weed-cli 1.8.2__tar.gz → 1.8.4__tar.gz

{weed_cli-1.8.2/weed_cli.egg-info → weed_cli-1.8.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: weed-cli
-Version: 1.8.2
+Version: 1.8.4
 Summary: Censorship-resistant video PoC — discovery/hosting/download over signed relay events, a real Kademlia DHT, or a TLS-capable NAT-traversal tunnel
 License: MIT
 Keywords: p2p,video,censorship-resistant,discovery,dht,kademlia,nat-traversal
@@ -21,6 +21,7 @@ Requires-Dist: pytest>=8.0; extra == "dev"
 Requires-Dist: pytest-cov>=5.0; extra == "dev"
 Requires-Dist: ruff>=0.5; extra == "dev"
 Requires-Dist: pytest-playwright>=0.5; extra == "dev"
+Requires-Dist: weed-cli[dht]; extra == "dev"
 Provides-Extra: dht
 Requires-Dist: kademlia>=2.2; extra == "dht"
 Provides-Extra: qr

{weed_cli-1.8.2 → weed_cli-1.8.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "weed-cli"
-version = "1.8.2"
+version = "1.8.4"
 description = "Censorship-resistant video PoC — discovery/hosting/download over signed relay events, a real Kademlia DHT, or a TLS-capable NAT-traversal tunnel"
 readme = "README.md"
 license = { text = "MIT" }
@@ -45,6 +45,15 @@ dev = [
   # too -- `playwright install chromium`, or point WEED_TEST_CHROMIUM at
   # an existing one (see tests/e2e/conftest.py).
   "pytest-playwright>=0.5",
+  # tests/test_dht.py imports dht.py, which imports kademlia at module
+  # level -- self-referencing the dht extra (not duplicating its version
+  # constraint here) means bumping kademlia's pin in one place stays
+  # enough. Missing this is exactly what broke CI: `pip install -e .[dev]`
+  # alone left kademlia (an otherwise-optional runtime dependency, real
+  # users of plain relay/DHT-less discovery never need it) uninstalled,
+  # so importing dht.py at test collection time raised ModuleNotFoundError
+  # before a single test even ran.
+  "weed-cli[dht]",
 ]
 dht = [
   "kademlia>=2.2",

