adapt-server 0.1.4__tar.gz → 0.2.2__tar.gz

adapt_server-0.2.2/PKG-INFO

@@ -0,0 +1,176 @@
+Metadata-Version: 2.4
+Name: adapt-server
+Version: 0.2.2
+Summary: Adaptive file-backed FastAPI server that turns datasets into CRUD APIs and UIs.
+Author-email: notesofcliff <notesofcliff@gmail.com>
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/McInci/adapt
+Project-URL: Repository, https://github.com/McIndi/adapt
+Project-URL: Issues, https://github.com/McIndi/adapt/issues
+Keywords: fastapi,api,csv,excel,parquet,markdown,media
+Classifier: Development Status :: 3 - Alpha
+Classifier: Framework :: FastAPI
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Internet :: WWW/HTTP :: HTTP Servers
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: fastapi
+Requires-Dist: uvicorn
+Requires-Dist: sqlmodel
+Requires-Dist: pendulum
+Requires-Dist: watchfiles
+Requires-Dist: jinja2
+Requires-Dist: openpyxl
+Requires-Dist: markdown
+Requires-Dist: python-multipart
+Requires-Dist: mutagen
+Requires-Dist: moviepy
+Requires-Dist: pillow
+Requires-Dist: python-json-logger
+Requires-Dist: pandas
+Requires-Dist: fastparquet
+Provides-Extra: dev
+Requires-Dist: pytest; extra == "dev"
+Requires-Dist: httpx; extra == "dev"
+Requires-Dist: build; extra == "dev"
+Requires-Dist: twine; extra == "dev"
+Dynamic: license-file
+
+# Adapt
+
+Adapt is a FastAPI server that turns files in a directory into APIs and UIs.
+
+- Datasets (`.csv`, `.xlsx`, `.parquet`) become CRUD endpoints and DataTables UIs
+- Markdown/HTML become browsable pages
+- Media files become streaming endpoints and player/gallery UIs
+- Python files can register custom routers
+
+## Quick Start
+
+```bash
+pip install adapt-server
+adapt addsuperuser --username admin /path/to/docroot
+adapt serve /path/to/docroot
+
+# Generate permissions for all discovered resources
+adapt admin create-permissions /path/to/docroot __all__
+
+# Everything below here can be done in the admin UI at
+# http://localhost:8000/admin/ after logging in with the superuser account.
+#
+# Create a regular user
+adapt admin create-user --username editor --password secret /path/to/docroot
+
+# By default, the editor user has no permissions.
+# See available groups (created by `adapt admin create-permissions`) and assign user to desired group
+adapt admin list-groups /path/to/docroot
+adapt admin add-to-group --username editor --group <group_name> /path/to/docroot
+```
+
+Useful URLs:
+
+- `/` landing page
+- `/admin/` admin UI
+- `/api/<resource>` resource API
+- `/ui/<resource>` resource UI
+- `/schema/<resource>` resource schema
+
+## What Adapt Generates
+
+From files in your docroot, Adapt auto-discovers resources and mounts routes with extensionless URLs where possible.
+
+Example:
+
+```text
+data/
+  employees.csv
+  sales.xlsx
+  video.mp4
+  readme.md
+  stats.py
+```
+
+Rough output:
+
+- `/api/employees`, `/ui/employees`, `/schema/employees`
+- `/api/sales/<sheet>`, `/ui/sales/<sheet>`
+- `/media/video.mp4`, `/ui/video.mp4`, `/ui/media`
+- `/readme`
+- `/api/stats/*`
+
+## Current Security Posture
+
+This reflects the current implementation in the codebase.
+
+### In Place
+
+- **Authentication:** session cookies and API keys (`X-API-Key`)
+- **Authorization:** RBAC (users, groups, permissions), plus superuser bypass
+- **Password security:** PBKDF2 hashing with per-user salts
+- **Session security:** expiration enforcement, sliding renewal, cleanup task
+- **CSRF protection:** enforced for cookie-authenticated unsafe methods (`POST/PUT/PATCH/DELETE`), including mixed session + API-key requests
+- **Redirect hardening:** login `next` paths are validated as local relative paths
+- **Response hardening:** CSP, `X-Frame-Options`, `X-Content-Type-Options`, `Referrer-Policy`, `Permissions-Policy`, HSTS (when TLS is enabled)
+- **Host header hardening:** Trusted Host middleware
+- **Data integrity:** lock-based, atomic writes for mutable dataset plugins
+- **Auditability:** admin/audit logging for security-relevant actions
+- **Sensitive response cleanup:** admin user APIs no longer expose `password_hash`
+
+### Important Deployment Notes
+
+- Use TLS in non-local environments (`--tls-cert` + `--tls-key`) so secure cookies and HSTS protections are effective.
+- API-key-only clients are exempt from CSRF checks by design; cookie-auth browser flows require CSRF tokens.
+
+## Core Features
+
+- Adaptive discovery and route generation
+- Dataset CRUD with schema exposure
+- Caching with invalidation on mutations
+- Built-in admin UI for users/groups/permissions/locks/cache/api keys/audit logs
+- Plugin architecture with companion overrides in `.adapt/`
+
+## Dataset Mutation Envelope
+
+For dataset endpoints, write operations use this payload structure:
+
+```json
+{
+  "action": "create|update|delete",
+  "data": []
+}
+```
+
+Use object data for `update`/`delete` as needed (for example, with `_row_id`).
+
+## CLI (Common Commands)
+
+```bash
+adapt serve <root> [--host ... --port ... --tls-cert ... --tls-key ... --reload --readonly --debug]
+adapt check <root>
+adapt addsuperuser <root> --username <name>
+adapt list-endpoints <root>
+adapt admin list-resources <root>
+adapt admin create-permissions <root> __all__
+```
+
+## Documentation
+
+Detailed docs live under `docs/manual/`.
+
+- Manual index: [docs/manual/index.md](docs/manual/index.md)
+- Security: [docs/manual/security.md](docs/manual/security.md)
+- Quick start: [docs/manual/quick_start.md](docs/manual/quick_start.md)
+- Configuration: [docs/manual/configuration.md](docs/manual/configuration.md)
+- API reference: [docs/manual/api_reference.md](docs/manual/api_reference.md)
+- Plugin development: [docs/manual/plugin_development.md](docs/manual/plugin_development.md)
+
+## License
+
+MIT. See [LICENSE](LICENSE).

