BI-analytics-admin 0.1.0__py3-none-any.whl

bi_analytics_admin-0.1.0.dist-info/METADATA

@@ -0,0 +1,185 @@
+Metadata-Version: 2.4
+Name: BI-analytics-admin
+Version: 0.1.0
+Summary: Python project for datascience, web, and MSSQL integration
+Author-email: bluemoondom <pillerova@mojeit.eu>
+Classifier: Programming Language :: Python :: 3
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: python-dotenv>=1.0.0
+Requires-Dist: numpy>=1.24.0
+Requires-Dist: pandas>=2.0.0
+Requires-Dist: scipy>=1.10.0
+Requires-Dist: scikit-learn>=1.3.0
+Requires-Dist: matplotlib>=3.7.0
+Requires-Dist: seaborn>=0.12.0
+Requires-Dist: jupyter>=1.0.0
+Requires-Dist: notebook>=6.5.0
+Requires-Dist: fastapi>=0.95.0
+Requires-Dist: uvicorn>=0.21.0
+Requires-Dist: jinja2>=3.1.0
+Requires-Dist: requests>=2.28.0
+Requires-Dist: pyodbc>=4.0.0
+Requires-Dist: sqlalchemy>=2.0.0
+Requires-Dist: pymssql>=2.2.0
+Requires-Dist: pymysql>=1.0.2
+Requires-Dist: psycopg2-binary>=2.9.0
+Requires-Dist: openpyxl>=3.1.0
+Requires-Dist: python-dateutil>=2.8.0
+Requires-Dist: tqdm>=4.65.0
+Requires-Dist: cryptography>=41.0.0
+Dynamic: license-file
+
+# Business Intelligence Analytics Admin — Features
+
+## Overview
+
+Analytics Admin is a multi-user business intelligence platform that allows organizations to connect to their databases, model data views, and build interactive dashboards. Each user operates within an isolated workspace, with dedicated connectors, views, and dashboards.
+
+---
+
+## Multi-User Architecture
+
+- Multi-user environment with separated connectors, views, and dashboards per user
+- Account registration and authentication handled exclusively through email
+- Multi-language interface support
+
+---
+
+## Database Connectors
+
+- Supported database engines: Microsoft SQL Server, MySQL, MariaDB, PostgreSQL, and SQLite
+- Allowed IP addresses configurable independently for each connector's API access
+- API authentication via bearer key, with a configurable custom header name
+- API tenant identifier for connector-level access control
+- Configurable maximum request rate (requests per minute)
+
+---
+
+## View Modeling
+
+The view modeling layer allows users to define reusable data structures on top of source tables and views.
+
+- Modeling based on tables and views, with support for subviews
+- Selection of the source connector for each view
+- One-click exposure of a view as an API endpoint
+- API access supports GET requests in both tabular and tree (hierarchical) structures, as well as PUT requests
+- Downloadable sample `.bat` script demonstrating API usage
+- Renaming of tables and columns to custom aliases directly by clicking on the column header
+- Color-coded visual indication when a subview is added to the model
+- Column selection for inclusion in a view via checkboxes
+- Visual display of join conditions between tables
+- Support for adding custom columns and custom conditions, with built-in protection against SQL injection
+- Enhanced graphical interface for building WHERE conditions
+- Support for ORDER BY and GROUP BY clauses
+- Automatic SQL query generation with syntax highlighting
+- Live data preview
+
+---
+
+## Dashboards
+