weed_cli-1.8.4/tests/test_web_ui_api.py

@@ -0,0 +1,273 @@
+"""
+web_ui.py's REST API against a real, isolated WebUIServer instance (see
+conftest.web_server) -- real HTTP requests via the stdlib, same as the
+rest of this codebase's own "no new dependency" convention. Every
+identity/library/hosts file this touches is redirected into tmp_path by
+the isolated_paths fixture web_server depends on; nothing here can ever
+read or write a real ~/.weed_* file.
+"""
+import json
+import os
+import threading
+import urllib.parse
+
+import node
+from testutil import http_get_json, http_post_json, http_post_raw
+
+
+def test_whoami_and_empty_library(web_server):
+    who = http_get_json(f'{web_server}/api/whoami')
+    assert len(who['pubkey']) == 64  # 32-byte Ed25519 pubkey, hex-encoded
+
+    lib = http_get_json(f'{web_server}/api/library')
+    assert lib == {'downloads': [], 'likes': [], 'subscriptions': [], 'playlists': [], 'history': []}
+
+
+def test_like_is_idempotent(web_server):
+    status, resp = http_post_json(f'{web_server}/api/like', {'content_hash': 'c' * 64})
+    assert status == 200
+    for _ in range(3):
+        http_post_json(f'{web_server}/api/like', {'content_hash': 'c' * 64})
+    lib = http_get_json(f'{web_server}/api/library')
+    assert lib['likes'] == ['c' * 64]
+
+
+def test_like_requires_content_hash(web_server):
+    status, resp = http_post_json(f'{web_server}/api/like', {})
+    assert status == 400
+    assert 'content_hash' in resp['error']
+
+
+def test_playlist_create_add_reorder_remove_delete(web_server):
+    status, resp = http_post_json(f'{web_server}/api/playlists/create', {'name': 'My List'})
+    assert status == 200
+    playlist_id = resp['playlist']['id']
+
+    for h in ('a' * 64, 'b' * 64):
+        status, resp = http_post_json(f'{web_server}/api/playlists/add', {
+            'playlist_id': playlist_id, 'content_hash': h, 'title': h[:8],
+        })
+        assert status == 200
+
+    lib = http_get_json(f'{web_server}/api/library')
+    pl = next(p for p in lib['playlists'] if p['id'] == playlist_id)
+    assert [it['content_hash'] for it in pl['items']] == ['a' * 64, 'b' * 64]
+
+    status, _ = http_post_json(f'{web_server}/api/playlists/reorder', {
+        'playlist_id': playlist_id, 'order': ['b' * 64, 'a' * 64],
+    })
+    assert status == 200
+    lib = http_get_json(f'{web_server}/api/library')
+    pl = next(p for p in lib['playlists'] if p['id'] == playlist_id)
+    assert [it['content_hash'] for it in pl['items']] == ['b' * 64, 'a' * 64]
+
+    status, _ = http_post_json(f'{web_server}/api/playlists/remove', {
+        'playlist_id': playlist_id, 'content_hash': 'a' * 64,
+    })
+    assert status == 200
+    lib = http_get_json(f'{web_server}/api/library')
+    pl = next(p for p in lib['playlists'] if p['id'] == playlist_id)
+    assert [it['content_hash'] for it in pl['items']] == ['b' * 64]
+
+    status, _ = http_post_json(f'{web_server}/api/playlists/delete', {'playlist_id': playlist_id})
+    assert status == 200
+    lib = http_get_json(f'{web_server}/api/library')
+    assert lib['playlists'] == []
+
+
+def test_play_requires_content_hash(web_server):
+    status, resp = http_post_json(f'{web_server}/api/play', {})
+    assert status == 400
+
+
+def test_play_bumps_count_and_history_for_a_known_download(web_server):
+    import web_ui
+    web_ui._library['downloads']['c' * 64] = {
+        'content_hash': 'c' * 64, 'job_id': 'job1', 'path': '/tmp/x.mp4',
+        'title': 'X', 'downloaded_at': 0, 'size': 1, 'bps': 1, 'signer_pubkey': None,
+    }
+
+    status, resp = http_post_json(f'{web_server}/api/play', {'content_hash': 'c' * 64, 'title': 'X'})
+    assert status == 200
+    assert resp['play_count'] == 1
+    assert resp['last_played'] is not None
+
+    status, resp = http_post_json(f'{web_server}/api/play', {'content_hash': 'c' * 64, 'title': 'X'})
+    assert resp['play_count'] == 2
+
+    lib = http_get_json(f'{web_server}/api/library')
+    rec = next(d for d in lib['downloads'] if d['content_hash'] == 'c' * 64)
+    assert rec['play_count'] == 2
+    assert len(lib['history']) == 2
