fix(vaults): stop false bad-key flags from a failed decode check

Judge a vault KID only on a file whose KID map holds it, tell remote vaults of a bad pair only once another key replaces it, and let the server CDM unflag a pair it returns; the server never flags a CDM-licensed pair. Log FFmpeg stderr on a failed check and name the missing CDM when none is set.

tests/remote/unit/test_server_cdm_key_verification.py

@@ -43,11 +43,12 @@ def test_client_marks_vault_keys_and_forgets_cdm_keys():
     assert svc.server_vault_keys == {}
 
 
-def test_report_bad_posts_only_the_pair():
+def test_server_vault_flag_posts_only_the_pair():
     svc = remote_service()
     posted: list = []
     svc.client = SimpleNamespace(post_optional=lambda ep, data: posted.append((ep, data)) or {})
-    svc.server_vault.report_bad(KID, "v")
+    assert svc.server_vault.report_now
+    svc.server_vault.flag_bad_key("SVC", KID, "v", "server_cdm")
     assert posted == [("/api/session/sess/keys/bad", {"kid": KID.hex, "key": "v"})]
 
 
@@ -77,18 +78,27 @@ def session(monkeypatch):
     return entry, vault
 
 
-async def test_server_flags_a_served_pair_with_its_own_vault_name(session):
+async def test_server_flags_a_served_pair_with_its_own_vault_name(session, monkeypatch):
     entry, vault = session
+    monkeypatch.setattr(handlers, "CACHED_PAIRS", {("SimpleNamespace", KID.hex, "v")})
     resp = await handlers.session_bad_key_handler({"kid": KID.hex, "key": "v"}, "sess")
     assert resp.status == 200
     assert vault.flagged == [("SVC", KID, "v", "sqlite")]
     assert KID.hex not in entry.served_keys
+    assert not handlers.CACHED_PAIRS
 
     with pytest.raises(APIError):
         await handlers.session_bad_key_handler({"kid": CDM_KID.hex, "key": "nope"}, "sess")
     assert len(vault.flagged) == 1
 
 
+async def test_server_does_not_flag_a_pair_its_cdm_licensed(session):
+    entry, vault = session
+    resp = await handlers.session_bad_key_handler({"kid": CDM_KID.hex, "key": "c"}, "sess")
+    assert json.loads(resp.body) == {"flagged": False}
+    assert vault.flagged == []
+
+
 class _WV:
     def __init__(self, b64, kids):
         self._pssh = SimpleNamespace(dumps=lambda: b64)
@@ -218,3 +228,20 @@ def test_reconstruct_drm_keeps_the_default_kid_of_a_pssh_without_kids():
     (drm,) = reconstruct_drm([{"type": "widevine", "pssh": content_id_only.dumps(), "kids": [str(KID)]}])
 
     assert real_kids(drm) == [KID]
+
+
+def test_a_cdm_licence_unflags_a_pair_a_client_reported(monkeypatch, tmp_path):
+    """The CDM returned the reported pair, so the client's decode check was wrong."""
+    from unshackle.core.vaults import Vaults
+    from unshackle.vaults.SQLite import SQLite
+
+    local = SQLite("local", tmp_path / "local.db")
+    vaults = Vaults("SVC")
+    vaults.vaults = [local]
+    vaults.flag_bad_key(KID, "ab" * 16)
+    monkeypatch.setattr(handlers, "load_server_vaults", lambda service: vaults)
+    monkeypatch.setattr(handlers, "CACHED_PAIRS", set())
+
+    handlers.cache_to_vaults({KID.hex: "ab" * 16}, "SVC")
+    assert not local.is_bad_key(KID, "ab" * 16)
+    assert local.get_key(KID, "SVC") == "ab" * 16

tests/remote/unit/test_server_cdm_vault_write.py

@@ -42,6 +42,9 @@ class FakeVaults:
     def is_flagged(self, kid, key):
         return False
 
+    def clear_licensed_flags(self, content_keys):
+        return []
+
     def add_keys(self, kid_keys):
         self.added.update(kid_keys)
         self.pushes.append(dict(kid_keys))
@@ -227,3 +230,21 @@ def test_cdm_only_trusts_server_vault_keys():
 
     assert vaults.sources == {}
     assert dl.LICENSE_KEY_CACHE == {CACHED: "k_cached"}
+
+
+@pytest.mark.parametrize("system", ["widevine", "playready"])
+def test_no_cdm_and_no_server_cdm_names_the_missing_cdm(system):
+    """The server does not license this service for the API key, and the client has no CDM for it."""
+    import click
+
+    from unshackle.core.drm import PlayReady, Widevine
+
+    cmd = make_cmd(FakeVaults())
+    cmd._remote_service = SimpleNamespace(_server_cdm=False)
+    cmd.cdm = None
+    cmd.cdm_for = lambda system, quality=None: None
+    drm_class = PlayReady if system == "playready" else Widevine
+    drm = drm_class.__new__(drm_class)
+    drm.content_keys = {}
+    with pytest.raises(click.ClickException, match="No CDM configured for TEST"):
+        prepare(cmd, drm, lambda **kwargs: None, NEW)