admina-framework 0.12.0__tar.gz → 0.12.2__tar.gz

{admina_framework-0.12.0/admina_framework.egg-info → admina_framework-0.12.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: admina-framework
-Version: 0.12.0
+Version: 0.12.2
 Summary: Admina — governed AI development framework
 Author-email: Stefano Noferi <info@admina.org>
 Maintainer-email: Stefano Noferi <info@admina.org>
@@ -382,6 +382,10 @@ Real-time governance dashboard on port 3000:
 
 API backend: `GET /api/dashboard/score`, `/feed`, `/compliance`, `/sovereignty`, `/infra`, `/models`
 
+In `admina dev` local mode the dashboard asks for the API key (`admina password show`)
+and keeps a short-lived browser session that only the read-only dashboard API accepts.
+Set `ADMINA_DASHBOARD_ENABLED=false` to stop serving the bundled dashboard.
+
 ## Configuration
 
 Admina uses `admina.yaml` as the primary config file (with `.env` fallback for backward compatibility):

{admina_framework-0.12.0 → admina_framework-0.12.2}/README.md

@@ -305,6 +305,10 @@ Real-time governance dashboard on port 3000:
 
 API backend: `GET /api/dashboard/score`, `/feed`, `/compliance`, `/sovereignty`, `/infra`, `/models`
 
+In `admina dev` local mode the dashboard asks for the API key (`admina password show`)
+and keeps a short-lived browser session that only the read-only dashboard API accepts.
+Set `ADMINA_DASHBOARD_ENABLED=false` to stop serving the bundled dashboard.
+
 ## Configuration
 
 Admina uses `admina.yaml` as the primary config file (with `.env` fallback for backward compatibility):

{admina_framework-0.12.0 → admina_framework-0.12.2}/admina/__init__.py

@@ -23,7 +23,7 @@ from __future__ import annotations
 
 from admina.sdk import ComplianceKit, GovernedAgent, GovernedData, GovernedModel
 
-__version__ = "0.12.0"
+__version__ = "0.12.2"
 
 __all__ = [
     "__version__",

{admina_framework-0.12.0 → admina_framework-0.12.2}/admina/cli/main.py

@@ -643,6 +643,7 @@ def _run_local(
                 click.echo(f"    http://{ip}:{port}  ({label})")
         else:
             click.echo(f"  Ready → http://{display_host}:{port}")
+        click.echo("  Dashboard sign-in: the API key (show it with `admina password show`)")
         if not no_browser:
             webbrowser.open(f"http://{display_host}:{port}")
     else:

{admina_framework-0.12.0 → admina_framework-0.12.2}/admina/dashboard/static/index.html

@@ -330,6 +330,33 @@
   .link-card:hover { border-color: var(--teal); }
   .link-card .lc-label { font-size: 11px; text-transform: uppercase; color: var(--muted); margin-bottom: 6px; }
   .link-card .lc-title { font-size: 14px; font-weight: 600; }
+
+  /* ── Sign-in ─────────────────────────────────────────── */
+  .signin {
+    position: fixed; inset: 0; z-index: 300; background: var(--bg);
+    display: flex; align-items: center; justify-content: center; padding: 24px;
+  }
+  .signin-card {
+    width: 100%; max-width: 420px; background: var(--surface);
+    border: 1px solid var(--border2); border-radius: 12px; padding: 28px;
+  }
+  .signin-card .logo { display: flex; align-items: center; gap: 10px; font-size: 18px; font-weight: 700; margin-bottom: 16px; }
+  .signin-card .logo img { width: 32px; height: 32px; object-fit: contain; }
+  .signin-card .logo .accent { color: var(--teal); }
+  .signin-card p { font-size: 13px; color: var(--muted); line-height: 1.6; margin-bottom: 16px; }
+  .signin-card code { font-family: var(--mono); font-size: 12px; color: var(--text); }
+  .signin-card label { display: block; font-size: 12px; text-transform: uppercase; letter-spacing: 0.05em; color: var(--muted); margin-bottom: 6px; }
+  .signin-card input {
+    width: 100%; padding: 9px 12px; border-radius: 6px; border: 1px solid var(--border2);
+    background: var(--surface2); color: var(--text); font-family: var(--mono); font-size: 13px;
+  }
+  .signin-card input:focus { outline: none; border-color: var(--teal); }
+  .signin-card button {
+    margin-top: 14px; width: 100%; padding: 9px 12px; border-radius: 6px; cursor: pointer;
+    background: var(--teal-dark); color: #fff; border: 1px solid var(--teal); font-size: 14px; font-weight: 600;
+  }
+  .signin-card button:disabled { opacity: 0.6; cursor: default; }
+  .signin-card .error { margin-top: 12px; font-size: 13px; color: var(--red); }
 </style>
 </head>
 <body>
@@ -339,6 +366,25 @@
      ════════════════════════════════════════════════════════ -->
 <div x-data="dashboard()" x-init="init()">
 
