# Vishow.top — implementation draft 0.1.1

This project updates **vishow.top**. It is independent of vishowtools.com.

**Status:** review draft, locally tested. It has not been deployed or approved as a production release. Provider credentials, account-specific data access, real-browser rendering, and the target Nginx configuration still require verification.

## What is included

- Six main pages: Home, IP Check, AI & Media, Password, 2FA Codes, and Wi-Fi QR.
- Field Notes theme: warm ivory surfaces, forest-green accents, editorial headings and horizontal navigation.
- Wi-Fi QR generator: local processing, password visibility, hidden networks, clear, and PNG/SVG downloads.
- IP Check has three tabs. Sections 01 and 02 share one card with two headers; Sections 03 and 04 retain the provider comparisons.
- Section 05 is on AI & Media, with AI/media categories, status/region/type rows, and expandable evidence.
- IPinfo Lite uses exactly the eight requested fields.
- Nine optional reputation/classification connectors retain separate scores and flags. Empty credentials disable a provider; no demo keys or author intermediary are used.
- The local checker covers nine AI services and seven media services. Browser observations and locally imported JSON reports are also supported.
- Passwords and 2FA secrets stay in the browser. External fonts and the original inline JavaScript have been removed.
- Existing plain-text endpoints are retained. `/all.json` is now encoded by Python instead of interpolating unescaped headers into JSON.

## Wi-Fi QR generator

Open `/wifi.html` after serving the `public/` directory over HTTP or HTTPS. ES modules should not be opened through `file://`. No API, IPinfo token, database or server change is needed for this tool.

Enter the exact SSID, choose WPA/WPA2 Personal, open or WEP, and enter the password where required. Hidden networks are supported. Generate, then download PNG or SVG. PNG is drawn at an integer module scale; both exports have a white quiet zone. Downloads contain QR geometry and no extra metadata or printed password. The encoded credentials remain recoverable by anyone who can scan the image.

Inputs are kept only in page memory; there is no browser storage, credential upload or analytics. Editing credentials removes the old code and disables downloads. Clear and page navigation clear the fields and revoke outstanding download URLs. A pending PNG export is discarded if the inputs change. Enterprise Wi-Fi, captive portals and WPA3-only networks are not supported. Physical iPhone/Android joining has not been tested; verify on your intended phones before publishing.

The tests use dev-only packages listed in `package.json`: `npm run test:wifi` verifies escaping, validation, independent PNG/SVG decoding and form state. These packages are not required by the deployed frontend. The bundled encoder's MIT notice is retained; see NOTICE.md.

## What Section 05 can establish

The current implementation makes **unauthenticated web requests**. It reports responses, redirects, authentication requirements, challenges, explicit structured country restrictions, rate limits, and transport failures. It does not log into user accounts or make paid model calls. Each local probe may follow at most two HTTPS redirects on its exact initial hostname; external destinations and sign-in redirects are not followed. Rate limits and challenges stop supplementary requests.

**It does not yet fully replace the original script’s media-unlock heuristics.** A successful page response does not prove usable chat, media playback, catalogue access, or subscription eligibility. Automated Native/ViaDNS detection and authoritative service-region detection are not implemented. YouTube and Prime Video may show explicitly labelled **page hints** from `contentRegion` and `currentTerritory`; these can reflect page configuration rather than playback territory. Conflicting hints remain unknown.

The local checker retains each endpoint result in `services[].probes`, and the website displays it under Evidence by service. ChatGPT includes a separate OpenAI API compliance endpoint observation taken from the uploaded script; its response never overrides the ChatGPT website verdict. Netflix includes the original two title URLs, and Reddit includes the original chat-page URL. These undocumented endpoint heuristics still need live verification; a title page is not proof of playback. Claude, Grok, Perplexity, Gemini, Copilot, DeepSeek, Qwen, Mistral, TikTok, Disney+ and Spotify currently have website-response checks only. No universal AI availability verdict is claimed.