+- Tabular display of data sourced from a view
+- Automatic removal of NULL values from displayed results
+- Conditional formatting of numeric values: positive values shown in green, negative values shown in red
+- Support for numeric and date/time formatting
+- Configurable row limits
+- Automatic detection of data types to generate appropriate filtering conditions for a view
+
+### Pivot Tables
+
+- Creation of pivot (cross-tabulated) tables
+- Column hiding and reordering
+- Configuration of pivot dimensions and aggregation functions: Sum, Count, Average, Maximum, and Minimum
+- Display of columns that are neither assigned as dimensions nor as metrics
+
+### Charts
+
+- Chart creation from a library of 17 predefined chart types
+- Configuration of X and Y axes, with support for additional series
+- Each series can be independently defined as a column (bar) or a line
+- Further breakdown of a series by an additional dimension, based on a selected column
+- Ability to show or hide individual values in the chart legend
+- Toggle for displaying or hiding gridlines
+- Configuration of chart dimensions and layout, including the number of charts displayed per row
+
+---
+
+## Security
+
+- Transport security via SSL, supporting both PEM and PFX certificate formats
+- Globally configurable trusted hosts (allowed IP addresses)
+- CORS, Content Security Policy (CSP), and HSTS enforcement
+- Request and access logging
+- JWT secret used for verification of web tokens
+- API bearer key and tenant identifier configured individually for each user and each connector
+- Trusted host IP addresses configurable independently for each connector
+- Configurable maximum request rate (requests per minute)
+- Registration and authentication via email, with session validity limited by a defined time period
+- Prevention of duplicate concurrent sessions
+
+---
+
+## Requirements and Installation
+
+The application is started with the following command:
+
+```
+python -m src.web.server
+```
+
+### Dependencies
+
+**Core**
+- python-dotenv >= 1.0.0
+
+**Data Science**
+- numpy >= 1.24.0
+- pandas >= 2.0.0
+- scipy >= 1.10.0
+- scikit-learn >= 1.3.0
+- matplotlib >= 3.7.0
+- seaborn >= 0.12.0
+- jupyter >= 1.0.0
+- notebook >= 6.5.0
+
+**Web**
+- fastapi >= 0.95.0
+- uvicorn >= 0.21.0
+- jinja2 >= 3.1.0
+- requests >= 2.28.0
+
+**Database**
+- pyodbc >= 4.0.0 (MSSQL / SQL Server)
+- sqlalchemy >= 2.0.0
+- pymssql >= 2.2.0
+- pymysql >= 1.0.2 (MySQL / MariaDB connector)
+- psycopg2-binary >= 2.9.0 (PostgreSQL connector)
+- sqlite3 (SQLite) is included in the Python standard library and requires no separate package
+
+**Office / Export**
+- openpyxl >= 3.1.0
+
+**Utilities**
+- python-dateutil >= 2.8.0
+- tqdm >= 4.65.0
+- cryptography >= 41.0.0 (PFX/PKCS12 extraction for HTTPS)
+
+---
+
+## Screenshots
+
+![Dashboard view](screen1.jpg)
+
+![Dashboard chart configuration](screen2.jpg)
+
+![View modeling canvas](screen3.jpg)
+
+![Query conditions and generated SQL](screen4.jpg)
+
+![Connector management](screen5.jpg)
+
+---

bi_analytics_admin-0.1.0.dist-info/RECORD

@@ -0,0 +1,33 @@
+bi_analytics_admin-0.1.0.dist-info/licenses/LICENSE,sha256=NnLb7U_0tvuiQxs8ZoONQ43zl8fmc0ErCzKemTVEEuo,4531