+    assert lib['history'][0]['content_hash'] == 'c' * 64  # newest first
+
+
+def test_play_for_unknown_content_hash_still_logs_history_but_no_count(web_server):
+    """A play_count only exists on a downloads record -- playing something
+    that isn't (yet, or ever) in _library['downloads'] shouldn't 500, it
+    just can't report a play_count."""
+    status, resp = http_post_json(f'{web_server}/api/play', {'content_hash': 'z' * 64, 'title': 'Ghost'})
+    assert status == 200
+    assert resp['play_count'] is None
+
+    lib = http_get_json(f'{web_server}/api/library')
+    assert len(lib['history']) == 1
+    assert lib['history'][0]['title'] == 'Ghost'
+
+
+def _upload_url(web_server, name, archive_dir):
+    qs = urllib.parse.urlencode({'name': name, 'archive_dir': archive_dir})
+    return f'{web_server}/api/upload?{qs}'
+
+
+def test_upload_video_produces_a_real_hostable_archive(web_server, tmp_path):
+    """End to end: upload real bytes, then confirm node.py's own
+    manifest/chunk readers (the actual code `host` runs) can load the
+    result back correctly -- not just that the endpoint returned 200."""
+    archive_dir = str(tmp_path / 'archive')
+    data = os.urandom(200_000)
+    status, resp = http_post_raw(_upload_url(web_server, 'clip.mp4', archive_dir), data)
+
+    assert status == 200
+    assert resp['ok'] is True
+    assert resp['name'] == 'clip.mp4'
+    assert len(resp['content_hash']) == 64
+    assert resp['n_chunks'] >= 1
+
+    dest = os.path.join(archive_dir, 'clip.mp4')
+    assert os.path.isfile(dest)
+    assert os.path.getsize(dest) == len(data)
+    assert not os.path.exists(dest + '.uploading')  # tmp file cleaned up
+
+    entries = node.load_manifest_entries(archive_dir)
+    assert len(entries) == 1
+    assert entries[0]['sha256'] == resp['content_hash']
+    leaves = node.load_leaves(archive_dir, resp['content_hash'])
+    assert len(leaves) == resp['n_chunks']
+
+
+def test_upload_appends_correctly_when_existing_manifest_has_no_trailing_newline(web_server, tmp_path):
+    """Real incident, not a hypothetical: an existing manifest.jsonl that
+    doesn't end in a newline (this archive's did not) used to get a new
+    entry appended directly onto the end of the last line via a bare
+    open(path, 'a') -- merging two JSON objects into one unparseable
+    line. node.load_manifest_entries has no per-line error handling, so
+    that one bad line broke reading the *entire* manifest, not just the
+    new upload -- every pre-existing file in the archive became
+    unloadable ("files could not be found") until the manifest was
+    rebuilt from scratch."""
+    archive_dir = tmp_path / 'archive'
+    ott_dir = archive_dir / '.ott'
+    ott_dir.mkdir(parents=True)
+    pre_existing = {'sha256': 'b' * 64, 'name': 'old.mp4', 'orig_path': 'old.mp4',
+                     'last_path': str(archive_dir / 'old.mp4'), 'size': 1,
+                     'added': '2020-01-01T00:00:00Z', 'type': 'video', 'n_chunks': 1, 'chunk_size': 262144}
+    # deliberately no trailing newline -- this is the exact condition that broke it
+    (ott_dir / 'manifest.jsonl').write_text(json.dumps(pre_existing))
+
+    status, resp = http_post_raw(_upload_url(web_server, 'new.mp4', str(archive_dir)), os.urandom(50_000))
+    assert status == 200
+
+    # the real assertion: BOTH entries must still be independently
+    # loadable afterward, old and new alike
+    entries = node.load_manifest_entries(str(archive_dir))
+    names = {e['name'] for e in entries}
+    assert names == {'old.mp4', 'new.mp4'}
+
+
+def test_concurrent_uploads_to_the_same_archive_dont_lose_an_entry(web_server, tmp_path):
+    """Dropping several files at once in the browser fires one upload
+    request per file, concurrently -- all racing to read-modify-write the
+    same manifest.jsonl. Without a lock around that, two requests can
+    both read the same "before" state and whichever writes last wins,
+    silently dropping the other's entry."""
+    archive_dir = str(tmp_path / 'archive')
+    threads = [
+        threading.Thread(target=http_post_raw,
+                          args=(_upload_url(web_server, f'concurrent{i}.mp4', archive_dir), os.urandom(20_000)))
