pycloudedge 0.1.7__tar.gz → 0.1.9__tar.gz

{pycloudedge-0.1.7 → pycloudedge-0.1.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pycloudedge
-Version: 0.1.7
+Version: 0.1.9
 Summary: Python library for CloudEdge cameras
 Home-page: https://github.com/fradaloisio/pycloudedge
 Author: Francesco D'Aloisio

{pycloudedge-0.1.7 → pycloudedge-0.1.9}/cloudedge/__init__.py

@@ -22,6 +22,13 @@ from .exceptions import (
     ConfigurationError, NetworkError, ValidationError, RateLimitError
 )
 from .iot_parameters import IOT_PARAMETERS, get_parameter_name, format_parameter_value
+from .stream_profiles import (
+    get_available_live_stream_ids,
+    get_live_stream_profiles,
+    select_default_live_stream_id,
+    select_live_stream_id,
+    supports_adaptive_live_stream,
+)
 
 try:
     from ._version import version as __version__
@@ -50,4 +57,9 @@ __all__ = [
     'decrypt_jpgx3',
     'decrypt_jpgx3_from_url',
     'verify_licence_for_url',
-]
+    'get_available_live_stream_ids',
+    'get_live_stream_profiles',
+    'select_default_live_stream_id',
+    'select_live_stream_id',
+    'supports_adaptive_live_stream',
+]

{pycloudedge-0.1.7 → pycloudedge-0.1.9}/cloudedge/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.1.7'
-__version_tuple__ = version_tuple = (0, 1, 7)
+__version__ = version = '0.1.9'
+__version_tuple__ = version_tuple = (0, 1, 9)
 
-__commit_id__ = commit_id = 'ga9a42e171'
+__commit_id__ = commit_id = None

{pycloudedge-0.1.7 → pycloudedge-0.1.9}/cloudedge/client.py

@@ -17,6 +17,8 @@ import subprocess
 import socket
 import ipaddress
 import logging
+import math
+import tempfile
 from typing import Dict, List, Optional, Union, Any
 from urllib.parse import quote, urlencode
 
@@ -37,10 +39,11 @@ from .iot_parameters import (
 )
 from .constants import (
     CA_KEY, CA_SECRET, DEFAULT_HEADERS, DEFAULT_TIMEOUT,
-    REDIRECT_URL,
+    REDIRECT_URL, SESSION_INVALID_RESULT_CODES,
 )
 from .validators import validate_email, validate_country_code, validate_phone_code
 from .logging_config import get_logger
+from .stream_profiles import extract_stream_capabilities
 from .utils import retry_on_failure
 
 # Device online status values returned by get_device_online_status()
@@ -76,6 +79,7 @@ def _extract_app_streaming_metadata(device: Dict[str, Any]) -> Dict[str, Any]:
         value = device.get(source_key)
         if value not in (None, ""):
             metadata[normalized_key] = value
+    metadata.update(extract_stream_capabilities(device))
     return metadata
 
 
@@ -226,7 +230,7 @@ class CloudEdgeClient:
         on_login=None,
         on_disconnect=None,
         remote: bool = False,
-        video_id: int = 0,
+        video_id: Optional[int] = None,
         manage_stream_switch: bool = True,
     ):
         """Create a native P2P streamer for a CloudEdge camera device."""
@@ -463,6 +467,9 @@ class CloudEdgeClient:
     @retry_on_failure(max_attempts=3, delay=1.0)
     def _make_request(self, method: str, url: str, **kwargs) -> requests.Response:
         """Make HTTP request with retry logic and error handling."""
+        # Never issue a request without a timeout: a hung connection would
+        # otherwise block the caller (and its thread) forever.
+        kwargs.setdefault('timeout', DEFAULT_TIMEOUT)
         try:
             response = self._session.request(method, url, **kwargs)
             response.raise_for_status()
@@ -506,10 +513,15 @@ class CloudEdgeClient:
         iv = "01234567".encode('utf-8')
         
         try:
-            from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
+            from cryptography.hazmat.primitives.ciphers import Cipher, modes
             from cryptography.hazmat.primitives import padding
 