+web/auth.py,sha256=wEtv_GENnXcrCLSkyBUpQiAbjV9Oigq2Ke4r5dln92w,8198
+web/config.py,sha256=ZuOgBgIyZb1Jwr07crRNZxNFplTejOHUpZV6SJJzhfQ,6648
+web/db.py,sha256=705N0szQOKwtGlMRhwijwOZL9Z4YdL01ACPUFAEmYHU,29695
+web/main.py,sha256=JV1BwXk3vGOZWfZJ9QtHMJ0vvk24hXUmdxcODRYb7AM,3022
+web/security.py,sha256=y7I8w2RSiZ3ia1rtlxSuI4DTvplH6SirMARdyA8chCg,3430
+web/server.py,sha256=uJF8MISC5nbb_ui3pXbwOeyLkZKCwlnCx-d8HNK0DPU,1922
+web/ssl_utils.py,sha256=ZkP4T8QLM47nrG5tPl40qGGv47vr25sibbNl6GWP8aI,2019
+web/dialects/__init__.py,sha256=90eVNbONYJ3Tn5vx6zz6C6I2gv6jkch-ivb5iAVmXPE,1538
+web/dialects/base.py,sha256=yZUjz8NYspdPoKYOBkXZeDjhr9We8YKalL2E5LuotVc,4990
+web/dialects/mssql.py,sha256=8OgZcz369EofluuKdR1I-FsnpS0YuoCO_9KYa9YZ2HY,2998
+web/dialects/mysql.py,sha256=IrKXH_SY-_Sz_ZKiGWa_kQ_l4yZdiuDW_zlrqYctKsQ,3732
+web/dialects/postgresql.py,sha256=QzvKxfHX9MAQPLD17a1eVRv0QdTkrj4sMkWW9mqo7Zk,3728
+web/dialects/sqlite.py,sha256=3w3WTimOIkkRNE_wdilmJVY5ltRp-mpTRXb37FCJLaQ,3926
+web/models/dashboard.py,sha256=1DrYKD4wjFlvFIVa2sRx0a0tUguHgyAkg1gGOjK2igY,4744
+web/models/user.py,sha256=gkjtR6DMAqChKaaiOBbniKmSRj8oVXjMbxS-AtX7mMk,1760
+web/routers/auth.py,sha256=Wk0c66SiWmfapcrlltEEA7p8b4dzlxQPr5T6L96uyGE,5917
+web/routers/connectors.py,sha256=UoqYRDRAgIj1nfgAQa0GJd7o084XmLopTUS4BNQzXqA,8962
+web/routers/dashboards.py,sha256=BzVRfOmBJicaicJT7_8IuTtChEhZzkh0jYZrqEAP-Lk,6909
+web/routers/public_api.py,sha256=Tf2athD-2il8T8XPgBeSOMl0VNZezW2qRMjB4W6L6Zc,16813
+web/routers/views.py,sha256=TB8XHrRZ25jNxsJYsoIhBSaScWZgl01__liyvxGD-_I,6270
+web/services/email_service.py,sha256=0SBoOYH5kUM0VX7d9Fp8jfZ7xTKf8wXPJAFnRRnWSZc,5065
+web/services/export.py,sha256=RhjQMSBJ3xzB3_tB6fdeuBMz16SYphT2SHW2j5Bg7dU,916
+web/services/migrations.py,sha256=cGohBDtntNUOzzyga41Hub6aV_OryyA-79fb-Cg4hSE,4093
+web/services/query.py,sha256=GQGhGrte4fSEg00cyChquWRd52yss_Y4__oBKbZJdMw,3008
+web/services/storage.py,sha256=8yY_HY8PhjSTYWjOg2mW5vQR3bFA-5FiRlaiLqKPL_4,32011
+web/services/user_storage.py,sha256=pOkyNYtK1UHv2mcB0lHQZ1iCWw0Jo9sHPY1hWCNYOHM,38194
+web/services/view_modeling.py,sha256=ODOYA27Ryb6lnjYyUiK1fL3ta101f1edyjdGzBxBQTg,70587
+bi_analytics_admin-0.1.0.dist-info/METADATA,sha256=7pBdv48R5dQaVundpnCCzA80m4_4Rvjm7lIgurb4ab8,6091
+bi_analytics_admin-0.1.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+bi_analytics_admin-0.1.0.dist-info/entry_points.txt,sha256=Ce2eHMuIJt4Y1YM9rznEL2ZnfZVnUL3GQbtcGjXq4vE,55
+bi_analytics_admin-0.1.0.dist-info/top_level.txt,sha256=Te2Js_nwNom3AyuSoJHnQuEgXipUJ35SsySY2fzfNkI,4
+bi_analytics_admin-0.1.0.dist-info/RECORD,,

bi_analytics_admin-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

bi_analytics_admin-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+BI-analytics-admin = web.server:main

bi_analytics_admin-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,134 @@
+PolyForm Noncommercial License 1.0.0
+
+<https://polyformproject.org/licenses/noncommercial/1.0.0>
+
+Required Notice: Copyright Dominika Pillerová (https://myerp.cz) 2026
+
+## Acceptance
+
+In order to get any license under these terms, you must agree
+to them as both strict obligations and conditions to all
+your licenses.
