance with a self-signed certificate.
+
     Returns
     -------
     dict
         A dictionary with the file names as keys and the metadata
         associated with those files as values.
     """
-    base_url = get_base_url(production=production, authors=authors)
+    base_url = get_base_url(production=production, authors=authors, local=local)
     headers = {}
     if token is not None:
         headers["Authorization"] = "Bearer %s" % token
 
-    r = requests.get(f"{base_url}/api/records/{record_id}/files", headers=headers)
+    r = requests.get(
+        f"{base_url}/api/records/{record_id}/files", headers=headers, verify=verify
+    )
     try:
         if r.status_code == 404 and token is not None:
             # An unpublished record has no published version to return,
             # so fall back to its draft, which requires authentication.
             r.close()
             r = requests.get(
-                f"{base_url}/api/records/{record_id}/draft/files", headers=headers
+                f"{base_url}/api/records/{record_id}/draft/files",
+                headers=headers,
+                verify=verify,
             )
 
         r.raise_for_status()
@@ -114,6 +137,8 @@ def download_files_from_record(
     production: bool = True,
     authors: bool = False,
     token: Optional[str] = None,
+    local: bool = False,
+    verify: bool = True,
 ):
     """Download one or more files from a record.
 
@@ -157,12 +182,28 @@ def download_files_from_record(
         files from restricted records. If omitted, the requests are
         made without authentication and only public records are
         available.
+
+    local
+        Whether to download from a local instance, at
+        ``https://127.0.0.1:5000``, instead of the test (development)
+        instance.
+
+    verify
+        Whether to verify the server's TLS certificate, for requests to
+        the instance itself. Use ``False`` for a local instance with a
+        self-signed certificate. Redirects to other hosts are always
+        verified.
     """
     if not os.path.isdir(output_path):
         raise IOError(f"{output_path} is not an extant directory")
 
     files = get_files_from_record(
-        record_id, production=production, authors=authors, token=token
+        record_id,
+        production=production,
+        authors=authors,
+        token=token,
+        local=local,
+        verify=verify,
     )
     if filenames is None:
         filenames = sorted(files.keys())
@@ -181,7 +222,11 @@ def download_files_from_record(
 
         content_url = entry["links"]["content"]
         download_content(
-            content_url, output_file, max_redirects=max_redirects, token=token
+            content_url,
+            output_file,
+            max_redirects=max_redirects,
+            token=token,
+            verify=verify,
         )
 
 
@@ -190,6 +235,7 @@ def download_content(
     fname: os.PathLike,
     max_redirects=5,
     token: Optional[str] = None,
+    verify: bool = True,
 ):
     """Download the contents of a file.
 
@@ -216,6 +262,11 @@ def download_content(
         content from restricted records. If omitted, the request is
         made without authentication. The token is only sent to the
         host of ``content_url``, not to hosts we are redirected to.
+
+    verify
+        Whether to verify the server's TLS certificate. Like the token,
+        it applies only to the host of ``content_url``: a redirect to
+        another host is always verified.
     """
     url = content_url
     host = urlsplit(content_url).netloc
@@ -228,7 +279,9 @@ def download_content(
         if token is not None and urlsplit(url).netloc == host:
             headers["Authorization"] = "Bearer %s" % token
 
-        with requests.get(url, stream=True, headers=headers) as r:
+        # A redirect to another host (the file store) is always verified
+        verify_url = verify if urlsplit(url).netloc == host else True
+        with requests.get(url, stream=True, headers=headers, verify=verify_url) as r:
             r.raise_for_status()
             if "Location" in r.headers:
                 # Redirection - follow to the next URL

{caltechdata_api-2.2.3 → caltechdata_api-2.2.4}/caltechdata_api.egg-info/PKG-INFO

@@ -1,9 +1,9 @@
 Metadata-Version: 2.4
 Name: caltechdata_api
-Version: 2.2.3
+Version: 2.2.4
 Summary: Python wrapper for CaltechDATA API.
 Author: Rohan Bhattarai, Elizabeth Won
-Author-email: Thomas E Morrell <tmorrell@caltech.edu>, Alexander A Abakah <aabakah@caltech.edu>, Kshemaahna Nagi <knagi@caltech.edu>
+Author-email: Thomas E Morrell <tmorrell@caltech.edu>, Alexander A Abakah <aabakah@caltech.edu>, Kshemaahna Nagi <knagi@caltech.edu>, Robert Doiel <rsdoiel@caltech.edu>
 Maintainer-email: Thomas E Morrell <tmorrell@caltech.edu>
 License-Expression: BSD-3-Clause
 Project-URL: Homepage, https://github.com/caltechlibrary/caltechdata_api

