mirror of
https://github.com/maziggy/bambuddy.git
synced 2026-10-05 13:41:36 +02:00
* feat(makerworld): URL-paste import and print for MakerWorld models
Add a dedicated /makerworld sidebar page where users paste a MakerWorld
model URL and get the full plate list + one-click "Import to Library" or
"Print Now". Closes the workflow gap that kept LAN-only users on the
Bambu Handy app solely for MakerWorld download-and-send.
The authenticated tier reuses the existing Bambu Cloud token that
Bambuddy already stores for firmware checks and slicer settings --
MakerWorld shares the same auth backend, so the same JWT works there.
No separate OAuth flow, no companion browser extension, no credential
hijack. Anonymous users can still paste a URL and see model metadata;
the 3MF download itself requires the Cloud login.
Print Now hands off to the existing PrintModal (plate picker + AMS
mapping + dispatch) so multi-filament models work via the same code
path as library-file prints. Imported 3MFs are stored through a new
shared save_3mf_bytes_to_library() helper so the multipart upload
route and the MakerWorld import route don't duplicate 3MF parsing +
thumbnail extraction logic.
LibraryFile gains indexed source_type + source_url columns. Re-pasting
a URL for a model already in the library returns the existing row
instead of re-downloading -- dedupe is by canonicalised URL, not SHA256,
because MakerWorld's download URLs are signed and change per request.
Thumbnail proxy (/makerworld/thumbnail) hot-links through the backend
instead of directly to makerworld.bblmw.com -- the SPA's img-src CSP
stays strict and users' IPs don't hit MakerWorld's CDN logs. The
endpoint is intentionally unauthenticated since <img> tags can't carry
a Bearer token; SSRF-guarded by a CDN host allowlist so it can't be
used as a generic proxy.
Search and browse-catalogue are explicitly out of scope. The public
design/search endpoint returns empty results from server-originated
requests (likely needs csrf/session state reproducible only from a
real browser), and the __NEXT_DATA__ HTML fallback is blocked by
Cloudflare. URL-paste covers the realistic discovery pattern (Reddit /
YouTube / shared links).
Headers match kloshi-io/makerworld-api-reverse's production-tested set
(User-Agent: 3d-printing-service/1.0, x-bbl-* client identifiers,
Referer). The /instance/{id}/f3mf call includes ?type=download which
community userscripts use to signal legitimate download intent. 418
responses (MakerWorld's CAPTCHA gate) retry once with backoff and then
surface a clear actionable error with an "Open on MakerWorld" fallback
link; we never try to evade bot detection.
Permissions: new makerworld:view (browse metadata, view thumbnails) and
makerworld:import (save 3MFs to library). Administrators and Operators
get both; Viewers get view-only. Migration grants these to existing
groups based on whether they already have library:upload / library:read.
Disclaimer in the UI and wiki page mirrors kloshi's framing: not
affiliated with or endorsed by MakerWorld or Bambu Lab, interoperability
only, not intended to circumvent access controls.
Tests: 30 backend (service + routes) + 4 frontend. Full backend suite
(1931 tests) clean. Frontend build clean.
* feat(makerworld): ship working URL-paste import via api.bambulab.com iot-service
The MakerWorld integration shipped in 0.2.4b1 dev was broken for most
public models: the makerworld.com/design-service path returns "Please
log in to download models" even with a valid Bambu Cloud bearer,
because it's cookie-gated behind Cloudflare. Published reverse-
engineering projects work around this by pasting browser cookies; we
route around it entirely by using the api.bambulab.com/iot-service
endpoint (documented by Pr0zak/YASTL#51), which accepts the same
bearer Bambuddy already has and returns a presigned S3 URL.
Working flow:
GET api.bambulab.com/v1/design-service/design/{id} → metadata
GET api.bambulab.com/v1/iot-service/api/user/profile/{pid}?model_id=<str>
Authorization: Bearer {cloud_token} → signed S3 URL
urllib.request (no redirects, no query re-encoding) → bytes
Notes on each step:
- The model_id query param is the alphanumeric string from the
design response (e.g. US2bb73b106683e5), NOT the integer designId
from the /models/{N} URL. The import route fetches design metadata
first to get it.
- S3 presigned URLs MUST be fetched with urllib (not httpx/curl_cffi)
because the signature is computed over exact query-string bytes;
any normalising encoder breaks it with SignatureDoesNotMatch 400s
(YASTL#52 hit the same issue). Wrapped in a no-redirect opener so
the .amazonaws.com host allowlist guarantee isn't bypassed by a
302 elsewhere.
- The canonical source_url now includes profile_id so different
plates of the same model get distinct library entries. Older rows
from dev builds keep the model-level URL; the resolve endpoint's
"already imported" check LIKEs both shapes.
UI rebuild:
- Per-plate Save + Save & Slice in Bambu Studio / OrcaSlicer (the
plate is unsliced source, so "Print Now" was misleading and is
replaced by an explicit slicer hand-off).
- Import all plates with sequential progress.
- Folder picker (default: auto-created top-level "MakerWorld"
folder, created on first import, folder tree invalidated so
File Manager shows it immediately).
- Image gallery per plate with keyboard-navigable lightbox.
- Recent imports sidebar (sticky on lg+, vertical list with
jump-to-library / slicer / open-on-makerworld icons).
- Inline follow-up actions on imported plate rows so the user
doesn't scroll back to a top-of-page card.
- Per-plate delete via the standard ConfirmModal (no window.confirm).
- Elapsed-time + phase label during import so the 10-30s synchronous
POST doesn't feel frozen.