+
+## Copyright License
+
+The licensor grants you a copyright license for the software
+to do everything you might do with the software that would
+otherwise infringe the licensor's copyright in it for any
+permitted purpose. However, you may only distribute the
+software according to Distribution License and make changes
+or new works based on the software according to Changes and
+New Works License.
+
+## Distribution License
+
+The licensor grants you an additional copyright license to
+distribute copies of the software. Your license to distribute
+covers distributing the software with changes and new works
+permitted by Changes and New Works License.
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of
+the software from you also gets a copy of these terms or the
+URL for them above, as well as copies of any plain-text lines
+beginning with `Required Notice:` that the licensor provided
+with the software. For example:
+
+> Required Notice: Copyright MyERP.cz, Inc. (https://myerp.cz)
+
+## Changes and New Works License
+
+The licensor grants you an additional copyright license to
+make changes and new works based on the software for any
+permitted purpose.
+
+## Patent License
+
+The licensor grants you a patent license for the software
+that covers patent claims the licensor can license, or
+becomes able to license, that you would infringe by using
+the software.
+
+## Noncommercial Purposes
+
+Any noncommercial purpose is a permitted purpose.
+
+## Personal Uses
+
+Personal use for research, experiment, and testing for the
+benefit of public knowledge, personal study, private
+entertainment, hobby projects, amateur pursuits, or religious
+observance, without any anticipated commercial application,
+is use for a permitted purpose.
+
+## Noncommercial Organizations
+
+Use by any charitable organization, educational institution,
+public research organization, public safety or health
+organization, environmental protection organization, or
+government institution is use for a permitted purpose
+regardless of the source of funding or obligations resulting
+from the funding.
+
+## Fair Use
+
+You may have "fair use" rights for the software under the
+law. These terms do not limit them.
+
+## No Other Rights
+
+These terms do not allow you to sublicense or transfer any of
+your licenses to anyone else, or prevent the licensor from
+granting licenses to anyone else. These terms do not imply
+any other licenses.
+
+## Patent Defense
+
+If you make any written claim that the software infringes or
+contributes to infringement of any patent, your patent
+license for the software granted under these terms ends
+immediately. If your company makes such a claim, your patent
+license ends immediately for work on behalf of your company.
+
+## Violations
+
+The first time you are notified in writing that you have
+violated any of these terms, or done anything with the
+software not covered by your licenses, your licenses can
+nonetheless continue if you come into full compliance with
+these terms, and take practical steps to correct past
+violations, within 32 days of receiving notice. Otherwise,
+all your licenses end immediately.
+
+## No Liability
+
+***As far as the law allows, the software comes as is,
+without any warranty or condition, and the licensor will not
+be liable to you for any damages arising out of these terms
+or the use or nature of the software, under any kind of
+legal claim.***
+
+## Definitions
+
+The **licensor** is the individual or entity offering these
+terms, and the **software** is the software the licensor
+makes available under these terms.
+
+**You** refers to the individual or entity agreeing to these
+terms.
+
+**Your company** is any legal entity, sole proprietorship, or
+other kind of organization that you work for, plus all
+organizations that have control over, are under the control
+of, or are under common control with that organization.
+**Control** means ownership of substantially all the assets
+of an entity, or the power to direct its management and
+policies by vote, contract, or otherwise. Control can be
+direct or indirect.
+
+**Your licenses** are all the licenses granted to you for the
+software under these terms.
+
+**Use** means anything you do with the software requiring one
+of your licenses.

bi_analytics_admin-0.1.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+web

web/auth.py

@@ -0,0 +1,232 @@
+"""Authentication layer: magic links and JWT sessions."""
+
+from __future__ import annotations
+
+import hashlib
+import re
+import secrets
+from datetime import datetime, timedelta, timezone
+from typing import Any
+
+import jwt
+from fastapi import HTTPException, Request, Response
+
+from src.web.config import get_settings
+from src.web.models.user import Connector, User, UserRole
+from src.web.services.user_storage import UserStorage
+
+ALGORITHM = "HS256"
+MAGIC_LINK_EXPIRE_MINUTES = 15
+SESSION_EXPIRE_HOURS = 24
+COOKIE_NAME = "session"
+
+# Magic link tokens are generated by secrets.token_urlsafe(32) which produces
+# exactly 43 URL-safe base64 characters (letters, digits, '-' and '_').
