Add VuMark Generation API endpoint (#473)

[adamtheturtle]

Implements POST /targets/<target_id>/instances endpoint for generating VuMark instance images in SVG, PNG, or PDF format. Includes validators, exception classes, image generators, and comprehensive test coverage for both requests-mock and Flask implementations.

Closes #473

🤖 Generated with Claude Code

---

Note

Introduces VuMark instance generation across both Flask and requests-mock servers.

• Adds POST /targets/<target_id>/instances to generate instance images (image/svg+xml, image/png, application/pdf), with content produced by mock_vws._vumark_generators
• New validators in mock_vws._vumark_validators for Accept header and instance_id; integrates with key/target validators to require instance_id and correctly resolve target_id on /instances paths
• Extends result codes with INVALID_INSTANCE_ID and INVALID_ACCEPT_HEADER and corresponding exceptions; updates requests-mock _ResponseType to allow bytes bodies and sets appropriate response headers (including Content-Length)
• Comprehensive tests in tests/mock_vws/test_vumark_generation.py covering success paths, invalid headers/IDs, and response headers
• Minor config updates: add @route to vulture ignores and svg to spelling dictionary

^{Written by Cursor Bugbot for commit f193a40. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 3 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

[cursor]

PNG image has invisible content due to colors

Medium Severity

The generate_png function creates a black image using Image.new(mode="RGB", size=(200, 200)) (defaults to color 0, which is black), then draws the border and text using fill="black". This results in black text on a black background, making the VuMark mock content completely invisible in the generated PNG.

 

[cursor]

PDF has hardcoded length mismatching variable content

Medium Severity

The generate_pdf function hardcodes /Length 100 for the stream object, but the actual stream content length varies with instance_id. Similarly, the xref byte offsets (lines 103-108) and startxref 496 are hardcoded but shift when instance_id changes length. This produces technically malformed PDFs that may fail to render correctly in strict PDF readers.

 

[cursor]

SVG output is malformed for special character inputs

Low Severity

The generate_svg function inserts instance_id directly into XML content without escaping XML special characters. If instance_id contains <, >, or &, the generated SVG is malformed and will fail to parse. For example, an instance_id of "test<value>" produces invalid XML structure.