-            algorithm = algorithms.TripleDES(key)
+            try:
+                from cryptography.hazmat.decrepit.ciphers.algorithms import TripleDES
+            except ImportError:  # cryptography < 43
+                from cryptography.hazmat.primitives.ciphers.algorithms import TripleDES
+
+            algorithm = TripleDES(key)
             cipher = Cipher(algorithm, modes.CBC(iv))
             encryptor = cipher.encryptor()
             
@@ -599,25 +611,56 @@ class CloudEdgeClient:
         try:
             with open(self.session_cache_file, 'r') as f:
                 session_data = json.load(f)
-                
-            # Check if session is still valid (not older than 24 hours)
-            login_time = session_data.get('loginTime', 0)
-            if time.time() - login_time > 86400:  # 24 hours
-                self._log("Session cache expired")
+
+            if not isinstance(session_data, dict):
                 return None
-                
+            token = session_data.get("userToken")
+            user_id = session_data.get("userID")
+            if not isinstance(token, str) or not token or not isinstance(user_id, (str, int)) or not user_id:
+                return None
+
+            login_time = session_data.get("loginTime")
+            if (
+                not isinstance(login_time, (int, float))
+                or not math.isfinite(login_time)
+                or not 0 <= time.time() - login_time < 86400
+            ):
+                self._log("Session cache expired or has an invalid timestamp")
+                return None
+
             return session_data
-        except (json.JSONDecodeError, KeyError):
-            self._log("Invalid session cache file")
+        except (json.JSONDecodeError, UnicodeDecodeError, OSError):
+            self._log("Invalid or unreadable session cache file")
             return None
-            
+
     def _save_session_cache(self, session_data: Dict) -> None:
-        """Save session data to cache file."""
+        """Save session data to cache file.
+
+        The cache contains the account session token, so it is written
+        owner-only (0600) and atomically (temp file + rename) so a crash
+        mid-write can never leave a truncated file behind.
+        """
+        cache_dir = os.path.dirname(os.path.abspath(self.session_cache_file))
+        cache_name = os.path.basename(self.session_cache_file)
+        tmp_path: Optional[str] = None
         try:
-            with open(self.session_cache_file, 'w') as f:
+            fd, tmp_path = tempfile.mkstemp(
+                dir=cache_dir,
+                prefix=f".{cache_name}.",
+                suffix=".tmp",
+            )
+            with os.fdopen(fd, 'w', encoding='utf-8') as f:
                 json.dump(session_data, f)
+                f.flush()
+                os.fsync(f.fileno())
+            os.replace(tmp_path, self.session_cache_file)
         except Exception as e:
             self._log(f"Failed to save session cache: {e}")
+            if tmp_path is not None:
+                try:
+                    os.remove(tmp_path)
+                except OSError:
+                    pass
             
     def _discover_endpoints(self) -> None:
         """Call the global redirect API to discover the correct regional server.
@@ -716,19 +759,25 @@ class CloudEdgeClient:
         except Exception as exc:
             raise NetworkError(f"Endpoint discovery failed: {exc}") from exc
 
