<data> [name] Create thread\n"
- " reply <node_id> <data> [name] Reply to node\n"
- " edit <node_id> <data> Edit a node\n"
- " disable <node_id> Disable a node\n"
- " enable <node_id> Enable a node\n"
- " approve <node_id> Approve a node\n"
- " lock <node_id> Lock a thread\n"
- " unlock <node_id> Unlock a thread\n"
- " delete <node_id> Delete a node\n"
- " login <email> Request OTP\n"
- " verify <email> <otp> Verify OTP\n"
- " profile Show current user\n"
- "\n"
- "Examples:\n"
- " rb https://my.remarkbox.com threads meta.remarkbox.com\n"
- " rb threads meta.remarkbox.com # uses REMARKBOX_URL\n"
- " rb login user@example.com\n"
- " rb verify user@example.com 123456\n"
- " rb post meta.remarkbox.com \"Title\" \"Body\" MyBot\n"
- "\n"
- "Compile: gcc rb.c -o rb -lcurl\n"
- "\n", CLI_VERSION);
-}
-
-/* Run a command, print the response, return exit code. */
-static int run(rb_response_t r)
-{
- if (r.body && r.body_len > 0)
- rb_json_pretty(r.body);
- int rc = r.ok ? 0 : 1;
- rb_response_free(&r);
- return rc;
-}
-
-int main(int argc, char *argv[])
-{
- const char *base_uri;
- int cmd_start;
-
- if (argc < 2) { usage(); return 1; }
-
- /* Determine if first arg is a URI or a command */
- if (strncmp(argv[1], "http://", 7) == 0 || strncmp(argv[1], "https://", 8) == 0) {
- base_uri = argv[1];
- cmd_start = 2;
- } else {
- base_uri = getenv("REMARKBOX_URL");
- if (!base_uri || !*base_uri) {
- fprintf(stderr, "rb: no URI provided and REMARKBOX_URL not set\n");
- return 1;
- }
- cmd_start = 1;
- }
-
- if (cmd_start >= argc) { usage(); return 1; }
-
- curl_global_init(CURL_GLOBAL_DEFAULT);
-
- rb_client_t *c = rb_client_new(base_uri, NULL);
- const char *cmd = argv[cmd_start];
- int nargs = argc - cmd_start - 1;
- char **args = argv + cmd_start + 1;
- int rc = 1;
-
- if (strcmp(cmd, "version") == 0) {
- rc = run(rb_version(c));
- } else if (strcmp(cmd, "threads") == 0 && nargs >= 1) {
- rc = run(rb_list_threads(c, args[0]));
- } else if (strcmp(cmd, "thread") == 0 && nargs >= 1) {
- rc = run(rb_get_thread(c, args[0]));
- } else if (strcmp(cmd, "search") == 0 && nargs >= 2) {
- rc = run(rb_search_threads(c, args[0], args[1]));
- } else if (strcmp(cmd, "node") == 0 && nargs >= 1) {
- rc = run(rb_get_node(c, args[0]));
- } else if (strcmp(cmd, "post") == 0 && nargs >= 3) {
- rc = run(rb_create_thread(c, args[0], args[1], args[2],
- nargs >= 4 ? args[3] : NULL));
- } else if (strcmp(cmd, "reply") == 0 && nargs >= 2) {
- rc = run(rb_reply(c, args[0], args[1], nargs >= 3 ? args[2] : NULL));
- } else if (strcmp(cmd, "edit") == 0 && nargs >= 2) {
- rc = run(rb_edit_node(c, args[0], args[1]));
- } else if (strcmp(cmd, "disable") == 0 && nargs >= 1) {
- rc = run(rb_disable_node(c, args[0]));
- } else if (strcmp(cmd, "enable") == 0 && nargs >= 1) {
- rc = run(rb_enable_node(c, args[0]));
- } else if (strcmp(cmd, "approve") == 0 && nargs >= 1) {
- rc = run(rb_approve_node(c, args[0]));
- } else if (strcmp(cmd, "lock") == 0 && nargs >= 1) {
- rc = run(rb_lock_node(c, args[0]));
- } else if (strcmp(cmd, "unlock") == 0 && nargs >= 1) {
- rc = run(rb_unlock_node(c, args[0]));
- } else if (strcmp(cmd, "delete") == 0 && nargs >= 1) {
- rc = run(rb_delete_node(c, args[0]));
- } else if (strcmp(cmd, "login") == 0 && nargs >= 1) {
- rc = run(rb_login(c, args[0]));
- } else if (strcmp(cmd, "verify") == 0 && nargs >= 2) {
- rc = run(rb_verify(c, args[0], args[1]));
- } else if (strcmp(cmd, "profile") == 0) {
- rc = run(rb_get_profile(c));
- } else if (strcmp(cmd, "help") == 0 || strcmp(cmd, "--help") == 0 ||
- strcmp(cmd, "-h") == 0) {
- usage(); rc = 0;
- } else {
- fprintf(stderr, "rb: unknown command '%s'\n\n", cmd);
- usage(); rc = 1;
- }
-
- rb_client_free(c);
- curl_global_cleanup();
- return rc;
-}
diff --git a/remarkbox/api/rb.h b/remarkbox/api/rb.h
deleted file mode 100644
index d31767a..0000000
--- a/remarkbox/api/rb.h
+++ /dev/null
@@ -1,485 +0,0 @@
-/*
- * rb.h — Remarkbox C library (single-header, libcurl only)
- *
- * Download:
- * curl -s https://REMARKBOX/api/v1/clients/c?file=rb.h -o rb.h
- *
- * Usage as a library:
- * // In exactly ONE .c file, before including:
- * #define RB_IMPLEMENTATION
- * #include "rb.h"
- *
- * // In all other .c files, just:
- * #include "rb.h"
- *
- * Quick start:
- * rb_client_t *c = rb_client_new("https://my.remarkbox.com", NULL);
- * rb_response_t r = rb_version(c);
- * if (r.ok) printf("%s\n", r.body);
- * rb_response_free(&r);
- * rb_client_free(c);
- *
- * Requires: libcurl (link with -lcurl)
- * License: Same as Remarkbox
- */
-
-#ifndef RB_H
-#define RB_H
-
-#include <stdlib.h>
-#include <curl/curl.h>
-
-#define RB_LIB_VERSION "0.1.0"
-#define RB_MAX_URI 2048
-#define RB_MAX_BODY 1048576 /* 1 MB response limit */
-
-/* ---------------------------------------------------------------------------
- * Types
- * ------------------------------------------------------------------------- */
-
-typedef struct {
- char *base_uri; /* e.g. "https://my.remarkbox.com" */
- char *cookie_path; /* path to Netscape cookie jar */
-} rb_client_t;
-
-typedef struct {
- int ok; /* 1 if HTTP 2xx, 0 otherwise */
- long status; /* HTTP status code */
- char *body; /* raw JSON response (caller must rb_response_free) */
- size_t body_len;
-} rb_response_t;
-
-/* ---------------------------------------------------------------------------
- * Client lifecycle
- * ------------------------------------------------------------------------- */
-
-/* Create a client. cookie_path may be NULL for default
- (~/.config/remarkbox/cookies.txt or REMARKBOX_COOKIES). */
-rb_client_t *rb_client_new(const char *base_uri, const char *cookie_path);
-
-/* Free a client. */
-void rb_client_free(rb_client_t *c);
-
-/* Free response body. */
-void rb_response_free(rb_response_t *r);
-
-/* ---------------------------------------------------------------------------
- * API methods — each returns rb_response_t with raw JSON in body
- * ------------------------------------------------------------------------- */
-
-/* Version */
-rb_response_t rb_version(rb_client_t *c);
-
-/* Threads */
-rb_response_t rb_list_threads(rb_client_t *c, const char *ns);
-rb_response_t rb_get_thread(rb_client_t *c, const char *node_id);
-rb_response_t rb_search_threads(rb_client_t *c, const char *ns, const char *query);
-rb_response_t rb_create_thread(rb_client_t *c, const char *ns, const char *title,
- const char *data, const char *anon_name);
-
-/* Replies */
-rb_response_t rb_reply(rb_client_t *c, const char *node_id, const char *data,
- const char *anon_name);
-
-/* Nodes */
-rb_response_t rb_get_node(rb_client_t *c, const char *node_id);
-rb_response_t rb_edit_node(rb_client_t *c, const char *node_id, const char *data);
-rb_response_t rb_disable_node(rb_client_t *c, const char *node_id);
-rb_response_t rb_enable_node(rb_client_t *c, const char *node_id);
-rb_response_t rb_approve_node(rb_client_t *c, const char *node_id);
-rb_response_t rb_lock_node(rb_client_t *c, const char *node_id);
-rb_response_t rb_unlock_node(rb_client_t *c, const char *node_id);
-rb_response_t rb_delete_node(rb_client_t *c, const char *node_id);
-
-/* Auth */
-rb_response_t rb_login(rb_client_t *c, const char *email);
-rb_response_t rb_verify(rb_client_t *c, const char *email, const char *otp);
-
-/* Profile */
-rb_response_t rb_get_profile(rb_client_t *c);
-
-/* ---------------------------------------------------------------------------
- * Utility
- * ------------------------------------------------------------------------- */
-
-/* Pretty-print JSON to stdout. */
-void rb_json_pretty(const char *json);
-
-/* Escape a string for use inside a JSON string value.