+  <!-- Sign-in: the API key is exchanged for a short-lived browser session -->
+  <div class="signin" x-show="needsLogin" x-cloak>
+    <form class="signin-card" @submit.prevent="login()">
+      <div class="logo">
+        <img src="heimdall.png" alt="">
+        <span><span class="accent">Admina</span> Governance Dashboard</span>
+      </div>
+      <p>
+        Sign in with this instance's API key. In an <code>admina dev</code> project,
+        run <code>admina password show</code> to display it.
+      </p>
+      <label for="admina-api-key">API key</label>
+      <input id="admina-api-key" type="password" x-model="loginKey" x-ref="loginKey"
+             autocomplete="off" autocapitalize="off" spellcheck="false" required>
+      <button type="submit" :disabled="loginBusy || !loginKey">Sign in</button>
+      <div class="error" x-show="loginError" x-text="loginError" role="alert"></div>
+    </form>
+  </div>
+
   <!-- Top Bar -->
   <div class="topbar">
     <div class="logo">
@@ -349,6 +395,9 @@
       <span class="ts" x-text="lastUpdate"></span>
       <div class="sep"></div>
       <button class="refresh-btn" @click="refresh()">Refresh</button>
+      <template x-if="sessionActive">
+        <button class="refresh-btn" @click="logout()">Sign out</button>
+      </template>
       <div class="sep"></div>
       <div class="status">
         <div class="dot" :style="{ background: healthy ? 'var(--green)' : 'var(--red)' }"></div>
@@ -686,12 +735,14 @@
           </p>
           <p>
             Until you submit a real assessment, the dashboard renders all articles at 0% with a default
-            placeholder. To record your real coverage, POST your declared evidence to
-            <code class="inline">/api/compliance/gap-analysis</code>.
+            placeholder. To record your real coverage, send your declared evidence with a
+            <strong>POST</strong> request to <code class="inline">/api/compliance/gap-analysis</code>
+            on this host (the route accepts POST only: opening it in the browser answers
+            405 Method Not Allowed).
           </p>
           <p style="margin-bottom: 6px;"><strong>Example request:</strong></p>
           <button class="modal-copy-btn" @click="copyAssessmentCmd($event)">Copy command</button>
-          <pre class="modal-pre" id="assessment-cmd">curl -X POST http://localhost:8080/api/compliance/gap-analysis \
+          <pre class="modal-pre" id="assessment-cmd">curl -X POST <span x-text="apiBase"></span>/api/compliance/gap-analysis \
   -H "X-API-Key: $ADMINA_API_KEY" -H "Content-Type: application/json" \
   -d '{"risk_category": "high",
        "current_compliance": {
@@ -807,7 +858,9 @@
  * Admina Governance Dashboard — Alpine.js application.
  *
  * Reads from the Phase 3.1 API endpoints. Does NOT write.
- * All API calls go through the nginx reverse proxy (/api/*).
+ * All API calls go to /api/* on the same origin: the proxy itself in
+ * `admina dev` local mode (browser session after sign-in), or the nginx
+ * reverse proxy of the Docker stack (which adds the API key).
  */
 function dashboard() {
   return {
@@ -824,6 +877,12 @@ function dashboard() {
     modelData: {},
     oisg: {},
     showAssessmentHelp: false,
+    needsLogin: false,
+    sessionActive: false,
+    loginKey: '',
+    loginError: '',
+    loginBusy: false,
+    _started: false,
     _ws: null,
     _feedId: 0,
     _refreshTimer: null,
@@ -920,17 +979,96 @@ function dashboard() {
 
