veilrender 0.2.0__tar.gz → 0.3.1__tar.gz

{veilrender-0.2.0 → veilrender-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: veilrender
-Version: 0.2.0
+Version: 0.3.1
 Summary: Headless browser rendering API — self-hostable on HF Spaces, Docker, or bare metal
 Author: Peng Ding
 License-Expression: MIT
@@ -12,9 +12,10 @@ Classifier: Topic :: Internet :: WWW/HTTP
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 Requires-Dist: cloakbrowser>=0.3.0
+Requires-Dist: minio>=7.2.0
 Provides-Extra: dev
-Requires-Dist: ruff>=0.11.0; extra == "dev"
-Requires-Dist: ty>=0.0.1a0; extra == "dev"
+Requires-Dist: ruff==0.15.20; extra == "dev"
+Requires-Dist: ty==0.0.54; extra == "dev"
 Requires-Dist: pytest>=7.0.0; extra == "dev"
 Requires-Dist: pytest-asyncio>=0.21.0; extra == "dev"
 

{veilrender-0.2.0 → veilrender-0.3.1}/pyproject.toml

@@ -18,12 +18,13 @@ classifiers = [
 
 dependencies = [
     "cloakbrowser>=0.3.0",
+    "minio>=7.2.0",
 ]
 
 [project.optional-dependencies]
 dev = [
-    "ruff>=0.11.0",
-    "ty>=0.0.1a0",
+    "ruff==0.15.20",
+    "ty==0.0.54",
     "pytest>=7.0.0",
     "pytest-asyncio>=0.21.0",
 ]
@@ -43,6 +44,7 @@ version = { attr = "veilrender.__version__" }
 
 [tool.setuptools.package-data]
 "veilrender" = ["py.typed"]
+"veilrender.data" = ["blocklist.txt"]
 
 [tool.ruff]
 target-version = "py310"

{veilrender-0.2.0 → veilrender-0.3.1}/src/veilrender/__init__.py

@@ -1,3 +1,3 @@
 """VeilRender — headless browser rendering API."""
 
-__version__ = "0.2.0"
+__version__ = "0.3.1"

{veilrender-0.2.0 → veilrender-0.3.1}/src/veilrender/app.py

@@ -12,6 +12,7 @@ from veilrender.browser import browser_manager
 from veilrender.cdp_proxy import handle_cdp_upgrade, is_websocket_upgrade
 from veilrender.config import settings
 from veilrender.routes import dashboard, health, render, screenshot
+from veilrender.storage import storage_manager
 
 logging.basicConfig(
     level=logging.INFO,
@@ -36,7 +37,9 @@ async def _pipe(source: asyncio.StreamReader, dest: asyncio.StreamReader) -> Non
 
 def create_app() -> App:
     """Create and configure the VeilRender application."""
-    app = App(max_body_size=10 * 1024 * 1024)  # 10 MB
+    app = App(
+        max_body_size=64 * 1024
+    )  # 64 KB — render/screenshot payloads are small JSON
 
     # Register routes
     health.register(app)
@@ -53,6 +56,7 @@ def main() -> None:
 
     async def run_server() -> None:
         await browser_manager.start()
+        await storage_manager.ensure_bucket()
 
         shutdown_event = asyncio.Event()
 

veilrender-0.3.1/src/veilrender/auth.py

@@ -0,0 +1,114 @@
+"""Token-based authentication with IP-based rate limiting.
+
+Failed auth attempts are tracked per IP. After 3 failures within a
+rolling window, the IP is banned for a configurable duration.
+"""
+
+from __future__ import annotations
+
+import logging
+import time
+from collections import defaultdict
+
+from veilrender._vendor.httpserver import HTTPException, Request
+from veilrender.config import settings
+
+logger = logging.getLogger(__name__)
+
+# Fail2ban settings
+_MAX_FAILURES = 3
+_WINDOW_SECONDS = 300  # 5 minute rolling window
+_BAN_SECONDS = 600  # 10 minute ban
+
+# State: per-IP failure timestamps and ban expiry
+_failures: dict[str, list[float]] = defaultdict(list)
+_banned: dict[str, float] = {}
+
+
+def _get_client_ip(request: Request) -> str:
+    """Extract client IP, respecting X-Forwarded-For behind reverse proxy."""
+    forwarded = request.headers.get("x-forwarded-for", "")
+    if forwarded:
+        # Take the first (leftmost) IP — the original client
+        return forwarded.split(",")[0].strip()
+    return request.client_addr[0] if hasattr(request, "client_addr") else "unknown"
+
+
+def _is_banned(ip: str) -> bool:
+    """Check if an IP is currently banned."""
+    ban_until = _banned.get(ip)
+    if ban_until is None:
+        return False
+    if time.monotonic() >= ban_until:
+        del _banned[ip]
+        return False
+    return True
+
+
+def _record_failure(ip: str) -> None:
+    """Record an auth failure and ban if threshold exceeded."""
+    now = time.monotonic()
+
+    # Clean old entries outside the window
+    _failures[ip] = [t for t in _failures[ip] if now - t < _WINDOW_SECONDS]
+    _failures[ip].append(now)
+
+    if len(_failures[ip]) >= _MAX_FAILURES:
+        _banned[ip] = now + _BAN_SECONDS
+        _failures.pop(ip, None)
+        logger.warning(
+            "IP %s banned for %ds after %d auth failures",
+            ip,
+            _BAN_SECONDS,
+            _MAX_FAILURES,
+        )
+
+
+def _clear_failures(ip: str) -> None:
+    """Clear failure history on successful auth."""
+    _failures.pop(ip, None)
+
+
+def verify_token(request: Request) -> None:
+    """Verify the API token from header or query param.
+
+    Checks ``Authorization: Bearer <token>`` header first, then falls
+    back to ``?token=<token>`` query parameter.
+
+    Raises:
+        HTTPException: 403 if IP is banned, 401 if token is invalid,
+            403 if token is missing.
+
+    If ``VEILRENDER_API_TOKEN`` is not configured, auth is disabled.
+    """
+    expected = settings.api_token
+    if expected is None:
+        return
+
+    ip = _get_client_ip(request)
+
+    # Check ban first
+    if _is_banned(ip):
+        raise HTTPException(403, "Temporarily banned due to repeated auth failures")
+
+    # Check Authorization header
+    auth_header = request.headers.get("authorization", "")
+    if auth_header.startswith("Bearer "):
+        token = auth_header[7:].strip()
+        if token == expected:
+            _clear_failures(ip)
+            return
+        _record_failure(ip)
+        raise HTTPException(401, "Invalid token")
+
+    # Check query param
+    token_params = request.query_params.get("token", [])
+    if token_params:
+        if token_params[0] == expected:
+            _clear_failures(ip)
+            return
+        _record_failure(ip)
+        raise HTTPException(401, "Invalid token")
+
+    _record_failure(ip)
+    raise HTTPException(403, "Authentication required")