{caltechdata_api-2.2.3 → caltechdata_api-2.2.4}/caltechdata_api.egg-info/SOURCES.txt

@@ -26,6 +26,9 @@ caltechdata_api/vocabularies/relation_types.yaml
 caltechdata_api/vocabularies/resource_types.yaml
 caltechdata_api/vocabularies/roles.yaml
 caltechdata_api/vocabularies/title_types.yaml
+tests/test_accept_verify.py
 tests/test_download.py
+tests/test_download_verify.py
+tests/test_edit_verify.py
 tests/test_rdm.py
 tests/test_unit.py

{caltechdata_api-2.2.3 → caltechdata_api-2.2.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "caltechdata_api"
-version = "2.2.3"
+version = "2.2.4"
 description = "Python wrapper for CaltechDATA API."
 readme = "README.md"
 requires-python = ">=3.9"
@@ -16,6 +16,7 @@ authors = [
     {name = "Elizabeth Won"},
     {name = "Alexander A Abakah", email = "aabakah@caltech.edu"},
     {name = "Kshemaahna Nagi", email = "knagi@caltech.edu"},
+    {name = "Robert Doiel", email = "rsdoiel@caltech.edu"},
 ]
 maintainers = [
     {name = "Thomas E Morrell", email = "tmorrell@caltech.edu"},

caltechdata_api-2.2.4/tests/test_accept_verify.py

@@ -0,0 +1,53 @@
+"""caltechdata_accept passes its verify argument to every request it makes.
+
+No network is used: requests is replaced by a fake that records the keyword
+arguments of each call.
+"""
+
+from types import SimpleNamespace
+from unittest import mock
+
+import pytest
+import requests
+
+from caltechdata_api import caltechdata_accept
+
+ACCEPT = "https://data.caltechlibrary.dev/api/requests/r1/actions/accept"
+
+
+@pytest.fixture
+def calls():
+    """Replace requests.get/post; each call is recorded as (method, url, kwargs).
+
+    The draft's review link is missing (404) so the request list is read too,
+    which makes the run use every call caltechdata_accept has.
+    """
+    seen = []
+
+    def get(url, *args, **kwargs):
+        seen.append(("GET", url, kwargs))
+        if url.endswith("/draft/review"):
+            return SimpleNamespace(status_code=404, text="no review")
+        hits = {"hits": {"hits": [{"links": {"actions": {"accept": ACCEPT}}}]}}
+        return SimpleNamespace(status_code=200, json=lambda: hits)
+
+    def post(url, *args, **kwargs):
+        seen.append(("POST", url, kwargs))
+        return SimpleNamespace(status_code=200, json=lambda: {}, text="")
+
+    with mock.patch.multiple(requests, get=get, post=post):
+        yield seen
+
+
+@pytest.mark.parametrize("verify", [True, False])
+def test_verify_reaches_every_request(calls, verify):
+    caltechdata_accept(["abcde-12345"], token="t", verify=verify)
+    assert [m for m, _, _ in calls] == ["GET", "GET", "POST"]
+    for method, url, kwargs in calls:
+        assert kwargs.get("verify", True) is verify, f"{method} {url}"
+
+
+def test_verify_defaults_to_true(calls):
+    caltechdata_accept(["abcde-12345"], token="t")
+    for method, url, kwargs in calls:
+        assert kwargs.get("verify", True) is True, f"{method} {url}"

