Box Viewを使用した安全なアプリ内ドキュメントレビューの構築

mkdir loan-review && cd loan-review

python3 -m venv .venv
source .venv/bin/activate

pip install box-sdk-gen flask python-dotenv

BOX_CLIENT_ID=your_client_id
BOX_CLIENT_SECRET=your_client_secret
BOX_ENTERPRISE_ID=your_enterprise_id
LOAN_DOCS_FOLDER_ID=0

import os
from dotenv import load_dotenv
from box_sdk_gen import (
    BoxClient,
    BoxCCGAuth,
    CCGConfig,
)

load_dotenv()

def get_box_client() -> BoxClient:
    config = CCGConfig(
        client_id=os.getenv("BOX_CLIENT_ID"),
        client_secret=os.getenv("BOX_CLIENT_SECRET"),
        enterprise_id=os.getenv("BOX_ENTERPRISE_ID"),
    )
    auth = BoxCCGAuth(config=config)
    return BoxClient(auth=auth)

import os
from dotenv import load_dotenv
from box_sdk_gen import (
    BoxClient,
    UploadFileAttributes,
    UploadFileAttributesParentField,
)

load_dotenv()

def upload_document(client: BoxClient, file_path: str) -> str:
    folder_id = os.getenv("LOAN_DOCS_FOLDER_ID", "0")
    file_name = os.path.basename(file_path)

    with open(file_path, "rb") as file_stream:
        uploaded = client.uploads.upload_file(
            UploadFileAttributes(
                name=file_name,
                parent=UploadFileAttributesParentField(id=folder_id),
            ),
            file_stream,
        )

    file_id = uploaded.entries[0].id
    print(f"Uploaded {file_name} -> file ID {file_id}")
    return file_id

from box_sdk_gen import BoxClient

def get_embed_url(client: BoxClient, file_id: str) -> str:
    file = client.files.get_file_by_id(
        file_id,
        fields=["expiring_embed_link"],
    )

    if not file.expiring_embed_link:
        raise RuntimeError(
            "No embed link returned. The file may still be converting, "
            "or preview is not available for this file type."
        )

    return file.expiring_embed_link.url

from box_sdk_gen import BoxClient

PREVIEW_SCOPES = [
    "base_preview",
    "item_preview",
    "annotation_edit",
    "annotation_view_all",
    "item_download",
]

def get_downscoped_token(client: BoxClient, file_id: str) -> dict:
    token = client.auth.downscope_token(
        PREVIEW_SCOPES,
        resource=f"https://api.box.com/2.0/files/{file_id}",
    )
    return {
        "access_token": token.access_token,
        "expires_in": token.expires_in,
    }

import os
import tempfile

from dotenv import load_dotenv
from flask import Flask, request, jsonify, send_file

from box_client import get_box_client
from upload import upload_document
from preview import get_embed_url, get_downscoped_token

load_dotenv()
app = Flask(__name__)

@app.route("/api/documents", methods=["POST"])
def upload():
    if "file" not in request.files:
        return jsonify({"error": "no file provided"}), 400

    incoming = request.files["file"]
    with tempfile.NamedTemporaryFile(
        delete=False, suffix=f"_{incoming.filename}"
    ) as tmp:
        incoming.save(tmp.name)
        temp_path = tmp.name

    try:
        client = get_box_client()
        file_id = upload_document(client, temp_path)
    finally:
        os.remove(temp_path)

    return jsonify({"file_id": file_id}), 201

@app.route("/api/documents/<file_id>/embed", methods=["GET"])
def embed(file_id):
    client = get_box_client()
    embed_url = get_embed_url(client, file_id)
    return jsonify({"embed_url": embed_url}), 200

@app.route("/api/documents/<file_id>/token", methods=["GET"])
def token(file_id):
    client = get_box_client()
    return jsonify(get_downscoped_token(client, file_id)), 200

@app.route("/review/<file_id>")
def review_page(file_id):
    return send_file("review.html")

if __name__ == "__main__":
    app.run(port=5000, debug=True)

loan-review/
├── .env
├── .venv/
├── app.py
├── box_client.py
├── preview.py
└── upload.py

<!DOCTYPE html>
<html lang="en-US">
  <head>
    <meta charset="utf-8" />
    <title>Loan document review</title>
    <style>
      body { margin: 0; font-family: system-ui, sans-serif; }
      header { padding: 12px 20px; background: #f5f6f8; border-bottom: 1px solid #e0e0e0; }
      iframe { width: 100%; height: calc(100vh - 50px); border: 0; }
    </style>
  </head>
  <body>
    <header><strong>Loan application 4815</strong> &middot; Borrower tax return</header>
    <iframe id="doc" title="Borrower document"></iframe>

    <script>
      // The file ID is the last segment of the URL, e.g. /review/1234567890
      const fileId = window.location.pathname.split("/").pop();

      async function loadPreview() {
        const res = await fetch(`/api/documents/${fileId}/embed`);
        const { embed_url } = await res.json();
        document.getElementById("doc").src = embed_url;
      }

      loadPreview();
    </script>
  </body>
</html>

python app.py

curl -X POST http://127.0.0.1:5000/api/documents \
  -F "file=@sample-tax-return.pdf"

{ "file_id": "1234567890" }

curl http://127.0.0.1:5000/api/documents/1234567890/embed

{ "embed_url": "https://app.box.com/preview/expiring_embed/gvoct6FE!YT_X1Lau..." }

http://127.0.0.1:5000/review/1234567890