+        for i in range(8)
+    ]
+    for t in threads:
+        t.start()
+    for t in threads:
+        t.join()
+
+    entries = node.load_manifest_entries(archive_dir)
+    assert {e['name'] for e in entries} == {f'concurrent{i}.mp4' for i in range(8)}
+
+
+def test_upload_rejects_non_video_extension(web_server, tmp_path):
+    archive_dir = str(tmp_path / 'archive')
+    status, resp = http_post_raw(_upload_url(web_server, 'notes.txt', archive_dir), b'hello')
+    assert status == 400
+    assert 'not a recognized video extension' in resp['error']
+    assert not os.path.exists(archive_dir)  # never even created
+
+
+def test_upload_sanitizes_path_traversal_in_filename(web_server, tmp_path):
+    archive_dir = str(tmp_path / 'archive')
+    outside_target = tmp_path / 'evil.mp4'
+    status, resp = http_post_raw(
+        _upload_url(web_server, '../evil.mp4', archive_dir), os.urandom(1000))
+    assert status == 200  # basename strips the traversal, so this is just "evil.mp4" inside archive_dir
+    assert resp['name'] == 'evil.mp4'
+    assert not outside_target.exists()  # never escaped archive_dir
+    assert (tmp_path / 'archive' / 'evil.mp4').exists()
+
+
+def test_upload_requires_name_param(web_server, tmp_path):
+    conn_status, resp = http_post_raw(
+        f'{web_server}/api/upload?archive_dir=' + urllib.parse.quote(str(tmp_path)), b'data')
+    assert conn_status == 400
+    assert 'name' in resp['error']
+
+
+def test_upload_defaults_archive_dir_when_omitted(web_server, tmp_path, monkeypatch):
+    """No archive_dir query param at all, and no /share directory present
+    (the bare-metal / dev case) -- falls back to './share', resolved
+    relative to the server process's cwd, which is also this test process
+    (web_server runs in a background thread, not a subprocess) --
+    monkeypatch.chdir into tmp_path first so that resolves somewhere
+    throwaway instead of this repo's own real ./share (which has real,
+    non-test content -- see the repo root). It's extremely unlikely this
+    test machine has a real /share directory, but see
+    test_default_upload_archive_dir_unit below for the Docker-mount-
+    present branch, tested in isolation instead of through a real
+    filesystem write to a faked-out /share."""
+    monkeypatch.chdir(tmp_path)
+    status, resp = http_post_raw(f'{web_server}/api/upload?name=clip.mp4', os.urandom(1000))
+    assert status == 200
+    assert resp['archive_dir'] == './share'
+    assert (tmp_path / 'share' / 'clip.mp4').exists()
+
+
+def test_default_upload_archive_dir_unit(monkeypatch):
+    """web_ui._default_upload_archive_dir() in isolation, covering both
+    branches without ever touching a real filesystem path -- see its own
+    docstring for the real incident (a file archived into /app/share
+    inside the container while the user's /share went on looking empty,
+    fixable only by restarting) that this default exists to prevent."""
+    import web_ui
+    monkeypatch.setattr(os.path, 'isdir', lambda p: p == '/share')
+    assert web_ui._default_upload_archive_dir() == '/share'
+
+    monkeypatch.setattr(os.path, 'isdir', lambda p: False)
+    assert web_ui._default_upload_archive_dir() == './share'
+
+
+def test_cross_origin_post_rejected(web_server):
+    """No auth at all by design (see web_ui.py's module docstring) --
+    Origin-checking is the only thing standing between this and any other
+    open tab silently POSTing here. A request claiming a different Origin
+    must be refused."""
+    status, resp = http_post_json(f'{web_server}/api/like', {'content_hash': 'c' * 64},
+                                   headers={'Origin': 'http://evil.example'})
+    assert status == 403
+
+
+def test_request_with_no_origin_header_is_allowed(web_server):
+    """curl / server-to-server / direct API use never sets Origin -- only
+    a real cross-site browser request does, so a missing header is let
+    through (see web_ui.py's _check_origin docstring)."""
+    status, resp = http_post_json(f'{web_server}/api/like', {'content_hash': 'd' * 64})
+    assert status == 200

