machinaos 0.0.1 → 0.0.7

package/server/middleware/auth.py

@@ -1,89 +1,89 @@
-"""Authentication middleware for route protection."""
-
-import logging
-from fastapi import Request, HTTPException
-from fastapi.responses import JSONResponse
-from starlette.middleware.base import BaseHTTPMiddleware
-
-from core.container import container
-
-logger = logging.getLogger(__name__)
-
-# Public routes that don't require authentication
-PUBLIC_PATHS = frozenset([
-    "/health",
-    "/docs",
-    "/openapi.json",
-    "/redoc",
-    "/api/auth/status",
-    "/api/auth/login",
-    "/api/auth/register",
-    "/api/auth/logout",
-    "/ws/internal",  # Internal WebSocket for Temporal workers
-])
-
-# Path prefixes that are public
-PUBLIC_PREFIXES = (
-    "/webhook/",
-)
-
-
-class AuthMiddleware(BaseHTTPMiddleware):
-    """Middleware to protect routes requiring authentication."""
-
-    async def dispatch(self, request: Request, call_next):
-        path = request.url.path
-
-        # Allow public paths
-        if self._is_public_path(path):
-            return await call_next(request)
-
-        # Get settings
-        settings = container.settings()
-
-        # Check if auth is disabled (VITE_AUTH_ENABLED=false)
-        if settings.vite_auth_enabled and settings.vite_auth_enabled.lower() == 'false':
-            # Auth disabled - set anonymous user and allow request
-            request.state.user_id = 0
-            request.state.user_email = 'anonymous'
-            request.state.is_owner = True
-            return await call_next(request)
-
-        # Auth enabled - check token
-        token = request.cookies.get(settings.jwt_cookie_name)
-
-        if not token:
-            return JSONResponse(
-                status_code=401,
-                content={"detail": "Not authenticated"}
-            )
-
-        # Verify token
-        user_auth = container.user_auth_service()
-        payload = user_auth.verify_token(token)
-
-        if not payload:
-            return JSONResponse(
-                status_code=401,
-                content={"detail": "Invalid or expired session"}
-            )
-
-        # Attach user info to request state for downstream handlers
-        request.state.user_id = payload.get("sub")
-        request.state.user_email = payload.get("email")
-        request.state.is_owner = payload.get("is_owner", False)
-
-        return await call_next(request)
-
-    def _is_public_path(self, path: str) -> bool:
-        """Check if path is public (no auth required)."""
-        # Exact match
-        if path in PUBLIC_PATHS:
-            return True
-
-        # Prefix match
-        for prefix in PUBLIC_PREFIXES:
-            if path.startswith(prefix):
-                return True
-
-        return False
+"""Authentication middleware for route protection."""
+
+import logging
+from fastapi import Request, HTTPException
+from fastapi.responses import JSONResponse
+from starlette.middleware.base import BaseHTTPMiddleware
+
+from core.container import container
+
+logger = logging.getLogger(__name__)
+
+# Public routes that don't require authentication
+PUBLIC_PATHS = frozenset([
+    "/health",
+    "/docs",
+    "/openapi.json",
+    "/redoc",
+    "/api/auth/status",
+    "/api/auth/login",
+    "/api/auth/register",
+    "/api/auth/logout",
+    "/ws/internal",  # Internal WebSocket for Temporal workers
+])
+
+# Path prefixes that are public
+PUBLIC_PREFIXES = (
+    "/webhook/",
+)
+
+
+class AuthMiddleware(BaseHTTPMiddleware):
+    """Middleware to protect routes requiring authentication."""
+
+    async def dispatch(self, request: Request, call_next):
+        path = request.url.path
+
+        # Allow public paths
+        if self._is_public_path(path):
+            return await call_next(request)
+
+        # Get settings
+        settings = container.settings()
+
+        # Check if auth is disabled (VITE_AUTH_ENABLED=false)
+        if settings.vite_auth_enabled and settings.vite_auth_enabled.lower() == 'false':
+            # Auth disabled - set anonymous user and allow request
+            request.state.user_id = 0
+            request.state.user_email = 'anonymous'
+            request.state.is_owner = True
+            return await call_next(request)
+
+        # Auth enabled - check token
+        token = request.cookies.get(settings.jwt_cookie_name)
+
+        if not token:
+            return JSONResponse(
+                status_code=401,
+                content={"detail": "Not authenticated"}
+            )
+
+        # Verify token
+        user_auth = container.user_auth_service()
+        payload = user_auth.verify_token(token)
+
+        if not payload:
+            return JSONResponse(
+                status_code=401,
+                content={"detail": "Invalid or expired session"}
+            )
+
+        # Attach user info to request state for downstream handlers
+        request.state.user_id = payload.get("sub")
+        request.state.user_email = payload.get("email")
+        request.state.is_owner = payload.get("is_owner", False)
+
+        return await call_next(request)
+
+    def _is_public_path(self, path: str) -> bool:
+        """Check if path is public (no auth required)."""
+        # Exact match
+        if path in PUBLIC_PATHS:
+            return True
+
+        # Prefix match
+        for prefix in PUBLIC_PREFIXES:
+            if path.startswith(prefix):
+                return True
+
+        return False

