rightra 0.1.0__py3-none-any.whl

rightra/__init__.py

@@ -0,0 +1,30 @@
+"""Rightra server-side helpers for Python.
+
+Public surface:
+
+- Client for the Rightra API.
+- mint_upload_token and verify_upload_token for the PHP upload helper.
+- sign_s3_put and sign_r2_put for direct-to-bucket uploads.
+- RightraError for every failure.
+
+No framework imports. Django and Flask users import the same module.
+"""
+
+from __future__ import annotations
+
+from .client import Client
+from .errors import RightraError
+from .storage import sign_r2_put, sign_s3_put
+from .upload import DEFAULT_TTL as UPLOAD_TOKEN_DEFAULT_TTL
+from .upload import mint_upload_token, verify_upload_token
+
+__version__ = "0.1.0"
+__all__ = [
+    "Client",
+    "RightraError",
+    "UPLOAD_TOKEN_DEFAULT_TTL",
+    "mint_upload_token",
+    "verify_upload_token",
+    "sign_s3_put",
+    "sign_r2_put",
+]

rightra/client.py

@@ -0,0 +1,286 @@
+"""Rightra API client.
+
+Pure urllib. No requests. Every failure raises RightraError.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+import socket
+from typing import Any, Dict, Optional
+from urllib import error as urlerror
+from urllib import request as urlrequest
+
+from .errors import RightraError
+
+_CONTENT_ID_RE = re.compile(r"^RTR-[A-F0-9]{4}-[A-F0-9]{4}$")
+_DEFAULT_BASE = "https://api.oliviuus.com/api/rightra"
+_MAX_BODY = 2 * 1024 * 1024
+
+
+class Client:
+    """Client for the Rightra SDK API.
+
+    Args:
+        api_key: RIGHTRA_API_KEY. Must start with rk_live_ or rk_test_.
+        base_url: API base. Defaults to production.
+        timeout: Per-request timeout in seconds.
+    """
+
+    def __init__(
+        self,
+        api_key: str,
+        *,
+        base_url: str = _DEFAULT_BASE,
+        timeout: float = 30.0,
+    ) -> None:
+        if not isinstance(api_key, str) or not api_key.startswith(("rk_live_", "rk_test_")):
+            raise ValueError("api_key must start with rk_live_ or rk_test_.")
+        if not isinstance(base_url, str) or not base_url.startswith(("http://", "https://")):
+            raise ValueError("base_url must start with http:// or https://.")
+        if not isinstance(timeout, (int, float)) or timeout <= 0:
+            raise ValueError("timeout must be a positive number.")
+
+        self.api_key = api_key
+        self.base_url = base_url.rstrip("/")
+        self.timeout = float(timeout)
+
+    def _request(
+        self,
+        method: str,
+        path: str,
+        *,
+        body: Optional[Dict[str, Any]] = None,
+        stream_to: Optional[str] = None,
+    ) -> Dict[str, Any]:
+        url = f"{self.base_url}{path}"
+        data = None
+        if body is not None:
+            data = json.dumps(body).encode("utf-8")
+            if len(data) > _MAX_BODY:
+                raise ValueError("Request body exceeds the Rightra 2 MB limit.")
+
+        req = urlrequest.Request(url=url, data=data, method=method)
+        req.add_header("Authorization", f"Bearer {self.api_key}")
+        req.add_header("Accept", "application/json")
+        req.add_header("User-Agent", "rightra-python/0.1.0")
+        if data is not None:
+            req.add_header("Content-Type", "application/json")
+
+        try:
+            with urlrequest.urlopen(req, timeout=self.timeout) as resp:
+                if stream_to:
+                    self._stream_to(resp, stream_to)
+                    return {"success": True, "path": stream_to}
+                raw = resp.read()
+                return self._parse(raw, resp.status)
+        except urlerror.HTTPError as exc:
+            raw = b""
+            try:
+                raw = exc.read()
+            except Exception:
+                pass
+            parsed = self._safe_json(raw)
+            code = parsed.get("code") if isinstance(parsed, dict) else None