     // ── Init ───────────────────────────────────────────
     async init() {
-      await this.refresh();
+      if (await this.checkSession()) this.start();
+    },
+
+    start() {
+      // Alpine calls init() both automatically and via x-init: start once.
+      if (this._started) return;
+      this._started = true;
+      this.refresh();
       this.connectWebSocket();
       // Auto-refresh every 10s
       this._refreshTimer = setInterval(() => this.refresh(), 10000);
     },
 
+    // ── Session ────────────────────────────────────────
+    // Serving this page never signs the browser in. The API key is exchanged
+    // once for a short-lived HttpOnly session cookie that only the read-only
+    // dashboard API accepts. Behind the Docker nginx the proxy already
+    // receives the key, so no sign-in is needed there.
+    async checkSession() {
+      try {
+        const r = await fetch('/api/dashboard/session', { cache: 'no-store' });
+        if (r.status === 401) { this.showLogin(''); return false; }
+        if (r.ok) this.sessionActive = !!(await r.json()).session;
+      } catch (e) { /* network error: start anyway and show Disconnected */ }
+      return true;
+    },
+
+    async login() {
+      if (!this.loginKey) return;
+      this.loginBusy = true;
+      this.loginError = '';
+      try {
+        const r = await fetch('/api/dashboard/session', {
+          method: 'POST',
+          headers: { 'X-API-Key': this.loginKey },
+          cache: 'no-store',
+        });
+        if (r.ok) {
+          this.loginKey = '';
+          this.needsLogin = false;
+          this.sessionActive = true;
+          this.start();
+        } else if (r.status === 401) {
+          this.loginError = 'Invalid API key.';
+        } else {
+          let detail = '';
+          try { detail = (await r.json()).detail || ''; } catch (e) { /* not JSON */ }
+          this.loginError = detail || `Sign-in failed (HTTP ${r.status}).`;
+        }
+      } catch (e) {
+        this.loginError = 'Admina is not reachable.';
+      } finally {
+        this.loginBusy = false;
+      }
+    },
+
+    async logout() {
+      try { await fetch('/api/dashboard/session', { method: 'DELETE', cache: 'no-store' }); }
+      catch (e) { /* cookie expires on its own */ }
+      this.showLogin('');
+    },
+
+    showLogin(message) {
+      clearInterval(this._refreshTimer);
+      this._refreshTimer = null;
+      this._started = false;
+      if (this._ws) {
+        const ws = this._ws;
+        this._ws = null;
+        ws.onclose = null;
+        ws.close();
+      }
+      this.wsConnected = false;
+      this.sessionActive = false;
+      this.feedEvents = [];
+      this.loginError = message;
+      this.needsLogin = true;
+      this.$nextTick(() => this.$refs.loginKey && this.$refs.loginKey.focus());
+    },
+
     // ── Fetch all data ─────────────────────────────────
     async refresh() {
       // allSettled so one failing endpoint never blanks the whole dashboard.
       const okJson = async (url) => {
         const r = await fetch(url);
+        if (r.status === 401) {
+          const err = new Error(`${url} -> 401`);
+          err.unauthorized = true;
+          throw err;
+        }
         if (!r.ok) throw new Error(`${url} -> ${r.status}`);
         return r.json();
       };
@@ -944,6 +1082,10 @@ function dashboard() {
         okJson('/api/dashboard/models'),
         okJson('/api/dashboard/oisg'),
       ]);
+      if (results.some(r => r.status === 'rejected' && r.reason && r.reason.unauthorized)) {
+        this.showLogin('Your session has expired. Sign in again.');
+        return;
+      }
       const [scoreRes, compRes, sovRes, statsRes, feedRes, infraRes, modelsRes, oisgRes] =
         results.map(r => r.status === 'fulfilled' ? r.value : null);
 