- Writes to out (must be at least out_size bytes). */
-void rb_json_escape(const char *s, char *out, size_t out_size);
-
-
-/* =========================================================================
- * IMPLEMENTATION — include this in exactly one .c file
- * ========================================================================= */
-
-#ifdef RB_IMPLEMENTATION
-
-#include <stdio.h>
-#include <string.h>
-
-/* ---------------------------------------------------------------------------
- * Internal: response buffer
- * ------------------------------------------------------------------------- */
-
-struct rb__buf {
- char *data;
- size_t len;
- size_t cap;
-};
-
-static void rb__buf_init(struct rb__buf *b)
-{
- b->cap = 4096;
- b->data = (char *)malloc(b->cap);
- b->len = 0;
- if (b->data) b->data[0] = '\0';
-}
-
-static size_t rb__write_cb(void *ptr, size_t size, size_t nmemb, void *userdata)
-{
- struct rb__buf *b = (struct rb__buf *)userdata;
- size_t bytes = size * nmemb;
-
- if (b->len + bytes + 1 > RB_MAX_BODY)
- bytes = RB_MAX_BODY - b->len - 1;
-
- if (b->len + bytes + 1 > b->cap) {
- size_t newcap = b->cap * 2;
- while (newcap < b->len + bytes + 1) newcap *= 2;
- if (newcap > RB_MAX_BODY) newcap = RB_MAX_BODY;
- char *tmp = (char *)realloc(b->data, newcap);
- if (!tmp) return 0;
- b->data = tmp;
- b->cap = newcap;
- }
-
- memcpy(b->data + b->len, ptr, bytes);
- b->len += bytes;
- b->data[b->len] = '\0';
- return size * nmemb;
-}
-
-/* ---------------------------------------------------------------------------
- * Internal: default cookie path
- * ------------------------------------------------------------------------- */
-
-static const char *rb__default_cookie_path(void)
-{
- const char *env = getenv("REMARKBOX_COOKIES");
- if (env && *env) return env;
-
- static char path[1024];
- const char *home = getenv("HOME");
- if (!home) home = ".";
- snprintf(path, sizeof(path), "%s/.config/remarkbox/cookies.txt", home);
- return path;
-}
-
-/* ---------------------------------------------------------------------------
- * Client lifecycle
- * ------------------------------------------------------------------------- */
-
-rb_client_t *rb_client_new(const char *base_uri, const char *cookie_path)
-{
- rb_client_t *c = (rb_client_t *)calloc(1, sizeof(rb_client_t));
- if (!c) return NULL;
-
- /* Strip trailing slash */
- size_t len = strlen(base_uri);
- while (len > 0 && base_uri[len - 1] == '/') len--;
- c->base_uri = (char *)malloc(len + 1);
- if (c->base_uri) { memcpy(c->base_uri, base_uri, len); c->base_uri[len] = '\0'; }
-
- const char *cp = cookie_path ? cookie_path : rb__default_cookie_path();
- c->cookie_path = (char *)malloc(strlen(cp) + 1);
- if (c->cookie_path) strcpy(c->cookie_path, cp);
-
- return c;
-}
-
-void rb_client_free(rb_client_t *c)
-{
- if (!c) return;
- free(c->base_uri);
- free(c->cookie_path);
- free(c);
-}
-
-void rb_response_free(rb_response_t *r)
-{
- free(r->body);
- r->body = NULL;
- r->body_len = 0;
-}
-
-/* ---------------------------------------------------------------------------
- * Internal: HTTP request
- * ------------------------------------------------------------------------- */
-
-static rb_response_t rb__request(rb_client_t *c, const char *method,
- const char *api_path, const char *json_body,
- const char *extra_header)
-{
- rb_response_t result = {0, 0, NULL, 0};
- char uri[RB_MAX_URI];
- struct rb__buf resp;
-
- snprintf(uri, sizeof(uri), "%s%s", c->base_uri, api_path);
- rb__buf_init(&resp);
-
- CURL *curl = curl_easy_init();
- if (!curl) {
- result.body = (char *)malloc(32);
- if (result.body) { strcpy(result.body, "{\"error\":\"curl init failed\"}"); result.body_len = strlen(result.body); }
- return result;
- }
-
- curl_easy_setopt(curl, CURLOPT_URL, uri);
- curl_easy_setopt(curl, CURLOPT_CUSTOMREQUEST, method);
- curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, rb__write_cb);
- curl_easy_setopt(curl, CURLOPT_WRITEDATA, &resp);
- curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
- curl_easy_setopt(curl, CURLOPT_COOKIEFILE, c->cookie_path);
- curl_easy_setopt(curl, CURLOPT_COOKIEJAR, c->cookie_path);
- curl_easy_setopt(curl, CURLOPT_USERAGENT, "rb/" RB_LIB_VERSION);
-
- struct curl_slist *headers = NULL;
- headers = curl_slist_append(headers, "Accept: application/json");
- if (json_body) {
- headers = curl_slist_append(headers, "Content-Type: application/json");
- curl_easy_setopt(curl, CURLOPT_POSTFIELDS, json_body);
- }
- if (extra_header)
- headers = curl_slist_append(headers, extra_header);
- curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers);
-
- CURLcode res = curl_easy_perform(curl);
- curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &result.status);
- curl_slist_free_all(headers);
- curl_easy_cleanup(curl);
-
- if (res != CURLE_OK) {
- free(resp.data);
- result.body = (char *)malloc(128);
- if (result.body) {
- snprintf(result.body, 128, "{\"error\":\"%s\"}", curl_easy_strerror(res));
- result.body_len = strlen(result.body);
- }
- return result;
- }
-
- result.ok = (result.status >= 200 && result.status < 400);
- result.body = resp.data; /* caller owns this now */
- result.body_len = resp.len;
- return result;
-}
-
-/* ---------------------------------------------------------------------------
- * Utility
- * ------------------------------------------------------------------------- */
-
-void rb_json_escape(const char *s, char *out, size_t out_size)
-{
- size_t j = 0;
- for (size_t i = 0; s[i] && j + 6 < out_size; i++) {
- switch (s[i]) {
- case '"': out[j++] = '\\'; out[j++] = '"'; break;
- case '\\': out[j++] = '\\'; out[j++] = '\\'; break;
- case '\n': out[j++] = '\\'; out[j++] = 'n'; break;
- case '\r': out[j++] = '\\'; out[j++] = 'r'; break;
- case '\t': out[j++] = '\\'; out[j++] = 't'; break;
- default:
- if ((unsigned char)s[i] < 0x20)
- j += snprintf(out + j, out_size - j, "\\u%04x", (unsigned char)s[i]);
- else
- out[j++] = s[i];
- break;
- }
- }
- out[j] = '\0';
-}
-
-void rb_json_pretty(const char *s)
-{
- int indent = 0, in_string = 0, escaped = 0;
- for (; *s; s++) {
- if (escaped) { putchar(*s); escaped = 0; continue; }
- if (*s == '\\' && in_string) { putchar(*s); escaped = 1; continue; }
- if (*s == '"') { in_string = !in_string; putchar(*s); continue; }
- if (in_string) { putchar(*s); continue; }
- switch (*s) {
- case '{': case '[':
- putchar(*s); putchar('\n'); indent += 2;
- for (int i = 0; i < indent; i++) putchar(' ');
- break;
- case '}': case ']':
- putchar('\n'); indent -= 2; if (indent < 0) indent = 0;
- for (int i = 0; i < indent; i++) putchar(' ');
- putchar(*s); break;
- case ',':
- putchar(*s); putchar('\n');
- for (int i = 0; i < indent; i++) putchar(' ');
- break;
- case ':': putchar(*s); putchar(' '); break;
- default:
- if (*s != ' ' && *s != '\t' && *s != '\n' && *s != '\r')
- putchar(*s);
- break;
- }
- }
- putchar('\n');
-}
-
-/* ---------------------------------------------------------------------------
- * Internal: URI encoding helper
- * ------------------------------------------------------------------------- */
-
-static void rb__uri_encode(const char *s, char *out, size_t out_size)
-{
- CURL *curl = curl_easy_init();
- if (curl) {
- char *enc = curl_easy_escape(curl, s, 0);
- if (enc) { snprintf(out, out_size, "%s", enc); curl_free(enc); }
- else { snprintf(out, out_size, "%s", s); }
- curl_easy_cleanup(curl);
- } else {
- snprintf(out, out_size, "%s", s);
- }
-}
-
-/* ---------------------------------------------------------------------------
- * API methods
- * ------------------------------------------------------------------------- */
-
-rb_response_t rb_version(rb_client_t *c)
-{
- return rb__request(c, "GET", "/api/v1/version", NULL, NULL);
-}
-
-rb_response_t rb_list_threads(rb_client_t *c, const char *ns)
-{
- char path[RB_MAX_URI], enc[1024];
- rb__uri_encode(ns, enc, sizeof(enc));
- snprintf(path, sizeof(path), "/api/v1/threads?namespace=%s", enc);
- return rb__request(c, "GET", path, NULL, NULL);
-}
-
-rb_response_t rb_get_thread(rb_client_t *c, const char *node_id)
-{
- char path[RB_MAX_URI];
- snprintf(path, sizeof(path), "/api/v1/threads/%s", node_id);
- return rb__request(c, "GET", path, NULL, NULL);
-}
-
-rb_response_t rb_search_threads(rb_client_t *c, const char *ns, const char *query)
-{
- char path[RB_MAX_URI], enc_ns[512], enc_q[512];
- rb__uri_encode(ns, enc_ns, sizeof(enc_ns));
- rb__uri_encode(query, enc_q, sizeof(enc_q));
- snprintf(path, sizeof(path), "/api/v1/threads/search?namespace=%s&q=%s",
- enc_ns, enc_q);
- return rb__request(c, "GET", path, NULL, NULL);
-}
-
-rb_response_t rb_create_thread(rb_client_t *c, const char *ns, const char *title,
- const char *data, const char *anon_name)
-{
- char body[RB_MAX_BODY];
- char ens[2048], etitle[2048], edata[524288], ename[512];
- rb_json_escape(ns, ens, sizeof(ens));
- rb_json_escape(title, etitle, sizeof(etitle));
- rb_json_escape(data, edata, sizeof(edata));
- if (anon_name) {
- rb_json_escape(anon_name, ename, sizeof(ename));
- snprintf(body, sizeof(body),
- "{\"namespace\":\"%s\",\"title\":\"%s\",\"data\":\"%s\","
- "\"anonymous_name\":\"%s\"}", ens, etitle, edata, ename);
- } else {
- snprintf(body, sizeof(body),
- "{\"namespace\":\"%s\",\"title\":\"%s\",\"data\":\"%s\"}",
- ens, etitle, edata);
- }
- return rb__request(c, "POST", "/api/v1/threads", body, NULL);
-}
-
-rb_response_t rb_reply(rb_client_t *c, const char *node_id, const char *data,
- const char *anon_name)
-{
- char path[RB_MAX_URI], body[RB_MAX_BODY];
- char edata[524288], ename[512];
- rb_json_escape(data, edata, sizeof(edata));
- snprintf(path, sizeof(path), "/api/v1/threads/%s/replies", node_id);
- if (anon_name) {
- rb_json_escape(anon_name, ename, sizeof(ename));
- snprintf(body, sizeof(body),
- "{\"data\":\"%s\",\"anonymous_name\":\"%s\"}", edata, ename);
- } else {
- snprintf(body, sizeof(body), "{\"data\":\"%s\"}", edata);
- }
- return rb__request(c, "POST", path, body, NULL);
-}
-
-rb_response_t rb_get_node(rb_client_t *c, const char *node_id)
-{
- char path[RB_MAX_URI];
- snprintf(path, sizeof(path), "/api/v1/nodes/%s", node_id);
- return rb__request(c, "GET", path, NULL, NULL);
-}
-
-rb_response_t rb_edit_node(rb_client_t *c, const char *node_id, const char *data)
-{
- char path[RB_MAX_URI], body[RB_MAX_BODY], edata[524288];
- rb_json_escape(data, edata, sizeof(edata));
- snprintf(path, sizeof(path), "/api/v1/nodes/%s", node_id);
- snprintf(body, sizeof(body), "{\"data\":\"%s\"}", edata);
- return rb__request(c, "PATCH", path, body, NULL);
-}
-
-static rb_response_t rb__mod_flag(rb_client_t *c, const char *node_id,
- const char *field, const char *value)
-{
- char path[RB_MAX_URI], body[256];
- snprintf(path, sizeof(path), "/api/v1/nodes/%s", node_id);
- snprintf(body, sizeof(body), "{\"%s\":%s}", field, value);
- return rb__request(c, "PATCH", path, body, NULL);
-}
-
-rb_response_t rb_disable_node(rb_client_t *c, const char *id) { return rb__mod_flag(c, id, "disabled", "true"); }
-rb_response_t rb_enable_node(rb_client_t *c, const char *id) { return rb__mod_flag(c, id, "disabled", "false"); }
-rb_response_t rb_approve_node(rb_client_t *c, const char *id) { return rb__mod_flag(c, id, "approved", "true"); }
-rb_response_t rb_lock_node(rb_client_t *c, const char *id) { return rb__mod_flag(c, id, "locked", "true"); }
-rb_response_t rb_unlock_node(rb_client_t *c, const char *id) { return rb__mod_flag(c, id, "locked", "false"); }
-
-rb_response_t rb_delete_node(rb_client_t *c, const char *node_id)
-{
- char path[RB_MAX_URI];
- snprintf(path, sizeof(path), "/api/v1/nodes/%s", node_id);
- return rb__request(c, "DELETE", path, NULL, NULL);
-}
-
-rb_response_t rb_login(rb_client_t *c, const char *email)
-{
- char body[512], eemail[256];
- rb_json_escape(email, eemail, sizeof(eemail));
- snprintf(body, sizeof(body), "{\"email\":\"%s\"}", eemail);
- return rb__request(c, "POST", "/api/v1/auth/login", body, NULL);
-}
-
-rb_response_t rb_verify(rb_client_t *c, const char *email, const char *otp)
-{
- char body[512], eemail[256], eotp[64];
- rb_json_escape(email, eemail, sizeof(eemail));
- rb_json_escape(otp, eotp, sizeof(eotp));
- snprintf(body, sizeof(body), "{\"email\":\"%s\",\"otp\":\"%s\"}", eemail, eotp);
- return rb__request(c, "POST", "/api/v1/auth/verify", body, NULL);
-}
-
-rb_response_t rb_get_profile(rb_client_t *c)
-{
- return rb__request(c, "GET", "/api/v1/user/profile", NULL, NULL);
-}
-
-#endif /* RB_IMPLEMENTATION */
-#endif /* RB_H */
diff --git a/remarkbox/api/remarkbox_client.py b/remarkbox/api/remarkbox_client.py
deleted file mode 100644
index b6c0745..0000000
--- a/remarkbox/api/remarkbox_client.py
+++ /dev/null
@@ -1,732 +0,0 @@
-"""
-Remarkbox API Client (Python, stdlib only)
-
-Download:
- curl -s https://REMARKBOX/api/v1/clients/python -o remarkbox_client.py
- wget -q https://REMARKBOX/api/v1/clients/python -O remarkbox_client.py
-
-Quick start:
- from remarkbox_client import RemarkboxClient
-
- client = RemarkboxClient("https://my.remarkbox.com")
-
- # List threads
- result = client.list_threads("meta.remarkbox.com")
- for thread in result["threads"]:
- print(thread["title"])
-
- # Read a thread and its replies
- thread = client.get_thread(thread_id)
- for reply in thread["replies"]:
- print(reply["data"])
-
- # Post anonymously (namespace must allow anonymous)
- node = client.create_thread(
- namespace="meta.remarkbox.com",
- title="Hello from Python",
- data="This is a test post.",
- anonymous_name="MyBot",
- )
-
- # Reply to a thread
- reply = client.reply(node["node"]["id"], data="Nice thread!")
