Merge pull request #173 from Nachtalb/fix/report-terse-messages

refactor: terse abuse-report messages, no P1/P2 jargon

Author: Nachtalb

reverse_image_search_bot/abuse_report/prepare.py

@@ -250,9 +250,9 @@ def restore_report_files(report_uuid: str, p1: str) -> str | None:
         try:
             data = crypto.decrypt_file(bytes(b["nonce"]), ct, key)
         except Exception:
-            return "image key (P1) incorrect"
+            return "image key incorrect"
         if crypto.sha256_hex(data) != b["plaintext_sha256"]:
-            return "image key (P1) incorrect"
+            return "image key incorrect"
         plaintexts.append((updir / b["saved_filename"], data))
     for fp, data in plaintexts:
         try:
@@ -332,35 +332,24 @@ def prepare_report(user_id: int, progress: Callable[[int, int], None] | None = N
     existing = abuse.active_report_for_user(user_id)
     if existing:
         return PrepareResult(
-            error=f"An active report already exists for user {user_id} (status: {existing['status']}).",
+            error=f"active report already open ({existing['status']})",
             existing_uuid=existing["report_uuid"],
         )
 
     present, recorded, cleared = _present_files(user_id)
     if not present:
         if cleared:
-            return PrepareResult(
-                error=f"All {cleared} remaining file(s) of user {user_id} are marked cleared — nothing to report."
-            )
+            return PrepareResult(error=f"all {cleared} remaining file(s) cleared — nothing to report")
         filed = abuse.latest_filed_report_for_user(user_id)
         if filed and filed.get("ncmec_report_id"):
-            n = filed.get("reported_files", 0)
-            others = f" along with {n - 1} other file(s)" if n and n > 1 else ""
             return PrepareResult(
-                error=(
-                    f"User {user_id} was already filed with NCMEC in report "
-                    f"#{filed['ncmec_report_id']}{others}. The plaintext files were "
-                    f"deleted from disk after filing (the encrypted copies are kept "
-                    f"in that report) — nothing new to report."
-                ),
+                error=f"already filed with NCMEC in report #{filed['ncmec_report_id']}",
                 filed_uuid=filed["report_uuid"],
                 filed_ncmec_id=filed["ncmec_report_id"],
             )
-        return PrepareResult(
-            error=f"User {user_id} has {recorded} recorded file(s) but none are still on disk — nothing to report."
-        )
+        return PrepareResult(error=f"{recorded} recorded file(s), none still on disk — nothing to report")
 
-    # P1 is the one-time image key — shown ONCE and never stored. The page
+    # The image key is generated here, shown ONCE and never stored. The page
     # password is a single global secret (REPORT_PAGE_PASSWORD), not per-report.
     p1 = crypto.gen_password()
     report_uuid = crypto.gen_report_uuid()

reverse_image_search_bot/abuse_report/server.py

@@ -249,7 +249,7 @@ def note(done: int, total: int) -> None:
 
 
 async def _dm_report_created(bot, admin_id: int | None, user_id: int, result) -> None:
-    """DM the admin the P1 image key + report link for an app-created report."""
+    """DM the admin the image key + report link for an app-created report."""
     if bot is None or not admin_id:
         return
     import html as _html
@@ -260,16 +260,15 @@ async def _dm_report_created(bot, admin_id: int | None, user_id: int, result) ->
     try:
         await bot.send_message(
             admin_id,
-            f"<b>Report prepared</b> for user <code>{user_id}</code> ({_html.escape(uname)})\n"
-            f"Encrypted <b>{result.encrypted}</b> file(s).\n\n"
-            f"<b>Image key (P1):</b> <code>{_html.escape(result.p1 or '')}</code>\n\n"
-            f"Open it from the reports console, or: {_html.escape(url)}\n\n"
-            f"<i>P1 is not stored — keep it to decrypt the images.</i>",
+            f"🆕 <code>{user_id}</code> {_html.escape(uname)} · {result.encrypted} file(s) offline\n"
+            f"Image key: <code>{_html.escape(result.p1 or '')}</code>\n\n"
+            f"{_html.escape(url)}\n\n"
+            f"<i>Shown once and not stored — losing it loses the files.</i>",
             parse_mode="HTML",
             disable_web_page_preview=True,
         )
     except Exception:
-        logger.warning("failed to DM P1 for app-created report %s", result.report_uuid, exc_info=True)
+        logger.warning("failed to DM the image key for app-created report %s", result.report_uuid, exc_info=True)
 