+            message = (
+                parsed.get("message")
+                if isinstance(parsed, dict) and isinstance(parsed.get("message"), str)
+                else "The Rightra request failed."
+            )
+            raise RightraError(message, status=exc.code, code=code, body=parsed) from None
+        except (urlerror.URLError, socket.timeout, TimeoutError) as exc:
+            reason = getattr(exc, "reason", exc)
+            raise RightraError(
+                "Could not reach the Rightra service.",
+                status=0,
+                code="NETWORK_ERROR",
+                body=str(reason),
+            ) from None
+
+    @staticmethod
+    def _parse(raw: bytes, status: int) -> Dict[str, Any]:
+        if not raw:
+            return {"success": True, "status": status}
+        try:
+            parsed = json.loads(raw.decode("utf-8"))
+        except (UnicodeDecodeError, json.JSONDecodeError):
+            raise RightraError(
+                "The Rightra service returned an invalid response.",
+                status=status,
+                code="INVALID_RESPONSE",
+            ) from None
+        if not isinstance(parsed, dict):
+            raise RightraError(
+                "The Rightra service returned an unexpected response.",
+                status=status,
+                code="INVALID_RESPONSE",
+            )
+        return parsed
+
+    @staticmethod
+    def _safe_json(raw: bytes) -> Any:
+        if not raw:
+            return None
+        try:
+            return json.loads(raw.decode("utf-8"))
+        except Exception:
+            return None
+
+    @staticmethod
+    def _stream_to(resp, dest_path: str) -> None:
+        with open(dest_path, "wb") as handle:
+            while True:
+                chunk = resp.read(64 * 1024)
+                if not chunk:
+                    break
+                handle.write(chunk)
+
+    def register_content(
+        self,
+        *,
+        title: str,
+        type: str,
+        description: Optional[str] = None,
+        creator_name: Optional[str] = None,
+        rights_holder_name: Optional[str] = None,
+        storage_reference: Optional[Dict[str, Any]] = None,
+        encryption: Optional[Dict[str, Any]] = None,
+    ) -> Dict[str, Any]:
+        body: Dict[str, Any] = {"title": title, "type": type}
+        if description is not None:
+            body["description"] = description
+        if creator_name is not None:
+            body["creator_name"] = creator_name
+        if rights_holder_name is not None:
+            body["rights_holder_name"] = rights_holder_name
+        if storage_reference is not None:
+            body["storage_reference"] = storage_reference
+        if encryption is not None:
+            body["encryption"] = encryption
+        return self._request("POST", "/sdk/content", body=body)
+
+    def get_content(self, content_id: str) -> Dict[str, Any]:
+        self._require_content_id(content_id)
+        return self._request("GET", f"/sdk/content/{content_id}")
+
+    def set_encryption_key(
+        self,
+        content_id: str,
+        *,
+        key_material: str,
+        key_algorithm: str = "AES-256-GCM",
+        segment_manifest: Optional[Any] = None,
+    ) -> Dict[str, Any]:
+        self._require_content_id(content_id)
+        body: Dict[str, Any] = {
+            "key_material": key_material,
+            "key_algorithm": key_algorithm,
+        }
+        if segment_manifest is not None:
+            body["segment_manifest"] = segment_manifest
+        return self._request("POST", f"/sdk/content/{content_id}/key", body=body)
+
+    def set_manifest(
+        self,
+        content_id: str,
+        *,
+        manifest_url: str,
+        storage_details: Optional[Dict[str, Any]] = None,
+    ) -> Dict[str, Any]:
