mirror of
https://github.com/kuhyx/signal-bot.git
synced 2026-11-11 13:07:51 +01:00
Some checks are pending
CI / check (push) Waiting to run
Send a photo captioned "!add_photo alfa wakacje" in one of the album's own groups and it lands in the pack tagged with both, retrievable through !alfa and the new !losowe immediately -- no restart, and no tagger session on the PC. A label matching nobody becomes a custom tag, and !losowe is the only door to one, which is what keeps a live swap a *data* swap: it can never register a trigger or widen a command's groups. No typed label travels. Labels become pseudonym keys in a new registry arg_resolver, at the dispatcher, before the line that logs the command name -- so no handler, journal entry, command_uses row or reply body ever holds a word somebody typed. The reply is counts and pseudonyms: "dodano · p1: 4 · t1: 1". Stripping is exiftool with a *positive* check on the output, never an exit code. ffmpeg was tried first and fails silently on photos: given a JPEG with a real APP1 Exif segment it returned a byte-identical file, GPS intact, exit 0. The surviving-tag allowlist is per tag *name* rather than per group, because measurement showed a group-level "must be empty" rule rejects every format except JPEG -- a valid PNG always reports its IHDR, an MP4 some fifty QuickTime tags that are the container itself. Codec configuration (CompressorName, VendorID, the HEVC parameter set) is on the list by decision: CompressorName lives in the avc1 sample description and exiftool cannot write it at all, so the alternative was refusing every video and every iPhone HEIC. Location and identity tags are still refused, and the e2e run re-reads the stored files to prove a QuickTime geotag did not survive. .webm and .svg stay on the format allowlist and are stored *unstripped*: exiftool 13.55 can write neither, and its SVG reader does not even surface <metadata>. That is a deliberate, documented hole, not an oversight. Two things this had to defuse along the way: - personal_data_sources now reads custom.json, so "!add_photo kot <photo>" would have outlawed the word "kot" and refused every future commit, fixable only by hand-editing an album the committer cannot see. Minting now refuses a word that is already a command, and the gate subtracts the repo's own alias vocabulary from custom labels only -- curated people.json names are never excused. - signal_bot/external.py is now the single subprocess site in the repository, so ruff's S603 needs exactly one scoped per-file-ignore instead of one per module that shells out. A test asserts nothing else imports subprocess. A failed add changes nothing: media and the three manifests are written, the album is reloaded, and only a load that succeeds is published; a load that fails rolls all four back and keeps serving the pack that was already working, without raising -- Restart=always would turn a ConfigError into a loop. 977 tests, 100% branch coverage, no omits and no suppressions. scripts/e2e.sh gains 8 scenarios driven against the real exiftool on media generated at run time, and asserts the invariants a reply cannot: that a refused upload is not stored, that a message with no attachment leaves custom.json byte-identical, and that signal-cli's own copy of every ingested attachment is gone. Closes TODO-add-photo.md. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JqqE22jp94B1ypwxppdr1o
130 lines
4.9 KiB
Python
130 lines
4.9 KiB
Python
# Copyright (c) 2026 Krzysztof Rudnicki. MIT licence.
|
|
"""The stripper, driven against stub binaries rather than the real exiftool.
|
|
|
|
Stubs, not mocks of ``subprocess``: the thing worth testing is that the gate
|
|
reads the *output back* and refuses on what it finds there, and a stub that
|
|
really writes a file and really prints a report exercises that end to end
|
|
without needing exiftool installed. ``scripts/e2e.sh`` runs the real one.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import stat
|
|
from typing import TYPE_CHECKING
|
|
|
|
import pytest
|
|
|
|
from signal_bot.media_sniff import JPEG, MP4, SVG, WEBM, MediaKind
|
|
from signal_bot.media_strip import ExiftoolStripper
|
|
|
|
if TYPE_CHECKING:
|
|
from pathlib import Path
|
|
|
|
CLEAN_REPORT = """[ExifTool] ExifToolVersion : 13.55
|
|
[File] FileName : out.jpg
|
|
[File] MIMEType : image/jpeg
|
|
[Composite] ImageSize : 48x48
|
|
"""
|
|
|
|
# A geotag as a phone actually writes it into an mp4: a QuickTime atom, which
|
|
# a gate looking only at "GPS" would wave straight through.
|
|
LEAKY_REPORT = """[File] FileName : out.mp4
|
|
[QuickTime] MajorBrand : MP4 Base Media v1
|
|
[QuickTime] GPSCoordinates : 52.2297 21.0122 0
|
|
"""
|
|
|
|
# Lines the parser must simply skip rather than trip over.
|
|
NOISY_REPORT = """Warning: something exiftool felt like saying
|
|
[File] FileName : out.jpg
|
|
|
|
======== out.jpg
|
|
[Composite] ImageSize : 48x48
|
|
"""
|
|
|
|
STUB = """#!/usr/bin/env python3
|
|
import sys
|
|
args = sys.argv[1:]
|
|
if "-all=" in args:
|
|
{strip}
|
|
else:
|
|
sys.stdout.write({report!r})
|
|
sys.exit(0)
|
|
"""
|
|
|
|
|
|
def _stub(tmp_path: Path, name: str, *, strip: str, report: str = CLEAN_REPORT) -> str:
|
|
"""Write an executable stand-in for exiftool and return its path."""