{weed_cli-1.8.2 → weed_cli-1.8.4}/tests/testutil.py

@@ -66,6 +66,20 @@ def http_post_json(url, body, headers=None):
         conn.close()
 
 
+def http_post_raw(url, data, headers=None):
+    """For /api/upload -- the body is the raw file bytes, not JSON."""
+    conn_host, conn_port, path = _split_url(url)
+    conn = http.client.HTTPConnection(conn_host, conn_port, timeout=15)
+    try:
+        h = {'Content-Type': 'application/octet-stream'}
+        h.update(headers or {})
+        conn.request('POST', path, body=data, headers=h)
+        resp = conn.getresponse()
+        return resp.status, json.loads(resp.read().decode())
+    finally:
+        conn.close()
+
+
 def _split_url(url):
     # http.client wants (host, port) and a bare path, not a full URL
     assert url.startswith('http://')

{weed_cli-1.8.2 → weed_cli-1.8.4}/web_ui.py

@@ -14,6 +14,7 @@ already apply elsewhere in this repo). Pass --bind to expose it on a LAN
 at your own risk.
 """
 import contextlib
+import hashlib
 import io
 import json
 import mimetypes
@@ -184,6 +185,23 @@ def _save_persisted_hosts():
     os.replace(tmp, HOSTS_PATH)
 
 
+def _default_upload_archive_dir():
+    """/share only exists as a real directory when running inside the
+    Docker image built from Dockerfile.node -- docker-compose.node.yml
+    bind-mounts the host's archive there, and its own comments tell the
+    user to type /share into this exact form field. Defaulting an
+    omitted archive_dir to the relative './share' instead would land an
+    upload in this process's cwd (/app inside that container), a
+    directory nobody else is looking at: the file would archive fine,
+    but every subsequent /api/host call against the /share the user
+    actually typed would report "no archived file found", with no
+    restart able to fix it since the file was never in /share to begin
+    with. Outside Docker, /share won't exist and this falls back to
+    './share', matching docker-compose.node.yml's own default bind-mount
+    source on the host side."""
+    return '/share' if os.path.isdir('/share') else './share'
+
+
 def _remember_host(archive_dir, file_name, port, price, relay_urls, advertise_host, tunnel, ln_node):
     key = f'{archive_dir}|{file_name}|{port}'
     _persisted_hosts[key] = {
@@ -578,6 +596,21 @@ class Handler(BaseHTTPRequestHandler):
         if not self._check_origin():
             return self._json({'error': 'rejected: request Origin does not match this server — '
                                          'looks like a cross-site request, not this UI'}, status=403)
+
+        # Not a JSON-body endpoint like everything else here -- the body
+        # *is* the raw file being uploaded (see _handle_upload's own
+        # docstring for why: no multipart/form-data parser exists in the
+        # stdlib, and this repo's own "no new dependency" rule already
+        # ruled one out elsewhere). Handled before _read_json_body ever
+        # runs, since that would try to json.loads() raw video bytes and
+        # fail every single upload with a confusing "bad JSON body" error
+        # before this endpoint's own code ever ran.
+        if path == '/api/upload':
+            try:
+                return self._handle_upload()
+            except Exception as e:
+                return self._json({'error': f'{type(e).__name__}: {e}'}, status=400)
+
         try:
             body = self._read_json_body()
         except Exception as e:
@@ -602,6 +635,136 @@ class Handler(BaseHTTPRequestHandler):
         except Exception as e:
             self._json({'error': f'{type(e).__name__}: {e}'}, status=400)
 