+        self._require_content_id(content_id)
+        body: Dict[str, Any] = {"manifest_url": manifest_url}
+        if storage_details is not None:
+            body["storage_reference"] = storage_details
+        return self._request("POST", f"/sdk/content/{content_id}/manifest", body=body)
+
+    def queue_fingerprint(
+        self,
+        content_id: str,
+        *,
+        reference_material: str,
+        reference_type: str = "audio_sample",
+    ) -> Dict[str, Any]:
+        self._require_content_id(content_id)
+        body = {
+            "reference_material": reference_material,
+            "reference_type": reference_type,
+        }
+        return self._request("POST", f"/sdk/content/{content_id}/fingerprint", body=body)
+
+    def create_playback_session(
+        self,
+        content_id: str,
+        *,
+        viewer_id: str,
+        viewer_label: Optional[str] = None,
+        territory: Optional[str] = None,
+        client_public_key: Optional[str] = None,
+        device: Optional[Dict[str, Any]] = None,
+    ) -> Dict[str, Any]:
+        self._require_content_id(content_id)
+        if not isinstance(viewer_id, str) or not viewer_id.strip():
+            raise ValueError("viewer_id is required. Rightra fails closed without it.")
+        viewer: Dict[str, Any] = {"id": viewer_id.strip()}
+        if viewer_label:
+            viewer["label"] = viewer_label
+        body: Dict[str, Any] = {"content_id": content_id, "viewer": viewer}
+        if territory:
+            body["requested_territory"] = territory.upper()[:2]
+        if client_public_key:
+            body["client_public_key"] = client_public_key
+        if device:
+            body["device"] = device
+        return self._request("POST", "/sdk/playback-session", body=body)
+
+    def playback_event(
+        self,
+        *,
+        session_id: str,
+        event: str,
+        seconds_watched: int = 0,
+    ) -> Dict[str, Any]:
+        if not session_id:
+            raise ValueError("session_id is required.")
+        body = {
+            "session_id": session_id,
+            "event": event,
+            "seconds_watched": int(seconds_watched),
+        }
+        return self._request("POST", "/sdk/playback-event", body=body)
+
+    def record_download_attempt(
+        self,
+        *,
+        session_id: str,
+        attempt_type: str = "unknown",
+        details: Optional[Dict[str, Any]] = None,
+    ) -> Dict[str, Any]:
+        if not session_id:
+            raise ValueError("session_id is required.")
+        body: Dict[str, Any] = {"session_id": session_id, "attempt_type": attempt_type}
+        if details is not None:
+            body["details"] = details
+        return self._request("POST", "/sdk/download-attempt", body=body)
+
+    def request_download(self, session_id: str) -> Dict[str, Any]:
+        if not session_id:
+            raise ValueError("session_id is required.")
+        return self._request("POST", "/sdk/download-request", body={"session_id": session_id})
+
+    def download_status(self, job_id: str) -> Dict[str, Any]:
+        if not job_id:
+            raise ValueError("job_id is required.")
+        return self._request("GET", f"/sdk/download-status/{job_id}")
+
+    def download_file(self, job_id: str, dest_path: str) -> Dict[str, Any]:
+        if not job_id:
+            raise ValueError("job_id is required.")
+        if not dest_path:
+            raise ValueError("dest_path is required.")
+        return self._request("GET", f"/sdk/download-file/{job_id}", stream_to=dest_path)
+
+    @staticmethod
+    def _require_content_id(content_id: str) -> None:
+        if not isinstance(content_id, str) or not _CONTENT_ID_RE.match(content_id):
+            raise ValueError("content_id must look like RTR-XXXX-XXXX (uppercase hex).")