@@ -998,8 +1140,9 @@ function dashboard() {
 
         this._ws.onclose = () => {
           this.wsConnected = false;
+          if (this.needsLogin) return;
           console.log('[Admina] WebSocket disconnected, reconnecting in 3s...');
-          setTimeout(() => this.connectWebSocket(), 3000);
+          setTimeout(() => { if (!this.needsLogin) this.connectWebSocket(); }, 3000);
         };
 
         this._ws.onerror = () => {
@@ -1007,11 +1150,17 @@ function dashboard() {
         };
       } catch (e) {
         this.wsConnected = false;
-        setTimeout(() => this.connectWebSocket(), 5000);
+        setTimeout(() => { if (!this.needsLogin) this.connectWebSocket(); }, 5000);
       }
     },
 
     // ── Helpers ─────────────────────────────────────────
+    // The origin that served this page: the proxy itself, or the dashboard
+    // container that forwards /api/ to it.
+    get apiBase() {
+      return window.location.origin;
+    },
+
     copyAssessmentCmd(ev) {
       const pre = document.getElementById('assessment-cmd');
       if (!pre) return;

{admina_framework-0.12.0 → admina_framework-0.12.2}/admina/domains/compliance/forensic.py

@@ -24,6 +24,7 @@ import logging
 import os
 import threading
 import time
+from collections import deque
 from datetime import UTC, datetime
 from pathlib import Path
 
@@ -35,6 +36,8 @@ logger = logging.getLogger("admina.forensic_blackbox")
 _CHAIN_STATE_KEY = "_chain_state.json"
 # Sidecar holding the HMAC-SHA256 signature of the chain-state payload.
 _CHAIN_STATE_SIG_KEY = "_chain_state.json.sig"
+# Records kept in memory for recent_records(), newest last.
+RECENT_RECORDS_MAX = 1000
 
 
 class ForensicBlackBox(BaseForensicStore):
@@ -81,6 +84,10 @@ class ForensicBlackBox(BaseForensicStore):
         self.chain_head: str = "GENESIS"
         self.record_count: int = 0
         self._write_lock = threading.Lock()
+        # The last records written by this process, for readers that need
+        # recent activity without reading the backend back (the dashboard
+        # feed when no analytics store is configured).
+        self._recent: deque[dict] = deque(maxlen=RECENT_RECORDS_MAX)
         self._state_signing_key = state_signing_key or os.environ.get("ADMINA_FORENSIC_STATE_KEY")
         if self.filesystem_dir is not None:
             self.filesystem_dir.mkdir(parents=True, exist_ok=True)
@@ -346,6 +353,7 @@ class ForensicBlackBox(BaseForensicStore):
             # Store the record and persist the updated chain state
             self._store_to_s3(forensic_record)
             self._persist_chain_state()
+            self._recent.append(forensic_record)
 
             return {
                 "sequence_number": self.record_count,
@@ -354,6 +362,19 @@ class ForensicBlackBox(BaseForensicStore):
                 "stored": (self.boto3_client is not None or self.filesystem_dir is not None),
             }
 
+    def recent_records(self, limit: int = RECENT_RECORDS_MAX) -> list[dict]:
+        """Return up to *limit* records written by this process, newest first.
+
+        Only the last ``RECENT_RECORDS_MAX`` records are kept, in memory, with
+        every backend; records written before the process started are not
+        read back. Use :meth:`verify_chain` for the persisted chain.
+        """
+        if limit <= 0:
+            return []
+        with self._write_lock:
+            records = list(self._recent)
+        return records[::-1][:limit]
+
     def _store_to_s3(self, record: dict):
         """Persist a forensic record using the configured backend."""
         ts = datetime.now(UTC)

{admina_framework-0.12.0 → admina_framework-0.12.2}/admina/engines/presidio.py

@@ -57,6 +57,9 @@ _PRESIDIO_TO_ADMINA: dict[str, str] = {
 }
 
 # Languages Admina configures for Presidio, each mapped to its spaCy model.
+# The Presidio entity types requested from the analyzer.
+_ENTITIES: list[str] = list(_PRESIDIO_TO_ADMINA)
+
 _LANG_MODELS: dict[str, str] = {
     "en": "en_core_web_sm",
     "it": "it_core_news_sm",
@@ -111,9 +114,11 @@ class PresidioPIIEngine:
 
