siftlode/backend/app/routes/public.py

"""Public, login-free surface for shared download links (the `/watch/{token}` player page).

These routes are deliberately OUTSIDE the auth/`require_human` gate — the unguessable token IS the
credential (a capability URL). They only ever expose one file's stream + minimal metadata, never
the app or any account data. Password-protected links exchange the password once at `/unlock` for
a short-lived signed grant that the media URL carries (a `<video src>` can't send a header).
"""

from fastapi import APIRouter, Depends, Request
from fastapi.responses import FileResponse
from pydantic import BaseModel
from sqlalchemy import select
from sqlalchemy.orm import Session

from app.config import settings
from app.db import get_db
from app.downloads import links as linksmod
from app.downloads import storage
from app.models import DownloadJob, DownloadLink, MediaAsset
from app.ratelimit import RateLimiter, client_key
from app.security import verify_password
from app.refusal import refused
from app.routes._common import not_found

router = APIRouter(prefix="/api/public", tags=["public"])

# Slow password guessing on a link (the token itself is 192-bit, so it needs no throttle). Counted per
# viewer — the link AND the client (`client_key`) — so a client guessing wrong shuts out only itself, and a
# busy link's own unlocks don't count against its next viewer.
_unlock_limit = RateLimiter(max_events=10, window_seconds=300)
# ...under a ceiling on WRONG passwords for the link from every client together, so guessing spread over
# many addresses stays slow too; unlocking with the password never adds to it. The price of the ceiling:
# someone with the link but not its password, guessing from 50 / 10 = 5 networks, can keep the link shut
# for everyone until the window passes. It is checked before the password and counted after it, so guesses
# already running when it fills are still checked — as many as the route's threadpool runs at once.
_unlock_failures = RateLimiter(max_events=50, window_seconds=300)


def _link_or_404(db: Session, token: str) -> DownloadLink:
    link = db.execute(select(DownloadLink).where(DownloadLink.token == token)).scalar_one_or_none()
    if link is None or linksmod.is_expired(link):
        raise refused(404, "link_gone")
    return link


def _ready_target(db: Session, link: DownloadLink) -> tuple[DownloadJob, MediaAsset]:
    job = db.get(DownloadJob, link.job_id)
    asset = db.get(MediaAsset, job.asset_id) if job and job.asset_id else None
    if job is None or asset is None or asset.status != "ready" or not asset.rel_path:
        raise refused(404, "video_gone")
    # Verify the file is actually on disk here (not just flagged ready), so the watch page never
    # loads a player for a missing file — meta and file agree.
    path = storage.safe_abs_path(settings.download_root, asset.rel_path)
    if path is None:
        raise refused(404, "video_gone")
    return job, asset


def _ready_asset(db: Session, link: DownloadLink) -> MediaAsset:
    return _ready_target(db, link)[1]


def _file_url(token: str, grant: str | None = None) -> str:
    base = f"/api/public/watch/{token}/file"
    return f"{base}?g={grant}" if grant else base


def _poster_url(token: str, asset, grant: str | None = None) -> str | None:
    if not asset.poster_path:
        return None
    base = f"/api/public/watch/{token}/poster.jpg"
    return f"{base}?g={grant}" if grant else base


@router.get("/watch/{token}")
def watch_meta(token: str, db: Session = Depends(get_db)) -> dict:
    """Public metadata for the watch page. For a password link, returns only `needs_password`
    until the viewer unlocks it (no title/thumbnail leak)."""
    link = _link_or_404(db, token)
    if link.password_hash:
        return {"needs_password": True}
    job, asset = _ready_target(db, link)
    link.view_count += 1
    db.commit()
    return {
        "needs_password": False,
        **linksmod.public_meta(link, job, asset, _file_url(token), _poster_url(token, asset)),
    }


class WatchUnlockIn(BaseModel):
    password: str = ""


@router.post("/watch/{token}/unlock")
def watch_unlock(
    token: str, body: WatchUnlockIn, request: Request, db: Session = Depends(get_db)
) -> dict:
    """Exchange the link password for a signed grant carried by the media URL."""
    # The link first: a token naming none must leave no limiter entry behind, or posting made-up tokens
    # would grow the limiter without bound.
    link = _link_or_404(db, token)
    viewer = f"{token}|{client_key(request)}"
    if _unlock_failures.exhausted(token) or not _unlock_limit.allow(viewer):
        raise refused(429, "too_many_attempts")
    if not link.password_hash:
        # Not a password link — nothing to unlock; just hand back the plain meta.
        job, asset = _ready_target(db, link)
        return {
            "ok": True,
            "needs_password": False,
            **linksmod.public_meta(link, job, asset, _file_url(token), _poster_url(token, asset)),
        }
    if not verify_password(body.password, link.password_hash):
        _unlock_failures.allow(token)
        raise refused(403, "wrong_share_password")
    job, asset = _ready_target(db, link)
    link.view_count += 1
    db.commit()
    grant = linksmod.make_grant(token, link.password_version)
    return {
        "ok": True,
        "needs_password": False,
        **linksmod.public_meta(
            link, job, asset, _file_url(token, grant), _poster_url(token, asset, grant)
        ),
    }


@router.get("/watch/{token}/file")
def watch_file(token: str, g: str | None = None, db: Session = Depends(get_db)):
    """Range-aware stream of the shared file. Inline by default (plays in the page); an
    `allow_download` link serves it as an attachment. Password links require a valid grant."""
    link = _link_or_404(db, token)
    if link.password_hash and not linksmod.check_grant(token, g, link.password_version):
        raise refused(403, "share_password_required")
    asset = _ready_asset(db, link)
    path = storage.safe_abs_path(settings.download_root, asset.rel_path)
    if path is None:
        raise refused(404, "video_gone")

    filename = storage.download_filename(asset.title or "video", asset.container, path)
    # The served Content-Type comes from the asset's ffprobe-verified media_kind + a container
    # allow-list (storage.served_media_type) — NEVER guessed from the file's own extension. A generic
    # 'file' (and any media whose container we don't positively recognise, e.g. a media/HTML polyglot
    # named "evil.html") returns None → a neutral force-download attachment, so arbitrary uploaded
    # HTML/SVG can't execute inline on this login-free public origin. A recognised media container is
    # served with its real audio/video type, inline unless the link forces a download so it can play
    # in the watch page. Both are range-aware (FileResponse → 206) for seeking/resume.
    media_type = storage.served_media_type(asset.media_kind, asset.container)
    if media_type is None:
        return FileResponse(
            path,
            filename=filename,
            media_type="application/octet-stream",
            content_disposition_type="attachment",
        )
    disposition = "attachment" if link.allow_download else "inline"
    return FileResponse(
        path, filename=filename, media_type=media_type, content_disposition_type=disposition
    )


@router.get("/watch/{token}/poster.jpg")
def watch_poster(token: str, g: str | None = None, db: Session = Depends(get_db)):
    """The generated poster frame for a shared thumbnail-less video (used as the page/video poster
    and the link-preview image). Password links require a valid grant, like the file."""
    link = _link_or_404(db, token)
    if link.password_hash and not linksmod.check_grant(token, g, link.password_version):
        raise refused(403, "share_password_required")
    job, asset = _ready_target(db, link)
    if not asset.poster_path:
        raise not_found("poster")
    path = storage.safe_abs_path(settings.download_root, asset.poster_path)
    if path is None:
        raise not_found("poster")
    return FileResponse(path, media_type="image/jpeg")