refactored

modules/session.py

@@ -0,0 +1,68 @@
+from __future__ import annotations
+import logging
+import ssl
+import certifi
+
+_log = logging.getLogger(__name__)
+import requests
+import urllib3
+from requests.adapters import HTTPAdapter
+from typing import Any, Optional
+
+# On Windows, pip._vendor.truststore monkey-patches ssl.SSLContext.wrap_socket to add
+# a Windows trust store check AFTER Python's own TLS verification. Netflix's root CAs
+# are in certifi but not always in the Windows cert store, so the Windows check fails.
+# Patch _verify_peercerts (the truststore post-handshake hook) to a no-op so that
+# only Python's built-in verification against the certifi CA bundle is used.
+try:
+    import pip._vendor.truststore._api as _ts_api
+    _ts_api._verify_peercerts = lambda ssl_sock, server_hostname=None: None
+except Exception:
+    pass
+
+
+class CertifiAdapter(HTTPAdapter):
+    def __init__(self, ssl_context: Optional[ssl.SSLContext] = None, *args: Any, **kwargs: Any) -> None:
+        self._ssl_context = ssl_context
+        super().__init__(*args, **kwargs)
+
+    def init_poolmanager(self, *args: Any, **kwargs: Any) -> None:
+        if self._ssl_context is None:
+            ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+            ctx.load_verify_locations(cafile=certifi.where())
+            ctx.check_hostname = True
+            ctx.verify_mode = ssl.CERT_REQUIRED
+            self._ssl_context = ctx
+        else:
+            ctx = self._ssl_context
+        kwargs["ssl_context"] = ctx
+        super().init_poolmanager(*args, **kwargs)
+
+    def cert_verify(self, conn: Any, url: str, verify: bool, cert: Optional[Any]) -> None:
+        pass
+
+
+def setup_session(
+    verify_tls: bool = True,
+    proxy: Optional[str] = None,
+) -> requests.Session:
+    _log.debug("Creating session (TLS verify=%s, proxy=%s)", verify_tls, proxy)
+    session = requests.Session()
+    if verify_tls:
+        ssl_ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+        ssl_ctx.load_verify_locations(cafile=certifi.where())
+        ssl_ctx.check_hostname = True
+        ssl_ctx.verify_mode = ssl.CERT_REQUIRED
+        session.verify = certifi.where()
+        session.mount("https://", CertifiAdapter(ssl_context=ssl_ctx))
+    else:
+        session.verify = False
+        urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
+    if proxy:
+        session.proxies.update({"http": proxy, "https": proxy})
+        _log.debug("Proxy configured: %s", proxy)
+    session.headers.update({
+        "User-Agent": "Mozilla/5.0",
+        "Accept": "*/*",
+    })
+    return session