+    def _handle_upload(self):
+        """POST /api/upload?name=<file>&archive_dir=<dir> -- the file's raw
+        bytes as the whole request body (application/octet-stream, not
+        multipart/form-data: there's no multipart parser in the stdlib,
+        and pulling in a dependency just for this is exactly the kind of
+        thing this file's own module docstring already rules out
+        elsewhere). Streams straight to disk in fixed-size chunks rather
+        than reading the whole body into memory first -- fine for a
+        JSON API's few-KB bodies, not for a multi-GB video.
+
+        Archives it immediately (chunks + a real manifest.jsonl entry,
+        the exact on-disk shape node.load_manifest_entries/load_leaves
+        already read) so it's hostable the moment the upload finishes,
+        with no separate `ott add` step -- same reasoning as the rest of
+        this UI existing at all: don't make someone learn a second tool
+        just to do the thing this one already knows how to do.
+        Video-only, matching ott's own is_video() -- a non-video upload
+        would just be a manifest entry that can never actually be
+        hosted (see load_manifest_entries' own video-only filter, added
+        after exactly that silently broke `host` for everything else in
+        the same archive_dir), so it's rejected up front instead."""
+        from ott import is_video, chunk_hashes, merkle_root, OttStore
+
+        qs = parse_qs(urlparse(self.path).query)
+        raw_name = (qs.get('name') or [''])[0]
+        archive_dir = (qs.get('archive_dir') or [None])[0] or _default_upload_archive_dir()
+        if not raw_name:
+            return self._json({'error': 'name query param required'}, status=400)
+
+        # basename only -- '..' or an absolute path in the filename
+        # can't escape archive_dir this way
+        safe_name = os.path.basename(raw_name)
+        if not safe_name or safe_name in ('.', '..'):
+            return self._json({'error': f'invalid file name: {raw_name!r}'}, status=400)
+
+        if not is_video(safe_name):
+            return self._json(
+                {'error': f'{safe_name}: not a recognized video extension -- only video '
+                           'files can be hosted (see ott.is_video)'}, status=400)
+
+        archive_dir = os.path.expanduser(archive_dir)
+        os.makedirs(archive_dir, exist_ok=True)
+        dest_path = os.path.join(archive_dir, safe_name)
+
+        length = int(self.headers.get('Content-Length', 0))
+        if length <= 0:
+            return self._json({'error': 'empty upload'}, status=400)
+
+        # write to a temp name and os.replace at the end, same reasoning
+        # as _save_library's own tmp-file-then-replace: a client
+        # disconnecting mid-upload (closed laptop lid, flaky wifi) must
+        # not leave a truncated file sitting at the real destination
+        # name, silently masquerading as a complete one later.
+        tmp_path = dest_path + '.uploading'
+        written = 0
+        try:
+            with open(tmp_path, 'wb') as f:
+                remaining = length
+                while remaining > 0:
+                    chunk = self.rfile.read(min(1024 * 1024, remaining))
+                    if not chunk:
+                        break
+                    f.write(chunk)
+                    written += len(chunk)
+                    remaining -= len(chunk)
+        except Exception:
+            if os.path.exists(tmp_path):
+                os.remove(tmp_path)
+            raise
+        if written != length:
+            os.remove(tmp_path)
+            return self._json(
+                {'error': f'incomplete upload ({written:,}/{length:,} bytes) -- connection dropped?'},
+                status=400)
+        os.replace(tmp_path, dest_path)
+
+        ott_dir = os.path.join(archive_dir, '.ott')
+        os.makedirs(os.path.join(ott_dir, 'chunks'), exist_ok=True)
+        chunk_size = OttStore(ott_dir).chunk_size
+        chunks = chunk_hashes(dest_path, chunk_size)
+        digest = merkle_root(chunks) if chunks else hashlib.sha256(b'').hexdigest()
+        entry = {
+            'sha256': digest, 'name': safe_name, 'orig_path': safe_name, 'last_path': dest_path,
+            'size': written, 'added': time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime()),
+            'type': 'video', 'n_chunks': len(chunks), 'chunk_size': chunk_size,
+        }
+
+        # _lock (not just for _jobs/_hosts/_library, see its own comment
+        # up top -- this is the same "one file, must not be torn by two
+        # threads at once" concern) since dropping several files at once
+        # in the browser fires one of these per file, concurrently, and
+        # every one of them touches this *same* manifest.jsonl.
+        #
+        # tmp-file-then-os.replace, not a bare open(path, 'a') -- a real
+        # incident: appending blindly assumes the file already ends with
+        # a newline, and it didn't. That merged this entry onto the end
+        # of the previous line into one unparseable JSON blob, and
+        # load_manifest_entries' `[json.loads(line) for line in f]` has
+        # no per-line error handling -- one bad line raises and the
+        # *entire* manifest fails to load, which is exactly "files could
+        # not be found" for everything in the archive, not just the new
+        # upload. Reading the whole file, normalizing a missing trailing
+        # newline, and writing the result to a temp file before
+        # replacing the original atomically (same pattern _save_library
+        # already uses) can't leave a half-written or malformed file on
+        # disk no matter when a crash or a second concurrent request
+        # lands, and fixes the missing-newline case outright instead of
+        # just avoiding making it worse.
+        chunks_path = os.path.join(ott_dir, 'chunks', f'{digest}.json')
+        manifest_path = os.path.join(ott_dir, 'manifest.jsonl')
+        with _lock:
+            chunks_tmp = chunks_path + '.tmp'
+            with open(chunks_tmp, 'w') as f:
+                json.dump(chunks, f)
+            os.replace(chunks_tmp, chunks_path)
+
+            existing = ''
+            if os.path.exists(manifest_path):
+                with open(manifest_path) as f:
+                    existing = f.read()
+            if existing and not existing.endswith('\n'):
+                existing += '\n'
+            manifest_tmp = manifest_path + '.tmp'
+            with open(manifest_tmp, 'w') as f:
+                f.write(existing + json.dumps(entry) + '\n')
+            os.replace(manifest_tmp, manifest_path)
+
+        self._json({'ok': True, 'name': safe_name, 'content_hash': digest,
+                     'size': written, 'n_chunks': len(chunks), 'archive_dir': archive_dir})
+
     def _handle_host(self, body):
         archive_dir = body.get('archive_dir')
         if not archive_dir:

