Files
J621/backend/apps/library/serializers.py
T
JakeBreath 16907c39ca Support cross-origin frontends alongside same-origin setups
- django-cors-headers with env-driven CORS_ALLOWED_ORIGINS,
  CORS_ALLOW_ALL_ORIGINS, CORS_ALLOW_CREDENTIALS and CSRF_TRUSTED_ORIGINS;
  same-origin traffic is unaffected and a disallowed origin gets no CORS
  headers. Token auth needs no cookies, so credentials stay off by default.
- TRUST_PROXY_HEADERS=true lets a TLS-terminating proxy supply
  X-Forwarded-Proto/Host for correct absolute URLs.
- API media URLs (raw/thumbnail/upload/similarity/staged previews) are now
  absolute, built from the request host, so <img>/<video>/fetch() keep
  working when the SPA is served from another origin. Signed URLs are still
  per-user; nothing is stored in the DB.
- The SPA gains VITE_API_BASE (build-time, empty = same-origin) applied by
  a small apiUrl() helper used for XHR/fetch and the few URL fallbacks.

Verified with a throwaway instance: preflight and GET responses carry the
allowed origin, foreign origins get nothing, media GETs include CORS for
cross-origin fetch(), and payload URLs use the request host (dev :8000
unchanged).
2026-09-17 22:50:12 -05:00

