ntu-cool-cli 1.3.2__tar.gz → 1.3.4__tar.gz

{ntu_cool_cli-1.3.2/scripts/ntu_cool_cli.egg-info → ntu_cool_cli-1.3.4}/PKG-INFO

@@ -1,8 +1,9 @@
 Metadata-Version: 2.4
 Name: ntu-cool-cli
-Version: 1.3.2
+Version: 1.3.4
 Summary: Read-only CLI for NTU Cool: course announcements, course files, handouts, and submission status.
 Author-email: Gary Xie <gary.1020.xie@gmail.com>
+Maintainer-email: Gary Xie <gary.1020.xie@gmail.com>
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/Gary1020-byte/ntu-cool-cli
 Project-URL: Repository, https://github.com/Gary1020-byte/ntu-cool-cli

{ntu_cool_cli-1.3.2 → ntu_cool_cli-1.3.4}/pyproject.toml

@@ -4,15 +4,22 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ntu-cool-cli"
-version = "1.3.2"
+version = "1.3.4"
 description = "Read-only CLI for NTU Cool: course announcements, course files, handouts, and submission status."
 readme = "README.md"
 requires-python = ">=3.9"
 license = "MIT"
 license-files = ["LICENSE"]
+# Both keys, not just `authors`. Older setuptools splits the author table
+# into author/author_email and leaves the PyPI "author" field blank, so the
+# index page showed an email with no name next to it. `maintainer` is the
+# field the index renders for the person responsible for the release.
 authors = [
   { name = "Gary Xie", email = "gary.1020.xie@gmail.com" },
 ]
+maintainers = [
+  { name = "Gary Xie", email = "gary.1020.xie@gmail.com" },
+]
 keywords = [
   "ntu", "cool", "ceiba", "cli", "announcements", "course", "files",
   "homework", "handout", "student", "scraper", "read-only",

{ntu_cool_cli-1.3.2 → ntu_cool_cli-1.3.4/scripts/ntu_cool_cli.egg-info}/PKG-INFO

@@ -1,8 +1,9 @@
 Metadata-Version: 2.4
 Name: ntu-cool-cli
-Version: 1.3.2
+Version: 1.3.4
 Summary: Read-only CLI for NTU Cool: course announcements, course files, handouts, and submission status.
 Author-email: Gary Xie <gary.1020.xie@gmail.com>
+Maintainer-email: Gary Xie <gary.1020.xie@gmail.com>
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/Gary1020-byte/ntu-cool-cli
 Project-URL: Repository, https://github.com/Gary1020-byte/ntu-cool-cli

{ntu_cool_cli-1.3.2 → ntu_cool_cli-1.3.4}/scripts/ntu_fetch.py

@@ -239,8 +239,8 @@ def fetch_all_courses_historical(s: requests.Session) -> list[dict]:
 
     This endpoint is a trap. Measured 2026-10-23 on a real account: it answered
     with 10 courses while the current roster had 7. The extras were last term's
-    (`【114-1 寒假】毒道之處`, `114 微積分學前自我檢測`, `工程力學一`,
-    `工程圖學`) plus three entries with `name: null` and
+    (a term-bracket course title, a placement self-test, and two engineering
+    courses) plus three entries with `name: null` and
     `access_restricted_by_date: true`. **Every one of them carried
     `term: null`**, so there is no term field to filter on — you cannot tell
     a stale course from a current one after the fact.
@@ -1002,7 +1002,7 @@ def main() -> int:
                             skipped += 1
                             continue
                         # display_name is the human filename; `filename` is the
-                        # storage name and looks like "1789962952_790__lecture_ch1.pdf".
+                        # storage name and looks like "<TIMESTAMP>_<ID>__<ORIGINAL-NAME>".
                         raw_name = str(f.get("name") or f.get("filename") or f.get("id"))
                         safe = os.path.basename(raw_name).replace("/", "_")
                         safe = re.sub(r"[^\w.\-㐀-鿿]+", "_", safe).strip("_") or str(f["id"])

{ntu_cool_cli-1.3.2 → ntu_cool_cli-1.3.4}/tests/test_ntu_fetch.py

@@ -396,6 +396,103 @@ class TestNoPersonalCourseRoster(unittest.TestCase):
     ID_RE = re.compile(r"(?<![0-9])[56][0-9]{4}(?![0-9])")
     CODE_RE = re.compile(r"ESOE[0-9]{4}")
 