+# The regex enforces this format on every incoming token before it is used.
+MAGIC_LINK_TOKEN_RE = re.compile(r"^[A-Za-z0-9\-_]{43}$")
+MAGIC_LINK_TOKEN_LENGTH = 43
+
+
+def _now() -> datetime:
+    return datetime.now(timezone.utc)
+
+
+def _hash_token(token: str) -> str:
+    return hashlib.sha256(token.encode("utf-8")).hexdigest()
+
+
+def _random_token(n: int = 32) -> str:
+    return secrets.token_urlsafe(n)
+
+
+def create_magic_link(email: str, storage: UserStorage | None = None) -> tuple[str, str]:
+    """Create a single-use magic link token and return (token, url)."""
+    if storage is None:
+        storage = UserStorage()
+    user = storage.get_user_by_email(email)
+    if user is None:
+        raise HTTPException(status_code=403, detail="Neplatný email.")
+    if user.role != UserRole.NEW_ADMIN and not user.is_active:
+        # Pending new_admin can receive a magic link even while inactive.
+        raise HTTPException(status_code=403, detail="Účet není aktivní.")
+
+    token = _random_token()
+    token_hash = _hash_token(token)
+    expires_at = _now() + timedelta(minutes=MAGIC_LINK_EXPIRE_MINUTES)
+    storage.save_magic_link(token_hash, email, expires_at)
+
+    settings = get_settings()
+    base_url = settings.API_BASE_URL.rsplit("/", 1)[0] if "/" in settings.API_BASE_URL else settings.API_BASE_URL
+    url = f"{base_url}/auth/magic-link-redirect?token={token}"
+    return token, url
+
+
+def register_user(email: str, storage: UserStorage | None = None) -> tuple[User, str, str]:
+    """Create a pending new_admin user and return (user, token, url).
+
+    The user is created inactive with role ``new_admin``. The first magic-link
+    click activates the account and promotes the role to ``admin``.
+    """
+    if storage is None:
+        storage = UserStorage()
+    if not get_settings().REGISTRATION_ENABLED:
+        raise HTTPException(status_code=403, detail="Registrace není povolena.")
+    existing = storage.get_user_by_email(email)
+    if existing is not None:
+        raise HTTPException(status_code=409, detail="Uživatel s tímto emailem již existuje.")
+
+    # New admin gets a copy of the default (.env) connector.
+    connector = _default_connector_from_settings()
+    connector.name = email
+    created_connector = storage.create_connector(connector)
+    user = storage.create_user(
+        email=email,
+        role=UserRole.NEW_ADMIN,
+        connector_id=created_connector.id,
+    )
+    token, url = create_magic_link(email, storage)
+    return user, token, url
+
+
+def _default_connector_from_settings() -> Connector:
+    settings = get_settings()
+    return Connector(
+        name="Default (.env)",
+        db_host=settings.DB_HOST,
+        db_port=settings.DB_PORT,
+        db_name=settings.DB_NAME,
+        db_user=settings.DB_USER,
+        db_password=settings.DB_PASSWORD,
+        db_driver=settings.DB_DRIVER,
+        view_discovery_mode=settings.VIEW_DISCOVERY_MODE,
+        api_tenant=settings.API_TENANT,
+        api_key=settings.API_KEY or "",
+        api_key_header=settings.API_KEY_HEADER,
+        api_allowed_ips=settings.API_ALLOWED_IPS,
+        api_max_requests_per_minute=settings.API_MAX_REQUESTS_PER_MINUTE,
+    )
+
+
+def _validate_magic_link_token(token: str) -> str:
+    """Reject any magic link token that does not match the expected format.
+
+    Only URL-safe base64 characters of the exact length produced by
+    ``secrets.token_urlsafe(32)`` are accepted. This prevents pathological
+    or malformed input from ever reaching the database lookup.
+    """
+    if not token or not MAGIC_LINK_TOKEN_RE.match(token):
+        raise HTTPException(status_code=400, detail="Neplatný nebo expirovaný odkaz.")