309 lines
9.0 KiB
Python

import os
from datetime import timedelta
from pathlib import Path
from django.conf import settings
from django.core import signing
from rest_framework import serializers
from .models import (
DownloadTask,
MatchTask,
MediaItem,
MediaLocation,
SimilarityCheck,
TempUpload,
)
from .services import (
MEDIA_FILE_SALT,
UPLOAD_FILE_SALT,
VIDEO_EXTENSIONS,
signed_media_url,
)
class MediaLocationSerializer(serializers.ModelSerializer):
class Meta:
model = MediaLocation
fields = ["id", "path", "rel_path", "mtime"]
class MediaItemSerializer(serializers.ModelSerializer):
tags = serializers.ListField(
child=serializers.CharField(max_length=100), required=False
)
rating = serializers.ChoiceField(choices=["", "s", "q", "e"], required=False)
locations = MediaLocationSerializer(many=True, read_only=True)
j_id = serializers.SerializerMethodField()
display_rating = serializers.SerializerMethodField()
raw_url = serializers.SerializerMethodField()
thumbnail_url = serializers.SerializerMethodField()
filename = serializers.SerializerMethodField()
extension = serializers.SerializerMethodField()
kind = serializers.SerializerMethodField()
uploaded_by = serializers.SerializerMethodField()
uploaded_by_id = serializers.IntegerField(read_only=True)
class Meta:
model = MediaItem
fields = [
"id",
"j_id",
"md5",
"size",
"rating",
"display_rating",
"tags",
"notes",
"filename",
"extension",
"kind",
"raw_url",
"thumbnail_url",
"uploaded_by",
"uploaded_by_id",
"e621_post_id",
"e621_data",
"e621_match_status",
"e621_checked_at",
"locations",
"created_at",
"updated_at",
]
read_only_fields = [
"id",
"j_id",
"md5",
"size",
"display_rating",
"filename",
"extension",
"kind",
"raw_url",
"thumbnail_url",
"uploaded_by",
"uploaded_by_id",
"e621_post_id",
"e621_data",
"e621_match_status",
"e621_checked_at",
"locations",
"created_at",
"updated_at",
]
def _request_user(self):
request = self.context.get("request")
user = getattr(request, "user", None)
if user is None or not getattr(user, "is_authenticated", False):
return None
return user
def get_j_id(self, obj):
return f"J-{obj.id}"
def get_raw_url(self, obj):
return signed_media_url(
obj, self._request_user(), "raw", request=self.context.get("request")
)
def get_thumbnail_url(self, obj):
return signed_media_url(
obj,
self._request_user(),
"thumbnail",
request=self.context.get("request"),
)
def get_display_rating(self, obj):
if obj.rating:
return obj.rating
data = obj.e621_data or {}
rating = data.get("rating") if isinstance(data, dict) else None
return rating if rating in {"s", "q", "e"} else ""
def get_uploaded_by(self, obj):
return obj.uploaded_by.username if obj.uploaded_by else None
def _first_location(self, obj):
locations = list(obj.locations.all())
return locations[0] if locations else None
def get_filename(self, obj):
location = self._first_location(obj)
return os.path.basename(location.rel_path) if location else obj.md5
def get_extension(self, obj):
return os.path.splitext(self.get_filename(obj))[1].lstrip(".").lower()
def get_kind(self, obj):
return "video" if "." + self.get_extension(obj) in VIDEO_EXTENSIONS else "image"
class TempUploadSerializer(serializers.ModelSerializer):
temp_id = serializers.UUIDField(source="id", read_only=True)
library_j_id = serializers.SerializerMethodField()
file_url = serializers.SerializerMethodField()
preview_url = serializers.SerializerMethodField()
class Meta:
model = TempUpload
fields = [
"temp_id",
"original_filename",
"md5",
"size",
"status",
"resolution",
"e621_post_id",
"e621_data",
"custom_rating",
"custom_tags",
"custom_notes",
"iqdb_data",
"visual_matches",
"library_j_id",
"file_url",
"preview_url",
"created_at",
"updated_at",
]
read_only_fields = fields
def _request_user(self):
request = self.context.get("request")
user = getattr(request, "user", None)
if user is None or not getattr(user, "is_authenticated", False):
return None
return user
def get_library_j_id(self, obj):
return f"J-{obj.library_item_id}" if obj.library_item_id else None
def get_file_url(self, obj):
"""Signed URL so <img>/<video> tags can fetch the staged file."""
if not obj.file:
return None
user = self._request_user()
if user is None:
return None
signature = signing.dumps(
{"temp": str(obj.id), "user": user.id},
salt=UPLOAD_FILE_SALT,
)
url = f"/api/uploads/{obj.id}/file/?sig={signature}"
request = self.context.get("request")
return request.build_absolute_uri(url) if request is not None else url
def get_preview_url(self, obj):
"""A URL an <img>/<video> tag can load: staged file or library item."""
user = self._request_user()
if user is None:
return None
if obj.file:
return self.get_file_url(obj)
item = obj.library_item
if item is None:
return None
location = item.locations.first()
is_video = (
location is not None
and Path(location.rel_path).suffix.lower() in VIDEO_EXTENSIONS
)
action = "thumbnail" if is_video else "raw"
return signed_media_url(
item, user, action, request=self.context.get("request")
)
class DownloadTaskSerializer(serializers.ModelSerializer):
task_id = serializers.UUIDField(source="id", read_only=True)
library_j_id = serializers.SerializerMethodField()
class Meta:
model = DownloadTask
fields = [
"task_id",
"post_id",
"filename",
"status",
"progress",
"downloaded",
"total",
"speed",
"error",
"library_j_id",
"created_at",
"updated_at",
]
read_only_fields = fields
def get_library_j_id(self, obj):
return f"J-{obj.library_item_id}" if obj.library_item_id else None
class MatchTaskSerializer(serializers.ModelSerializer):
task_id = serializers.UUIDField(source="id", read_only=True)
class Meta:
model = MatchTask
fields = [
"task_id",
"scope",
"status",
"total",
"processed",
"matched",
"not_found",
"deleted",
"failed",
"error",
"created_at",
"updated_at",
]
read_only_fields = fields
class SimilarityCheckSerializer(serializers.ModelSerializer):
check_id = serializers.UUIDField(source="id", read_only=True)
file_url = serializers.SerializerMethodField()
expires_at = serializers.SerializerMethodField()
class Meta:
model = SimilarityCheck
fields = [
"check_id",
"original_filename",
"md5",
"size",
"file_url",
"results",
"expires_at",
"created_at",
]
read_only_fields = fields
def _request_user(self):
request = self.context.get("request")
user = getattr(request, "user", None)
if user is None or not getattr(user, "is_authenticated", False):
return None
return user
def get_file_url(self, obj):
"""Signed URL so <img> tags can preview the temporary upload."""
user = self._request_user()
if user is None or not obj.file:
return None
signature = signing.dumps(
{"check": str(obj.id), "user": user.id},
salt=UPLOAD_FILE_SALT,
)
url = f"/api/similarity/{obj.id}/file/?sig={signature}"
request = self.context.get("request")
return request.build_absolute_uri(url) if request is not None else url
def get_expires_at(self, obj):
ttl = int(getattr(settings, "SIMILARITY_TTL_MINUTES", 30))
return obj.created_at + timedelta(minutes=ttl)