-    def authenticate(self) -> bool:
+    def authenticate(self, force_refresh: bool = False) -> bool:
         """
         Authenticate with CloudEdge API.
-        
+
+        Args:
+            force_refresh: Skip the cached session and perform a fresh
+                login. Use after the server rejected the cached token
+                (e.g. another device logged into the account): the cache
+                file on disk still looks valid but the session is dead.
+
         Returns:
             bool: True if authentication successful, False otherwise
-            
+
         Raises:
             AuthenticationError: If authentication fails
             NetworkError: If network request fails
         """
         # Try to load cached session first
-        self.session_data = self._load_session_cache()
+        self.session_data = None if force_refresh else self._load_session_cache()
         if self.session_data:
             self._log("Using cached session")
             # Restore discovered endpoints from cache if present
@@ -736,6 +785,13 @@ class CloudEdgeClient:
                 self.BASE_URL = self.session_data["apiServer"]
             if self.session_data.get("openapiServer"):
                 self.OPENAPI_BASE_URL = self.session_data["openapiServer"]
+            # Older caches may predate endpoint discovery. Keep the valid token,
+            # but discover its regional URLs before making authenticated requests.
+            if not self.BASE_URL or not self.OPENAPI_BASE_URL:
+                self._discover_endpoints()
+                self.session_data["apiServer"] = self.BASE_URL
+                self.session_data["openapiServer"] = self.OPENAPI_BASE_URL
+                self._save_session_cache(self.session_data)
             # Fetch MQTT config if not already present in the cached session
             if not self.session_data.get("mqtt"):
                 try:
@@ -1108,6 +1164,14 @@ class CloudEdgeClient:
                 error_msg = response_data.get('resultMsg', 'Unknown error')
                 error_code = response_data.get('resultCode', 'unknown')
                 self._log(f"API error - Code: {error_code}, Message: {error_msg}, Full response: {response_data}")
+                if str(error_code) in SESSION_INVALID_RESULT_CODES:
+                    # The server rejected our token (e.g. the account was
+                    # logged in elsewhere — one active session per account).
+                    # Raise the typed auth error so callers re-authenticate
+                    # instead of retrying forever with a dead session.
+                    raise AuthenticationError(
+                        f"Session rejected by API (Code: {error_code}): {error_msg}"
+                    )
                 raise CloudEdgeError(
                     f"Failed to retrieve homes: {error_msg} (Code: {error_code})",
                     details={"error_code": error_code, "message": error_msg, "response": response_data}
@@ -1205,6 +1269,10 @@ class CloudEdgeClient:
             else:
                 error_msg = response_data.get('resultMsg', 'Unknown error')
                 error_code = response_data.get('resultCode', 'unknown')
+                if str(error_code) in SESSION_INVALID_RESULT_CODES:
+                    raise AuthenticationError(
+                        f"Session rejected by API (Code: {error_code}): {error_msg}"
+                    )
                 raise CloudEdgeError(
                     f"Failed to retrieve home devices: {error_msg}",
                     details={"error_code": error_code, "message": error_msg, "home_id": home_id}
@@ -1240,6 +1308,8 @@ class CloudEdgeClient:
                 self._log(f"Found {len(default_devices)} devices via default home API")
                 all_devices.extend(default_devices)
                 return all_devices
+        except AuthenticationError:
+            raise
         except Exception as e:
             self._log(f"Default home API failed: {e}, trying home-based approach...")
         
@@ -1257,11 +1327,21 @@ class CloudEdgeClient:
                     home_devices = self.get_devices_by_home(home_id)
                     self._log(f"Found {len(home_devices)} devices in home '{home_name}'")
                     all_devices.extend(home_devices)
+                except AuthenticationError:
+                    raise
                 except Exception as e:
-                    self._log(f"Failed to get devices from home '{home_name}': {e}")
+                    # A partial inventory would make callers remove devices
+                    # (and stop streams) during a temporary API outage.
+                    raise CloudEdgeError(
+                        f"Failed to get devices from home '{home_name}': {e}"
+                    ) from e
                     
             return all_devices
-            
+
+        except AuthenticationError:
+            # Must propagate as-is: callers re-authenticate on this type,
+            # wrapping it in CloudEdgeError would hide the recovery signal.
+            raise
         except Exception as e:
             raise CloudEdgeError(f"Failed to get devices from homes: {e}")
             
@@ -1371,6 +1451,10 @@ class CloudEdgeClient:
             else:
                 error_msg = response_data.get('resultMsg', 'Unknown error')
                 error_code = response_data.get('resultCode', 'unknown')
+                if str(error_code) in SESSION_INVALID_RESULT_CODES:
+                    raise AuthenticationError(
+                        f"Session rejected by API (Code: {error_code}): {error_msg}"
+                    )
                 raise CloudEdgeError(
                     f"Failed to retrieve devices: {error_msg}",
                     details={"error_code": error_code, "message": error_msg}
@@ -1936,18 +2020,17 @@ class CloudEdgeClient:
         # First try the get_all_devices method for comprehensive search
         devices = self.get_all_devices()
         
-        # Search for exact match first
-        for device in devices:
-            if device.get('name', '').lower() == device_name.lower():
-                return device
-                
-        # If exact match not found, try partial match
-        for device in devices:
-            if device_name.lower() in device.get('name', '').lower():
-                return device
-                
-        return None
-        
+        name = device_name.lower()
+        matches = [device for device in devices if device.get("name", "").lower() == name]
+        if not matches:
+            matches = [device for device in devices if name in device.get("name", "").lower()]
+        if len(matches) > 1:
+            raise DeviceNotFoundError(
+                f"Device name '{device_name}' is ambiguous; use a unique device name",
+                details={"device_name": device_name, "matches": len(matches)},
+            )
+        return matches[0] if matches else None
+
     def set_device_parameter(
         self,
         device_name: str,