         # Union of per-language analyses: a recognizer registered for only one
         # language is missed by the other pass, so both are run and merged.
+        # Only the mapped entity types are requested: the other recognizers
+        # (URL among them, slow on text with many dots) would be discarded.
         raw = []
         for lang in self.languages:
-            raw.extend(self._analyzer.analyze(text=text, language=lang))
+            raw.extend(self._analyzer.analyze(text=text, language=lang, entities=_ENTITIES))
 
         spans: list[tuple[int, int, str, str]] = []
         for r in raw:

{admina_framework-0.12.0 → admina_framework-0.12.2}/admina/plugins/builtin/auth/apikey.py

@@ -16,17 +16,17 @@
 
 Simple header-based authentication using constant-time comparison.
 Supports both ``X-API-Key`` and ``Authorization: Bearer`` headers.
+
+Cookies are never accepted here. The bundled dashboard's browser session is
+handled by the proxy itself, which admits it only on the read-only dashboard
+API (see ``admina.proxy.dashboard_session``).
 """
 
 from __future__ import annotations
 
-import base64
-import hashlib
-import hmac
 import logging
 import os
 import secrets
-import time
 from typing import Any
 
 from admina.plugins.base import BaseAuthProvider
@@ -94,12 +94,13 @@ class APIKeyAuthProvider(BaseAuthProvider):
         if path in self._exempt_paths:
             return {"user_id": "anonymous", "roles": ["public"], "metadata": {}}
 
-        # Accept a raw API key from headers/Bearer, or a signed session cookie.
+        # Accept only the raw API key from X-API-Key or Authorization: Bearer.
         provided = self._extract_key(request)
-        if provided and secrets.compare_digest(provided, self._api_key):
+        # Compare bytes: compare_digest raises TypeError on non-ASCII str.
+        if provided and secrets.compare_digest(
+            provided.encode("utf-8"), self._api_key.encode("utf-8")
+        ):
             return {"user_id": "api_key_user", "roles": ["authenticated"], "metadata": {}}
-        if self._verify_session_cookie(self._extract_session_cookie(request)):
-            return {"user_id": "dashboard_session", "roles": ["authenticated"], "metadata": {}}
         raise PermissionError("Invalid or missing API key")
 
     async def authorize(
@@ -128,12 +129,7 @@ class APIKeyAuthProvider(BaseAuthProvider):
 
     @staticmethod
     def _extract_key(request: Any) -> str:
-        """Extract the raw API key from request headers (X-API-Key or Bearer).
-
-        The admina_session cookie is NOT extracted here — it carries a signed
-        token, not the raw key, and is handled separately by
-        ``_extract_session_cookie`` + ``_verify_session_cookie``.
-        """
+        """Extract the raw API key from request headers (X-API-Key or Bearer)."""
         if isinstance(request, dict):
             headers = request.get("headers", {})
         else:
@@ -145,36 +141,3 @@ class APIKeyAuthProvider(BaseAuthProvider):
             if auth.startswith("Bearer "):
                 key = auth.removeprefix("Bearer ").strip()
         return key
-
-    @staticmethod
-    def _extract_session_cookie(request: Any) -> str:
-        """Extract the admina_session cookie value from a request."""
-        if isinstance(request, dict):
-            cookies = request.get("cookies", {})
-        else:
-            cookies = dict(getattr(request, "cookies", {}))
-        return cookies.get("admina_session", "")
-
-    def _verify_session_cookie(self, token: str) -> bool:
-        """Verify a signed admina_session cookie against the configured key.
-
-        Mirrors the proxy's dashboard token format (HMAC-SHA256 over the
-        expiry). Replicated locally so this plugin does not depend on the
-        proxy package.
-        """
-        if not self._api_key or not token:
-            return False
-        try:
-            raw = base64.urlsafe_b64decode(token.encode("ascii")).decode("utf-8")
-            payload, sig = raw.rsplit(".", 1)
-        except (ValueError, UnicodeDecodeError):
-            return False
-        expected = hmac.new(
-            self._api_key.encode("utf-8"), payload.encode("utf-8"), hashlib.sha256
-        ).hexdigest()
-        if not secrets.compare_digest(sig, expected):
-            return False
-        try:
-            return int(time.time()) < int(payload)
-        except ValueError:
-            return False