Files
bambuddy/backend/app/schemas/makerworld.py
T
MartinNYHC 5da403ba0c Feature/makerworld (#1099)
* feat(makerworld): URL-paste import and print for MakerWorld models

  Add a dedicated /makerworld sidebar page where users paste a MakerWorld
  model URL and get the full plate list + one-click "Import to Library" or
  "Print Now". Closes the workflow gap that kept LAN-only users on the
  Bambu Handy app solely for MakerWorld download-and-send.

  The authenticated tier reuses the existing Bambu Cloud token that
  Bambuddy already stores for firmware checks and slicer settings --
  MakerWorld shares the same auth backend, so the same JWT works there.
  No separate OAuth flow, no companion browser extension, no credential
  hijack. Anonymous users can still paste a URL and see model metadata;
  the 3MF download itself requires the Cloud login.

  Print Now hands off to the existing PrintModal (plate picker + AMS
  mapping + dispatch) so multi-filament models work via the same code
  path as library-file prints. Imported 3MFs are stored through a new
  shared save_3mf_bytes_to_library() helper so the multipart upload
  route and the MakerWorld import route don't duplicate 3MF parsing +
  thumbnail extraction logic.

  LibraryFile gains indexed source_type + source_url columns. Re-pasting
  a URL for a model already in the library returns the existing row
  instead of re-downloading -- dedupe is by canonicalised URL, not SHA256,
  because MakerWorld's download URLs are signed and change per request.

  Thumbnail proxy (/makerworld/thumbnail) hot-links through the backend
  instead of directly to makerworld.bblmw.com -- the SPA's img-src CSP
  stays strict and users' IPs don't hit MakerWorld's CDN logs. The
  endpoint is intentionally unauthenticated since <img> tags can't carry
  a Bearer token; SSRF-guarded by a CDN host allowlist so it can't be
  used as a generic proxy.

  Search and browse-catalogue are explicitly out of scope. The public
  design/search endpoint returns empty results from server-originated
  requests (likely needs csrf/session state reproducible only from a
  real browser), and the __NEXT_DATA__ HTML fallback is blocked by
  Cloudflare. URL-paste covers the realistic discovery pattern (Reddit /
  YouTube / shared links).

  Headers match kloshi-io/makerworld-api-reverse's production-tested set
  (User-Agent: 3d-printing-service/1.0, x-bbl-* client identifiers,
  Referer). The /instance/{id}/f3mf call includes ?type=download which
  community userscripts use to signal legitimate download intent. 418
  responses (MakerWorld's CAPTCHA gate) retry once with backoff and then
  surface a clear actionable error with an "Open on MakerWorld" fallback
  link; we never try to evade bot detection.

  Permissions: new makerworld:view (browse metadata, view thumbnails) and
  makerworld:import (save 3MFs to library). Administrators and Operators
  get both; Viewers get view-only. Migration grants these to existing
  groups based on whether they already have library:upload / library:read.

  Disclaimer in the UI and wiki page mirrors kloshi's framing: not
  affiliated with or endorsed by MakerWorld or Bambu Lab, interoperability
  only, not intended to circumvent access controls.

  Tests: 30 backend (service + routes) + 4 frontend. Full backend suite
  (1931 tests) clean. Frontend build clean.

* feat(makerworld): ship working URL-paste import via api.bambulab.com iot-service

  The MakerWorld integration shipped in 0.2.4b1 dev was broken for most
  public models: the makerworld.com/design-service path returns "Please
  log in to download models" even with a valid Bambu Cloud bearer,
  because it's cookie-gated behind Cloudflare. Published reverse-
  engineering projects work around this by pasting browser cookies; we
  route around it entirely by using the api.bambulab.com/iot-service
  endpoint (documented by Pr0zak/YASTL#51), which accepts the same
  bearer Bambuddy already has and returns a presigned S3 URL.

  Working flow:
    GET api.bambulab.com/v1/design-service/design/{id}  → metadata
    GET api.bambulab.com/v1/iot-service/api/user/profile/{pid}?model_id=<str>
         Authorization: Bearer {cloud_token}             → signed S3 URL
    urllib.request (no redirects, no query re-encoding)  → bytes

  Notes on each step:
    - The model_id query param is the alphanumeric string from the
      design response (e.g. US2bb73b106683e5), NOT the integer designId
      from the /models/{N} URL. The import route fetches design metadata
      first to get it.
    - S3 presigned URLs MUST be fetched with urllib (not httpx/curl_cffi)
      because the signature is computed over exact query-string bytes;
      any normalising encoder breaks it with SignatureDoesNotMatch 400s
      (YASTL#52 hit the same issue). Wrapped in a no-redirect opener so
      the .amazonaws.com host allowlist guarantee isn't bypassed by a
      302 elsewhere.
    - The canonical source_url now includes profile_id so different
      plates of the same model get distinct library entries. Older rows
      from dev builds keep the model-level URL; the resolve endpoint's
      "already imported" check LIKEs both shapes.