-
- # Authenticate via email OTP
- client.login("agent@example.com")
- # ... check inbox for 6-digit code ...
- client.verify("agent@example.com", "123456")
-
- # Now requests are authenticated
- thread = client.create_thread(
- namespace="meta.remarkbox.com",
- title="Verified post",
- data="Posted with a session.",
- )
-
- # Edit your own post
- client.edit_node(thread["node"]["id"], data="Updated content.")
-
-Configuration:
- # From arguments (highest priority)
- client = RemarkboxClient("https://my.remarkbox.com")
-
- # From environment variables
- # REMARKBOX_URL=https://my.remarkbox.com
- # REMARKBOX_EMAIL=agent@example.com
- client = RemarkboxClient.from_env()
-
- # From config file (~/.config/remarkbox/config.json)
- # {"url": "https://my.remarkbox.com", "email": "agent@example.com"}
- client = RemarkboxClient.from_config()
-
-Requires: Python 3.6+ (stdlib only, no pip install needed)
-License: Same as Remarkbox
-"""
-
-import json
-import os
-import http.cookiejar
-import urllib.request
-import urllib.error
-import urllib.parse
-
-
-__version__ = "0.1.0"
-
-
-class RemarkboxError(Exception):
- """Raised when the API returns an error response."""
-
- def __init__(self, status, body):
- self.status = status
- self.body = body
- msg = body.get("error", str(body)) if isinstance(body, dict) else str(body)
- super().__init__("HTTP {}: {}".format(status, msg))
-
-
-class RemarkboxClient:
- """Remarkbox API client. Manages sessions via cookies automatically."""
-
- def __init__(self, url, email=None, cookie_file=None):
- """
- Args:
- url: Base URL of the Remarkbox instance (e.g. https://my.remarkbox.com)
- email: Optional default email for login/verify
- cookie_file: Optional path to persist session cookies across runs.
- If provided, cookies are loaded on init and saved
- after login/verify. Use this to stay logged in.
- """
- self.url = url.rstrip("/")
- self.email = email
- self._cookie_file = cookie_file
- if cookie_file:
- self._cookie_jar = http.cookiejar.MozillaCookieJar(cookie_file)
- if os.path.exists(cookie_file):
- self._cookie_jar.load(ignore_discard=True, ignore_expires=True)
- else:
- self._cookie_jar = http.cookiejar.CookieJar()
- self._opener = urllib.request.build_opener(
- urllib.request.HTTPCookieProcessor(self._cookie_jar)
- )
-
- @classmethod
- def from_env(cls):
- """Create client from environment variables.
-
- Reads:
- REMARKBOX_URL (required)
- REMARKBOX_EMAIL (optional)
- """
- url = os.environ.get("REMARKBOX_URL")
- if not url:
- raise RemarkboxError(0, {"error": "REMARKBOX_URL environment variable not set"})
- email = os.environ.get("REMARKBOX_EMAIL")
- return cls(url, email=email)
-
- @classmethod
- def from_config(cls, path=None):
- """Create client from a JSON config file.
-
- Default path: ~/.config/remarkbox/config.json
-
- Config format:
- {"url": "https://my.remarkbox.com", "email": "agent@example.com"}
- """
- if path is None:
- path = os.path.join(
- os.path.expanduser("~"), ".config", "remarkbox", "config.json"
- )
- with open(path) as f:
- config = json.load(f)
- url = config.get("url")
- if not url:
- raise RemarkboxError(0, {"error": "url is required in config file"})
- return cls(url, email=config.get("email"), cookie_file=config.get("cookie_file"))
-
- def _save_cookies(self):
- """Persist cookies to disk if cookie_file was provided."""
- if self._cookie_file and hasattr(self._cookie_jar, "save"):
- self._cookie_jar.save(ignore_discard=True, ignore_expires=True)
-
- def _request(self, method, path, body=None, headers=None):
- """Make an HTTP request and return parsed JSON."""
- url = self.url + path
- data = None
- _headers = {}
-
- if body is not None:
- data = json.dumps(body).encode("utf-8")
- _headers["Content-Type"] = "application/json"
-
- if headers:
- _headers.update(headers)
-
- req = urllib.request.Request(url, data=data, headers=_headers, method=method)
-
- try:
- resp = self._opener.open(req)
- raw = resp.read().decode("utf-8")
- try:
- return json.loads(raw) if raw else {}
- except json.JSONDecodeError:
- raise RemarkboxError(resp.status, {"error": "Non-JSON response"})
- except urllib.error.HTTPError as e:
- raw = e.read().decode("utf-8")
- try:
- body = json.loads(raw)
- except Exception:
- body = {"error": raw}
- raise RemarkboxError(e.code, body)
-
- # ----- Version -----
-
- def version(self):
- """Get the deployed version (git commit hash).
-
- Returns:
- dict with key: version
- """
- return self._request("GET", "/api/v1/version")
-
- # ----- Threads -----
-
- def list_threads(self, namespace, page=1):
- """List threads in a namespace.
-
- Args:
- namespace: The namespace name (e.g. "meta.remarkbox.com")
- page: Page number (default 1)
-
- Returns:
- dict with keys: namespace, threads, page, page_size
- """
- params = urllib.parse.urlencode({"namespace": namespace, "page": page})
- return self._request("GET", "/api/v1/threads?" + params)
-
- def get_thread(self, node_id, limit=None, offset=None):
- """Get a thread and its replies (paginated).
-
- Args:
- node_id: UUID of the root thread node
- limit: Maximum replies to return (default 100, max 500)
- offset: Number of replies to skip (default 0)
-
- Returns:
- dict with keys: namespace, thread, replies, total_replies,
- page, limit, offset, has_more
- """
- params = {}
- if limit is not None:
- params["limit"] = limit
- if offset is not None:
- params["offset"] = offset
- path = "/api/v1/threads/{}".format(node_id)
- if params:
- path += "?" + urllib.parse.urlencode(params)
- return self._request("GET", path)
-
- def create_thread(self, namespace, title, data, anonymous_name=None, email=None,
- source_format=None):
- """Create a new thread.
-
- Args:
- namespace: Target namespace name
- title: Thread title
- data: Content (max 500000 chars)
- anonymous_name: Name for anonymous posting (optional)
- email: Email to associate with post (optional)
- source_format: Input format — markdown (default), html, rst,
- mediawiki, latex, textile, org, etc. (any pandoc input format)
-
- Returns:
- dict with keys: node, verified
- """
- body = {"namespace": namespace, "title": title, "data": data}
- if anonymous_name:
- body["anonymous_name"] = anonymous_name
- if email:
- body["email"] = email
- if source_format:
- body["source_format"] = source_format
- return self._request("POST", "/api/v1/threads", body)
-
- # ----- Replies -----
-
- def reply(self, node_id, data, anonymous_name=None, email=None, source_format=None):
- """Reply to a thread or another reply.
-
- Args:
- node_id: UUID of the parent node (thread or reply)
- data: Content (max 500000 chars)
- anonymous_name: Name for anonymous posting (optional)
- email: Email to associate with post (optional)
- source_format: Input format (default: markdown)
-
- Returns:
- dict with keys: node, verified
- """
- body = {"data": data}
- if anonymous_name:
- body["anonymous_name"] = anonymous_name
- if email:
- body["email"] = email
- if source_format:
- body["source_format"] = source_format
- return self._request("POST", "/api/v1/threads/{}/replies".format(node_id), body)
-
- # ----- Nodes -----
-
- def get_node(self, node_id):
- """Get a single node by ID.
-
- Args:
- node_id: UUID of the node
-
- Returns:
- dict with key: node
- """
- return self._request("GET", "/api/v1/nodes/{}".format(node_id))
-
- def edit_node(self, node_id, data=None, title=None, source_format=None):
- """Edit a node (requires authentication).
-
- Args:
- node_id: UUID of the node to edit
- data: New content (optional)
- title: New title, only for root nodes (optional)
- source_format: Input format (default: markdown)
-
- Returns:
- dict with key: node
- """
- body = {}
- if data is not None:
- body["data"] = data
- if title is not None:
- body["title"] = title
- if source_format is not None:
- body["source_format"] = source_format
- if not body:
- raise ValueError("data or title is required")
- return self._request("PATCH", "/api/v1/nodes/{}".format(node_id), body)
-
- def disable_node(self, node_id):
- """Disable a node (requires authentication, moderator or owner).
-
- Args:
- node_id: UUID of the node to disable
-
- Returns:
- dict with key: node
- """
- return self._request("PATCH", "/api/v1/nodes/{}".format(node_id), {"disabled": True})
-
- def enable_node(self, node_id):
- """Enable a previously disabled node (requires authentication, moderator or owner).
-
- Args:
- node_id: UUID of the node to enable
-
- Returns:
- dict with key: node
- """
- return self._request("PATCH", "/api/v1/nodes/{}".format(node_id), {"disabled": False})
-
- def approve_node(self, node_id):
- """Approve a node (requires authentication, moderator or owner).
-
- Args:
- node_id: UUID of the node to approve
-
- Returns:
- dict with key: node
- """
- return self._request("PATCH", "/api/v1/nodes/{}".format(node_id), {"approved": True})
-
- def lock_node(self, node_id):
- """Lock a thread (requires authentication, moderator or owner). Root nodes only.