rightra/errors.py

@@ -0,0 +1,33 @@
+"""Exception types for the Rightra Python package."""
+
+from __future__ import annotations
+
+from typing import Any, Optional
+
+
+class RightraError(Exception):
+    """Raised for every Rightra failure.
+
+    Attributes:
+        status: HTTP status code. 0 for network or transport failures.
+        code: Rightra error code when the server provided one, else None.
+        message: A sentence safe to show a user.
+        body: Parsed response body when available, else None.
+    """
+
+    def __init__(
+        self,
+        message: str,
+        *,
+        status: int = 0,
+        code: Optional[str] = None,
+        body: Optional[Any] = None,
+    ) -> None:
+        super().__init__(message)
+        self.status = status
+        self.code = code
+        self.message = message
+        self.body = body
+
+    def __repr__(self) -> str:
+        return f"RightraError(status={self.status!r}, code={self.code!r}, message={self.message!r})"

rightra/storage.py

@@ -0,0 +1,166 @@
+"""Presigned PUT URL helpers for S3 and Cloudflare R2.
+
+Pure Python. No boto3, no botocore, no aws-sdk. Signs with SigV4 using
+hmac and hashlib from the standard library.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import hmac
+from datetime import datetime, timezone
+from typing import Dict, Optional
+from urllib.parse import quote, urlencode
+
+_ALGO = "AWS4-HMAC-SHA256"
+_SERVICE = "s3"
+_MAX_EXPIRES = 604800
+
+
+def _hmac(key: bytes, msg: str) -> bytes:
+    return hmac.new(key, msg.encode("utf-8"), hashlib.sha256).digest()
+
+
+def _sha256_hex(data: bytes) -> str:
+    return hashlib.sha256(data).hexdigest()
+
+
+def _validate_expires(expires: int) -> None:
+    if not isinstance(expires, int) or isinstance(expires, bool):
+        raise ValueError("expires must be an integer number of seconds.")
+    if expires <= 0 or expires > _MAX_EXPIRES:
+        raise ValueError(f"expires must be between 1 and {_MAX_EXPIRES} seconds.")
+
+
+def _encode_key(key: str) -> str:
+    return "/".join(quote(segment, safe="-_.~") for segment in key.split("/"))
+
+
+def _signing_key(secret_key: str, date_stamp: str, region: str) -> bytes:
+    k_date = _hmac(("AWS4" + secret_key).encode("utf-8"), date_stamp)
+    k_region = _hmac(k_date, region)
+    k_service = _hmac(k_region, _SERVICE)
+    return _hmac(k_service, "aws4_request")
+
+
+def _build_presigned_url(
+    *,
+    scheme: str,
+    host: str,
+    bucket: str,
+    key: str,
+    access_key: str,
+    secret_key: str,
+    region: str,
+    expires: int,
+    content_type: Optional[str],
+    now: Optional[datetime],
+) -> str:
+    _validate_expires(expires)
+    if not access_key or not secret_key:
+        raise ValueError("access_key and secret_key are required.")
+    if not bucket or not key:
+        raise ValueError("bucket and key are required.")
+
+    moment = (now or datetime.now(timezone.utc)).astimezone(timezone.utc)
+    amz_date = moment.strftime("%Y%m%dT%H%M%SZ")
+    date_stamp = moment.strftime("%Y%m%d")
+
+    canonical_uri = "/" + _encode_key(key)
+    canonical_headers = f"host:{host}\n"
+    signed_headers = "host"
+
+    query: Dict[str, str] = {
+        "X-Amz-Algorithm": _ALGO,
+        "X-Amz-Credential": f"{access_key}/{date_stamp}/{region}/{_SERVICE}/aws4_request",
+        "X-Amz-Date": amz_date,
+        "X-Amz-Expires": str(expires),
+        "X-Amz-SignedHeaders": signed_headers,
+    }
+    if content_type:
+        query["response-content-type"] = content_type
+
+    canonical_query = urlencode(sorted(query.items()), quote_via=quote, safe="-_.~")
+
+    canonical_request = "\n".join(
+        [
+            "PUT",
+            canonical_uri,
+            canonical_query,
+            canonical_headers,
+            signed_headers,
+            "UNSIGNED-PAYLOAD",
+        ]
+    )
+
+    credential_scope = f"{date_stamp}/{region}/{_SERVICE}/aws4_request"
+    string_to_sign = "\n".join(
+        [
+            _ALGO,
+            amz_date,
+            credential_scope,
+            _sha256_hex(canonical_request.encode("utf-8")),
+        ]
+    )
+
+    key_b = _signing_key(secret_key, date_stamp, region)
+    signature = hmac.new(key_b, string_to_sign.encode("utf-8"), hashlib.sha256).hexdigest()
+
+    final_query = canonical_query + "&X-Amz-Signature=" + signature
+    return f"{scheme}://{host}{canonical_uri}?{final_query}"
+
+
+def sign_s3_put(
+    *,
+    access_key: str,
+    secret_key: str,
+    bucket: str,
+    key: str,
+    region: str = "us-east-1",
+    expires: int = 900,
+    content_type: Optional[str] = None,
+    now: Optional[datetime] = None,
+) -> str:
+    """Return a presigned S3 PUT URL."""
+    host = f"{bucket}.s3.{region}.amazonaws.com"
+    return _build_presigned_url(
+        scheme="https",
+        host=host,
+        bucket=bucket,
+        key=key,
+        access_key=access_key,
+        secret_key=secret_key,
+        region=region,
+        expires=expires,
+        content_type=content_type,
+        now=now,
+    )
+
+
+def sign_r2_put(
+    *,
+    account_id: str,
+    access_key: str,
+    secret_key: str,
+    bucket: str,
+    key: str,
+    expires: int = 900,
+    content_type: Optional[str] = None,
+    now: Optional[datetime] = None,
+) -> str:
+    """Return a presigned Cloudflare R2 PUT URL."""
+    if not account_id:
+        raise ValueError("account_id is required for R2.")
+    host = f"{account_id}.r2.cloudflarestorage.com"
+    return _build_presigned_url(
+        scheme="https",
+        host=host,
+        bucket=bucket,
+        key=f"{bucket}/{key}",
+        access_key=access_key,
+        secret_key=secret_key,
+        region="auto",
+        expires=expires,
+        content_type=content_type,
+        now=now,
+    )