caltechdata_api-2.2.4/tests/test_download_verify.py

@@ -0,0 +1,148 @@
+"""download_from_record can target a local instance and skip TLS verification.
+
+A test instance with a self-signed certificate (local=True) needs verify=False
+on its requests. A redirect to another host (the file store) is still
+verified. No network is used: requests.get is replaced by a fake that records
+the keyword arguments of each call.
+"""
+
+from unittest import mock
+
+import pytest
+import requests
+
+from caltechdata_api.download_from_record import (
+    download_content,
+    download_files_from_record,
+    get_base_url,
+    get_files_from_record,
+)
+
+LOCAL = "https://127.0.0.1:5000"
+STORE = "https://store.example.org/object"
+RECORD = "abcde-12345"
+
+
+class Response:
+    def __init__(self, status=200, payload=None, headers=None, body=b""):
+        self.status_code = status
+        self._payload = payload
+        self.headers = headers or {}
+        self._body = body
+
+    def json(self):
+        return self._payload
+
+    def raise_for_status(self):
+        if self.status_code >= 400:
+            raise requests.HTTPError(str(self.status_code))
+
+    def iter_content(self, chunk_size=1024):
+        yield self._body
+
+    def close(self):
+        pass
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *exc):
+        self.close()
+
+
+def entries():
+    content = f"{LOCAL}/api/records/{RECORD}/files/a.txt/content"
+    return {"entries": [{"key": "a.txt", "links": {"content": content}}]}
+
+
+@pytest.fixture
+def calls():
+    """Replace requests.get; each call is recorded as (url, kwargs)."""
+    seen = []
+
+    def get(url, *args, **kwargs):
+        seen.append((url, kwargs))
+        if url.endswith("/draft/files"):
+            return Response(200, entries())
+        if url.endswith("/files"):
+            return Response(404)
+        if url.endswith("/content"):
+            return Response(200, headers={"Location": STORE})
+        if url == STORE:
+            return Response(200, headers={"content-length": "2"}, body=b"hi")
+        raise AssertionError(f"unexpected GET {url}")
+
+    with mock.patch.object(requests, "get", get):
+        yield seen
+
+
+def test_get_base_url_local():
+    assert get_base_url(production=False, authors=True, local=True) == LOCAL
+    assert get_base_url(production=False, authors=False, local=True) == LOCAL
+
+
+def test_get_base_url_production_wins_over_local():
+    assert get_base_url(production=True, authors=True, local=True) == (
+        "https://authors.library.caltech.edu"
+    )
+
+
+def test_get_base_url_unchanged_without_local():
+    assert get_base_url(production=False, authors=True) == (
+        "https://authors.caltechlibrary.dev"
+    )
+    assert get_base_url(production=True) == "https://data.caltech.edu"
+
+
+@pytest.mark.parametrize("verify", [True, False])
+def test_get_files_uses_the_local_host_and_verify(calls, verify):
+    # the published files are not found, so the draft is tried as well
+    files = get_files_from_record(
+        RECORD, production=False, authors=True, local=True, token="t", verify=verify
+    )
+    assert list(files) == ["a.txt"]
+    assert [u for u, _ in calls] == [
+        f"{LOCAL}/api/records/{RECORD}/files",
+        f"{LOCAL}/api/records/{RECORD}/draft/files",
+    ]
+    for url, kwargs in calls:
+        assert kwargs.get("verify", True) is verify, url
+
+
+@pytest.mark.parametrize("verify", [True, False])
+def test_download_verifies_other_hosts(calls, tmp_path, verify):
+    download_files_from_record(
+        RECORD,
+        tmp_path,
+        production=False,
+        authors=True,
+        local=True,
+        token="t",
+        verify=verify,
+    )
+    assert (tmp_path / "a.txt").read_bytes() == b"hi"
+    by_url = {url: kwargs.get("verify", True) for url, kwargs in calls}
+    # the instance's own requests follow verify
+    assert by_url[f"{LOCAL}/api/records/{RECORD}/files"] is verify
+    assert by_url[f"{LOCAL}/api/records/{RECORD}/files/a.txt/content"] is verify
+    # a redirect to another host is always verified
+    assert by_url[STORE] is True
+
+
+def test_download_content_verify_false_stays_on_the_first_host(calls, tmp_path):
+    download_content(
+        f"{LOCAL}/api/records/{RECORD}/files/a.txt/content",
+        tmp_path / "a.txt",
+        verify=False,
+    )
+    by_url = {url: kwargs.get("verify", True) for url, kwargs in calls}
+    assert by_url[f"{LOCAL}/api/records/{RECORD}/files/a.txt/content"] is False
+    assert by_url[STORE] is True
+
+
+def test_defaults_are_unchanged(calls):
+    get_files_from_record(RECORD, production=False, authors=True, token="t")
+    dev = "https://authors.caltechlibrary.dev"
+    assert calls[0][0] == f"{dev}/api/records/{RECORD}/files"
+    for _, kwargs in calls:
+        assert kwargs.get("verify", True) is True