-
- Args:
- node_id: UUID of the root node to lock
-
- Returns:
- dict with key: node
- """
- return self._request("PATCH", "/api/v1/nodes/{}".format(node_id), {"locked": True})
-
- def unlock_node(self, node_id):
- """Unlock a thread (requires authentication, moderator or owner). Root nodes only.
-
- Args:
- node_id: UUID of the root node to unlock
-
- Returns:
- dict with key: node
- """
- return self._request("PATCH", "/api/v1/nodes/{}".format(node_id), {"locked": False})
-
- def delete_node(self, node_id, sudo_otp=None):
- """Delete a node permanently (requires moderator + sudo OTP).
-
- First call without sudo_otp returns 202 and emails a code.
- Second call with the code performs the deletion.
-
- Args:
- node_id: UUID of the node to delete
- sudo_otp: 8-digit confirmation code from email (optional)
-
- Returns:
- dict with key: deleted (the node ID), or status/message if OTP required
- """
- headers = {}
- if sudo_otp:
- headers["X-Sudo-OTP"] = sudo_otp
- return self._request("DELETE", "/api/v1/nodes/{}".format(node_id), headers=headers)
-
- # ----- Auth -----
-
- def login(self, email=None):
- """Request an OTP code be sent to the email address.
-
- Args:
- email: Email address (uses self.email if not provided)
-
- Returns:
- dict with keys: status, message
- """
- email = email or self.email
- if not email:
- raise ValueError("email is required")
- return self._request("POST", "/api/v1/auth/login", {"email": email})
-
- def verify(self, email=None, otp=None):
- """Verify an OTP code and establish an authenticated session.
-
- After calling this, subsequent requests are authenticated
- via the session cookie (managed automatically).
-
- Args:
- email: Email address (uses self.email if not provided)
- otp: The 6-digit verification code from email
-
- Returns:
- dict with keys: status, user
- """
- email = email or self.email
- if not email:
- raise ValueError("email is required")
- if not otp:
- raise ValueError("otp is required")
- result = self._request("POST", "/api/v1/auth/verify", {"email": email, "otp": otp})
- self._save_cookies()
- return result
-
- # ----- Profile -----
-
- def get_profile(self):
- """Get the current authenticated user's profile.
-
- Returns:
- dict with key: user (id, name, email)
- """
- return self._request("GET", "/api/v1/user/profile")
-
- def update_profile(self, name):
- """Update the current user's display name.
-
- Args:
- name: New display name (alphanumeric and dashes only)
-
- Returns:
- dict with key: user (id, name, email)
- """
- return self._request("PATCH", "/api/v1/user/profile", {"name": name})
-
- # ----- Export -----
-
- def export_formats(self):
- """List all available export formats.
-
- Returns:
- dict with keys: formats (list of strings), count
- """
- return self._request("GET", "/api/v1/export/formats")
-
- def export_thread(self, node_id, fmt="markdown"):
- """Export a thread in the specified format.
-
- Args:
- node_id: UUID of the root thread node
- fmt: Pandoc output format (e.g. markdown, html5, pdf, epub, docx)
-
- Returns:
- bytes (binary formats) or str (text formats)
- """
- return self._raw_request(
- "GET", "/api/v1/export/threads/{}.{}".format(node_id, fmt)
- )
-
- def export_namespace(self, namespace, fmt="markdown"):
- """Export an entire namespace as a book in the specified format.
-
- Args:
- namespace: Namespace name (e.g. "meta.remarkbox.com")
- fmt: Pandoc output format
-
- Returns:
- bytes (binary formats) or str (text formats)
- """
- return self._raw_request(
- "GET", "/api/v1/export/namespace/{}.{}".format(namespace, fmt)
- )
-
- def export_node(self, node_id, fmt="markdown"):
- """Export a node and its subtree in the specified format (on-demand).
-
- Args:
- node_id: UUID of the node
- fmt: Pandoc output format
-
- Returns:
- bytes (binary formats) or str (text formats)
- """
- return self._raw_request(
- "GET", "/api/v1/export/nodes/{}.{}".format(node_id, fmt)
- )
-
- def _raw_request(self, method, path):
- """Make an HTTP request and return raw response body."""
- url = self.url + path
- req = urllib.request.Request(url, method=method)
- try:
- resp = self._opener.open(req)
- content_type = resp.headers.get("Content-Type", "")
- body = resp.read()
- if "text/" in content_type or "json" in content_type or "xml" in content_type:
- return body.decode("utf-8")
- return body
- except urllib.error.HTTPError as e:
- raw = e.read().decode("utf-8")
- try:
- body = json.loads(raw)
- except Exception:
- body = {"error": raw}
- raise RemarkboxError(e.code, body)
-
- # ----- Wiki / Revisions -----
-
- def wiki_edit(self, node_id, data, source_format=None):
- """Wiki-edit a node (creates revision, any authenticated user if wiki mode).
-
- Args:
- node_id: UUID of the node to edit
- data: New content
- source_format: Input format (default: markdown)
-
- Returns:
- dict with key: node
- """
- body = {"data": data}
- if source_format:
- body["source_format"] = source_format
- return self._request("POST", "/api/v1/nodes/{}/wiki-edit".format(node_id), body)
-
- def get_revisions(self, node_id):
- """Get revision history for a node.
-
- Args:
- node_id: UUID of the node
-
- Returns:
- dict with keys: node_id, revisions, count
- """
- return self._request("GET", "/api/v1/nodes/{}/revisions".format(node_id))
-
- def get_revision(self, revision_id):
- """Get a specific revision by ID.
-
- Args:
- revision_id: UUID of the revision
-
- Returns:
- dict with key: revision
- """
- return self._request("GET", "/api/v1/revisions/{}".format(revision_id))
-
- def diff_revisions(self, revision_id, other_id):
- """Compare two revisions of the same node via unified diff.
-
- Args:
- revision_id: UUID of the first (from) revision
- other_id: UUID of the second (to) revision
-
- Returns:
- dict with keys: from_revision, to_revision, from_number,
- to_number, node_id, diff
- """
- return self._request(
- "GET", "/api/v1/revisions/{}/diff/{}".format(revision_id, other_id)
- )
-
- # ----- Themes -----
-
- def get_theme_css(self, namespace):
- """Get the auto-generated theme CSS for a namespace.
-
- Args:
- namespace: Namespace name
-
- Returns:
- CSS string
- """
- return self._raw_request(
- "GET", "/api/v1/themes/{}/css".format(namespace)
- )
-
- def get_theme_preview(self, namespace):
- """Get theme palette preview for a namespace.
-
- Args:
- namespace: Namespace name
-
- Returns:
- dict with keys: namespace, palette, css_url
- """
- return self._request(
- "GET", "/api/v1/themes/{}/preview".format(namespace)
- )
-
- # ----- Admin (superuser only) -----
-
- def admin_list_namespaces(self):
- """List all namespaces (requires superuser).
-
- Returns:
- dict with key: namespaces (list of namespace dicts)
- """
- return self._request("GET", "/api/v1/admin/namespaces")
-
- def admin_recent_nodes(self, days=7, limit=100):
- """List recent nodes across all namespaces (requires superuser).
-
- Args:
- days: Number of days to look back (default 7, max 90)
- limit: Max results (default 100, max 500)
-
- Returns:
- dict with keys: days, count, nodes
- """
- params = urllib.parse.urlencode({"days": days, "limit": limit})
- return self._request("GET", "/api/v1/admin/recent-nodes?" + params)
-
-
-# ----- CLI -----
-
-def main():
- """Simple CLI for quick testing."""
- import sys
-
- usage = """Usage: python remarkbox_client.py <url> <command> [args...]
-
-Commands:
- threads <namespace> List threads
- thread <node_id> Get thread with replies
- node <node_id> Get a single node
- post <namespace> <title> <data> [name] Create thread (anonymous)
- reply <node_id> <data> [name] Reply to thread (anonymous)
- disable <node_id> Disable a node (auth required)
- enable <node_id> Enable a node (auth required)
- approve <node_id> Approve a node (auth required)
- lock <node_id> Lock a thread (auth required)
- unlock <node_id> Unlock a thread (auth required)
- delete <node_id> Delete a node (moderator only)
- login <email> Request OTP
- verify <email> <otp> Verify OTP
- formats List export formats
- export-thread <node_id> [format] Export thread (default: markdown)
- export-ns <namespace> [format] Export namespace as book
- export-node <node_id> [format] Export node subtree
-
-Examples:
- python remarkbox_client.py https://my.remarkbox.com threads meta.remarkbox.com
- python remarkbox_client.py https://my.remarkbox.com export-ns meta.remarkbox.com epub
- python remarkbox_client.py https://my.remarkbox.com export-thread <node_id> pdf
-"""
-
- if len(sys.argv) < 3:
- print(usage)
- sys.exit(1)
-
- url = sys.argv[1]
- cmd = sys.argv[2]
- args = sys.argv[3:]
- client = RemarkboxClient(url)
-
- try:
- if cmd == "threads" and len(args) >= 1:
- result = client.list_threads(args[0])
- elif cmd == "thread" and len(args) >= 1:
- result = client.get_thread(args[0])
- elif cmd == "node" and len(args) >= 1:
- result = client.get_node(args[0])
- elif cmd == "post" and len(args) >= 3:
- name = args[3] if len(args) > 3 else None
- result = client.create_thread(args[0], args[1], args[2], anonymous_name=name)
- elif cmd == "reply" and len(args) >= 2:
- name = args[2] if len(args) > 2 else None
- result = client.reply(args[0], args[1], anonymous_name=name)
- elif cmd == "disable" and len(args) >= 1:
- result = client.disable_node(args[0])
- elif cmd == "enable" and len(args) >= 1:
- result = client.enable_node(args[0])
- elif cmd == "approve" and len(args) >= 1:
- result = client.approve_node(args[0])
- elif cmd == "lock" and len(args) >= 1:
- result = client.lock_node(args[0])
- elif cmd == "unlock" and len(args) >= 1:
- result = client.unlock_node(args[0])
- elif cmd == "delete" and len(args) >= 1:
- result = client.delete_node(args[0])
- elif cmd == "login" and len(args) >= 1:
- result = client.login(args[0])
- elif cmd == "verify" and len(args) >= 2:
- result = client.verify(args[0], args[1])
- elif cmd == "formats":
- result = client.export_formats()
- elif cmd == "export-thread" and len(args) >= 1:
- fmt = args[1] if len(args) > 1 else "markdown"
- output = client.export_thread(args[0], fmt)
- if isinstance(output, bytes):
- sys.stdout.buffer.write(output)
- else:
- print(output)
- sys.exit(0)
- elif cmd == "export-ns" and len(args) >= 1:
- fmt = args[1] if len(args) > 1 else "markdown"
- output = client.export_namespace(args[0], fmt)
- if isinstance(output, bytes):
- sys.stdout.buffer.write(output)
- else:
- print(output)
- sys.exit(0)
- elif cmd == "export-node" and len(args) >= 1:
- fmt = args[1] if len(args) > 1 else "markdown"
- output = client.export_node(args[0], fmt)
- if isinstance(output, bytes):
- sys.stdout.buffer.write(output)
- else:
- print(output)
- sys.exit(0)
- else:
- print(usage)
- sys.exit(1)
-
- print(json.dumps(result, indent=2))
-
- except RemarkboxError as e:
- print(json.dumps({"error": str(e), "status": e.status}, indent=2), file=sys.stderr)
- sys.exit(1)
-
-
-if __name__ == "__main__":
- main()
diff --git a/remarkbox/api/serializers.py b/remarkbox/api/serializers.py
deleted file mode 100644
index 3093500..0000000
--- a/remarkbox/api/serializers.py
+++ /dev/null
@@ -1,56 +0,0 @@
-def serialize_node(node, include_children=False):
- """Serialize a Node model to a dictionary."""