+    # --- the rules that were missing when the guard was first written ---
+    #
+    # The original pair above catches a course id and an ESOE code. It does
+    # NOT catch the four things that actually leaked:
+    #
+    #   1. the six-digit course code as printed on the handout header, which
+    #      is written with a space in the middle and so misses ID_RE
+    #   2. the student id, `B` + eight digits -- a different shape entirely
+    #   3. a literal password pasted into an `authenticate(...)` call
+    #   4. the course TITLES and the room numbers, which are the identifying
+    #      part: a roster of four real course names with their exam dates
+    #      says who this account belongs to as clearly as a course id does
+    #   5. the real FILE NAMES -- a course's own worksheet, solution key and
+    #      optional-practice PDFs. These are the actual coursework files, so
+    #      a filename is more identifying than a course title: it names the
+    #      assignment the student sat. A filename rule is what was missing
+    #      when a reviewer pointed at three real homework filenames still
+    #      sitting in the published skill.
+    #
+    # Rules 1-3 and 5 are hard identifiers and need no context. Rule 4 needs
+    # context, because the same words appear in ordinary prose ("the Files
+    # tree structure", "a maths course"), so a title only counts when it
+    # sits near a course-context marker.
+    #
+    # Nothing here lists a real course name, student id, password or
+    # filename: a denylist of the leaked values would itself be the leak.
+    # Every rule is a shape, so it also catches values added after this
+    # file was written.
+    STUDENT_ID_RE = re.compile(r"(?<![A-Za-z0-9])[BR]\d{8}(?![0-9])")
+    COURSE_CODE_RE = re.compile(r"(?<!\d)[56]\d{2}\s?\d{5}(?!\d)")
+    PASSWORD_RE = re.compile(r"authenticate\(\s*[\"'][^\"']+[\"']\s*\)")
+    # A course title: a Chinese discipline noun, optionally with a leading
+    # qualifier and an optional trailing numeral (力學一, 電路一, 數學).
+    CN_TITLE_RE = re.compile(
+        r"(?<![一-鿿])[一-鿿]{2,4}(?:力學|數學|電路|結構|物理|化學|電子)"
+        r"(?:[一二三四五六七八九])?(?![一-鿿])")
+    EN_TITLE_RE = re.compile(
+        r"\b[A-Z][a-z]+ (?:Mechanics|Circuit Design"
+        r"|Electronics|Structures)\b"
+        r"|\b[A-Z][a-z]+ [A-Z][a-z]+ Structures\b")
+    ROOM_RE = re.compile(r"(?<![0-9])\d{2,3}\s?(?:教室|實驗室)")
+
+    # --- filenames ---
+    #
+    # A filename is the most identifying string in the whole tree: it names
+    # the exact worksheet, solution key or midterm paper the student sat.
+    # Redacting the course title while leaving its homework filenames in
+    # place leaves the account just as findable.
+    #
+    # So a filename counts when it carries a piece that identifies:
+    #   - a Chinese discipline noun (力學 / 數學 / 電路 / 結構 / 物理 / 化學)
+    #   - a course prefix (a two-to-four letter course tag, then CA / HW /
+    #     CH / note / mid / exam)
+    #   - an academic-term prefix (a three-or-four-digit term, then _ or -)
+    #   - a student id
+    #   - an English course name
+    #
+    # A generic filename does not count: a Chinese name that names no
+    # discipline, or a plain English noun, say nothing about whose they are.
+    # The rule must not be so broad that it rejects every .pdf in the tree --
+    # a guard that cries wolf is a guard that gets disabled.
+    FILENAME_RE = re.compile(
+        r"[^\s`|()<>\[\]{}\"'`,;。，、:：/\\]+?"
+        r"\.(?:pdf|zip|pptx?|docx?|xlsx?)")
+    FILENAME_CJK_RE = re.compile(r"力學|數學|電路|結構|物理|化學|電子|工力")
+    FILENAME_PREFIX_RE = re.compile(
+        r"^[A-Za-z]{2,4}_(?:CA|HW|CH|note|mid|exam)", re.IGNORECASE)
+    FILENAME_TERM_RE = re.compile(r"^\d{3,4}[-_]")
+    FILENAME_EN_RE = re.compile(
+        r"Mechanics|Circuits|Circuit_Design|Data_Structures|Electronics",
+        re.IGNORECASE)
+
+    def _filename_reason(self, token):
+        """Why this filename identifies someone, or None if it is generic."""
+        base = token.rsplit(".", 1)[0]
+        if "*" in base:
+            base = base.split("*")[0]
+        if not base:
+            return None
+        if self.FILENAME_CJK_RE.search(base):
+            return "a discipline noun"
+        if self.FILENAME_PREFIX_RE.match(base):
+            return "a course prefix"
+        if self.FILENAME_TERM_RE.match(base):
+            return "an academic-term prefix"
+        if self.STUDENT_ID_RE.search(base):
+            return "a student id"
+        if self.FILENAME_EN_RE.search(base):
+            return "an English course name"
+        return None
+    # Words that mean "this line is about a course", not "this line is prose".
+    CONTEXT_RE = re.compile(
+        r"期中考|期末考|模擬考|小考|課程|課堂|助教|講義|作業|學期|科目"
+        r"|\bcourses?\b|\bcourse\b|\broster\b|\bterm\b|\bhomework\b"
+        r"|\bHW\d|\bCA\d|ESOE|cool\.ntu|/courses/")
+    CONTEXT_LINES = 3
+
     def _repo_files(self):
         """Files that would actually be published: the git-tracked set.
 