  UI rebuild:
    - Per-plate Save + Save & Slice in Bambu Studio / OrcaSlicer (the
      plate is unsliced source, so "Print Now" was misleading and is
      replaced by an explicit slicer hand-off).
    - Import all plates with sequential progress.
    - Folder picker (default: auto-created top-level "MakerWorld"
      folder, created on first import, folder tree invalidated so
      File Manager shows it immediately).
    - Image gallery per plate with keyboard-navigable lightbox.
    - Recent imports sidebar (sticky on lg+, vertical list with
      jump-to-library / slicer / open-on-makerworld icons).
    - Inline follow-up actions on imported plate rows so the user
      doesn't scroll back to a top-of-page card.
    - Per-plate delete via the standard ConfirmModal (no window.confirm).
    - Elapsed-time + phase label during import so the 10-30s synchronous
      POST doesn't feel frozen.
    - URL-change detection drops the preview when the pasted URL
      diverges from the resolved one.

  Security hardening (found in review):
    - DOMPurify.sanitize on the MakerWorld HTML summary before
      dangerouslySetInnerHTML (user-authored content).
    - <img> tags in that HTML routed through the thumbnail proxy so
      the SPA's img-src 'self' data: blob: CSP isn't widened.
    - /makerworld/thumbnail uses follow_redirects=False (the host
      allowlist only covers the initial URL).
    - 3MF CDN fetch strips the bearer (signed URL is the credential).
    - S3 fetch uses a no-op HTTPRedirectHandler for the same reason.
    - Upstream filename is os.path.basename'd before persisting.

  Tests: 46 backend service unit tests, 19 route tests, 12 frontend
  tests — all passing. All user-facing strings localised across the
  8 UI languages.

* - frontend/src/App.tsx — removed the 3 stale <AdminRoute> lines (kept the 3 <PermissionRoute> equivalents). TSC + Vite both clean.
  - backend/tests/integration/test_auth_api.py — added # pragma: allowlist secret + # noqa: S106 on the test fixture line that GitGuardian flagged.
2026-04-23 14:10:14 +02:00

112 lines
3.9 KiB
Python

"""Pydantic schemas for the MakerWorld integration routes."""
from __future__ import annotations
from typing import Any
from pydantic import BaseModel, Field
class MakerWorldResolveRequest(BaseModel):
"""Body for POST /makerworld/resolve."""
url: str = Field(..., description="Any MakerWorld model URL (scheme optional)")
class MakerWorldResolvedModel(BaseModel):
"""Structured result of URL resolution.
``design`` and ``instances`` are passed through verbatim from MakerWorld's
API — we don't re-shape them because the frontend needs access to fields
MakerWorld may add over time (badges, license variants, etc.). Keeping
them as opaque dicts avoids brittle coupling.
"""
model_id: int
profile_id: int | None = Field(
default=None,
description="Specific profile from the URL's #profileId- fragment, if any",
)
design: dict[str, Any]
instances: list[dict[str, Any]]
already_imported_library_ids: list[int] = Field(
default_factory=list,
description="LibraryFile IDs that were previously imported from this model URL",
)
class MakerWorldImportRequest(BaseModel):
"""Body for POST /makerworld/import."""
model_id: int = Field(
...,
description="The MakerWorld design ID (the number in /models/{id}).",
)
profile_id: int | None = Field(
default=None,
description=(
"The profileId of the selected instance (plate configuration). Each "
"instance in `/design/{id}/instances` carries a `profileId` field — "
"the frontend forwards the picked one here. If omitted, the backend "
"falls back to the first available instance of the model."
),
)
instance_id: int | None = Field(
default=None,
description="Retained for backwards compatibility; no longer used by the download flow.",
)
folder_id: int | None = Field(default=None, description="Target library folder; null = root")
class MakerWorldRecentImport(BaseModel):
"""One row in the 'recent MakerWorld imports' list."""
library_file_id: int
filename: str
folder_id: int | None
thumbnail_path: str | None = Field(
default=None,
description="Relative path under /api/v1/library/files/{id}/thumbnail — "
"the frontend wraps it with a stream token to render.",
)
source_url: str | None = Field(
default=None,
description="Canonical MakerWorld URL (``https://makerworld.com/models/{id}"
"#profileId-{pid}``). The frontend uses it to build an 'Open on MakerWorld' "
"link and to extract model/profile ids without a second API round-trip.",
)
created_at: str
class MakerWorldImportResponse(BaseModel):
"""Result of a MakerWorld import."""
library_file_id: int
filename: str
folder_id: int | None = Field(
default=None,
description=(
"Folder the file was saved to — the auto-created 'MakerWorld' folder "
"by default, or whichever folder the caller specified. Surfaced so the "
"frontend can deep-link to File Manager → that folder after import."
),
)
profile_id: int | None = Field(
default=None,
description=(
"The MakerWorld profile (plate) id that was imported. Surfaced so the "
"frontend can match the response back to the plate row in the UI and "
"render inline 'view in library' / 'open in slicer' controls there."
),
)
was_existing: bool = Field(
description="True if a prior import from the same source URL was reused (no re-download)"
)
class MakerWorldStatus(BaseModel):
"""Integration health + auth status surfaced to the frontend."""
has_cloud_token: bool = Field(description="Whether the caller's account has a stored Bambu Cloud token")
can_download: bool = Field(description="Shortcut: has_cloud_token AND it looks valid. Downloads require it.")