- result = {
- "id": str(node.id),
- "root_id": str(node.root_id) if node.root_id else None,
- "parent_id": str(node.parent_id) if node.parent_id else None,
- "title": node.title,
- "data": node.data,
- "data_html": node.data_html,
- "source_format": node.source_format,
- "is_root": node.is_root,
- "depth": node.graph_depth,
- "created": node.created,
- "created_date": node.created_date,
- "created_ago": node.human_created_timestamp,
- "changed": node.changed,
- "changed_date": node.changed_date,
- "changed_ago": node.human_changed_timestamp,
- "disabled": node.disabled,
- "verified": node.verified,
- "locked": node.locked,
- "approved": node.approved,
- "was_edited": node.was_edited,
- "author": serialize_author(node),
- }
- if include_children:
- result["stats"] = node.stats if node.cache else None
- return result
-
-
-def serialize_author(node):
- """Serialize the author (User or UserSurrogate) of a node."""
- if node.user:
- return {
- "type": "user",
- "id": str(node.user.id),
- "name": node.user.name,
- }
- elif node.user_surrogate:
- return {
- "type": "surrogate",
- "id": str(node.user_surrogate.id),
- "name": node.user_surrogate.name,
- }
- return None
-
-
-def serialize_namespace_brief(namespace):
- """Serialize minimal namespace info for API responses."""
- return {
- "id": str(namespace.id),
- "name": namespace.name,
- "description": namespace.description,
- "allow_anonymous": namespace.allow_anonymous,
- "node_order": namespace.node_order,
- }
diff --git a/remarkbox/api/themes.py b/remarkbox/api/themes.py
deleted file mode 100644
index f3375c8..0000000
--- a/remarkbox/api/themes.py
+++ /dev/null
@@ -1,80 +0,0 @@
-"""Theme generation API endpoints."""
-
-from pyramid.response import Response
-from pyramid.view import view_config
-
-from remarkbox.models.namespace import get_namespace_by_name
-from remarkbox.lib.theme_generator import generate_theme_css
-
-
-@view_config(
- route_name="api-namespace-theme",
- request_method="GET",
- require_csrf=False,
-)
-def api_namespace_theme(request):
- """Generate and serve a theme CSS for a namespace.
-
- The theme is deterministic -- same namespace always gets the same theme.
- Cache-friendly: can be cached indefinitely (changes only if we change the algorithm).
- """
- namespace_name = request.matchdict["namespace_name"]
-
- # Validate namespace exists
- namespace = get_namespace_by_name(request.dbsession, namespace_name)
- if namespace is None:
- request.response.status_code = 404
- request.response.content_type = "application/json"
- request.response.json_body = {"error": "Namespace not found"}
- return request.response
-
- css = generate_theme_css(namespace_name)
-
- response = Response(
- body=css,
- content_type="text/css; charset=utf-8",
- )
- # Cache for 1 day -- theme is deterministic but we might update the algorithm
- response.cache_control.max_age = 86400
- response.cache_control.public = True
- return response
-
-
-@view_config(
- route_name="api-theme-preview",
- request_method="GET",
- renderer="json",
- require_csrf=False,
-)
-def api_theme_preview(request):
- """Preview theme variables for a namespace (JSON format).
-
- Useful for theme customization UI -- shows the computed palette
- without needing to parse CSS.
- """
- namespace_name = request.matchdict["namespace_name"]
-
- namespace = get_namespace_by_name(request.dbsession, namespace_name)
- if namespace is None:
- request.response.status_code = 404
- return {"error": "Namespace not found"}
-
- from remarkbox.lib.theme_generator import _name_to_seed
- seed = _name_to_seed(namespace_name)
-
- hue = seed[0] % 360
- hue_offset = 30 + (seed[1] % 30)
- secondary_hue = (hue + hue_offset) % 360
- accent_hue = (hue + 180 + (seed[2] % 40 - 20)) % 360
- sat_base = 40 + (seed[3] % 25)
-
- return {
- "namespace": namespace_name,
- "palette": {
- "primary_hue": hue,
- "secondary_hue": secondary_hue,
- "accent_hue": accent_hue,
- "saturation_base": sat_base,
- },
- "css_url": "/api/v1/themes/{}/css".format(namespace_name),
- }
diff --git a/remarkbox/api/views.py b/remarkbox/api/views.py
deleted file mode 100644
index 9f4826d..0000000
--- a/remarkbox/api/views.py
+++ /dev/null
@@ -1,1235 +0,0 @@
-import os
-import re
-import subprocess
-import sys
-
-from pyramid.response import Response
-from pyramid.view import view_config
-
-from remarkbox.models import (
- create_root_node,
- get_node_by_id,
- get_or_create_user_surrogate_by_name,
- get_nodes_who_share_root,
-)
-from remarkbox.models.user import (
- get_or_create_user_by_email,
- is_user_name_valid,
- is_user_name_available,
-)
-from remarkbox.models.namespace import (
- get_namespace_by_name,
- get_or_create_namespace,
- get_topsecret_namespaces,
-)
-from remarkbox.models.uri import get_or_create_uri
-from remarkbox.models.node import Node, get_or_create_node_by_uri
-from remarkbox.lib.mail import send_verification_digits_to_email, send_sudo_otp_email
-from remarkbox.models.sudo_otp import create_sudo_otp, verify_sudo_otp
-from remarkbox.lib.notify import schedule_notifications
-from remarkbox.views import verify_pending_nodes_in_session
-
-from remarkbox.models.meta import now_timestamp
-from remarkbox.models.spam import score_content
-from remarkbox.models.spam_llm import check_thread_relevance, check_reply_relevance
-
-from .serializers import serialize_node, serialize_namespace_brief
-
-MAX_CONTENT_LENGTH = 500000
-
-_email_regex = re.compile(r"^[^@]+@[^@]+\.[^.@]+$")
-
-
-def check_namespace_api_access(request, namespace):
- """Return an error dict if the namespace has API access disabled, else None."""
- if not namespace.api_access:
- request.response.status_code = 403
- return {"error": "API access is disabled for this namespace"}
- return None
-
-
-def get_json_body(request):
- """Get JSON body from request, or empty dict if not present."""
- try:
- return request.json_body
- except Exception:
- return {}
-
-
-def get_param(request, key, default=None):
- """Get a parameter from JSON body, then fall back to query/form params."""
- body = get_json_body(request)
- if key in body:
- return body[key]
- return request.params.get(key, default)
-
-
-def check_spam(request, data, user=None, namespace=None, title=None,
- parent_node=None):
- """Check content for spam. Always returns a result dict.
-
- Returns dict with keys:
- action: None (clean), "held", or "rejected"
- spam_score: float 0.0-1.0
- signals: list of signal strings
- spam_reason: human-readable LLM explanation or None
- error: present only when action == "rejected"
-
- - Hard threshold: action="rejected", sets 403 on response.
- - Soft threshold: action="held", caller should set approved=False.
- - Below thresholds: action=None, spam data still returned for storage.
- - Superusers bypass all checks (returns score 0.0).
- """
- settings = request.registry.settings
- result = {"action": None, "spam_score": 0.0, "signals": [], "spam_reason": None}
-
- if settings.get("spam.enabled", "true").strip().lower() not in ("true", "1", "yes"):
- return result
-
- if user and getattr(user, "is_superuser", False):
- return result
-
- hard_threshold = float(settings.get("spam.hard_threshold", 0.8))
- soft_threshold = float(settings.get("spam.soft_threshold", 0.5))
-
- spam_score, signals = score_content(
- data,
- user=user,
- ip_address=str(request.client_addr),
- dbsession=request.dbsession,
- settings=settings,
- )
-
- spam_reason = None
-
- # LLM relevance check: runs when globally enabled AND namespace allows it
- llm_globally_enabled = settings.get(
- "spam.llm.enabled", "false"
- ).strip().lower() in ("true", "1", "yes")
- ns_filter_enabled = True
- if namespace and hasattr(namespace, "spam_filter_enabled"):
- ns_filter_enabled = namespace.spam_filter_enabled is not False
-
- if llm_globally_enabled and ns_filter_enabled:
- relevant, explanation = _llm_relevance_check(
- settings, data, title=title, namespace=namespace,
- parent_node=parent_node,
- )
- if explanation:
- spam_reason = explanation
- if relevant is False:
- spam_score = min(spam_score + 0.4, 1.0)
- signals.append("llm_irrelevant")
- if explanation:
- signals.append("llm_reason:{}".format(explanation[:80]))
-
- result["spam_score"] = spam_score
- result["signals"] = signals
- result["spam_reason"] = spam_reason
-
- if spam_score >= hard_threshold:
- request.response.status_code = 403
- result["action"] = "rejected"
- result["error"] = "Content flagged as spam"
- elif spam_score >= soft_threshold:
- result["action"] = "held"
-
- return result
-
-
-def _llm_relevance_check(settings, data, title=None, namespace=None,
- parent_node=None):
- """Run LLM relevance check if enabled. Returns (relevant, explanation).
-
- For replies, includes the parent page URL (embed mode) so the LLM knows
- what the parent site is about.
- """
- if parent_node is not None:
- # Reply: check relevance to thread
- root = parent_node.root if parent_node else None
- # In embed mode, root.uri.data has the parent page URL
- page_url = None
- if root and getattr(root, "has_uri", False) and root.uri:
- page_url = root.uri.data
- ns_name = namespace.name if namespace else None
- return check_reply_relevance(
- thread_title=root.title if root else None,
- thread_content=root.data if root else None,
- parent_content=parent_node.data if parent_node else None,
- reply_content=data,
- page_url=page_url,
- namespace_name=ns_name,
- settings=settings,
- )
- elif namespace is not None:
- # New thread: check relevance to namespace
- ns_desc = None
- if hasattr(namespace, "description"):
- ns_desc = namespace.description
- return check_thread_relevance(
- namespace_name=namespace.name,
- namespace_description=ns_desc,
- title=title,
- content=data,
- settings=settings,
- )
- return None, None
-
-
-def _get_git_commit():
- """Read the current git commit hash, once at import time.
-
- Checks commit-hash.txt (written by CI build) first,
- then falls back to git rev-parse for dev environments.
- """
- # CI build writes commit-hash.txt as a build artifact
- _this_dir = os.path.dirname(os.path.abspath(__file__))
- for candidate in [
- os.path.join(_this_dir, "..", "..", "commit-hash.txt"), # repo root
- os.path.join(sys.prefix, "commit-hash.txt"), # inside virtualenv
- "/opt/remarkbox/commit-hash.txt",
- ]:
- try:
- with open(candidate) as f:
- sha = f.read().strip()
- if sha:
- return sha[:7]
- except OSError:
- pass
-
- # Dev environment: read from git
- try:
- return subprocess.check_output(
- ["git", "rev-parse", "--short", "HEAD"],
- cwd=_this_dir,
- stderr=subprocess.DEVNULL,
- ).decode().strip()
- except Exception:
- return "unknown"
-
-
-_GIT_COMMIT = _get_git_commit()
-
-
-# ---------------------------------------------------------------------------
-# Version
-# ---------------------------------------------------------------------------
-
-
-@view_config(
- route_name="api-version",
- request_method="GET",
- renderer="json",
- require_csrf=False,
-)
-def api_version(request):
- """Return the deployed version (git commit)."""
