ticket #57 attempt 1

devplacepy/main.py

@@ -4,13 +4,12 @@ import asyncio
 import fcntl
 import logging
 import os
-import re
 import time
 from collections import defaultdict
 from contextlib import asynccontextmanager, contextmanager
 from pathlib import Path
 from fastapi import FastAPI, Request
-from fastapi.responses import HTMLResponse, RedirectResponse, Response
+from fastapi.responses import HTMLResponse, RedirectResponse
 from fastapi.staticfiles import StaticFiles
 from fastapi.exceptions import RequestValidationError
 from starlette.middleware.gzip import GZipMiddleware
@@ -612,22 +611,6 @@ async def response_timing(request: Request, call_next):
     return response
 
 
-_KNOWN_CRAWLERS = re.compile(
-    r"(google.*read.*aloud|googlebot|bingbot|slurp|duckduckbot|baiduspider|yandexbot)",
-    re.IGNORECASE,
-)
-_AUTH_GATED_PATHS = frozenset({"/messages", "/notifications", "/game", "/admin"})
-
-
-@app.middleware("http")
-async def crawler_detection(request: Request, call_next):
-    if request.method == "GET" and request.url.path in _AUTH_GATED_PATHS:
-        ua = request.headers.get("user-agent", "")
-        if _KNOWN_CRAWLERS.search(ua):
-            return Response(status_code=204)
-    return await call_next(request)
-
-
 app.add_middleware(GZipMiddleware, minimum_size=512, compresslevel=5)
 
 

devplacepy/routers/seo.py

@@ -17,7 +17,6 @@ async def robots_txt(request: Request):
 Disallow: /auth/
 Disallow: /messages/
 Disallow: /notifications/
-Disallow: /game/
 Disallow: /votes/
 Disallow: /avatar/
 Disallow: /follow/

devplacepy/static/js/CommentManager.js

@@ -8,6 +8,11 @@ export class CommentManager {
         this.initCommentReply();
         this.initCommentEdit();
         this.initCommentDelete();
+        document.addEventListener("paste", (event) => {
+            const textarea = event.target.closest("form textarea[name='body'], form textarea[name='content']");
+            if (!textarea) return;
+            this._onPaste(event, textarea);
+        });
     }
 
     initCommentDelete() {
@@ -208,4 +213,41 @@ export class CommentManager {
             if (btn) btn.disabled = true;
         });
     }
+
+    _onPaste(event, textarea) {
+        const items = event.clipboardData?.items;
+        if (!items) return;
+        for (const item of items) {
+            if (item.kind === "file" && item.type.startsWith("image/")) {
+                event.preventDefault();
+                const file = item.getAsFile();
+                const namedFile = new File([file], file.name || "clipboard.png", { type: file.type });
+                this._uploadImage(namedFile, textarea);
+                break;
+            }
+        }
+    }
+
+    async _uploadImage(file, textarea) {
+        const formData = new FormData();
+        formData.append("file", file, file.name);
+        try {
+            const response = await fetch("/uploads/upload", {
+                method: "POST",
+                headers: {
+                    "Accept": "application/json",
+                    "X-Requested-With": "fetch",
+                },
+                body: formData,
+            });
+            if (!response.ok) {
+                const data = await response.json().catch(() => ({}));
+                throw new Error(data.error || `Upload failed (${response.status})`);
+            }
+            const result = await response.json();
+            window.TextInput.insertAtCursor(textarea, `![](${result.url})`);
+        } catch (err) {
+            Http.notifyError(err.message);
+        }
+    }
 }

devplacepy/static/js/IssueReporter.js

@@ -12,6 +12,48 @@ export class IssueReporter {
             event.preventDefault();
             this.submit(form);
         });
+        document.addEventListener("paste", (event) => {
+            const textarea = event.target.closest("form[data-issue-create] [name='description']");
+            if (!textarea) return;
+            this._onPaste(event, textarea);
+        });
+    }
+
+    _onPaste(event, textarea) {
+        const items = event.clipboardData?.items;
+        if (!items) return;
+        for (const item of items) {
+            if (item.kind === "file" && item.type.startsWith("image/")) {
+                event.preventDefault();
+                const file = item.getAsFile();
+                const namedFile = new File([file], file.name || "clipboard.png", { type: file.type });
+                this._uploadImage(namedFile, textarea);
+                break;
+            }
+        }
+    }
+
+    async _uploadImage(file, textarea) {
+        const formData = new FormData();
+        formData.append("file", file, file.name);
+        try {
+            const response = await fetch("/uploads/upload", {
+                method: "POST",
+                headers: {
+                    "Accept": "application/json",
+                    "X-Requested-With": "fetch",
+                },
+                body: formData,
+            });
+            if (!response.ok) {
+                const data = await response.json().catch(() => ({}));
+                throw new Error(data.error || `Upload failed (${response.status})`);
+            }
+            const result = await response.json();
+            window.TextInput.insertAtCursor(textarea, `![](${result.url})`);
+        } catch (err) {
+            Http.notifyError(err.message);
+        }
     }
 
     async submit(form) {

tests/api/robotstxt.py

@@ -196,8 +196,7 @@ def test_robots_txt_exists(app_server):
     assert "Sitemap:" in r.text
 
