Add SFTP store helper to API

backend/sftp_store.py

@@ -1,58 +1,29 @@
 from __future__ import annotations
 
-def _rjoin(*parts):
-    out = []
-    for p in parts:
-        if not p:
-            continue
-        p = str(p).strip("/")
-        if p:
-            out.append(p)
-    return "/".join(out)
-
-
-import base64
 import os
 from pathlib import Path
-from typing import Optional, Tuple
-
 import paramiko
 
 
-def _sftp_client() -> Tuple[paramiko.SFTPClient, paramiko.Transport]:
+def _sftp_client() -> tuple[paramiko.SFTPClient, paramiko.Transport]:
     host = (os.environ.get("SFTP_HOST") or "").strip()
     user = (os.environ.get("SFTP_USER") or "").strip()
+    port = int((os.environ.get("SFTP_PORT") or "22").strip() or "22")
+    password = os.environ.get("SFTP_PASS")
+
     if not host or not user:
         raise RuntimeError("Missing SFTP_HOST or SFTP_USER")
-
-    port = int((os.environ.get("SFTP_PORT") or "22").strip())
-    password = os.environ.get("SFTP_PASS")
-    key_b64 = os.environ.get("SFTP_KEY_B64")
-    key_pass = os.environ.get("SFTP_KEY_PASSPHRASE")
+    if not password:
+        raise RuntimeError("Missing SFTP_PASS")
 
     t = paramiko.Transport((host, port))
-    if key_b64:
-        key_bytes = base64.b64decode(key_b64)
-        pkey = paramiko.RSAKey.from_private_key_file(_write_tmp_key(key_bytes), password=key_pass)
-        t.connect(username=user, pkey=pkey)
-    else:
-        if not password:
-            raise RuntimeError("Missing SFTP_PASS (or provide SFTP_KEY_B64)")
-        t.connect(username=user, password=password)
-
+    # force password-only auth
+    t.connect(username=user, password=password)
     return paramiko.SFTPClient.from_transport(t), t
 
 
-def _write_tmp_key(key_bytes: bytes) -> str:
-    # HF container FS is writable for tmp; keep it simple.
-    p = Path("/tmp/sftp_key.pem")
-    p.write_bytes(key_bytes)
-    os.chmod(p, 0o600)
-    return str(p)
-
-
 def _mkdir_p(sftp: paramiko.SFTPClient, remote_dir: str) -> None:
-    parts = remote_dir.strip("/").split("/")
+    parts = [p for p in remote_dir.strip("/").split("/") if p]
     cur = ""
     for part in parts:
         cur += "/" + part
@@ -62,23 +33,41 @@ def _mkdir_p(sftp: paramiko.SFTPClient, remote_dir: str) -> None:
             sftp.mkdir(cur)
 
 
-def store_to_sftp(pdf_id: str, template_id: str, cfg_json_bytes: bytes, pdf_bytes: bytes, pdf_name: str) -> str:
-    base = (os.environ.get("SFTP_BASE_DIR") or "/").rstrip("/")
-    remote_dir = f"{base}/{template_id}/{pdf_id}"
-    remote_cfg = f"{remote_dir}/trainer_config_{pdf_id}__{template_id}.json"
-    remote_pdf = f"{remote_dir}/{pdf_name or (pdf_id + '.pdf')}"
+def store_to_sftp(
+    pdf_id: str,
+    template_id: str,
+    cfg_json_bytes: bytes,
+    pdf_bytes: bytes,
+    pdf_name: str,
+) -> str:
+    """
+    Remote layout:
+      <base>/<template_id>/<pdf_id>/
+        trainer_config_<pdf_id>__<template_id>.json
+        <pdf_name or <pdf_id>.pdf>
+    """
+    base = (os.environ.get("SFTP_BASE_DIR") or "/").strip()
+    if not base.startswith("/"):
+        base = "/" + base
+    base = base.rstrip("/") or "/"
 
     sftp, transport = _sftp_client()
     try:
+        remote_dir = f"{base}/{template_id}/{pdf_id}".replace("//", "/")
         _mkdir_p(sftp, remote_dir)
+
+        remote_cfg = f"{remote_dir}/trainer_config_{pdf_id}__{template_id}.json"
+        remote_pdf_name = (pdf_name or f"{pdf_id}.pdf").lstrip("/")
+        remote_pdf = f"{remote_dir}/{remote_pdf_name}"
+
         with sftp.open(remote_cfg, "wb") as f:
             f.write(cfg_json_bytes)
         with sftp.open(remote_pdf, "wb") as f:
             f.write(pdf_bytes)
+
+        return remote_dir
     finally:
         try:
             sftp.close()
         finally:
             transport.close()
-
-    return remote_dir