- return {"version": _GIT_COMMIT}
-
-
-# ---------------------------------------------------------------------------
-# Threads
-# ---------------------------------------------------------------------------
-
-
-@view_config(
- route_name="api-threads-list",
- request_method="GET",
- renderer="json",
- require_csrf=False,
-)
-def api_list_threads(request):
- """List threads (root nodes) in a namespace."""
- namespace_name = get_param(request, "namespace")
- if not namespace_name:
- request.response.status_code = 400
- return {"error": "namespace parameter is required"}
-
- namespace = get_or_create_namespace(request.dbsession, namespace_name)
-
- denied = check_namespace_api_access(request, namespace)
- if denied:
- return denied
-
- roots = (
- namespace.visible_roots
- .limit(request.page_size)
- .offset(request.page_offset)
- .all()
- )
-
- return {
- "namespace": serialize_namespace_brief(namespace),
- "threads": [serialize_node(root, include_children=True) for root in roots],
- "page": request.page_number,
- "page_size": request.page_size,
- }
-
-
-@view_config(
- route_name="api-threads-search",
- request_method="GET",
- renderer="json",
- require_csrf=False,
-)
-def api_search_threads(request):
- """Search threads by keywords in title and content within a namespace."""
- namespace_name = get_param(request, "namespace")
- q = get_param(request, "q", "").strip()
-
- if not namespace_name:
- request.response.status_code = 400
- return {"error": "namespace parameter is required"}
-
- if not q or len(q) < 2:
- return {"threads": []}
-
- namespace = get_or_create_namespace(request.dbsession, namespace_name)
-
- from remarkbox.models.node import Node
- from sqlalchemy import or_, and_
-
- _STOP_WORDS = {
- "a", "an", "the", "is", "it", "in", "on", "of", "to", "do", "i",
- "we", "my", "me", "or", "if", "at", "by", "so", "no", "up", "am",
- "be", "he", "us", "you", "can", "did", "has", "had", "was", "are",
- "for", "not", "but", "how", "our", "its", "his", "her", "who",
- "all", "any", "got", "get", "this", "that", "with", "from",
- "your", "have", "will", "what", "when", "does", "there", "would",
- "should", "could",
- }
-
- def _escape(s):
- return s.replace("%", "\\%").replace("_", "\\_")
-
- def _clean_keyword(word):
- """Strip punctuation and return lowercase, or None if stop word."""
- cleaned = re.sub(r'[^\w-]', '', word).strip('-')
- if not cleaned or len(cleaned) < 2 or cleaned.lower() in _STOP_WORDS:
- return None
- return cleaned
-
- # Extract meaningful keywords from query.
- keywords = [_clean_keyword(w) for w in q.split()]
- keywords = [kw for kw in keywords if kw]
-
- # Fall back to whole query if all words were stop words.
- if not keywords:
- keywords = [q]
-
- # Build OR conditions: any keyword matching title or data.
- keyword_conditions = []
- for kw in keywords:
- pattern = "%{}%".format(_escape(kw))
- keyword_conditions.append(Node.title.ilike(pattern))
- keyword_conditions.append(Node.data.ilike(pattern))
-
- # Search root nodes.
- title_matches = (
- namespace.visible_roots
- .filter(or_(*keyword_conditions))
- .limit(10)
- .all()
- )
- seen_ids = {r.id for r in title_matches}
-
- # Also search child nodes and return their root threads.
- remaining = 10 - len(title_matches)
- child_roots = []
- if remaining > 0:
- child_conditions = []
- for kw in keywords:
- pattern = "%{}%".format(_escape(kw))
- child_conditions.append(Node.data.ilike(pattern))
-
- child_query = (
- request.dbsession.query(Node)
- .filter(
- Node.namespace_id == None, # child nodes
- Node.disabled == False,
- or_(*child_conditions),
- )
- )
-
- # Get distinct root_ids from matching children, scoped to namespace.
- children = child_query.limit(50).all()
- for child in children:
- root = child.root
- if root.id not in seen_ids and root.namespace == namespace:
- seen_ids.add(root.id)
- child_roots.append(root)
- if len(child_roots) >= remaining:
- break
-
- all_roots = title_matches + child_roots
-
- return {
- "threads": [
- {
- "id": str(root.id),
- "title": root.title,
- "path": root.path,
- "created_ago": root.human_created_timestamp,
- "stats": root.stats if root.cache else None,
- }
- for root in all_roots
- ],
- }
-
-
-@view_config(
- route_name="api-thread-detail",
- request_method="GET",
- renderer="json",
- require_csrf=False,
-)
-def api_get_thread(request):
- """Get a thread with its replies (paginated).
-
- Query parameters:
- limit: Maximum replies to return (default 100, max 500).
- offset: Number of replies to skip (default 0).
- """
- node_id = request.matchdict["node_id"]
- node = get_node_by_id(request.dbsession, node_id)
-
- if node is None:
- request.response.status_code = 404
- return {"error": "Thread not found"}
-
- root = node if node.is_root else node.root
- namespace = root.namespace
-
- denied = check_namespace_api_access(request, namespace)
- if denied:
- return denied
-
- # Parse pagination params
- try:
- limit = int(get_param(request, "limit", 100))
- except (TypeError, ValueError):
- limit = 100
- limit = max(1, min(limit, 500))
-
- try:
- offset = int(get_param(request, "offset", 0))
- except (TypeError, ValueError):
- offset = 0
- offset = max(0, offset)
-
- # Build SQL-side visibility filters (mirrors namespace.can_see_node logic
- # for anonymous / non-moderator users; moderators and node owners would
- # see hidden nodes but that edge case is small and acceptable to omit
- # from the API for performance).
- visibility_filters = {"disabled": False}
- if namespace.hide_unless_approved:
- visibility_filters["approved"] = True
- if namespace.hide_unverified:
- visibility_filters["verified"] = True
-
- # Get total visible reply count (excluding root) for pagination metadata
- count_query = get_nodes_who_share_root(
- request.dbsession, root,
- exclude_root=True,
- visibility_filters=visibility_filters,
- )
- total_replies = count_query.count()
-
- # Fetch the paginated slice
- nodes = get_nodes_who_share_root(
- request.dbsession, root, namespace.node_order,
- limit=limit, offset=offset,
- exclude_root=True,
- visibility_filters=visibility_filters,
- )
-
- page = (offset // limit) + 1 if limit else 1
-
- return {
- "namespace": serialize_namespace_brief(namespace),
- "thread": serialize_node(root, include_children=True),
- "replies": [serialize_node(n) for n in nodes],
- "total_replies": total_replies,
- "page": page,
- "limit": limit,
- "offset": offset,
- "has_more": (offset + limit) < total_replies,
- }
-
-
-@view_config(
- route_name="api-threads-list",
- request_method="POST",
- renderer="json",
- require_csrf=False,
-)
-def api_create_thread(request):
- """Create a new thread."""
- body = get_json_body(request)
- namespace_name = body.get("namespace") or request.params.get("namespace")
- title = body.get("title") or request.params.get("thread_title", "")
- data = body.get("data") or request.params.get("thread_data", "")
- thread_uri = body.get("thread_uri") or request.params.get("thread_uri", "")
- anonymous_name = (
- body.get("anonymous_name") or request.params.get("anonymous_name", "")
- ).strip()
- email = body.get("email") or request.params.get("email", "")
- source_format = body.get("source_format") or request.params.get("source_format", "")
- source_format = source_format.strip() if source_format else None
-
- if not namespace_name:
- request.response.status_code = 400
- return {"error": "namespace is required"}
-
- if not title:
- request.response.status_code = 400
- return {"error": "title is required"}
-
- if not data:
- request.response.status_code = 400
- return {"error": "data is required"}
-
- if len(data) > MAX_CONTENT_LENGTH:
- request.response.status_code = 400
- return {
- "error": "data exceeds maximum length of {} characters".format(
- MAX_CONTENT_LENGTH
- )
- }
-
- namespace = get_namespace_by_name(request.dbsession, namespace_name)
- if namespace is None:
- request.response.status_code = 404
- return {"error": "namespace '{}' does not exist".format(namespace_name)}
-
- denied = check_namespace_api_access(request, namespace)
- if denied:
- return denied
-
- # Determine user or surrogate
- user_surrogate = None
- user = request.user
-
- if not user and email:
- user = get_or_create_user_by_email(request.dbsession, email)
-
- # Spam check (before creating anything)
- spam_result = check_spam(request, data, user=user, namespace=namespace,
- title=title)
- if spam_result.get("action") == "rejected":
- return {"error": spam_result["error"], "spam_score": spam_result["spam_score"]}
-
- if namespace.allow_anonymous and not user:
- if not anonymous_name:
- anonymous_name = "Anonymous"
- user_surrogate = get_or_create_user_surrogate_by_name(
- request.dbsession, anonymous_name, namespace
- )
- elif user is None:
- request.response.status_code = 400
- return {"error": "email is required (or namespace must allow_anonymous)"}
-
- if thread_uri:
- # Simulate what the embed iframe does: get or create the root node
- # via URI, then post the comment as a reply under it.
- root = get_or_create_node_by_uri(
- request.dbsession, thread_uri, node_title=title
- )
- request.dbsession.add(root)
- request.dbsession.flush()
-
- # Create the comment as a child of the root (same as api_reply)
- node = root.new_child()
- node.ip_address = str(request.client_addr)
- node.set_data(data, namespace=namespace, dbsession=request.dbsession,
- source_format=source_format)
-
- if user_surrogate:
- node.user_surrogate = user_surrogate
- node.verified = True
- node_event = None
- request.dbsession.add(user_surrogate)
- else:
- node.user = user
- node.verified = user.authenticated
- node_event = node.new_event(user, "commented")
- request.dbsession.add(user)
-
- if spam_result.get("action") == "held":
- node.approved = False
-
- # Store spam data on node for moderation UI
- node.spam_score = spam_result.get("spam_score")
- node.spam_reason = spam_result.get("spam_reason")
-
- # Bump thread
- root.changed = node.changed
- root._invalidate_cache()
-
- request.dbsession.add(node)
- if node_event:
- request.dbsession.add(node_event)
- request.dbsession.add(root)
- request.dbsession.flush()
-
- if node_event:
- schedule_notifications(request, node_event)
-
- request.response.status_code = 201
- return {
- "node": serialize_node(node),
- "root_node_id": str(root.id),
- "verified": node.verified,
- }
-
- # No thread_uri — create a standalone thread (root node holds the content)
- node = create_root_node()
- node.namespace = namespace
- node.ip_address = str(request.client_addr)
- node.title = title
- node.set_data(data, dbsession=request.dbsession, source_format=source_format)
-
- if user_surrogate:
- node.user_surrogate = user_surrogate
- node.verified = True
- node_event = None
- request.dbsession.add(user_surrogate)
- else:
- node.user = user
- node.verified = user.authenticated
- node_event = node.new_event(user, "created")
- request.dbsession.add(user)
-
- if spam_result.get("action") == "held":
- node.approved = False
-
- # Store spam data on node for moderation UI
- node.spam_score = spam_result.get("spam_score")
- node.spam_reason = spam_result.get("spam_reason")
-
- request.dbsession.add(node)
- if node_event:
- request.dbsession.add(node_event)
- request.dbsession.add(namespace)
- request.dbsession.flush()
-
- if node_event:
- request.node = node
- schedule_notifications(request, node_event)
-
- request.response.status_code = 201
- return {
- "node": serialize_node(node),
- "verified": node.verified,
- }
-
-
-# ---------------------------------------------------------------------------
-# Replies
-# ---------------------------------------------------------------------------
-
-
-@view_config(
- route_name="api-thread-replies",
- request_method="POST",
- renderer="json",
- require_csrf=False,
-)
-def api_reply(request):
- """Reply to a thread (create a child node)."""