rightra/upload.py

@@ -0,0 +1,108 @@
+"""Upload token helpers.
+
+The token format matches the PHP helper (``rightra-upload.php``) and the
+Laravel package (``UploadToken::mint``):
+
+    X-Rightra-Token: <expiry>.<hmac>
+    hmac = HMAC-SHA256("<contentId>|<expiry>", RIGHTRA_UPLOAD_SECRET)
+
+``expiry`` is a unix timestamp. The token is bound to one content id and is
+valid until that timestamp. The master secret never reaches the browser.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import hmac
+import re
+import time
+from typing import Optional
+
+_CONTENT_ID_RE = re.compile(r"^RTR-[A-F0-9]{4}-[A-F0-9]{4}$")
+_TOKEN_RE = re.compile(r"^(\d{9,11})\.([a-f0-9]{64})$")
+
+DEFAULT_TTL = 900
+_MAX_TTL = 86400  # 24 hours. Anything longer is a bug, not a feature.
+
+
+def _require_content_id(content_id: str) -> str:
+    if not isinstance(content_id, str) or not _CONTENT_ID_RE.match(content_id):
+        raise ValueError("content_id must look like RTR-XXXX-XXXX (uppercase hex).")
+    return content_id
+
+
+def _require_secret(secret: str) -> bytes:
+    if not isinstance(secret, str) or not secret:
+        raise ValueError("secret is required to mint or verify upload tokens.")
+    return secret.encode("utf-8")
+
+
+def _sign(content_id: str, expiry: int, secret: bytes) -> str:
+    payload = f"{content_id}|{expiry}".encode("utf-8")
+    return hmac.new(secret, payload, hashlib.sha256).hexdigest()
+
+
+def mint_upload_token(
+    content_id: str,
+    secret: str,
+    *,
+    ttl: int = DEFAULT_TTL,
+    now: Optional[int] = None,
+) -> str:
+    """Return ``"<expiry>.<hmac>"`` for the given content id.
+
+    Args:
+        content_id: A Rightra content id, ``RTR-XXXX-XXXX``.
+        secret: ``RIGHTRA_UPLOAD_SECRET``.
+        ttl: Seconds the token stays valid. Defaults to 900.
+        now: Override the current unix time. Useful in tests.
+
+    Raises:
+        ValueError: If inputs are invalid.
+    """
+    _require_content_id(content_id)
+    secret_b = _require_secret(secret)
+
+    if not isinstance(ttl, int) or isinstance(ttl, bool):
+        raise ValueError("ttl must be an integer.")
+    if ttl <= 0 or ttl > _MAX_TTL:
+        raise ValueError(f"ttl must be between 1 and {_MAX_TTL} seconds.")
+
+    current = int(now if now is not None else time.time())
+    expiry = current + ttl
+    signature = _sign(content_id, expiry, secret_b)
+    return f"{expiry}.{signature}"
+
+
+def verify_upload_token(
+    token: str,
+    content_id: str,
+    secret: str,
+    *,
+    now: Optional[int] = None,
+) -> bool:
+    """Return ``True`` if the token is well formed, unexpired, and signed correctly.
+
+    Uses a constant-time comparison so timing does not leak the expected signature.
+    """
+    if not isinstance(token, str):
+        return False
+    try:
+        _require_content_id(content_id)
+        secret_b = _require_secret(secret)
+    except ValueError:
+        return False
+
+    match = _TOKEN_RE.match(token)
+    if not match:
+        return False
+
+    expiry = int(match.group(1))
+    provided = match.group(2)
+
+    current = int(now if now is not None else time.time())
+    if expiry < current:
+        return False
+
+    expected = _sign(content_id, expiry, secret_b)
+    return hmac.compare_digest(expected, provided)