caltechdata_api-2.2.4/tests/test_edit_verify.py

@@ -0,0 +1,149 @@
+"""caltechdata_edit passes its verify argument to every request it makes.
+
+A test instance with a self-signed certificate (local=True) needs verify=False
+on every call, including the ones made by write_files_rdm and add_file_links.
+No network is used: requests is replaced by a router that answers the calls an
+edit of a published record makes, and records the keyword arguments.
+"""
+
+from types import SimpleNamespace
+from unittest import mock
+from urllib.parse import urlsplit
+
+import pytest
+import requests
+
+from caltechdata_api import caltechdata_edit
+
+BASE = "https://127.0.0.1:5000"
+RECORD = "abcde-12345"
+NEW = "fghij-67890"
+
+
+def respond(method, url):
+    """Return (status, payload) for the calls an edit makes."""
+    path = urlsplit(url).path
+    if method == "GET":
+        if path.endswith("/draft/review"):
+            accept = "https://data.caltechlibrary.dev/api/requests/r1/actions/accept"
+            return 200, {"links": {"actions": {"accept": accept}}}
+        if path.endswith("/draft/files"):
+            return 200, {"entries": []}
+        if path.endswith("/draft"):
+            return 200, {}
+        return 200, {"status": "published", "files": {"enabled": False}}
+    if method == "POST":
+        if path.endswith("/communities") or path.endswith("/actions/accept"):
+            return 200, {}
+        if path.endswith("/versions"):
+            return 201, {"id": NEW}
+        if path.endswith("/draft/files"):
+            link = f"{BASE}/api/records/{NEW}/draft/files/a.txt"
+            return 201, {
+                "entries": [
+                    {
+                        "key": "a.txt",
+                        "links": {
+                            "self": link,
+                            "content": link + "/content",
+                            "commit": link + "/commit",
+                        },
+                    }
+                ]
+            }
+        if path.endswith("/commit"):
+            return 200, {}
+        if path.endswith("/actions/publish"):
+            return 202, {"id": NEW, "pids": {"doi": {"identifier": "10.1/x"}}}
+    if method == "PUT":
+        if path.endswith("/content"):
+            return 200, {}
+        return 200, {"links": {"files": f"{BASE}/api/records/{NEW}/draft/files"}}
+    raise AssertionError(f"unexpected {method} {url}")
+
+
+@pytest.fixture
+def calls():
+    """Replace requests.get/post/put/delete; the list records (method, kwargs)."""
+    seen = []
+
+    def make(method):
+        def fake(url, *args, **kwargs):
+            seen.append((method, url, kwargs))
+            status, payload = respond(method, url)
+            return SimpleNamespace(
+                status_code=status, json=lambda: payload, text=str(payload), url=url
+            )
+
+        return fake
+
+    with mock.patch.multiple(
+        requests, **{m.lower(): make(m) for m in ("GET", "POST", "PUT", "DELETE")}
+    ):
+        yield seen
+
+
+@pytest.fixture
+def s3():
+    """Stand in for s3fs, which add_file_links uses to size each linked file."""
+    fs = mock.Mock()
+    fs.return_value.info.return_value = {"size": 1}
+    with mock.patch("caltechdata_api.caltechdata_write.s3fs.S3FileSystem", fs):
+        yield fs
+
+
+def edit(**kwargs):
+    return caltechdata_edit(
+        RECORD, token="t", authors=True, local=True, publish=True, **kwargs
+    )
+
+
+def assert_all(calls, expected):
+    assert calls, "no requests were made"
+    for method, url, kwargs in calls:
+        assert (
+            kwargs.get("verify", True) is expected
+        ), f"{method} {url} did not get verify={expected}"
+
+
+@pytest.mark.parametrize("verify", [True, False])
+def test_metadata_only_edit(calls, verify):
+    edit(verify=verify)
+    assert_all(calls, verify)
+
+
+@pytest.mark.parametrize("verify", [True, False])
+def test_new_version(calls, verify):
+    edit(new_version=True, verify=verify)
+    assert_all(calls, verify)
+
+
+@pytest.mark.parametrize("verify", [True, False])
+def test_file_upload(calls, tmp_path, verify):
+    path = tmp_path / "a.txt"
+    path.write_text("x")
+    edit(files=[str(path)], verify=verify)
+    assert_all(calls, verify)
+    # the upload and its commit were part of the run
+    assert any(m == "PUT" and u.endswith("/content") for m, u, _ in calls)
+
+
+@pytest.mark.parametrize("verify", [True, False])
+def test_file_links(calls, s3, verify):
+    edit(file_links=["https://s3.example.org/bucket/a.txt"], verify=verify)
+    assert_all(calls, verify)
+    assert any(m == "POST" and u.endswith("/draft/files") for m, u, _ in calls)
+
+
+def test_verify_defaults_to_true(calls):
+    edit()
+    assert_all(calls, True)
+    assert all(kwargs.get("verify", True) is True for _, _, kwargs in calls)
+
+
+@pytest.mark.parametrize("verify", [True, False])
+def test_community_accept(calls, verify):
+    # adding to a community accepts the request through caltechdata_accept
+    edit(community="c-1", verify=verify)
+    assert_all(calls, verify)
+    assert any(m == "POST" and u.endswith("/actions/accept") for m, u, _ in calls)