- node_id = request.matchdict["node_id"]
- parent = get_node_by_id(request.dbsession, node_id)
-
- if parent is None:
- request.response.status_code = 404
- return {"error": "Parent node not found"}
-
- if parent.disabled:
- request.response.status_code = 403
- return {"error": "Cannot reply to a disabled node"}
-
- if parent.root.locked:
- request.response.status_code = 403
- return {"error": "Thread is locked"}
-
- # Enforce max nesting depth (T8)
- namespace = parent.root.namespace
- if namespace.max_nesting_depth is not None:
- if parent.depth >= namespace.max_nesting_depth:
- request.response.status_code = 403
- return {"error": "Maximum nesting depth reached"}
-
- body = get_json_body(request)
- data = body.get("data") or request.params.get("thread_data", "")
- anonymous_name = (
- body.get("anonymous_name") or request.params.get("anonymous_name", "")
- ).strip()
- email = body.get("email") or request.params.get("email", "")
- source_format = body.get("source_format") or request.params.get("source_format", "")
- source_format = source_format.strip() if source_format else None
-
- if not data:
- request.response.status_code = 400
- return {"error": "data is required"}
-
- if len(data) > MAX_CONTENT_LENGTH:
- request.response.status_code = 400
- return {
- "error": "data exceeds maximum length of {} characters".format(
- MAX_CONTENT_LENGTH
- )
- }
-
- namespace = parent.root.namespace
-
- denied = check_namespace_api_access(request, namespace)
- if denied:
- return denied
-
- # Determine user or surrogate
- user_surrogate = None
- user = request.user
-
- if not user and email:
- user = get_or_create_user_by_email(request.dbsession, email)
-
- # Spam check (before creating anything)
- spam_result = check_spam(request, data, user=user, namespace=namespace,
- parent_node=parent)
- if spam_result.get("action") == "rejected":
- return {"error": spam_result["error"], "spam_score": spam_result["spam_score"]}
-
- if namespace.allow_anonymous and not user:
- if not anonymous_name:
- anonymous_name = "Anonymous"
- user_surrogate = get_or_create_user_surrogate_by_name(
- request.dbsession, anonymous_name, namespace
- )
- elif user is None:
- request.response.status_code = 400
- return {"error": "email is required (or namespace must allow_anonymous)"}
-
- # Create child node
- child = parent.new_child()
- child.ip_address = str(request.client_addr)
- child.set_data(data, namespace=namespace, dbsession=request.dbsession,
- source_format=source_format)
-
- if user_surrogate:
- child.user_surrogate = user_surrogate
- child.verified = True
- child_event = None
- request.dbsession.add(user_surrogate)
- else:
- child.user = user
- child.verified = user.authenticated
- child_event = child.new_event(user, "commented")
-
- if spam_result.get("action") == "held":
- child.approved = False
- elif namespace.hide_unless_approved:
- if user:
- child.approved = namespace.is_moderator(user)
- else:
- child.approved = False
-
- # Store spam data on node for moderation UI
- child.spam_score = spam_result.get("spam_score")
- child.spam_reason = spam_result.get("spam_reason")
-
- # Bump thread
- parent.root.changed = child.changed
- parent._invalidate_cache()
-
- if user:
- request.dbsession.add(user)
- request.dbsession.add(child)
- if child_event:
- request.dbsession.add(child_event)
- request.dbsession.add(parent)
- request.dbsession.add(parent.root)
- request.dbsession.flush()
-
- if child_event:
- schedule_notifications(request, child_event)
-
- request.response.status_code = 201
- return {
- "node": serialize_node(child),
- "verified": child.verified,
- }
-
-
-# ---------------------------------------------------------------------------
-# Nodes
-# ---------------------------------------------------------------------------
-
-
-@view_config(
- route_name="api-node-detail",
- request_method="GET",
- renderer="json",
- require_csrf=False,
-)
-def api_get_node(request):
- """Get a single node by ID."""
- node_id = request.matchdict["node_id"]
- node = get_node_by_id(request.dbsession, node_id)
-
- if node is None:
- request.response.status_code = 404
- return {"error": "Node not found"}
-
- denied = check_namespace_api_access(request, node.root.namespace)
- if denied:
- return denied
-
- return {"node": serialize_node(node)}
-
-
-@view_config(
- route_name="api-node-detail",
- request_method="PATCH",
- renderer="json",
- require_csrf=False,
-)
-def api_edit_node(request):
- """Edit an existing node (requires authentication)."""
- node_id = request.matchdict["node_id"]
- node = get_node_by_id(request.dbsession, node_id)
-
- if node is None:
- request.response.status_code = 404
- return {"error": "Node not found"}
-
- if not request.user or not request.user.authenticated:
- request.response.status_code = 401
- return {"error": "Authentication required"}
-
- namespace = node.root.namespace
-
- denied = check_namespace_api_access(request, namespace)
- if denied:
- return denied
-
- if not namespace.can_alter_node(node, request.user):
- request.response.status_code = 403
- return {"error": "You do not have permission to edit this node"}
-
- body = get_json_body(request)
- data = body.get("data") or request.params.get("thread_data", "")
- title = body.get("title") or request.params.get("thread_title", "")
- source_format = body.get("source_format") or request.params.get("source_format", "")
- source_format = source_format.strip() if source_format else None
-
- # Moderation flags (require can_alter_node, already checked above)
- disabled = body.get("disabled")
- approved = body.get("approved")
- locked = body.get("locked")
-
- has_content_change = bool(data or title)
- has_moderation_change = (disabled is not None or approved is not None
- or locked is not None)
-
- if not has_content_change and not has_moderation_change:
- request.response.status_code = 400
- return {"error": "data, title, disabled, approved, or locked is required"}
-
- if data and len(data) > MAX_CONTENT_LENGTH:
- request.response.status_code = 400
- return {
- "error": "data exceeds maximum length of {} characters".format(
- MAX_CONTENT_LENGTH
- )
- }
-
- if title and node.is_root:
- node.title = title
- if data:
- node.set_data(data, source_format=source_format)
- node.changed = now_timestamp()
- node._invalidate_cache()
-
- if disabled is True:
- node.disable()
- elif disabled is False:
- node.enable()
-
- if approved is True:
- node.approved = True
- elif approved is False:
- node.approved = False
-
- if locked is not None and node.is_root:
- node.locked = bool(locked)
-
- request.dbsession.add(node)
- request.dbsession.flush()
-
- return {"node": serialize_node(node)}
-
-
-@view_config(
- route_name="api-node-detail",
- request_method="DELETE",
- renderer="json",
- require_csrf=False,
-)
-def api_delete_node(request):
- """Delete a node permanently (requires moderator + sudo OTP)."""
- node_id = request.matchdict["node_id"]
- node = get_node_by_id(request.dbsession, node_id)
-
- if node is None:
- request.response.status_code = 404
- return {"error": "Node not found"}
-
- if not request.user or not request.user.authenticated:
- request.response.status_code = 401
- return {"error": "Authentication required"}
-
- namespace = node.root.namespace
-
- denied = check_namespace_api_access(request, namespace)
- if denied:
- return denied
-
- if not namespace.is_moderator(request.user):
- request.response.status_code = 403
- return {"error": "Only moderators can delete nodes"}
-
- # Sudo OTP gate.
- sudo_otp = request.headers.get("X-Sudo-OTP", "").strip()
- action_key = "delete_node:{}".format(node_id)
-
- if not sudo_otp:
- action_description = "Delete node {}".format(node_id)
- code = create_sudo_otp(
- request.dbsession,
- action_key,
- action_description,
- client_ip=str(request.client_addr),
- )
- send_sudo_otp_email(request, request.user.email, action_description, code)
- request.response.status_code = 202
- return {
- "status": "otp_required",
- "message": "A confirmation code has been sent to your email. "
- "Repeat this request with the X-Sudo-OTP header.",
- }
-
- ok, err = verify_sudo_otp(request.dbsession, action_key, sudo_otp)
- if not ok:
- request.response.status_code = 403
- return {"error": err}
-
- node_id_str = str(node.id)
- request.dbsession.delete(node)
- request.dbsession.flush()
-
- return {"deleted": node_id_str}
-
-
-# ---------------------------------------------------------------------------
-# Authentication
-# ---------------------------------------------------------------------------
-
-
-@view_config(
- route_name="api-auth-login",
- request_method="POST",
- renderer="json",
- require_csrf=False,
-)
-def api_auth_login(request):
- """Submit email to receive OTP."""
- body = get_json_body(request)
- email = body.get("email") or request.params.get("email", "")
-
- if not email or _email_regex.match(email) is None:
- request.response.status_code = 400
- return {"error": "A valid email address is required"}
-
- user = get_or_create_user_by_email(request.dbsession, email)
-
- if user.throttle_password():
- return {
- "status": "throttled",
- "message": "Verification code already sent to {}. Check email to log in.".format(
- email
- ),
- }
-
- raw_otp = user.new_password()
- request.dbsession.add(user)
- request.dbsession.flush()
-
- send_verification_digits_to_email(request, user.email, raw_otp)
-
- return {
- "status": "sent",
- "message": "Verification code sent to {}.".format(email),
- }
-
-
-@view_config(
- route_name="api-auth-verify",
- request_method="POST",
- renderer="json",
- require_csrf=False,
-)
-def api_auth_verify(request):
- """Submit OTP to verify and authenticate."""
- body = get_json_body(request)
- email = body.get("email") or request.params.get("email", "")
- raw_otp = body.get("otp") or request.params.get("raw-otp", "")
-
- if not email or not raw_otp:
- request.response.status_code = 400
- return {"error": "email and otp are required"}
-
- user = get_or_create_user_by_email(request.dbsession, email)
-
- if user.check_password(raw_otp):
- user.verified = True
- request.session["authenticated_user_id"] = str(user.id)
-
- verify_pending_nodes_in_session(request, user)
- user.create_default_reply_watcher()
-
- request.dbsession.add(user)
- request.dbsession.flush()
-
- return {
- "status": "authenticated",
- "user": {
- "id": str(user.id),
- "name": user.name,
- "email": user.email,
- },
- }
-
- request.response.status_code = 401
- return {"error": "Invalid verification code"}
-
-
-# ---------------------------------------------------------------------------
-# User Profile
-# ---------------------------------------------------------------------------
-
-
-@view_config(
- route_name="api-user-profile",
- request_method="GET",
- renderer="json",
- require_csrf=False,
-)
-def api_get_profile(request):
- """Get the current user's profile."""
- if not request.user or not request.user.authenticated:
- request.response.status_code = 401
- return {"error": "Authentication required"}
-
- return {
- "user": {
- "id": str(request.user.id),
- "name": request.user.name,
- "email": request.user.email,
- },
- }
-
-
-@view_config(
- route_name="api-user-profile",
- request_method="PATCH",
- renderer="json",
- require_csrf=False,
-)
-def api_update_profile(request):
- """Update the current user's profile (display name)."""
