5 Commits

Include renames

Author	SHA1	Message	Date
peter	7fce7a7ce5	chore(deps): drop python-multipart -- nothing parses a multipart body now ... Its own entry in requirements.txt said the download center's local-file upload was "the only multipart endpoint in the app". Since that route reads a raw body, the claim is false and the package is dead weight: no route declares File/Form, and nothing calls `request.form()`. Removed from requirements.txt and from its single pinned line in requirements.lock. The lock is generated and normally regenerated wholesale, but a full regeneration would bump every transitive dependency, which has no business riding inside a security fix -- the next legitimate regeneration reproduces exactly this state, since the package is gone from the source. The `multipart` entry in logs.py's third-party level map goes with it: a level for a logger that can no longer exist.	2026-09-22 01:59:09 +02:00
peter	1354f5b503	feat(downloads): a Facebook cookie download stuck at "Cannot parse data" is retried as Chrome ... Measured on dev: with the user's cookie some reels still answer "Cannot parse data" and only extract when the request impersonates Chrome. Impersonation is a second attempt behind that one error, only when a cookie is attached — links that already download with the cookie keep their plain path, and without a cookie the same error is the login wall. curl_cffi is pinned inside yt-dlp's supported range (0.10-0.15; outside it every target silently reports "unavailable"); the lock only gains the new packages. A test fails the gate if the locked pair can no longer impersonate.	2026-09-13 22:48:21 +02:00
peter	fe0b34cd00	feat(downloads): local file upload ingest — media library backend (E7 S5a) ... Add the non-yt-dlp ingest path so a user-uploaded file joins the same download library and inherits its function set. Any file type is accepted: media (video/audio) gets the full set (metadata, share, play/edit), a generic file (pdf/zip/docx/…) is download-only. - MediaAsset.media_kind ("video"|"audio"|"file") — the stored discriminator that gates library actions. Set at every finalize (download probe, editor carries the source's kind, upload probe); consolidates the ad-hoc audio-detect that lived only in links.py into one invariant (downloads.mediakind.derive). Migration 0076 adds the column + backfills existing rows. - downloads/upload.py: ingest_upload probes the file (ffprobe → codecs/dims/duration), places it in a per-user .uploads tree, and creates an already-ready asset + done job (the same cache-hit shortcut enqueue uses). Uploads never expire (irreplaceable). - POST /api/downloads/upload: streaming multipart with the per-file cap (download_upload_max_bytes, default 500 MiB) enforced on actual bytes read; quota charges the known size up front (quota.check_upload). - Security: a generic file is always served force-download (attachment + application/octet-stream) on both the in-app and public endpoints, so uploaded HTML/SVG can't execute inline. Edit + redownload reject non-media / upload sources. - python-multipart added (first multipart endpoint in the app).	2026-08-29 08:02:11 +02:00
peter	8ffa65a9da	fix(security): bump cryptography 46.0.7 -> 50.0.0 to clear 4 CVEs ... The pip-audit step added in E1 S4 flagged cryptography 46.0.7 for PYSEC-2026-3552 /3553/3554 and GHSA-537c-gmf6-5ccf; all are fixed by 50.0.0. The requirements.txt ceiling `<47` was blocking the upgrade — relaxed to `>=50.0.0,<51`. The lock is a surgical bump (only the cryptography line changed; cffi 2.1.1 already satisfies it, no other package moved). pip-audit -r requirements.lock is now clean. Add tests/test_security.py (there was none for the crypto primitives): the Fernet encrypt/decrypt round-trip, decrypt_optional degrading on garbage and on a key mismatch (the B-core-2 path), and the argon2 password hash/verify round-trip — so a future crypto-lib bump can't silently break the token-at-rest path. Gate green: 330 pytest.	2026-08-18 02:47:05 +02:00
peter	44d4e4876d	build(deps): pin a reproducible lock + pip-audit; bump node 20->22 (E1 S4, SEC-5/DX-3) ... requirements.txt stays the source (floor ranges); requirements.lock pins the exact resolved versions (generated in the python:3.12-slim prod base, extras like psycopg-binary/uvloop included). The prod Dockerfile, Dockerfile.test and CI now install the lock, so the image is reproducible and the versions are the ones pip-audit scans. CI gains a non-blocking pip-audit step over the lock. The frontend build + CI move from the EOL node 20 to node 22.	2026-08-18 02:34:45 +02:00