adapt_server-0.2.2/README.md

@@ -0,0 +1,131 @@
+# Adapt
+
+Adapt is a FastAPI server that turns files in a directory into APIs and UIs.
+
+- Datasets (`.csv`, `.xlsx`, `.parquet`) become CRUD endpoints and DataTables UIs
+- Markdown/HTML become browsable pages
+- Media files become streaming endpoints and player/gallery UIs
+- Python files can register custom routers
+
+## Quick Start
+
+```bash
+pip install adapt-server
+adapt addsuperuser --username admin /path/to/docroot
+adapt serve /path/to/docroot
+
+# Generate permissions for all discovered resources
+adapt admin create-permissions /path/to/docroot __all__
+
+# Everything below here can be done in the admin UI at
+# http://localhost:8000/admin/ after logging in with the superuser account.
+#
+# Create a regular user
+adapt admin create-user --username editor --password secret /path/to/docroot
+
+# By default, the editor user has no permissions.
+# See available groups (created by `adapt admin create-permissions`) and assign user to desired group
+adapt admin list-groups /path/to/docroot
+adapt admin add-to-group --username editor --group <group_name> /path/to/docroot
+```
+
+Useful URLs:
+
+- `/` landing page
+- `/admin/` admin UI
+- `/api/<resource>` resource API
+- `/ui/<resource>` resource UI
+- `/schema/<resource>` resource schema
+
+## What Adapt Generates
+
+From files in your docroot, Adapt auto-discovers resources and mounts routes with extensionless URLs where possible.
+
+Example:
+
+```text
+data/
+  employees.csv
+  sales.xlsx
+  video.mp4
+  readme.md
+  stats.py
+```
+
+Rough output:
+
+- `/api/employees`, `/ui/employees`, `/schema/employees`
+- `/api/sales/<sheet>`, `/ui/sales/<sheet>`
+- `/media/video.mp4`, `/ui/video.mp4`, `/ui/media`
+- `/readme`
+- `/api/stats/*`
+
+## Current Security Posture
+
+This reflects the current implementation in the codebase.
+
+### In Place
+
+- **Authentication:** session cookies and API keys (`X-API-Key`)
+- **Authorization:** RBAC (users, groups, permissions), plus superuser bypass
+- **Password security:** PBKDF2 hashing with per-user salts
+- **Session security:** expiration enforcement, sliding renewal, cleanup task
+- **CSRF protection:** enforced for cookie-authenticated unsafe methods (`POST/PUT/PATCH/DELETE`), including mixed session + API-key requests
+- **Redirect hardening:** login `next` paths are validated as local relative paths
+- **Response hardening:** CSP, `X-Frame-Options`, `X-Content-Type-Options`, `Referrer-Policy`, `Permissions-Policy`, HSTS (when TLS is enabled)
+- **Host header hardening:** Trusted Host middleware
+- **Data integrity:** lock-based, atomic writes for mutable dataset plugins
+- **Auditability:** admin/audit logging for security-relevant actions
+- **Sensitive response cleanup:** admin user APIs no longer expose `password_hash`
+
+### Important Deployment Notes
+
+- Use TLS in non-local environments (`--tls-cert` + `--tls-key`) so secure cookies and HSTS protections are effective.
+- API-key-only clients are exempt from CSRF checks by design; cookie-auth browser flows require CSRF tokens.
+
+## Core Features
+
+- Adaptive discovery and route generation
+- Dataset CRUD with schema exposure
+- Caching with invalidation on mutations
+- Built-in admin UI for users/groups/permissions/locks/cache/api keys/audit logs
+- Plugin architecture with companion overrides in `.adapt/`
+
+## Dataset Mutation Envelope
+
+For dataset endpoints, write operations use this payload structure:
+
+```json
+{
+  "action": "create|update|delete",
+  "data": []
+}
+```
+
+Use object data for `update`/`delete` as needed (for example, with `_row_id`).
+
+## CLI (Common Commands)
+
+```bash
+adapt serve <root> [--host ... --port ... --tls-cert ... --tls-key ... --reload --readonly --debug]
+adapt check <root>
+adapt addsuperuser <root> --username <name>
+adapt list-endpoints <root>
+adapt admin list-resources <root>
+adapt admin create-permissions <root> __all__
+```
+
+## Documentation
+
+Detailed docs live under `docs/manual/`.
+
+- Manual index: [docs/manual/index.md](docs/manual/index.md)
+- Security: [docs/manual/security.md](docs/manual/security.md)
+- Quick start: [docs/manual/quick_start.md](docs/manual/quick_start.md)
+- Configuration: [docs/manual/configuration.md](docs/manual/configuration.md)
+- API reference: [docs/manual/api_reference.md](docs/manual/api_reference.md)
+- Plugin development: [docs/manual/plugin_development.md](docs/manual/plugin_development.md)
+
+## License
+
+MIT. See [LICENSE](LICENSE).