 
 async def index(request: web.Request) -> web.StreamResponse:
@@ -336,7 +335,7 @@ async def api_fetch_video(request: web.Request) -> web.Response:
     payload = await request.json()
     p1 = payload.get("image_key", "")
     if not p1:
-        raise web.HTTPBadRequest(text="image_key (P1) required")
+        raise web.HTTPBadRequest(text="image key required")
     blob = abuse.get_report_blob(int(request.match_info["blob_id"]))
     if not blob or blob["report_uuid"] != rep["report_uuid"]:
         raise web.HTTPNotFound(text="blob not found")
@@ -493,9 +492,9 @@ def _note(msg: str) -> None:
         try:
             plaintext = crypto.decrypt_file(bytes(b["nonce"]), cipher, key)
         except Exception as dec_err:
-            raise web.HTTPBadRequest(text="image key (P1) incorrect — decryption failed") from dec_err
+            raise web.HTTPBadRequest(text="image key incorrect — decryption failed") from dec_err
         if crypto.sha256_hex(plaintext) != b["plaintext_sha256"]:
-            raise web.HTTPBadRequest(text="image key (P1) incorrect — hash mismatch")
+            raise web.HTTPBadRequest(text="image key incorrect — hash mismatch")
         # Report the extracted frame/still. original_file_name keeps the
         # uploader's original name when we have one (important to preserve);
         # location_of_file is our PUBLIC copy's URL (the one that may have been
@@ -526,9 +525,9 @@ def _note(msg: str) -> None:
                 try:
                     vplain = crypto.decrypt_file(bytes(b["video_nonce"]), vfp.read_bytes(), key)
                 except Exception as verr:
-                    raise web.HTTPBadRequest(text="image key (P1) incorrect — video decryption failed") from verr
+                    raise web.HTTPBadRequest(text="image key incorrect — video decryption failed") from verr
                 if crypto.sha256_hex(vplain) != b["video_sha256"]:
-                    raise web.HTTPBadRequest(text="image key (P1) incorrect — video hash mismatch")
+                    raise web.HTTPBadRequest(text="image key incorrect — video hash mismatch")
                 files.append(
                     {
                         "kind": "video",
@@ -558,7 +557,7 @@ async def api_review(request: web.Request) -> web.Response:
     payload = await request.json()
     p1 = payload.get("image_key", "")
     if not p1:
-        raise web.HTTPBadRequest(text="image_key (P1) required")
+        raise web.HTTPBadRequest(text="image key required")
 
     files, selected = await _gather_selected_files(request, rep, p1)
     # Fetch the reported user's bio (best-effort) before reading the row, so it
@@ -619,7 +618,7 @@ async def api_submit(request: web.Request) -> web.Response:
     payload = await request.json()
     p1 = payload.get("image_key", "")
     if not p1:
-        raise web.HTTPBadRequest(text="image_key (P1) required")
+        raise web.HTTPBadRequest(text="image key required")
     uuid = rep["report_uuid"]
     if uuid in _submit_tasks and not _submit_tasks[uuid].done():
         return web.json_response({"ok": True, "status": abuse.REPORT_SUBMITTING})  # already running
@@ -700,7 +699,7 @@ async def api_cancel(request: web.Request) -> web.Response:
         payload = await request.json()
     p1 = payload.get("image_key", "")
     if not p1:
-        raise web.HTTPBadRequest(text="image_key (P1) required to restore the files")
+        raise web.HTTPBadRequest(text="image key required to restore the files")
     # Restore BEFORE purging the blobs — they are the only copy of the plaintext.
     # A wrong key aborts without writing anything, so the files stay recoverable.
     err = await asyncio.to_thread(restore_report_files, rep["report_uuid"], p1)