{veilrender-0.2.0 → veilrender-0.3.1}/src/veilrender/browser.py

@@ -12,6 +12,7 @@ from cloakbrowser import ensure_binary, get_default_stealth_args
 from playwright.async_api import Browser, BrowserContext, Page, async_playwright
 
 from veilrender.config import settings
+from veilrender.filters import load_blocklist, make_route_handler
 
 logger = logging.getLogger(__name__)
 
@@ -34,6 +35,14 @@ class BrowserManager:
         self._semaphore = asyncio.Semaphore(settings.max_concurrent)
         self._lock = asyncio.Lock()
 
+        # Load blocklist once at init if resource filtering is enabled
+        if settings.resource_filter:
+            self._blocklist = load_blocklist(settings.blocked_domains_extra)
+            self._route_handler = make_route_handler(self._blocklist)
+        else:
+            self._blocklist = frozenset()
+            self._route_handler = None
+
     async def start(self) -> None:
         """Launch Chromium with CDP and connect Playwright to it."""
         executable_path = ensure_binary()
@@ -173,6 +182,8 @@ class BrowserManager:
                     user_agent=None,  # use Playwright default
                 )
                 page = await context.new_page()
+                if self._route_handler:
+                    await page.route("**/*", self._route_handler)
                 yield context, page
             finally:
                 if context:

veilrender-0.3.1/src/veilrender/config.py

@@ -0,0 +1,51 @@
+"""Application settings loaded from environment variables."""
+
+from __future__ import annotations
+
+import os
+
+
+class Settings:
+    """Configuration from ``VEILRENDER_*`` environment variables."""
+
+    def __init__(self) -> None:
+        self.api_token: str | None = os.environ.get("VEILRENDER_API_TOKEN")
+        self.port: int = int(os.environ.get("VEILRENDER_PORT", "7860"))
+        self.host: str = os.environ.get("VEILRENDER_HOST", "0.0.0.0")
+        self.timeout: int = int(os.environ.get("VEILRENDER_TIMEOUT", "30000"))
+        self.viewport_width: int = int(
+            os.environ.get("VEILRENDER_VIEWPORT_WIDTH", "1280")
+        )
+        self.viewport_height: int = int(
+            os.environ.get("VEILRENDER_VIEWPORT_HEIGHT", "720")
+        )
+        self.max_concurrent: int = int(os.environ.get("VEILRENDER_MAX_CONCURRENT", "5"))
+        self.resource_filter: bool = (
+            os.environ.get("VEILRENDER_RESOURCE_FILTER", "true").lower() == "true"
+        )
+        _extra = os.environ.get("VEILRENDER_BLOCKED_DOMAINS_EXTRA", "")
+        self.blocked_domains_extra: list[str] = (
+            [d.strip() for d in _extra.split(",") if d.strip()] if _extra else []
+        )
+
+        # Cache settings
+        self.cache_enabled: bool = (
+            os.environ.get("VEILRENDER_CACHE_ENABLED", "false").lower() == "true"
+        )
+        self.cache_ttl: int = int(os.environ.get("VEILRENDER_CACHE_TTL", "86400"))
+        self.cache_l1_maxsize: int = int(
+            os.environ.get("VEILRENDER_CACHE_L1_MAXSIZE", "100")
+        )
+
+        # S3-compatible storage (Cloudflare R2, Oracle Object Storage, etc.)
+        self.s3_endpoint: str | None = os.environ.get("VEILRENDER_S3_ENDPOINT")
+        self.s3_access_key: str | None = os.environ.get("VEILRENDER_S3_ACCESS_KEY")
+        self.s3_secret_key: str | None = os.environ.get("VEILRENDER_S3_SECRET_KEY")
+        self.s3_bucket: str = os.environ.get("VEILRENDER_S3_BUCKET", "veilrender-cache")
+        self.s3_region: str = os.environ.get("VEILRENDER_S3_REGION", "auto")
+        self.s3_secure: bool = (
+            os.environ.get("VEILRENDER_S3_SECURE", "true").lower() == "true"
+        )
+
+
+settings = Settings()