No extra token is required for service probes. Run them on the intended connection; IPinfo credentials are only for IP data. Tests contact the services directly, so the services see the source IP. No report is sent to the original script author.

The Bash checker must run on the device or VPS whose connection is being checked. Entering a remote IP permits database lookup only; it cannot make requests originate from that IP. VPN and split-routing rules can produce different exit IPs for different destinations.

## Stack and files

| Component | Implementation |
| --- | --- |
| Website | Separate HTML, CSS and JavaScript; no frontend build step |
| Backend | Python 3.11+ and FastAPI; tested here on Python 3.12.14 |
| Local checker | Bash interface, curl transport, jq terminal formatting, shared Python parser |
| Hosting candidate | Existing Nginx HTTPS server, with an API Unix socket |
| Data storage | Bounded temporary memory cache; no application database |

`check.sh` renders Sections 1–5 in the terminal or emits JSON. `backend/diagnostics.py` validates addresses, makes bounded curl requests, and parses responses. Moving parsing out of shell expressions avoids executing text returned by providers.

No root access is required to run the checker. It does not install packages, change routing, scrape demo credentials, contact the original author’s counter, upload reports, test mail, or run downloaded code.

## Local checker

Required installed commands: Bash, Python 3.11+, curl and jq. The Python engine uses only the standard library; the local checker does not require FastAPI.

Read-only dependency check:

```bash
printf '\n\n\n\n'
command -v bash python3 curl jq
python3 --version
bash -n check.sh
./check.sh --help
```

From this project directory, `./check.sh --services all` contacts the configured providers and all listed services. Its default family is IPv4. `--ipv6` selects IPv6 where the route supports it. An optional `VISHOW_PROXY` environment variable explicitly selects an HTTP(S) or SOCKS proxy. Ordinary proxy environment variables and `.curlrc` are ignored so the route is deliberate.

To create a browser-importable report:

```bash
./check.sh --json --services all > report.json
```

This writes or replaces `report.json` in the current directory. Choose another filename to preserve an earlier report. The file contains the detected public IP and results; no upload occurs. Verify it with `jq '.schema_version, .subject, (.services | length)' report.json`. Delete the file when it is no longer needed.

For an explicit database lookup, use `./check.sh --ip 8.8.8.8 --services none`. `8.8.8.8` is only a public example, not your IP. Service probes are intentionally rejected with an explicit remote IP.

Without an IPinfo token, local IP detection falls back to `https://vishow.top/ip`. If that endpoint cannot be reached, service probes can still run, but the report says the public IP was not detected.

## Provider configuration

Enter credentials locally, outside the public web root. Do not send real tokens in chat. The supplied `deploy/api.env.example` contains empty values only.

| Variable | Purpose |
| --- | --- |
| `IPINFO_TOKEN` | The eight-field IPinfo Lite response |
| `IPINFO_EXTENDED_TOKEN` | Optional legacy extended IPinfo data; Lite alone does not provide these fields |
| `IPAPI_KEY` | ipapi.is classification, abuse ratio and flags |
| `IPREGISTRY_KEY` | ipregistry classification and security fields |
| `IP2LOCATION_KEY` | IP2Location.io; available fields depend on the plan |
| `ABUSEIPDB_KEY` | Abuse confidence and usage classification |
| `IPQS_KEY` | IPQS fraud score and flags |
| `DBIP_KEY` | DB-IP v2; threat fields require the appropriate product |
| `IPDATA_KEY` | ipdata threat fields where included in the account |
| `SCAMALYTICS_KEY`, `SCAMALYTICS_ENDPOINT` | Exact HTTPS account endpoint and key; no guessed endpoint |

IPinfo Lite has country/continent and ASN data, not reputation data. The current ipapi.is documentation says its anonymous response is minimal; a key is needed for the security fields. Its free account currently offers a daily allowance, but this does not make the other providers’ products free. Confirm account terms before enabling a public service.