reverse_image_search_bot/abuse_report/static/report.html

@@ -133,7 +133,7 @@ <h1>NCMEC Abuse Report</h1>
 <main>
   <!-- Global page password gate -->
   <div class="card" id="unlock-card">
-    <input type="password" id="p2" autocomplete="off" placeholder="Report page password">
+    <input type="password" id="p2" autocomplete="off" placeholder="Page password">
     <div style="height:10px"></div>
     <button id="unlock-btn">Unlock report</button>
     <div class="muted" id="unlock-err" style="color:#f08a8a;margin-top:8px"></div>
@@ -153,10 +153,10 @@ <h1>NCMEC Abuse Report</h1>
       <div class="kv"><span>NCMEC report id</span><b id="r-ncmec">—</b></div>
     </div>
 
-    <!-- Decrypt (P1) -->
+    <!-- Decrypt with the image key -->
     <div class="card" id="decrypt-card">
       <label for="p1">Image decryption key</label>
-      <input type="password" id="p1" autocomplete="off" placeholder="Enter the image key to reveal thumbnails">
+      <input type="password" id="p1" autocomplete="off" placeholder="Image key">
       <div style="height:10px"></div>
       <button id="decrypt-btn">Decrypt &amp; show images</button>
       <div class="muted" id="decrypt-err" style="color:#f08a8a;margin-top:8px"></div>
@@ -216,7 +216,7 @@ <h2 id="notice-title"></h2>
 <dialog id="cancel-dlg">
   <div class="dlg-body">
     <h2>Cancel this report?</h2>
-    <div class="muted" style="margin-bottom:12px">The files are decrypted back onto disk and the encrypted blobs discarded. Needs the image key (P1) — it is the only copy.</div>
+    <div class="muted" style="margin-bottom:12px">The files are decrypted back onto disk and the encrypted blobs discarded. Needs the image key — the blobs are the only copy.</div>
     <label style="display:flex;gap:8px;align-items:flex-start;font-size:14px;color:#e8e8ea;margin-bottom:14px;cursor:pointer">
       <input type="checkbox" id="cancel-clear" style="margin-top:3px">
       <span>Mark all images in this round as <b>cleared</b>.</span>
@@ -607,7 +607,7 @@ <h2>Review — everything sent to NCMEC</h2>
   const ids = Object.keys(sel);
   if (!ids.length) { $("action-err").textContent = "Select at least one image."; return; }
   for (const id of ids) if (!sel[id]) { $("action-err").textContent = "Every selected image needs a classification (A1/A2/B1/B2/NR)."; return; }
-  if (!P1KEY) { $("action-err").textContent = "Decrypt the images first (the image key is needed to submit)."; return; }
+  if (!P1KEY) { $("action-err").textContent = "Decrypt the images first."; return; }
   const btn = $("review-btn"); btn.disabled = true; btn.textContent = "Preparing review…";
   try {
     await saveSelection();
@@ -826,8 +826,8 @@ <h2>Review — everything sent to NCMEC</h2>
 $("cancel-back-btn").onclick = () => cancelDlg.close();
 $("cancel-confirm-btn").onclick = async () => {
   const clearFiles = $("cancel-clear").checked;
-  // Cancelling restores the plaintext from the blobs, so it needs P1.
-  if (!$("p1").value) { cancelDlg.close(); $("action-err").textContent = "Enter the image key (P1) first — cancelling restores the files."; return; }
+  // Cancelling restores the plaintext from the blobs, so it needs the image key.
+  if (!$("p1").value) { cancelDlg.close(); $("action-err").textContent = "Enter the image key first — cancelling restores the files."; return; }
   try {
     await api("/api/cancel", {
       method: "POST", headers: { "Content-Type": "application/json" },