package/server/models/auth.py

@@ -1,52 +1,52 @@
-"""User authentication models."""
-
-from datetime import datetime, timezone
-from typing import Optional
-from sqlmodel import SQLModel, Field, Column, DateTime
-from sqlalchemy import func
-import bcrypt
-
-
-class User(SQLModel, table=True):
-    """User account for authentication."""
-
-    __tablename__ = "users"
-
-    id: Optional[int] = Field(default=None, primary_key=True)
-    email: str = Field(unique=True, index=True, max_length=255)
-    password_hash: str = Field(max_length=255)
-    display_name: str = Field(max_length=100)
-    is_owner: bool = Field(default=False)  # First user in single-owner mode
-    is_active: bool = Field(default=True)
-    created_at: datetime = Field(
-        default_factory=lambda: datetime.now(timezone.utc),
-        sa_column=Column(DateTime(timezone=True), server_default=func.now())
-    )
-    last_login: Optional[datetime] = Field(
-        default=None,
-        sa_column=Column(DateTime(timezone=True), nullable=True)
-    )
-
-    def set_password(self, password: str) -> None:
-        """Hash and set password using bcrypt."""
-        salt = bcrypt.gensalt()
-        self.password_hash = bcrypt.hashpw(password.encode('utf-8'), salt).decode('utf-8')
-
-    def verify_password(self, password: str) -> bool:
-        """Verify password against stored hash."""
-        return bcrypt.checkpw(
-            password.encode('utf-8'),
-            self.password_hash.encode('utf-8')
-        )
-
-    @classmethod
-    def create(cls, email: str, password: str, display_name: str, is_owner: bool = False) -> "User":
-        """Factory method to create a user with hashed password."""
-        user = cls(
-            email=email.lower().strip(),
-            password_hash="",  # Will be set below
-            display_name=display_name.strip(),
-            is_owner=is_owner
-        )
-        user.set_password(password)
-        return user
+"""User authentication models."""
+
+from datetime import datetime, timezone
+from typing import Optional
+from sqlmodel import SQLModel, Field, Column, DateTime
+from sqlalchemy import func
+import bcrypt
+
+
+class User(SQLModel, table=True):
+    """User account for authentication."""
+
+    __tablename__ = "users"
+
+    id: Optional[int] = Field(default=None, primary_key=True)
+    email: str = Field(unique=True, index=True, max_length=255)
+    password_hash: str = Field(max_length=255)
+    display_name: str = Field(max_length=100)
+    is_owner: bool = Field(default=False)  # First user in single-owner mode
+    is_active: bool = Field(default=True)
+    created_at: datetime = Field(
+        default_factory=lambda: datetime.now(timezone.utc),
+        sa_column=Column(DateTime(timezone=True), server_default=func.now())
+    )
+    last_login: Optional[datetime] = Field(
+        default=None,
+        sa_column=Column(DateTime(timezone=True), nullable=True)
+    )
+
+    def set_password(self, password: str) -> None:
+        """Hash and set password using bcrypt."""
+        salt = bcrypt.gensalt()
+        self.password_hash = bcrypt.hashpw(password.encode('utf-8'), salt).decode('utf-8')
+
+    def verify_password(self, password: str) -> bool:
+        """Verify password against stored hash."""
+        return bcrypt.checkpw(
+            password.encode('utf-8'),
+            self.password_hash.encode('utf-8')
+        )
+
+    @classmethod
+    def create(cls, email: str, password: str, display_name: str, is_owner: bool = False) -> "User":
+        """Factory method to create a user with hashed password."""
+        user = cls(
+            email=email.lower().strip(),
+            password_hash="",  # Will be set below
+            display_name=display_name.strip(),
+            is_owner=is_owner
+        )
+        user.set_password(password)
+        return user

package/server/models/cache.py

@@ -1,24 +1,24 @@
-"""SQLite-backed cache model for key-value storage with TTL.
-
-Follows n8n pattern where SQLite is sufficient for single-process deployments,
-with Redis used only for distributed queue mode.
-"""
-
-import time
-from typing import Optional
-from sqlmodel import SQLModel, Field
-
-
-class CacheEntry(SQLModel, table=True):
-    """Generic key-value cache with optional expiration.
-
-    Used as Redis alternative for local development (no Docker required).
-    Production can use Redis for better performance at scale.
-    """
-
-    __tablename__ = "cache_entries"
-
-    key: str = Field(primary_key=True, max_length=512)
-    value: str = Field(max_length=1000000)  # JSON serialized, up to 1MB
-    expires_at: Optional[float] = Field(default=None, index=True)  # Unix timestamp
-    created_at: float = Field(default_factory=time.time)
+"""SQLite-backed cache model for key-value storage with TTL.
+
+Follows n8n pattern where SQLite is sufficient for single-process deployments,
+with Redis used only for distributed queue mode.
+"""
+
+import time
+from typing import Optional
+from sqlmodel import SQLModel, Field
+
+
+class CacheEntry(SQLModel, table=True):
+    """Generic key-value cache with optional expiration.
+
+    Used as Redis alternative for local development (no Docker required).
+    Production can use Redis for better performance at scale.
+    """
+
+    __tablename__ = "cache_entries"
+
+    key: str = Field(primary_key=True, max_length=512)
+    value: str = Field(max_length=1000000)  # JSON serialized, up to 1MB
+    expires_at: Optional[float] = Field(default=None, index=True)  # Unix timestamp
+    created_at: float = Field(default_factory=time.time)