The Problem The repository publishes dependencies only through a Pipfile without a corresponding Pipfile.lock, so installs are non‑reproducible and third‑party package versions can drift silently. In addition, the codebase contains seven files with indentation depths up to 10 and two files (>1 200 LOC) that concentrate most of the logic, making control‑flow hard to follow and changes risky.

What This Does ensta is a Python package for reading and writing Instagram data via the Mobile and Web APIs. It supports both authenticated (username/password or email) and anonymous requests, and provides helpers for profile lookup, follow/unfollow, biography changes, proxy configuration, media upload, Direct messaging, and credential handling. The public surface is small – most users start with from ensta import Mobile(...) – but internally the library wires together ~72 modules, 153 import edges, and 227 self‑call edges.

How It Is Wired

  • Entry point – ensta/Mobile.py (32 functions, 1 class). Construction calls __init__, then methods such as profile, follow, unfollow, change_profile_picture, switch_to_private_account, etc.
  • Network backbone – ensta/WebSession.py (32 functions, 1 class) owns authentication, follow/unfollow, and follower/following queries. Its methods are called from 37 call sites (e.g., post, NetworkError).
  • Credential & session management – ensta/Credentials.py (login, handle_2fa, new_totp_code, bypass_totp) and ensta/SessionManager.py (persists tokens to disk, performs crypto operations).
  • Parsing & structures – parsers in ensta/parser/ and data structures in ensta/structures/ transform Instagram JSON into Python objects; ensta/lib/Exceptions.py defines the exception hierarchy caught broadly in ensta/Web.py.
  • Outbound calls – 32 functions make real HTTP requests; 3 functions perform crypto/secret generation; 2 functions read/write files (SessionManager.save_to_file/load_from_file).

How To Use It

pip install ensta               # installs from PyPI; no lockfile guarantee
from ensta import Mobile

mobile = Mobile("my_user", "my_pass",
                proxy={"http": "socks5://user:pass@host:port",
                       "https": "socks5://user:pass@host:port"})

profile = mobile.profile("leomessi")
print(profile.full_name, profile.biography)
mobile.follow("leomessi")
mobile.unfollow("leomessi")
mobile.change_profile_picture("new.jpg")

Configuration is supplied via the Mobile constructor (username/password, optional proxy dict). No environment variables or secret files are required for basic use.

Real‑World Use A small automation script can fetch a target’s follower count, compare it against a threshold, and unfollow accounts that drop below the limit – all without writing raw HTTP. The script only needs the target username and the operator’s credentials; proxy settings are optional but recommended when the operator’s IP is flagged by Instagram.

Code Health & Issues

Measured static‑analysis findings (14 total)

  • High cognitive load – deep nesting in ensta/WebSession.py, ensta/Authentication.py, ensta/Guest.py (max depth 10).
  • High cognitive load – oversized files: ensta/WebSession.py (1 206 LOC), ensta/Mobile.py (large surface).
  • High clarity – 78 duplicated 6‑line blocks across 11 files (ensta/Authentication.py, ensta/WebSession.py, ensta/Guest.py, ensta/containers/PhotoUpload.py, …).
  • Medium resilience – broad except clauses in ensta/Web.py swallow errors indiscriminately.
  • Low clarity – 15 TODO/FIXME in ensta/containers/PhotoUpload.py, 17 in ensta/containers/ReelUpload.py, 4 in ensta/containers/Shared.py.

SDLC / repository‑hygiene findings (7 items)

  • Pin GitHub Actions to commit SHAs (.github/workflows uses @v3.1 tags).
  • Declare least‑privilege permissions: contents: read on workflows that reference secrets (pr-check.yml).
  • Enable Dependabot/Renovate for Pipfile/github-actions.
  • Add dependency‑vulnerability scanning gate (e.g., dependency-review-action).
  • Set persist-credentials: false on checkout and pass explicit tokens only where needed.
  • Expand the test suite (currently 2 test files vs. 72 source files).
  • Add timeout-minutes to workflow jobs to avoid six‑hour platform defaults.

The Bottom Line ensta offers a pragmatic Python wrapper around Instagram’s Mobile API, with clear entry points and useful features for authentication, profile management, and media upload. The codebase suffers from a missing dependency lockfile, deeply nested control flow, duplicated logic, and sparse test coverage, which together raise the risk of brittle changes and non‑reproducible installs. Teams that need rapid prototyping or simple data extraction will find it functional; projects requiring long‑term maintenance, CI/CD hygiene, or strict reproducibility should plan to lock dependencies, refactor the largest modules, and add automated tests.