reverse_image_search_bot/abuse_report/static/reports.html

@@ -46,6 +46,8 @@
   .badge.cancelled, .badge.error, .badge.retracted, .badge.review { background: #3a1c1c; color: #f0a0a0; }
   .err { color: #f08a8a; font-size: 13px; margin-top: 8px; }
   code { background: #2a2c33; padding: 1px 5px; border-radius: 4px; }
+  code.copyable { cursor: pointer; border: 1px dashed #4a4c56; }
+  code.copyable:active { background: #3a6df0; color: #fff; }
   /* Tabs */
   .tabs { display: flex; gap: 8px; margin-bottom: 14px; }
   .tab { flex: 1; text-align: center; padding: 10px; border-radius: 9px; background: #1f2128; border: 1px solid #2a2c33; color: #9a9ba2; cursor: pointer; font-weight: 600; }
@@ -103,7 +105,7 @@ <h1>Abuse Reports</h1>
       <div class="card">
         <label for="target">Create a new report</label>
         <div class="row">
-          <textarea id="target" rows="2" placeholder="user id, @username, filename, #uid…, or paste Cloudflare file URLs" style="flex:1;min-width:180px"></textarea>
+          <textarea id="target" rows="1" placeholder="ID, @username, file or URLs" style="flex:1;min-width:180px"></textarea>
           <button id="create-btn">Create</button>
         </div>
         <div class="err" id="create-err"></div>
@@ -290,26 +292,29 @@ <h1>Abuse Reports</h1>
       row.style.marginBottom = "10px";
       if (res.uuid) {
         row.innerHTML =
-          `<div>🆕 <code>${res.user_id}</code> — encrypted <b>${res.encrypted}</b> file(s).</div>` +
-          `<div style="margin:4px 0">Image key (P1): <code>${escapeHtml(res.p1)}</code> ` +
-          `<span class="muted">(shown once — copy it)</span></div>`;
+          `<div>🆕 encrypted <b>${res.encrypted}</b> file(s).</div>` +
+          `<div style="margin:4px 0">Image key: <code class="copyable" data-copy="${escapeHtml(res.p1)}">${escapeHtml(res.p1)}</code></div>`;
       } else {
         const icon = res.ncmec_report_id ? "✅" : (res.existing_uuid ? "⏳" : "⏭");
-        row.innerHTML = `<div>${icon} <code>${res.user_id}</code> — ${escapeHtml(res.error || "nothing to report")}</div>`;
+        row.innerHTML = `<div>${icon} ${escapeHtml(res.error || "nothing to report")}</div>`;
       }
       const uuid = res.uuid || res.existing_uuid || res.filed_uuid;
       if (uuid) {
         const b = document.createElement("button");
-        b.textContent = "Open report " + res.user_id;
+        b.textContent = "Open " + res.user_id;
+        b.style.width = "100%";
         b.onclick = () => openReport(uuid);
         row.appendChild(b);
+      } else {
+        // No report to open — the id has nowhere else to live.
+        row.firstChild.innerHTML = `<code>${res.user_id}</code> · ` + row.firstChild.innerHTML;
       }
       ok.appendChild(row);
     }
     if ((j.unknown || []).length) {
       const u = document.createElement("div");
       u.className = "muted";
-      u.textContent = `❓ ${j.unknown.length} token(s) with no uploader on record: ${j.unknown.join(", ")}`;
+      u.textContent = `❓ no uploader on record: ${j.unknown.join(", ")}`;
       ok.appendChild(u);
     }
     $("target").value = "";
@@ -327,6 +332,24 @@ <h1>Abuse Reports</h1>
   return String(s).replace(/[&<>"']/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[c]));
 }
 