{adapt_server-0.1.4 → adapt_server-0.2.2}/adapt/__init__.py

@@ -1,3 +1,3 @@
 """Adapt package namespace."""
 
-__version__ = "0.1.1"
+__version__ = "0.2.2"

{adapt_server-0.1.4 → adapt_server-0.2.2}/adapt/admin/groups.py

@@ -7,7 +7,7 @@ from ..auth import require_superuser
 from ..storage import User, Group, UserGroup, get_db_session
 from ..audit import log_action
 from . import router
-from .models import GroupCreate, GroupRead
+from .models import GroupCreate, GroupReadSafe, GroupUserRead
 
 logger = logging.getLogger(__name__)
 
@@ -58,7 +58,7 @@ def list_groups(
     logger.debug("Listed %d groups with query params", len(result))
     return result
 
-@router.get("/groups/{group_id}", response_model=GroupRead)
+@router.get("/groups/{group_id}", response_model=GroupReadSafe)
 def get_group(group_id: int, db: Session = Depends(get_db_session), user = Depends(require_superuser)):
     """Get a group by ID, including its users."""
     group = db.get(Group, group_id)
@@ -72,11 +72,20 @@ def get_group(group_id: int, db: Session = Depends(get_db_session), user = Depen
     users = db.exec(stmt).all()
     
     logger.debug("Retrieved group %s with %d users", group.name, len(users))
-    return GroupRead(
+    return GroupReadSafe(
         id=group.id,
         name=group.name,
         description=group.description,
-        users=users
+        users=[
+            GroupUserRead(
+                id=u.id,
+                username=u.username,
+                is_active=u.is_active,
+                is_superuser=u.is_superuser,
+                created_at=u.created_at,
+            )
+            for u in users
+        ]
     )
 
 @router.post("/groups", response_model=Group)

{adapt_server-0.1.4 → adapt_server-0.2.2}/adapt/admin/models.py

@@ -1,9 +1,8 @@
+from datetime import datetime
 from pydantic import BaseModel
 from typing import List, Optional
 import logging
 