|
|
path = tmp_path / name
|
|
path.write_text(STUB.format(strip=strip, report=report), encoding="utf-8")
|
|
path.chmod(path.stat().st_mode | stat.S_IEXEC)
|
|
return str(path)
|
|
|
|
|
|
COPIES = 'open(args[args.index("-o") + 1], "wb").write(open(args[-1], "rb").read())'
|
|
WRITES_NOTHING = "pass"
|
|
FAILS = "sys.exit(3)"
|
|
|
|
|
|
def test_a_clean_file_comes_back_stripped(tmp_path: Path) -> None:
|
|
stripper = ExiftoolStripper(_stub(tmp_path, "ok", strip=COPIES))
|
|
assert stripper.strip(b"\xff\xd8\xffdata", JPEG) == b"\xff\xd8\xffdata"
|
|
|
|
|
|
def test_a_tag_that_survived_the_strip_refuses_the_upload(tmp_path: Path) -> None:
|
|
"""The whole point: the exit code was 0 and the file is still dirty."""
|
|
stripper = ExiftoolStripper(_stub(tmp_path, "leaky", strip=COPIES, report=LEAKY_REPORT))
|
|
assert stripper.strip(b"\x00\x00\x00\x20ftypmp42", MP4) is None
|
|
|
|
|
|
def test_lines_that_are_not_tags_are_skipped(tmp_path: Path) -> None:
|
|
stripper = ExiftoolStripper(_stub(tmp_path, "noisy", strip=COPIES, report=NOISY_REPORT))
|
|
assert stripper.strip(b"\xff\xd8\xffdata", JPEG) == b"\xff\xd8\xffdata"
|
|
|
|
|
|
def test_a_strip_that_exits_nonzero_stores_nothing(tmp_path: Path) -> None:
|
|
stripper = ExiftoolStripper(_stub(tmp_path, "fails", strip=FAILS))
|
|
assert stripper.strip(b"\xff\xd8\xffdata", JPEG) is None
|
|
|
|
|
|
def test_a_strip_that_writes_no_output_stores_nothing(tmp_path: Path) -> None:
|
|
"""Exit 0 and no file is exactly the shape of the ffmpeg regression."""
|
|
stripper = ExiftoolStripper(_stub(tmp_path, "silent", strip=WRITES_NOTHING))
|
|
assert stripper.strip(b"\xff\xd8\xffdata", JPEG) is None
|
|
|
|
|
|
def test_a_report_that_fails_to_run_stores_nothing(tmp_path: Path) -> None:
|
|
path = tmp_path / "half"
|
|
path.write_text(
|
|
"#!/usr/bin/env python3\n"
|
|
"import sys\n"
|
|
"args = sys.argv[1:]\n"
|
|
'if "-all=" in args:\n'
|
|
' open(args[args.index("-o") + 1], "wb").write(open(args[-1], "rb").read())\n'
|
|
" sys.exit(0)\n"
|
|
"sys.exit(4)\n",
|
|
encoding="utf-8",
|
|
)
|
|
path.chmod(path.stat().st_mode | stat.S_IEXEC)
|
|
assert ExiftoolStripper(str(path)).strip(b"\xff\xd8\xffdata", JPEG) is None
|
|
|
|
|
|
def test_a_missing_binary_refuses_rather_than_raising(tmp_path: Path) -> None:
|
|
stripper = ExiftoolStripper(str(tmp_path / "not-here"))
|
|
assert stripper.strip(b"\xff\xd8\xffdata", JPEG) is None
|
|
|
|
|
|
def test_no_exiftool_at_all_refuses_the_upload(monkeypatch: pytest.MonkeyPatch) -> None:
|
|
"""Never stores it dirty instead: a strip that cannot run is a refusal."""
|
|
monkeypatch.setattr("signal_bot.media_strip.shutil.which", lambda _: None)
|
|
assert ExiftoolStripper().strip(b"\xff\xd8\xffdata", JPEG) is None
|
|
|
|
|
|
@pytest.mark.parametrize("kind", [SVG, WEBM])
|
|
def test_the_two_unwritable_formats_are_stored_as_they_arrived(
|
|
tmp_path: Path, kind: MediaKind
|
|
) -> None:
|
|
"""kuhy's decision of 2026-08-31, and it must not need exiftool at all."""
|
|
stripper = ExiftoolStripper(str(tmp_path / "never-invoked"))
|
|
payload = b"<svg><metadata>a name</metadata></svg>"
|
|
assert stripper.strip(payload, kind) == payload
|