Scamalytics, DB-IP extended fields, ipregistry and ipdata mappings are adapted from the supplied script. Their account-specific responses have not been tested with real credentials. Every missing field stays null. API errors, quotas, and unsupported response shapes remain visible per source.

## Backend and deployment preparation

The supplied service and Nginx files are **review candidates**, not an installer. Proposed paths:

- Project: `/opt/vishow-top`
- Existing public root: `/var/www/vishowTool`
- Credentials: `/etc/vishow-top/api.env`, readable only by the administrator/service setup
- API socket: `/run/vishow-top/api.sock`
- Service account in the candidate: `www-data`

Confirm the real Nginx user, existing listeners, current configuration and target paths before using these candidates. The uploaded configuration uses standalone HTTPS on TCP/443. Hysteria2 proxying, a CDN or another reverse proxy would require a separate real-client-IP review.

The API trusts `X-Real-IP` only when `VISHOW_TRUST_LOCAL_PROXY=1` and its peer is local or the connection is a Unix socket. The candidate Uvicorn command disables generic forwarded-header processing. Nginx overwrites the trusted header with its observed address. Do not expose this backend socket through an untrusted relay.

The API limits report requests, bounds concurrent provider work, and keeps at most 128 reports in memory for approximately five minutes. It runs one worker so its limits and cache remain consistent. Its route set contains no server-side service-testing endpoint.

Dependencies are listed in `requirements-lock.txt`. The separate `.venv` used for validation is not part of the deliverable. The lock includes the test client dependency as well as runtime packages; no global Python installation is required.

For deployment, the sequence is **Check → Change → Verify → Rollback**:

1. **Check:** confirm current files, Nginx configuration, permissions, installed Python/curl versions, service user, API credentials, and the proposed paths. Back up the current public directory and Nginx file without overwriting earlier backups.
2. **Change:** after deployment approval, place the project and public files, create a private virtual environment, configure credentials, prepare the corresponding source, and install the reviewed service/configuration.
3. **Verify:** run `nginx -t` before reload; verify the socket, service status, `/api/health`, `/api/context`, `/ip`, escaped `/all.json`, every page, provider results, source links and request limits. Verify real-browser behaviour on desktop and mobile. Compare browser-observed IP with the Nginx address.
4. **Rollback:** restore the previous public directory and Nginx file, verify the restored Nginx configuration, reload it, and stop the new API service. The original password tool was `/`; its new page is `/password.html`.

Exact server-changing commands should be prepared only after the live server state is known.

## Source publication

Before deployment, run `python3 prepare_source.py` from the project directory. It creates an allowlisted `public/source/` tree containing the source, licence, build instructions and tests. It does not include `.venv`, browser downloads, reports, or credential files. Verify `/sources.html` and its links after deployment.

This source preparation is reversible by removing the generated `public/source/` tree. Do not place real configuration secrets in that directory or in files on the allowlist.

## Validation

Python: `.venv/bin/python -m unittest discover -s tests -p 'test_*.py' -v`.

Cryptography: `node --test tests/crypto.test.js`.

DOM interactions: install the development dependency from `package.json`, then `node tests/dom.test.js`. Node.js is required only for these tests, not for production hosting.

Read `REVIEW.md` for the actual verification results and limitations. Passing unit/DOM tests does not establish real service availability or production readiness.

## References

- Original report and field mappings: https://github.com/xykt/IPQuality (uploaded v2026-09-16).
- IPinfo Lite: https://ipinfo.io/developers/lite-api
- ipapi.is: https://ipapi.is/developers.html
- AbuseIPDB: https://docs.abuseipdb.com/
- IPQS: https://www.ipqualityscore.com/documentation/proxy-detection-api/overview
- IP2Location.io: https://www.ip2location.io/ip2location-documentation
- Browser response restrictions: https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API/Using_Fetch

Licence: AGPL-3.0-only; see `LICENSE` and `NOTICE.md`.