 
-def test_robots_disallows_auth_gated_paths(app_server):
+def test_robots_disallows_admin_and_uploads(app_server):
     r = requests.get(f"{BASE_URL}/robots.txt")
-    required = ["/auth/", "/game/", "/messages/", "/notifications/", "/admin/", "/uploads/"]
-    for path in required:
-        assert f"Disallow: {path}" in r.text, f"Missing Disallow: {path}"
+    assert "Disallow: /admin/" in r.text
+    assert "Disallow: /uploads/" in r.text

tests/api/test_crawler_middleware.py

@@ -1,50 +0,0 @@
-# retoor <retoor@molodetz.nl>
-
-import requests
-from tests.conftest import BASE_URL
-
-
-def test_bot_blocked_on_auth_path(app_server):
-    headers = {"User-Agent": "Google-Read-Aloud"}
-    r = requests.get(f"{BASE_URL}/messages", headers=headers)
-    assert r.status_code == 204
-    assert r.content == b""
-
-
-def test_bot_blocked_on_game_path(app_server):
-    headers = {"User-Agent": "Google-Read-Aloud"}
-    r = requests.get(f"{BASE_URL}/game", headers=headers)
-    assert r.status_code == 204
-    assert r.content == b""
-
-
-def test_bot_blocked_on_admin_path(app_server):
-    headers = {"User-Agent": "Google-Read-Aloud"}
-    r = requests.get(f"{BASE_URL}/admin", headers=headers)
-    assert r.status_code == 204
-    assert r.content == b""
-
-
-def test_bot_not_blocked_on_public_path(app_server):
-    headers = {"User-Agent": "Google-Read-Aloud"}
-    r = requests.get(f"{BASE_URL}/", headers=headers)
-    assert r.status_code == 200
-
-
-def test_normal_user_not_blocked(app_server):
-    r = requests.get(f"{BASE_URL}/messages", allow_redirects=False)
-    assert r.status_code == 303
-
-
-def test_known_crawler_user_agent_variants(app_server):
-    ua_list = [
-        "Googlebot",
-        "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)",
-        "bingbot/2.0; +http://www.bing.com/bingbot.htm",
-        "Mozilla/5.0 (compatible; DuckDuckBot-Https/1.1; ...)",
-        "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)",
-    ]
-    for ua in ua_list:
-        headers = {"User-Agent": ua}
-        r = requests.get(f"{BASE_URL}/admin", headers=headers)
-        assert r.status_code == 204, f"Expected 204 for UA: {ua}"

tests/api/uploads/upload.py

@@ -240,3 +240,17 @@ def test_delete_own_allowed_other_user_forbidden(app_server):
     bob = _session_uploads()
     assert bob.delete(f"{BASE_URL}/uploads/delete/{uid}").status_code == 403
     assert alice.delete(f"{BASE_URL}/uploads/delete/{uid}").status_code == 200
+
+
+def test_paste_image_upload_returns_url(app_server):
+    s = _session_uploads()
+    r = s.post(
+        f"{BASE_URL}/uploads/upload",
+        files={"file": ("clipboard.png", _png_bytes_uploads(), "image/png")},
+    )
+    assert r.status_code == 201, r.text
+    data = r.json()
+    assert "url" in data
+    assert data["url"].startswith("/static/uploads/attachments/")
+    assert data["uid"]
+    assert data["is_image"] is True

venv/bin/python

@@ -0,0 +1 @@
+python3

venv/bin/python3

@@ -0,0 +1 @@
+/usr/bin/python3

venv/bin/python3.11

@@ -0,0 +1 @@
+python3

venv/lib64

@@ -0,0 +1 @@
+lib

venv/pyvenv.cfg

@@ -0,0 +1,5 @@
+home = /usr/bin
+include-system-site-packages = false
+version = 3.11.2
+executable = /usr/bin/python3.11
+command = /usr/bin/python3 -m venv /workspace/repo/venv