rightra-0.1.0.dist-info/METADATA

@@ -0,0 +1,130 @@
+Metadata-Version: 2.4
+Name: rightra
+Version: 0.1.0
+Summary: Server-side helpers for Rightra: upload tokens, presigned storage URLs, and the Rightra API client for Django, Flask, and any Python backend.
+Author-email: OLIVIUUS Ltd <contact@oliviuus.com>
+License-Expression: LicenseRef-Proprietary
+Project-URL: Homepage, https://docs.oliviuus.com/rightra/python
+Project-URL: Source, https://github.com/hagenimanasamuel/rightra-python
+Project-URL: Repository, https://github.com/hagenimanasamuel/rightra-python
+Keywords: rightra,oliviuus,drm,watermark,video,django,flask
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Framework :: Django
+Classifier: Framework :: Flask
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# Rightra for Python
+
+Server-side helpers for Rightra, the digital content protection and rights intelligence product by Oliviuus.
+
+This package does the backend side only: mint short-lived upload tokens, sign S3 and R2 uploads, and call the Rightra API from a Django, Flask, or any Python backend. The browser player is loaded from a script tag on the page. It is not part of this package.
+
+Contact: contact@oliviuus.com
+
+## Requirements
+
+- Python 3.9 or newer
+- No runtime dependencies
+
+## Install
+
+    pip install rightra
+
+## Configure
+
+Store these values as environment variables or in your framework settings:
+
+    RIGHTRA_API_KEY=rk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+    RIGHTRA_UPLOAD_SECRET=your-upload-secret
+    RIGHTRA_UPLOAD_TOKEN_TTL=900
+
+RIGHTRA_API_KEY is required. Without it every API call fails closed.
+
+## Upload tokens
+
+The PHP upload helper and the Laravel UploadToken::mint both expect a token in the form <expiry>.<hmac>, where hmac = HMAC-SHA256("<contentId>|<expiry>", RIGHTRA_UPLOAD_SECRET) and expiry is a unix timestamp. The Python helper produces exactly the same string.
+
+    import os
+    import rightra
+
+    token = rightra.mint_upload_token("RTR-853D-52D0", secret=os.environ["RIGHTRA_UPLOAD_SECRET"])
+
+Send the token to your frontend and let the browser send it as the X-Rightra-Token header when it calls rightra-upload.php. The master secret never reaches the browser.
+
+rightra.verify_upload_token(token, content_id, secret) performs the same check the PHP helper does. Use it if you proxy uploads through your own Python backend instead of the PHP helper.
+
+## API client
+
+    import os
+    from rightra import Client
+
+    client = Client(api_key=os.environ["RIGHTRA_API_KEY"])
+
+    created = client.register_content(
+        title="My Film",
+        type="film",
+        description="Feature length film.",
+        creator_name="Example Studio",
+    )
+
+    content_id = created["content"]["content_id"]
+
+    client.set_manifest(
+        content_id,
+        manifest_url="https://your-storage.example/manifest.json",
+    )
+
+    session = client.create_playback_session(
+        content_id,
+        viewer_id=str(request.user.id),
+        viewer_label=request.user.get_full_name(),
+        territory="RW",
+    )
+
+## Presigned uploads
+
+Sign PUT URLs for S3 or R2 without pulling in boto3.
+
+    import os
+    from rightra import sign_s3_put, sign_r2_put
+
+    put_url = sign_s3_put(
+        access_key=os.environ["AWS_ACCESS_KEY_ID"],
+        secret_key=os.environ["AWS_SECRET_ACCESS_KEY"],
+        bucket="my-rightra-bucket",
+        key=f"uploads/{content_id}/seg-0.enc",
+        region="us-east-1",
+    )
+
+    r2_url = sign_r2_put(
+        account_id=os.environ["R2_ACCOUNT_ID"],
+        access_key=os.environ["R2_ACCESS_KEY_ID"],
+        secret_key=os.environ["R2_SECRET_ACCESS_KEY"],
+        bucket="rightra",
+        key=f"uploads/{content_id}/seg-0.enc",
+    )
+
+## Errors
+
+Every failure raises rightra.RightraError. The exception carries .status, .code, and .message. Network errors are wrapped in the same type with .status == 0.
+
+## Framework notes
+
+Django and Flask users import the same module. There is no app context and no settings module lookup. Pass configuration explicitly from your own settings layer so secrets stay in one place.
+
+## Limits
+
+This package does not encrypt or decrypt media. It does not render a player. Those are the browser SDK's job. The Python package is the server side of the same workflow.
+
+## License
+
+Proprietary. Copyright OLIVIUUS Ltd. Contact: contact@oliviuus.com