-from ..storage import User
-
 logger = logging.getLogger(__name__)
 
 class UserCreate(BaseModel):
@@ -17,12 +16,31 @@ class GroupCreate(BaseModel):
     name: str
     description: Optional[str] = None
 
-class GroupRead(BaseModel):
-    """Model for reading group data with users."""
+
+class UserPublic(BaseModel):
+    """Safe user response model without sensitive fields."""
+    id: int
+    username: str
+    is_active: bool
+    is_superuser: bool
+    created_at: datetime
+
+
+class GroupUserRead(BaseModel):
+    """Safe group user representation."""
+    id: int
+    username: str
+    is_active: bool
+    is_superuser: bool
+    created_at: datetime
+
+
+class GroupReadSafe(BaseModel):
+    """Safe model for reading group data with users."""
     id: int
     name: str
     description: Optional[str] = None
-    users: List[User] = []
+    users: List[GroupUserRead] = []
 
 class PermissionCreate(BaseModel):
     """Model for creating a new permission."""

{adapt_server-0.1.4 → adapt_server-0.2.2}/adapt/admin/resources.py

@@ -2,8 +2,10 @@ from pathlib import Path
 from typing import List
 import logging
 
+from .. import cache
 from ..config import AdaptConfig
 from ..discovery import discover_resources
+from ..storage import init_database
 
 logger = logging.getLogger(__name__)
 
@@ -14,6 +16,9 @@ def list_resources(root: Path) -> List[str]:
     Returns a list of resource identifiers including sub-namespaces for multi-resource files.
     """
     config = AdaptConfig(root=root)
+    config.load_from_file()
+    init_database(config.db_path)
+    cache.configure(str(config.db_path))
     resources = discover_resources(root, config)
     resource_names = []
     for r in resources:

{adapt_server-0.1.4 → adapt_server-0.2.2}/adapt/admin/ui.py

@@ -4,6 +4,7 @@ import logging
 
 from ..auth import get_current_user
 from ..utils import build_ui_links
+from ..security_urls import login_redirect_url
 from . import router
 
 logger = logging.getLogger(__name__)
@@ -14,7 +15,7 @@ def admin_ui(request: Request):
     user = get_current_user(request)
     if not user or not getattr(user, "is_superuser", False):
         logger.debug("Non-superuser access to admin UI, redirecting to login")
-        return RedirectResponse(url="/auth/login?next=/admin/", status_code=302)
+        return RedirectResponse(url=login_redirect_url("/admin/"), status_code=302)
 
     # Build context for template
     is_superuser = getattr(user, 'is_superuser', False)

{adapt_server-0.1.4 → adapt_server-0.2.2}/adapt/admin/users.py

@@ -7,11 +7,11 @@ from ..auth import require_superuser, hash_password
 from ..storage import User, get_db_session
 from ..audit import log_action
 from . import router
-from .models import UserCreate
+from .models import UserCreate, UserPublic
 
 logger = logging.getLogger(__name__)
 
-@router.get("/users", response_model=List[User])
+@router.get("/users", response_model=List[UserPublic])
 def list_users(
     db: Session = Depends(get_db_session),
     limit: int = Query(None, ge=1, le=1000),
@@ -59,9 +59,18 @@ def list_users(
             result.append(u)
     
     logger.debug("Listed %d users with query params", len(result))
-    return result
+    return [
+        UserPublic(
+            id=u.id,
+            username=u.username,
+            is_active=u.is_active,
+            is_superuser=u.is_superuser,
+            created_at=u.created_at,
+        )
+        for u in result
+    ]
 
-@router.post("/users", response_model=User)
+@router.post("/users", response_model=UserPublic)
 def create_user(user_data: UserCreate, request: Request, db: Session = Depends(get_db_session), user: User = Depends(require_superuser)):
     """Create a new user."""
     # Check if server is in read-only mode
@@ -87,7 +96,13 @@ def create_user(user_data: UserCreate, request: Request, db: Session = Depends(g
     log_action(request, "create_user", "user", f"Created user {new_user.username}", user.id)
     logger.info("Created user %s", new_user.username)
     
-    return new_user
+    return UserPublic(
+        id=new_user.id,
+        username=new_user.username,
+        is_active=new_user.is_active,
+        is_superuser=new_user.is_superuser,
+        created_at=new_user.created_at,
+    )
 
 @router.delete("/users/{user_id}")
 def delete_user(user_id: int, request: Request, db: Session = Depends(get_db_session), user: User = Depends(require_superuser)):