- URL-change detection drops the preview when the pasted URL
diverges from the resolved one.
Security hardening (found in review):
- DOMPurify.sanitize on the MakerWorld HTML summary before
dangerouslySetInnerHTML (user-authored content).
- <img> tags in that HTML routed through the thumbnail proxy so
the SPA's img-src 'self' data: blob: CSP isn't widened.
- /makerworld/thumbnail uses follow_redirects=False (the host
allowlist only covers the initial URL).
- 3MF CDN fetch strips the bearer (signed URL is the credential).
- S3 fetch uses a no-op HTTPRedirectHandler for the same reason.
- Upstream filename is os.path.basename'd before persisting.
Tests: 46 backend service unit tests, 19 route tests, 12 frontend
tests — all passing. All user-facing strings localised across the
8 UI languages.
* - frontend/src/App.tsx — removed the 3 stale <AdminRoute> lines (kept the 3 <PermissionRoute> equivalents). TSC + Vite both clean.
- backend/tests/integration/test_auth_api.py — added # pragma: allowlist secret + # noqa: S106 on the test fixture line that GitGuardian flagged.
112 lines
3.9 KiB
Python
112 lines
3.9 KiB
Python
"""Pydantic schemas for the MakerWorld integration routes."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from typing import Any
|
|
|
|
from pydantic import BaseModel, Field
|
|
|
|
|
|
class MakerWorldResolveRequest(BaseModel):
|
|
"""Body for POST /makerworld/resolve."""
|
|
|
|
url: str = Field(..., description="Any MakerWorld model URL (scheme optional)")
|
|
|
|
|
|
class MakerWorldResolvedModel(BaseModel):
|
|
"""Structured result of URL resolution.
|
|
|
|
``design`` and ``instances`` are passed through verbatim from MakerWorld's
|
|
API — we don't re-shape them because the frontend needs access to fields
|
|
MakerWorld may add over time (badges, license variants, etc.). Keeping
|
|
them as opaque dicts avoids brittle coupling.
|
|
"""
|
|
|
|
model_id: int
|
|
profile_id: int | None = Field(
|
|
default=None,
|
|
description="Specific profile from the URL's #profileId- fragment, if any",
|
|
)
|
|
design: dict[str, Any]
|
|
instances: list[dict[str, Any]]
|
|
already_imported_library_ids: list[int] = Field(
|
|
default_factory=list,
|
|
description="LibraryFile IDs that were previously imported from this model URL",
|
|
)
|
|
|
|
|
|
class MakerWorldImportRequest(BaseModel):
|
|
"""Body for POST /makerworld/import."""
|
|
|
|
model_id: int = Field(
|
|
...,
|
|
description="The MakerWorld design ID (the number in /models/{id}).",
|
|
)
|
|
profile_id: int | None = Field(
|
|
default=None,
|
|
description=(
|
|
"The profileId of the selected instance (plate configuration). Each "
|
|
"instance in `/design/{id}/instances` carries a `profileId` field — "
|
|
"the frontend forwards the picked one here. If omitted, the backend "
|
|
"falls back to the first available instance of the model."
|
|
),
|
|
)
|
|
instance_id: int | None = Field(
|
|
default=None,
|
|
description="Retained for backwards compatibility; no longer used by the download flow.",
|
|
)
|
|
folder_id: int | None = Field(default=None, description="Target library folder; null = root")
|
|
|
|
|
|
class MakerWorldRecentImport(BaseModel):
|
|
"""One row in the 'recent MakerWorld imports' list."""
|
|
|
|
library_file_id: int
|
|
filename: str
|
|
folder_id: int | None
|
|
thumbnail_path: str | None = Field(
|
|
default=None,
|
|
description="Relative path under /api/v1/library/files/{id}/thumbnail — "
|
|
"the frontend wraps it with a stream token to render.",
|
|
)
|
|
source_url: str | None = Field(
|
|
default=None,
|
|
description="Canonical MakerWorld URL (``https://makerworld.com/models/{id}"
|
|
"#profileId-{pid}``). The frontend uses it to build an 'Open on MakerWorld' "
|
|
"link and to extract model/profile ids without a second API round-trip.",
|
|
)
|
|
created_at: str
|
|
|
|
|
|
class MakerWorldImportResponse(BaseModel):
|
|
"""Result of a MakerWorld import."""
|
|
|
|
library_file_id: int
|
|
filename: str
|
|
folder_id: int | None = Field(
|
|
default=None,
|
|
description=(
|
|
"Folder the file was saved to — the auto-created 'MakerWorld' folder "
|
|
"by default, or whichever folder the caller specified. Surfaced so the "
|
|
"frontend can deep-link to File Manager → that folder after import."
|
|
),
|
|
)
|
|
profile_id: int | None = Field(
|
|
default=None,
|
|
description=(
|
|
"The MakerWorld profile (plate) id that was imported. Surfaced so the "
|
|
"frontend can match the response back to the plate row in the UI and "
|
|
"render inline 'view in library' / 'open in slicer' controls there."
|
|
),
|
|
)
|
|
was_existing: bool = Field(
|
|
description="True if a prior import from the same source URL was reused (no re-download)"
|
|
)
|
|
|
|
|
|
class MakerWorldStatus(BaseModel):
|
|
"""Integration health + auth status surfaced to the frontend."""
|
|
|
|
has_cloud_token: bool = Field(description="Whether the caller's account has a stored Bambu Cloud token")
|
|
can_download: bool = Field(description="Shortcut: has_cloud_token AND it looks valid. Downloads require it.")
|