
    ShH                         d Z ddlZddlZddlZddlZddlmZmZmZm	Z	m
Z
 ddlmZ ddlmZ ddlmZmZmZ  ede      Zd	ed
efdZej1                  d      defd       Zy)a  
media_routes.py

Purpose:
  Serve user-owned images through signed URLs instead of exposing /static/User-photos directly.
  Requires the user to be authenticated and to own the camera the image belongs to.

Routes:
  - GET /media/<token>

Security:
  - Token is an HMAC of the normalized relative path under User-photos using SECRET_KEY
  - No expiry to remain stable; access still requires session auth + ownership check
  - Prevents enumeration of /static/User-photos and direct linking
    N)	Blueprintabort	send_filesessioncurrent_app   )get_db)STATIC_PATH)parse_ts_from_anynormalize_to_static_user_photosresolve_share_tokenmedia_routesdatareturnc                 V    dt        |        dz  z  }t        j                  | |z         S )N=   )lenbase64urlsafe_b64decode)r   paddings     KC:\Users\algun\Documents\ceba web\Ceba - Github\app_modules\media_routes.py_b64url_decoder      s+    c$iZ!^$G##D7N33    z/media/<path:token>tokenc                    d }d}| j                  d      dk(  rCt        |       }|st        d       |\  }}dd l}|j                         |kD  rt        d       d}nt	        j
                  d      }|st        d	       d| vrt        d
       | j                  dd      \  }}	 t        |      j                  d      }t        |      }t        j                  j                  d      xs dj                  d      }	t        j                  |	|j                  d      t         j"                        j%                         }
	 t        |      }t        j&                  |
      st        d       t)        |      \  }}|st        d       t+               }|su|j-                  dt        d   |f      j/                         }|sJ|j-                  dt        d   f      j/                         }|rt1        |d   xs d      dk7  rt        d       t2        j4                  j7                  t8        |      }t2        j4                  j;                  |      }|j=                  t2        j4                  j;                  t8                    st        d
       t2        j4                  j?                  |      st        d       tA        |      }d|jB                  d<   |S # t        $ r t        d
       Y %w xY w# t        $ r t        d
       Y w xY w)NF.   i  r   i  Tuser_idi  i  r   zutf-8
SECRET_KEY i  z5SELECT 1 FROM cameras WHERE user_id=? AND camera_id=?z%SELECT is_admin FROM users WHERE id=?is_adminzprivate, max-age=300zCache-Control)"countr   r   timer   getsplitr   decode	Exceptionr   r   configencodehmacnewhashlibsha256digestcompare_digestr   r	   executefetchoneintospathjoinr
   realpath
startswithexistsr   headers)r   rel	is_publicresolvedexp_tr   b64_relb64_macsecretexpectedprovided_camdbownerrowabs_pathreal_absresps                       r   	media_getrM   #   su    CI {{31&u-#JS779s?#J	 ++i(#Je#J ;;sA.	 )009C .c2$$((6<"DDWM88FCJJw$7HOOQ	%g.H ""8X6#J s#FAsc
	B

RU\]fUgilTmnwwy**DwyGYF[\eegC#c*o23q8c
 ww||K-Hww)Hrww//<=c
77>>(#c
XD$:DLL!KG  	#J	  	#J	s$   #K =K& K#"K#&K>=K>)__doc__r4   r   r+   r-   flaskr   r   r   r   r   rG   r	   pathsr
   helpersr   r   r   __name__bpstrbytesr   routerM    r   r   <module>rX      sp     
    C C   \ \ ~x(4 4 4
 
 >S > !>r   