# Module: cdn_manager

## Purpose

Manages upload and download operations to an S3-compatible CDN (object storage) using separate credentials for read and write access.

## Public Interface

### Classes

#### `CDNCredentials` (cdef class)

| Attribute                | Type | Description                    |
|--------------------------|------|--------------------------------|
| host                     | str  | S3 endpoint URL                |
| downloader_access_key    | str  | Read-only access key           |
| downloader_access_secret | str  | Read-only secret key           |
| uploader_access_key      | str  | Write access key               |
| uploader_access_secret   | str  | Write secret key               |

#### `CDNManager` (cdef class)

| Attribute       | Type   | Description                        |
|-----------------|--------|------------------------------------|
| creds           | CDNCredentials | Stored credentials            |
| download_client | object | boto3 S3 client (read credentials) |
| upload_client   | object | boto3 S3 client (write credentials)|

| Method     | Signature                                              | Returns | Description                          |
|------------|--------------------------------------------------------|---------|--------------------------------------|
| `__init__` | `(self, CDNCredentials credentials)`                   | —       | Creates both S3 clients              |
| `upload`   | `cdef (self, str bucket, str filename, bytes file_bytes)` | bool | Uploads bytes to S3 bucket/key       |
| `download` | `cdef (self, str folder, str filename)`                | bool    | Downloads S3 object to local `folder/filename` |

Note: `.pxd` declares the parameter as `str bucket` while `.pyx` uses `str folder`. Functionally identical (Cython matches by position).

## Internal Logic

### Constructor
Creates two separate boto3 S3 clients:
- `download_client` with `downloader_access_key` / `downloader_access_secret`
- `upload_client` with `uploader_access_key` / `uploader_access_secret`

Both clients connect to the same `endpoint_url` (CDN host).

### `upload`
Uses `upload_fileobj` to stream bytes to S3. Returns `True` on success, `False` on exception.

### `download`
Creates local directory if needed (`os.makedirs`), then uses `download_file` to save S3 object to local path `folder/filename`. Returns `True` on success, `False` on exception.

## Dependencies

- **Internal**: `constants` (for `log()`, `logerror()`)
- **External**: `io`, `os` (stdlib), `boto3` (1.40.9)

## Consumers

- `api_client` — `load_big_file_cdn()`, `upload_big_small_resource()`, `upload_to_cdn()`, `download_from_cdn()`

## Data Models

`CDNCredentials` is the data model.

## Configuration

CDN credentials are loaded from a YAML file (`cdn.yaml`) by the `api_client` module, not by this module directly.

## External Integrations

- **S3-compatible storage**: upload and download via boto3 S3 client with custom endpoint URL

## Security

Separate read/write credential pairs enforce least-privilege access to CDN storage.

## Tests

No tests found.