{weed_cli-1.8.2 → weed_cli-1.8.4/weed_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: weed-cli
-Version: 1.8.2
+Version: 1.8.4
 Summary: Censorship-resistant video PoC — discovery/hosting/download over signed relay events, a real Kademlia DHT, or a TLS-capable NAT-traversal tunnel
 License: MIT
 Keywords: p2p,video,censorship-resistant,discovery,dht,kademlia,nat-traversal
@@ -21,6 +21,7 @@ Requires-Dist: pytest>=8.0; extra == "dev"
 Requires-Dist: pytest-cov>=5.0; extra == "dev"
 Requires-Dist: ruff>=0.5; extra == "dev"
 Requires-Dist: pytest-playwright>=0.5; extra == "dev"
+Requires-Dist: weed-cli[dht]; extra == "dev"
 Provides-Extra: dht
 Requires-Dist: kademlia>=2.2; extra == "dht"
 Provides-Extra: qr

{weed_cli-1.8.2 → weed_cli-1.8.4}/weed_cli.egg-info/requires.txt

@@ -6,6 +6,7 @@ pytest>=8.0
 pytest-cov>=5.0
 ruff>=0.5
 pytest-playwright>=0.5
+weed-cli[dht]
 
 [dht]
 kademlia>=2.2

weed_cli-1.8.2/tests/test_web_ui_api.py

@@ -1,127 +0,0 @@
-"""
-web_ui.py's REST API against a real, isolated WebUIServer instance (see
-conftest.web_server) -- real HTTP requests via the stdlib, same as the
-rest of this codebase's own "no new dependency" convention. Every
-identity/library/hosts file this touches is redirected into tmp_path by
-the isolated_paths fixture web_server depends on; nothing here can ever
-read or write a real ~/.weed_* file.
-"""
-from testutil import http_get_json, http_post_json
-
-
-def test_whoami_and_empty_library(web_server):
-    who = http_get_json(f'{web_server}/api/whoami')
-    assert len(who['pubkey']) == 64  # 32-byte Ed25519 pubkey, hex-encoded
-
-    lib = http_get_json(f'{web_server}/api/library')
-    assert lib == {'downloads': [], 'likes': [], 'subscriptions': [], 'playlists': [], 'history': []}
-
-
-def test_like_is_idempotent(web_server):
-    status, resp = http_post_json(f'{web_server}/api/like', {'content_hash': 'c' * 64})
-    assert status == 200
-    for _ in range(3):
-        http_post_json(f'{web_server}/api/like', {'content_hash': 'c' * 64})
-    lib = http_get_json(f'{web_server}/api/library')
-    assert lib['likes'] == ['c' * 64]
-
-
-def test_like_requires_content_hash(web_server):
-    status, resp = http_post_json(f'{web_server}/api/like', {})
-    assert status == 400
-    assert 'content_hash' in resp['error']
-
-
-def test_playlist_create_add_reorder_remove_delete(web_server):
-    status, resp = http_post_json(f'{web_server}/api/playlists/create', {'name': 'My List'})
-    assert status == 200
-    playlist_id = resp['playlist']['id']
-
-    for h in ('a' * 64, 'b' * 64):
-        status, resp = http_post_json(f'{web_server}/api/playlists/add', {
-            'playlist_id': playlist_id, 'content_hash': h, 'title': h[:8],
-        })
-        assert status == 200
-
-    lib = http_get_json(f'{web_server}/api/library')
-    pl = next(p for p in lib['playlists'] if p['id'] == playlist_id)
-    assert [it['content_hash'] for it in pl['items']] == ['a' * 64, 'b' * 64]
-
-    status, _ = http_post_json(f'{web_server}/api/playlists/reorder', {
-        'playlist_id': playlist_id, 'order': ['b' * 64, 'a' * 64],
-    })
-    assert status == 200
-    lib = http_get_json(f'{web_server}/api/library')
-    pl = next(p for p in lib['playlists'] if p['id'] == playlist_id)