+// Tap a .copyable to copy its data-copy value (clipboard API needs a secure
+// context; the textarea fallback covers older Telegram webviews).
+document.addEventListener("click", ev => {
+  const el = ev.target.closest(".copyable");
+  if (!el) return;
+  const text = el.dataset.copy || el.textContent;
+  if (navigator.clipboard && navigator.clipboard.writeText) {
+    navigator.clipboard.writeText(text).catch(() => {});
+    return;
+  }
+  const ta = document.createElement("textarea");
+  ta.value = text;
+  document.body.appendChild(ta);
+  ta.select();
+  try { document.execCommand("copy"); } catch (e) {}
+  ta.remove();
+});
+
 // ============ Tabs ============
 document.querySelectorAll(".tab").forEach(t => {
   t.onclick = () => {

reverse_image_search_bot/commands/report.py

@@ -128,7 +128,7 @@ async def report_users(
                     "icon": "🆕",
                     "user_id": uid,
                     "username": uname,
-                    "detail": f"P1 <code>{html.escape(result.p1 or '')}</code> · {result.encrypted} file(s) offline",
+                    "detail": f"key <code>{html.escape(result.p1 or '')}</code> · {result.encrypted} file(s) offline",
                     "uuid": result.report_uuid,
                 }
             )
@@ -272,20 +272,15 @@ async def start_report(update: Update, context: ContextTypes.DEFAULT_TYPE, user_
     user = abuse.get_user(user_id) or {}
     uname = f"@{user['username']}" if user.get("username") else "—"
     launch = (
-        "Tap the <b>Open report</b> menu button (bottom-left ⊞) to open it."
+        "Tap the <b>Open report</b> menu button (bottom-left ⊞)."
         if menu_button_set
         else f"Open via the report menu button: {html.escape(url)}"
     )
     await update.message.reply_html(
-        f"<b>Report prepared</b> for user <code>{user_id}</code> ({html.escape(uname)})\n"
-        f"Encrypted <b>{result.encrypted}</b> file(s) and took them offline.\n\n"
-        + f"<b>Image key (P1):</b> <code>{html.escape(result.p1 or '')}</code>\n\n"
+        f"🆕 <code>{user_id}</code> {html.escape(uname)} · {result.encrypted} file(s) offline\n"
+        f"Image key: <code>{html.escape(result.p1 or '')}</code>\n\n"
         f"{launch}\n\n"
-        f"<i>Use the global page password to open the report, then P1 to decrypt "
-        f"the images. The files are no longer on disk — the encrypted blobs are "
-        f"the only copy, so P1 is NOT recoverable and losing it loses the files. "
-        f"Cancelling restores them to disk; filing keeps the reported ones "
-        f"encrypted in the DB, bans the user, and deletes the rest.</i>",
+        f"<i>Shown once and not stored — losing it loses the files.</i>",
         disable_web_page_preview=True,
     )
 

tests/test_abuse_prepare.py

@@ -101,7 +101,7 @@ def test_restore_with_wrong_key_writes_nothing(env):
     mkfiles(1, 2)
     result = prepare.prepare_report(1)
     err = prepare.restore_report_files(result.report_uuid or "", "totally-wrong-key")
-    assert "P1" in (err or "")
+    assert "image key" in (err or "")
     assert plaintexts(updir) == []  # nothing scattered into the upload dir
 
 

tests/test_report_command.py

@@ -114,8 +114,8 @@ async def test_report_bulk_urls_group_unique_users(abuse, tmp_path, monkeypatch)
     out = "\n".join(replies)
     # Two unique uploaders → two 🆕 rows (user 1 grouped despite two files).
     assert out.count("🆕") >= 2
-    # Both users' P1 keys are surfaced as "P1 <code>…".
-    assert out.count("P1 <code>") == 2
+    # Both users' image keys are surfaced as "key <code>…".
+    assert out.count("key <code>") == 2
     # The unknown file is reported.
     assert "UNKNOWN.jpg" in out and "no uploader on record" in out
     # Reports actually exist, one active per user.
@@ -142,7 +142,7 @@ async def test_report_single_target_by_username(abuse, tmp_path, monkeypatch):
     await rc.report_command(cast(Any, update), cast(Any, context))
 
     out = "\n".join(replies)
-    assert "🆕" in out and "55" in out and "P1 <code>" in out
+    assert "🆕" in out and "55" in out and "key <code>" in out
     assert abuse.active_report_for_user(55) is not None