feat(vaults): report bad keys to the vault that served them

tests/core/test_vault_bad_keys.py

@@ -1,3 +1,4 @@
+import logging
 import time
 from pathlib import Path
 from types import SimpleNamespace
@@ -8,6 +9,7 @@ import pytest
 from unshackle.commands import dl as dl_module
 from unshackle.commands.dl import dl
 from unshackle.core.vaults import Vaults
+from unshackle.vaults.API import API
 from unshackle.vaults.SQLite import SQLite
 
 KID = UUID("11111111-2222-3333-4444-555555555555")
@@ -331,3 +333,47 @@ def test_a_sibling_verdict_during_the_decrypt_still_triggers_the_retry(
     assert path.read_bytes() == b"plain:" + GOOD.encode()
     assert drm.decrypted_with == [{KID: BAD}, {KID: GOOD}]
     assert licences == [GOOD]  # the good key in the run cache survives the flag of the bad one
+
+
+def test_api_vault_reports_the_pair_upstream(monkeypatch: pytest.MonkeyPatch, caplog: pytest.LogCaptureFixture) -> None:
+    api = API("vault", "https://vault.example/", "tok")
+    calls: list[tuple[str, str, object]] = []
+    ok = SimpleNamespace(status_code=200, raise_for_status=lambda: None, json=lambda: {"code": 0})
+    monkeypatch.setattr(api.session, "post", lambda url, **kw: calls.append(("POST", url, kw.get("json"))) or ok)
+    monkeypatch.setattr(api.session, "delete", lambda url, **kw: calls.append(("DELETE", url, None)) or ok)
+
+    vaults = Vaults("SVC")
+    vaults.vaults = [api]
+    vaults.sources[KID] = (BAD, api)
+    vaults.flag_bad_key(KID, BAD)
+    vaults.unflag_bad_key(KID, BAD)
+
+    assert calls == [
+        ("POST", f"https://vault.example/bad-keys/{KID.hex}", {"content_key": BAD, "service": "SVC"}),
+        ("DELETE", f"https://vault.example/bad-keys/{KID.hex}/{BAD}", None),
+    ]
+
+    calls.clear()
+    vaults.sources[KID] = (BAD, SimpleNamespace(name="other"))
+    vaults.flag_bad_key(KID, BAD)
+    assert calls == []
+    vaults.sources[KID] = (BAD, api)
+
+    monkeypatch.setattr(api.session, "post", lambda url, **kw: (_ for _ in ()).throw(ConnectionError("down")))
+    caplog.clear()
+    with caplog.at_level(logging.DEBUG, logger="unshackle.core.vaults"):
+        vaults.flag_bad_key(KID, BAD)
+    assert [r.levelname for r in caplog.records] == ["DEBUG"]
+
+    gone = SimpleNamespace(status_code=404, raise_for_status=lambda: (_ for _ in ()).throw(RuntimeError("404")))
+    monkeypatch.setattr(api.session, "post", lambda url, **kw: gone)
+    caplog.clear()
+    vaults.flag_bad_key(KID, BAD)
+    assert not caplog.records
+
+    denied = SimpleNamespace(status_code=200, raise_for_status=lambda: None, json=lambda: {"code": 1, "message": "no"})
+    monkeypatch.setattr(api.session, "post", lambda url, **kw: denied)
+    monkeypatch.setattr(api.session, "delete", lambda url, **kw: denied)
+    vaults.flag_bad_key(KID, BAD)
+    vaults.unflag_bad_key(KID, BAD)
+    assert not caplog.records

tests/remote/unit/test_server_cdm_key_verification.py

@@ -132,3 +132,17 @@ async def test_batch_reports_vault_keys_from_the_init_segment_pssh(monkeypatch):
     assert payload["keys"] == {"vid": {CDM_KID.hex: "v"}}
     assert payload["vault_keys"] == [CDM_KID.hex]
     assert session.served_keys == {CDM_KID.hex: ("v", "sqlite")}
+
+
+async def test_server_tells_a_remote_vault_only_when_it_served_the_pair(monkeypatch, session):
+    entry, local = session
+    bystander, source = _Vault(), _Vault()
+    bystander.local = source.local = False
+    bystander.name, source.name = "other", "sqlite"
+    monkeypatch.setattr(
+        handlers, "load_server_vaults", lambda name: SimpleNamespace(vaults=[local, bystander, source], service="SVC")
+    )
+    await handlers.session_bad_key_handler({"kid": KID.hex, "key": "v"}, "sess")
+    assert local.flagged == [("SVC", KID, "v", "sqlite")]
+    assert source.flagged == [("SVC", KID, "v", "sqlite")]
+    assert bystander.flagged == []