@@ -427,6 +524,91 @@ class TestNoPersonalCourseRoster(unittest.TestCase):
             self.assertIsNone(
                 hit, f"ESOE course code {hit.group(0) if hit else ''!r} in {path}")
 
+    def test_no_student_ids_anywhere(self):
+        """`B` + eight digits is a student id, and it is not a course id."""
+        for path in self._repo_files():
+            src = path.read_text(encoding="utf-8", errors="replace")
+            hit = self.STUDENT_ID_RE.search(src)
+            self.assertIsNone(
+                hit, f"student id {hit.group(0) if hit else ''!r} in {path}")
+
+    def test_no_six_digit_course_codes_anywhere(self):
+        """The handout header carries the course code as six digits with a
+        space in the middle, so the five-digit course-id rule never sees it."""
+        for path in self._repo_files():
+            src = path.read_text(encoding="utf-8", errors="replace")
+            hit = self.COURSE_CODE_RE.search(src)
+            self.assertIsNone(
+                hit, f"course code {hit.group(0) if hit else ''!r} in {path}")
+
+    def test_no_literal_passwords_anywhere(self):
+        """A password pasted into an `authenticate(...)` call is a leak, even
+        when the password is one the course published."""
+        for path in self._repo_files():
+            src = path.read_text(encoding="utf-8", errors="replace")
+            hit = self.PASSWORD_RE.search(src)
+            self.assertIsNone(
+                hit, f"literal password {hit.group(0) if hit else ''!r} in {path}")
+
+    def test_no_course_titles_in_course_context(self):
+        """A course title plus an exam date says whose account this is.
+
+        The same words appear in ordinary prose, so a title only counts when
+        a course-context marker sits within a few lines of it. Without the
+        context window this rule fires on 'the Files tree structure'."""
+        for path in self._repo_files():
+            lines = path.read_text(encoding="utf-8", errors="replace").splitlines()
+            for i, line in enumerate(lines):
+                for rx, label in ((self.CN_TITLE_RE, "course title"),
+                                  (self.EN_TITLE_RE, "course title")):
+                    hit = rx.search(line)
+                    if not hit:
+                        continue
+                    lo = max(0, i - self.CONTEXT_LINES)
+                    hi = min(len(lines), i + self.CONTEXT_LINES + 1)
+                    window = "\n".join(lines[lo:hi])
+                    if not self.CONTEXT_RE.search(window):
+                        continue
+                    self.fail(
+                        f"{label} {hit.group(0)!r} in {path}:{i + 1} "
+                        f"near a course-context marker:\n{line.strip()[:160]}")
+
+    def test_no_identifying_filenames(self):
+        """A filename that names a course's actual coursework identifies the
+        student more directly than a course title does.
+
+        Generic filenames are allowed: 期中座位表.pdf, worksheet.pdf and
+        seating.pdf do not say whose they are."""
+        for path in self._repo_files():
+            src = path.read_text(encoding="utf-8", errors="replace")
+            for i, line in enumerate(src.splitlines(), 1):
+                for match in self.FILENAME_RE.finditer(line):
+                    token = match.group(0)
+                    reason = self._filename_reason(token)
+                    if reason is None:
+                        continue
+                    self.fail(
+                        f"filename {token!r} in {path}:{i} carries {reason}:\n"
+                        f"{line.strip()[:160]}")
+
+    def test_no_room_numbers_in_course_context(self):
+        """A room number is only identifying in a course context; the same
+        digits appear in a port number or a code elsewhere."""
+        for path in self._repo_files():
+            lines = path.read_text(encoding="utf-8", errors="replace").splitlines()
+            for i, line in enumerate(lines):
+                hit = self.ROOM_RE.search(line)
+                if not hit:
+                    continue
+                lo = max(0, i - self.CONTEXT_LINES)
+                hi = min(len(lines), i + self.CONTEXT_LINES + 1)
+                window = "\n".join(lines[lo:hi])
+                if not self.CONTEXT_RE.search(window):
+                    continue
+                self.fail(
+                    f"room {hit.group(0)!r} in {path}:{i + 1} "
+                    f"near a course-context marker:\n{line.strip()[:160]}")
+
 
 class _PagedResponse(_FakeResponse):
     def __init__(self, payload, status=200, next_url=None):
@@ -667,7 +849,7 @@ class TestFetchAssignmentHandouts(unittest.TestCase):
         '<p>see <a class="instructure_file_link" '
         'href="https://cool.ntu.edu.tw/courses/9/files/10140367/download" '
         'data-api-endpoint="https://cool.ntu.edu.tw/api/v1/courses/9/files/10140367" '
-        'data-api-returntype="File">DS_CA3.zip</a></p>'
+        'data-api-returntype="File"><PREFIX>_CA3.zip</a></p>'
     )
 
     def test_finds_the_endpoint_in_the_description(self):