{pycloudedge-0.1.7 → pycloudedge-0.1.9}/cloudedge/constants.py

@@ -31,5 +31,11 @@ DEFAULT_LANGUAGE = "en"
 DEFAULT_TIMEOUT = 30
 PING_TIMEOUT = 2.0
 
+# API result codes that mean the session token was rejected by the server
+# (e.g. the account logged in elsewhere — one active session per account).
+# 1023 observed empirically: valid-looking cached token -> homes API 1023;
+# fresh login -> works.
+SESSION_INVALID_RESULT_CODES = {"1023"}
+
 # Cache settings
 DEFAULT_CACHE_FILE = ".cloudedge_session_cache"

{pycloudedge-0.1.7 → pycloudedge-0.1.9}/cloudedge/mqtt.py

@@ -76,6 +76,9 @@ class CloudEdgeMqttListener:
         on_motion: Callback invoked only for motion-related events.
         on_connect: Called when the MQTT connection is established.
         on_disconnect: Called when the MQTT connection drops.
+        verify_tls: Verify the broker's TLS certificate (default ``True``).
+            Only set ``False`` if your regional broker presents an
+            unverifiable certificate — this exposes the connection to MITM.
     """
 
     def __init__(
@@ -86,6 +89,7 @@ class CloudEdgeMqttListener:
         on_motion: Optional[OnEventCallback] = None,
         on_connect: Optional[Callable[[], None]] = None,
         on_disconnect: Optional[Callable[[], None]] = None,
+        verify_tls: bool = True,
     ) -> None:
         mqtt_cfg = client.get_mqtt_config()
         if not mqtt_cfg:
@@ -109,6 +113,7 @@ class CloudEdgeMqttListener:
 
         self._client: Any = None
         self._connected = False
+        self._verify_tls = verify_tls
 
     @property
     def connected(self) -> bool:
@@ -173,10 +178,7 @@ class CloudEdgeMqttListener:
 
         client.username_pw_set(self._username, self._password)
 
-        ssl_ctx = ssl.create_default_context()
-        ssl_ctx.check_hostname = False
-        ssl_ctx.verify_mode = ssl.CERT_NONE
-        client.tls_set_context(ssl_ctx)
+        client.tls_set_context(self._build_ssl_context())
 
         client.on_connect = _on_connect
         client.on_disconnect = _on_disconnect
@@ -194,6 +196,26 @@ class CloudEdgeMqttListener:
             self._connected = False
             return False
 
+    def _build_ssl_context(self) -> ssl.SSLContext:
+        """Return the TLS context for the broker connection.
+
+        Certificate verification is ON by default: the broker credentials
+        travel over this connection and unverified TLS allows MITM. If a
+        regional broker really presents an unverifiable certificate,
+        construct the listener with ``verify_tls=False`` (a warning is
+        logged); there is no silent automatic downgrade.
+        """
+        ctx = ssl.create_default_context()
+        if not self._verify_tls:
+            _LOGGER.warning(
+                "MQTT TLS certificate verification DISABLED for %s:%s — "
+                "connection is exposed to man-in-the-middle attacks",
+                self._host, self._port,
+            )
+            ctx.check_hostname = False
+            ctx.verify_mode = ssl.CERT_NONE
+        return ctx
+
     def stop(self) -> None:
         """Stop the MQTT background loop and disconnect."""
         if self._client:
@@ -212,7 +234,7 @@ class CloudEdgeMqttListener:
         except (json.JSONDecodeError, UnicodeDecodeError):
             return
 
-        _LOGGER.info("MQTT raw payload: %s", json.dumps(data, default=str)[:2000])
+        _LOGGER.debug("MQTT raw payload: %s", json.dumps(data, default=str)[:2000])
 
         original = data
 
@@ -258,7 +280,7 @@ class CloudEdgeMqttListener:
             if val:
                 extra[field] = str(val)
 
-        _LOGGER.info(
+        _LOGGER.debug(
             "MQTT event: %s  device=%s  motion=%s  url=%s",
             evt_name, device_id, is_motion, bool(extra.get("url")),
         )