+    return token
+
+
+def consume_magic_link(token: str, storage: UserStorage | None = None) -> str:
+    """Validate magic link token and create a session JWT.
+
+    If the user is a pending ``new_admin``, activate them and promote the role
+    to ``admin`` on first use.
+    """
+    token = _validate_magic_link_token(token)
+    if storage is None:
+        storage = UserStorage()
+    token_hash = _hash_token(token)
+    link = storage.use_magic_link(token_hash)
+    if link is None:
+        raise HTTPException(status_code=400, detail="Neplatný nebo expirovaný odkaz.")
+    user = storage.get_user_by_email(link["email"])
+    if user is None:
+        raise HTTPException(status_code=403, detail="Účet nebyl nalezen.")
+    if user.role == UserRole.NEW_ADMIN:
+        storage.activate_new_admin(user.id)
+        user = storage.get_user_by_id(user.id)
+    if user is None or not user.is_active:
+        raise HTTPException(status_code=403, detail="Účet nebyl nalezen nebo není aktivní.")
+    session_token = create_session_token(user)
+    storage.save_session(_hash_token(session_token), user.id)
+    return session_token
+
+
+def create_session_token(user: User) -> str:
+    """Return signed JWT for the user."""
+    settings = get_settings()
+    now = _now()
+    payload = {
+        "sub": str(user.id),
+        "email": user.email,
+        "role": user.role.value,
+        "connector_id": user.connector_id,
+        "iat": now,
+        "exp": now + timedelta(hours=SESSION_EXPIRE_HOURS),
+    }
+    return jwt.encode(payload, settings.JWT_SECRET, algorithm=ALGORITHM)
+
+
+
+def set_session_cookie(response: Response, token: str, *, secure: bool | None = None) -> None:
+    if secure is None:
+        settings = get_settings()
+        secure = not settings.LOCALHOST_MODE
+    response.set_cookie(
+        key=COOKIE_NAME,
+        value=token,
+        httponly=True,
+        secure=secure,
+        samesite="lax",
+        path="/",
+        max_age=int(timedelta(hours=SESSION_EXPIRE_HOURS).total_seconds()),
+    )
+
+
+def clear_session_cookie(response: Response) -> None:
+    response.delete_cookie(key=COOKIE_NAME)
+
+
+def _hash_token(token: str) -> str:
+    return hashlib.sha256(token.encode("utf-8")).hexdigest()
+
+
+def _decode_token(token: str) -> dict[str, Any]:
+    try:
+        return jwt.decode(token, get_settings().JWT_SECRET, algorithms=[ALGORITHM])
+    except jwt.ExpiredSignatureError as exc:
+        raise HTTPException(status_code=401, detail="Session expired") from exc
+    except jwt.InvalidTokenError as exc:
+        raise HTTPException(status_code=401, detail="Invalid session") from exc
+
+
+def get_current_user(request: Request) -> User:
+    token = request.cookies.get(COOKIE_NAME)
+    if not token:
+        raise HTTPException(status_code=401, detail="Not authenticated")
+    storage = UserStorage()
+    token_hash = _hash_token(token)
+    if not storage.is_session_valid(token_hash):
+        raise HTTPException(status_code=401, detail="Session revoked")
+    payload = _decode_token(token)
+    user_id = payload.get("sub")
+    user = storage.get_user_by_id(int(user_id)) if user_id else None
+    if user is None or not user.is_active:
+        raise HTTPException(status_code=401, detail="User not found or inactive")
+    return user
+
+
+def get_current_user_optional(request: Request) -> User | None:
+    """Return the current user if authenticated, otherwise None."""
+    try:
+        return get_current_user(request)
+    except HTTPException:
+        return None
+
+
+def get_current_admin(request: Request) -> User:
+    user = get_current_user(request)
+    if user.role != UserRole.ADMIN:
+        raise HTTPException(status_code=403, detail="Admin access required")
+    return user
+
+
+def require_user(request: Request) -> User:
+    return get_current_user(request)
+
+
+def require_admin(request: Request) -> User:
+    return get_current_admin(request)