rightra-0.1.0.dist-info/RECORD

@@ -0,0 +1,11 @@
+rightra/__init__.py,sha256=EWC_uF7Veq1qPCovELLkukpY6raDiWgTnY03fkYZNKE,813
+rightra/client.py,sha256=speqVu55OZlRYR_sxqxe1HAmneEj4Rzgxyv_muwIJnY,10607
+rightra/errors.py,sha256=FJKbpeQXampmpWmbXZyZcvB9z-_0ydPjFZtXTQtWwQE,965
+rightra/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+rightra/storage.py,sha256=tiK7t8OFSd0nTYHYTN_I_vO5ixhOZEcN93ROzAikvgc,4777
+rightra/upload.py,sha256=ABQ3JFfAliQue24Oyo-5vhC9cJXEkbQdIlDQa2iw3LQ,3284
+rightra-0.1.0.dist-info/licenses/LICENSE,sha256=edfpeFBqVonXQAC2-Iz8S-yiCSNlS6d2QemRzCw8LcI,796
+rightra-0.1.0.dist-info/METADATA,sha256=iQOE-Mz33Qc-lG_KS6PxAB2CFcl-0cgL7at9IJp1FrU,4776
+rightra-0.1.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+rightra-0.1.0.dist-info/top_level.txt,sha256=bBFhs6j0mpTp40ZuNCyUr4MecTvH2nbSdekzbzag6ds,8
+rightra-0.1.0.dist-info/RECORD,,

rightra-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

rightra-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,16 @@
+Copyright (c) OLIVIUUS Ltd. All rights reserved.
+
+This software and its source code are proprietary and confidential.
+
+No permission is granted to use, copy, modify, merge, publish, distribute,
+sublicense, or sell copies of this software, in whole or in part, without
+prior written consent from OLIVIUUS Ltd.
+
+Contact: contact@oliviuus.com
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+OLIVIUUS LTD BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

rightra-0.1.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+rightra