-    assert [it['content_hash'] for it in pl['items']] == ['b' * 64, 'a' * 64]
-
-    status, _ = http_post_json(f'{web_server}/api/playlists/remove', {
-        'playlist_id': playlist_id, 'content_hash': 'a' * 64,
-    })
-    assert status == 200
-    lib = http_get_json(f'{web_server}/api/library')
-    pl = next(p for p in lib['playlists'] if p['id'] == playlist_id)
-    assert [it['content_hash'] for it in pl['items']] == ['b' * 64]
-
-    status, _ = http_post_json(f'{web_server}/api/playlists/delete', {'playlist_id': playlist_id})
-    assert status == 200
-    lib = http_get_json(f'{web_server}/api/library')
-    assert lib['playlists'] == []
-
-
-def test_play_requires_content_hash(web_server):
-    status, resp = http_post_json(f'{web_server}/api/play', {})
-    assert status == 400
-
-
-def test_play_bumps_count_and_history_for_a_known_download(web_server):
-    import web_ui
-    web_ui._library['downloads']['c' * 64] = {
-        'content_hash': 'c' * 64, 'job_id': 'job1', 'path': '/tmp/x.mp4',
-        'title': 'X', 'downloaded_at': 0, 'size': 1, 'bps': 1, 'signer_pubkey': None,
-    }
-
-    status, resp = http_post_json(f'{web_server}/api/play', {'content_hash': 'c' * 64, 'title': 'X'})
-    assert status == 200
-    assert resp['play_count'] == 1
-    assert resp['last_played'] is not None
-
-    status, resp = http_post_json(f'{web_server}/api/play', {'content_hash': 'c' * 64, 'title': 'X'})
-    assert resp['play_count'] == 2
-
-    lib = http_get_json(f'{web_server}/api/library')
-    rec = next(d for d in lib['downloads'] if d['content_hash'] == 'c' * 64)
-    assert rec['play_count'] == 2
-    assert len(lib['history']) == 2
-    assert lib['history'][0]['content_hash'] == 'c' * 64  # newest first
-
-
-def test_play_for_unknown_content_hash_still_logs_history_but_no_count(web_server):
-    """A play_count only exists on a downloads record -- playing something
-    that isn't (yet, or ever) in _library['downloads'] shouldn't 500, it
-    just can't report a play_count."""
-    status, resp = http_post_json(f'{web_server}/api/play', {'content_hash': 'z' * 64, 'title': 'Ghost'})
-    assert status == 200
-    assert resp['play_count'] is None
-
-    lib = http_get_json(f'{web_server}/api/library')
-    assert len(lib['history']) == 1
-    assert lib['history'][0]['title'] == 'Ghost'
-
-
-def test_cross_origin_post_rejected(web_server):
-    """No auth at all by design (see web_ui.py's module docstring) --
-    Origin-checking is the only thing standing between this and any other
-    open tab silently POSTing here. A request claiming a different Origin
-    must be refused."""
-    status, resp = http_post_json(f'{web_server}/api/like', {'content_hash': 'c' * 64},
-                                   headers={'Origin': 'http://evil.example'})
-    assert status == 403
-
-
-def test_request_with_no_origin_header_is_allowed(web_server):
-    """curl / server-to-server / direct API use never sets Origin -- only
-    a real cross-site browser request does, so a missing header is let
-    through (see web_ui.py's _check_origin docstring)."""
-    status, resp = http_post_json(f'{web_server}/api/like', {'content_hash': 'd' * 64})
-    assert status == 200