- if not request.user or not request.user.authenticated:
- request.response.status_code = 401
- return {"error": "Authentication required"}
-
- body = get_json_body(request)
- name = body.get("name", "").strip()
-
- if not name:
- request.response.status_code = 400
- return {"error": "name is required"}
-
- if not is_user_name_valid(name):
- request.response.status_code = 400
- return {"error": "name must be alphanumeric (dashes allowed)"}
-
- # Allow setting to current name (idempotent)
- if name.lower() != request.user.name.lower():
- if not is_user_name_available(request.dbsession, name):
- request.response.status_code = 409
- return {"error": "name is already taken"}
-
- request.user.name = name
- request.dbsession.add(request.user)
- request.dbsession.flush()
-
- return {
- "user": {
- "id": str(request.user.id),
- "name": request.user.name,
- "email": request.user.email,
- },
- }
-
-
-# ---------------------------------------------------------------------------
-# Clients
-# ---------------------------------------------------------------------------
-
-_client_dir = os.path.dirname(os.path.abspath(__file__))
-
-
-@view_config(
- route_name="api-client-python",
- request_method="GET",
- require_csrf=False,
-)
-def api_client_python(request):
- """Serve the Python client for agents to download."""
- path = os.path.join(_client_dir, "remarkbox_client.py")
- with open(path) as f:
- content = f.read()
- return Response(
- body=content,
- content_type="text/plain",
- charset="utf-8",
- )
-
-
-@view_config(
- route_name="api-client-c",
- request_method="GET",
- require_csrf=False,
-)
-def api_client_c(request):
- """Serve the C client for download.
-
- ?file=rb.h returns the header library instead of the CLI.
- """
- filename = request.params.get("file", "rb.c")
- if filename not in ("rb.c", "rb.h"):
- filename = "rb.c"
- path = os.path.join(_client_dir, filename)
- with open(path) as f:
- content = f.read()
- return Response(
- body=content,
- content_type="text/plain",
- charset="utf-8",
- )
-
-
-# ---------------------------------------------------------------------------
-# Admin (superuser only)
-# ---------------------------------------------------------------------------
-
-
-def _require_superuser(request):
- """Return error dict if user is not a superuser, else None."""
- if not request.user or not request.user.authenticated:
- request.response.status_code = 401
- return {"error": "Authentication required"}
- if not getattr(request.user, "is_superuser", False):
- request.response.status_code = 403
- return {"error": "Superuser access required"}
- return None
-
-
-@view_config(
- route_name="api-admin-namespaces",
- request_method="GET",
- renderer="json",
- require_csrf=False,
-)
-def api_admin_namespaces(request):
- """List all namespaces (superuser only)."""
- denied = _require_superuser(request)
- if denied:
- return denied
-
- namespaces = get_topsecret_namespaces(request.dbsession)
- return {
- "namespaces": [
- {
- "id": str(ns.id),
- "name": ns.name,
- "subscription_type": ns.subscription_type,
- "owner_count": len(ns.owners),
- "root_count": ns.roots.count(),
- }
- for ns in namespaces
- ],
- }
-
-
-@view_config(
- route_name="api-admin-recent-nodes",
- request_method="GET",
- renderer="json",
- require_csrf=False,
-)
-def api_admin_recent_nodes(request):
- """List recent nodes across all namespaces (superuser only).
-
- Query parameters:
- days: Number of days to look back (default 7, max 90).
- limit: Max results (default 100, max 500).
- """
- denied = _require_superuser(request)
- if denied:
- return denied
-
- import time
- try:
- days = int(get_param(request, "days", 7))
- except (TypeError, ValueError):
- days = 7
- days = max(1, min(days, 90))
-
- try:
- limit = int(get_param(request, "limit", 100))
- except (TypeError, ValueError):
- limit = 100
- limit = max(1, min(limit, 500))
-
- cutoff_ms = int((time.time() - days * 86400) * 1000)
-
- nodes = (
- request.dbsession.query(Node)
- .filter(Node.created > cutoff_ms)
- .order_by(Node.created.desc())
- .limit(limit)
- .all()
- )
-
- return {
- "days": days,
- "count": len(nodes),
- "nodes": [
- {
- "id": str(n.id),
- "root_id": str(n.root_id) if n.root_id else None,
- "namespace": n.root.namespace.name if n.root and n.root.namespace else None,
- "title": n.title,
- "data": n.data[:200] if n.data else None,
- "ip_address": n.ip_address,
- "created_ago": n.human_created_timestamp,
- "disabled": n.disabled,
- "verified": n.verified,
- "approved": n.approved,
- "author": n.user.name if n.user else (
- n.user_surrogate.name if n.user_surrogate else None
- ),
- }
- for n in nodes
- ],
- }
diff --git a/remarkbox/api/wiki.py b/remarkbox/api/wiki.py
deleted file mode 100644
index af17e66..0000000
--- a/remarkbox/api/wiki.py
+++ /dev/null
@@ -1,187 +0,0 @@
-"""Wiki mode and revision history API endpoints."""
-
-import difflib
-
-from pyramid.view import view_config
-
-from remarkbox.models.node import get_node_by_id, Node
-from remarkbox.models.revision import Revision
-
-from .views import check_namespace_api_access, get_json_body, MAX_CONTENT_LENGTH
-from .serializers import serialize_node
-
-from remarkbox.models.meta import get_object_by_id
-
-
-def serialize_revision(rev):
- """Serialize a Revision to a dict."""
- return {
- "id": str(rev.id),
- "node_id": str(rev.node_id),
- "user_id": str(rev.user_id) if rev.user_id else None,
- "author": rev.user.name if rev.user else None,
- "data": rev.data,
- "source_format": rev.source_format,
- "revision_number": rev.revision_number,
- "created": rev.created,
- }
-
-
-@view_config(
- route_name="api-node-revisions",
- request_method="GET",
- renderer="json",
- require_csrf=False,
-)
-def api_node_revisions(request):
- """Get revision history for a node."""
- node_id = request.matchdict["node_id"]
- node = get_node_by_id(request.dbsession, node_id)
-
- if node is None:
- request.response.status_code = 404
- return {"error": "Node not found"}
-
- namespace = node.root.namespace
- denied = check_namespace_api_access(request, namespace)
- if denied:
- return denied
-
- revisions = (
- request.dbsession.query(Revision)
- .filter(Revision.node_id == node.id)
- .order_by(Revision.revision_number.desc())
- .all()
- )
-
- return {
- "node_id": str(node.id),
- "revisions": [serialize_revision(r) for r in revisions],
- "count": len(revisions),
- }
-
-
-@view_config(
- route_name="api-node-wiki-edit",
- request_method="POST",
- renderer="json",
- require_csrf=False,
-)
-def api_wiki_edit(request):
- """Wiki-edit a node (creates a revision, any authenticated user if wiki mode)."""
- node_id = request.matchdict["node_id"]
- node = get_node_by_id(request.dbsession, node_id)
-
- if node is None:
- request.response.status_code = 404
- return {"error": "Node not found"}
-
- if not request.user or not request.user.authenticated:
- request.response.status_code = 401
- return {"error": "Authentication required"}
-
- namespace = node.root.namespace
-
- denied = check_namespace_api_access(request, namespace)
- if denied:
- return denied
-
- if not namespace.can_wiki_edit(node, request.user):
- request.response.status_code = 403
- return {"error": "Wiki editing not permitted for this node"}
-
- body = get_json_body(request)
- data = body.get("data", "")
-
- if not data:
- request.response.status_code = 400
- return {"error": "data is required"}
-
- if len(data) > MAX_CONTENT_LENGTH:
- request.response.status_code = 400
- return {"error": "data exceeds maximum length"}
-
- source_format = body.get("source_format")
-
- node.wiki_edit(data, user=request.user, source_format=source_format)
- request.dbsession.add(node)
- request.dbsession.flush()
-
- return {"node": serialize_node(node)}
-
-
-@view_config(
- route_name="api-revision-detail",
- request_method="GET",
- renderer="json",
- require_csrf=False,
-)
-def api_get_revision(request):
- """Get a specific revision by ID."""
- revision_id = request.matchdict["revision_id"]
-
- revision = get_object_by_id(request.dbsession, revision_id, Revision)
-
- if revision is None:
- request.response.status_code = 404
- return {"error": "Revision not found"}
-
- node = get_node_by_id(request.dbsession, revision.node_id)
- if node:
- namespace = node.root.namespace
- denied = check_namespace_api_access(request, namespace)
- if denied:
- return denied
-
- return {"revision": serialize_revision(revision)}
-
-
-@view_config(
- route_name="api-revision-diff",
- request_method="GET",
- renderer="json",
- require_csrf=False,
-)
-def api_revision_diff(request):
- """Compare two revisions of the same node via unified diff."""
- revision_id = request.matchdict["revision_id"]
- other_id = request.matchdict["other_id"]
-
- revision = get_object_by_id(request.dbsession, revision_id, Revision)
- if revision is None:
- request.response.status_code = 404
- return {"error": "Revision not found: {}".format(revision_id)}
-
- other = get_object_by_id(request.dbsession, other_id, Revision)
- if other is None:
- request.response.status_code = 404
- return {"error": "Revision not found: {}".format(other_id)}
-
- if revision.node_id != other.node_id:
- request.response.status_code = 400
- return {"error": "Revisions belong to different nodes"}
-
- node = get_node_by_id(request.dbsession, revision.node_id)
- if node:
- namespace = node.root.namespace
- denied = check_namespace_api_access(request, namespace)
- if denied:
- return denied
-
- from_lines = revision.data.splitlines(keepends=True)
- to_lines = other.data.splitlines(keepends=True)
- diff = difflib.unified_diff(
- from_lines,
- to_lines,
- fromfile="revision {}".format(revision.revision_number),
- tofile="revision {}".format(other.revision_number),
- )
-
- return {
- "from_revision": str(revision.id),
- "to_revision": str(other.id),
- "from_number": revision.revision_number,
- "to_number": other.revision_number,
- "node_id": str(revision.node_id),
- "diff": "".join(diff),
- }
diff --git a/remarkbox/lib/mail.py b/remarkbox/lib/mail.py
index 0fdd128..1589cf4 100644
--- a/remarkbox/lib/mail.py
+++ b/remarkbox/lib/mail.py
@@ -13,8 +13,6 @@ from remarkbox.lib.mail_messages import (
WELCOME_2_TEXT,
WELCOME_2_HTML,
OPERATOR_HTML,
- SUDO_OTP_TEXT,
- SUDO_OTP_HTML,
)
import dkim
@@ -199,14 +197,6 @@ def send_verification_digits_to_email(request, to_email, raw_digits):
send_pyramid_email(request, to_email, subject, message_text, message_html)
-def send_sudo_otp_email(request, to_email, action_description, code):
- """Send a sudo OTP confirmation email."""
- subject = "Security Verification - {}".format(code)
- message_text = SUDO_OTP_TEXT.format(action=action_description, code=code)
- message_html = SUDO_OTP_HTML.format(action=action_description, code=code)
- send_pyramid_email(request, to_email, subject, message_text, message_html)
-
-
def send_operator_email(request, msg):
send_pyramid_email(
request,
diff --git a/remarkbox/lib/mail_messages.py b/remarkbox/lib/mail_messages.py
index 4dda9a2..0af4bbf 100644
--- a/remarkbox/lib/mail_messages.py
+++ b/remarkbox/lib/mail_messages.py
@@ -117,50 +117,6 @@ WELCOME_2_HTML = """
</html>
"""
-SUDO_OTP_TEXT = """
-Security Verification Required
-
-Action: {action}
-
-Your one-time confirmation code is:
-
- \n{code}\n
-
-This code expires in 15 minutes.
-
-If you did not request this action, you can safely ignore this email.
-"""
-
-SUDO_OTP_HTML = """
-<!DOCTYPE html>
-<html>
-<head>
-<title>Security Verification
-
-
-
- Security Verification Required
-
- Action: {action}
-
- Your one-time confirmation code is:
-
- {code}
-
- This code expires in 15 minutes.
-
- If you did not request this action, you can safely ignore this email.
-
-