alphadesk 0.2.0__py3-none-any.whl

alphadesk/app/admin.py

@@ -0,0 +1,261 @@
+"""The owner's admin routes and every reader's plan routes (2026-09-18).
+
+/api/admin/*  OWNER ONLY (ALPHADESK_OWNER_EMAILS): every account, and the
+              switches an operator needs — disable, sign out everywhere,
+              extend a trial. Anyone else gets 403, not a hint of the list.
+/api/billing  the signed-in reader's own access, and the doors to the
+              payment processor's checkout and billing portal. With no
+              processor configured those answer 503 and charge nothing.
+/api/billing/webhook/{provider}  the processor's signed notifications. The
+              signature is the processor's own; an unverifiable body changes
+              nothing.
+"""
+from __future__ import annotations
+
+import logging
+import os
+
+from fastapi import APIRouter, Body, HTTPException, Request, Response
+from pydantic import BaseModel, Field
+
+from alphadesk import billing
+from alphadesk.app import auth
+from alphadesk.ledger import store
+
+log = logging.getLogger(__name__)
+
+router = APIRouter()
+
+
+def _claims(request: Request) -> dict:
+    claims = auth.current_user(request)
+    if not claims or not claims.get("uid"):
+        raise HTTPException(401, "sign in required")
+    return claims
+
+
+def _owner(request: Request) -> dict:
+    claims = _claims(request)
+    if not billing.is_owner(claims.get("email")):
+        raise HTTPException(403, "owners only")
+    return claims
+
+
+# ── the owner's admin page ──────────────────────────────────────────────────
+
+@router.get("/api/admin/users")
+def admin_users(request: Request):
+    """Every account, newest first, with its access decided exactly as the
+    gate decides it — and the totals the page leads with."""
+    _owner(request)
+    users = []
+    for u in store.admin_list_users():
+        users.append({
+            "user_id": u["user_id"],
+            "email": u["email"],
+            "disabled": bool(u["disabled"]),
+            "created_at": u["created_at"],
+            "last_seen_at": u["last_seen_at"],
+            "sign_ins": u["sign_ins"],
+            "counts": u["counts"],
+            "access": billing.access(u),
+        })
+    totals = {"accounts": len(users), "disabled": sum(1 for u in users if u["disabled"])}
+    for state in ("owner", "subscribed", "trialing", "expired"):
+        totals[state] = sum(1 for u in users if u["access"]["state"] == state and not u["disabled"])
+    return {"users": users, "totals": totals, "enforced": billing.enforced(),
+            "trial_days": billing.trial_days(), "payments": billing.provider() is not None}
+
+
+class DisableIn(BaseModel):
+    disabled: bool
+
+
+@router.post("/api/admin/users/{user_id}/disabled")
+def admin_disable(user_id: str, body: DisableIn, request: Request):
+    """Disable or re-enable an account. Disabling also signs it out
+    everywhere, so an open tab stops at its next request."""
+    claims = _owner(request)
+    if user_id == claims["uid"] and body.disabled:
+        raise HTTPException(422, "you cannot disable your own account")
+    if not store.set_user_disabled(user_id, body.disabled):
+        raise HTTPException(404, "no such account")
+    if body.disabled:
+        auth.invalidate_sessions(user_id)
+    else:
+        auth._session_states.pop(user_id, None)
+    billing.forget(user_id)
+    log.info("admin %s set disabled=%s on %s", claims["email"], body.disabled, user_id)
+    return {"ok": True}
+
+
+@router.post("/api/admin/users/{user_id}/sign-out")
+def admin_sign_out(user_id: str, request: Request):
+    claims = _owner(request)
+    if not auth.invalidate_sessions(user_id):
+        raise HTTPException(404, "no such account")
+    log.info("admin %s signed out %s everywhere", claims["email"], user_id)
+    return {"ok": True}
+
+
+class TrialIn(BaseModel):
+    days: int = Field(ge=1, le=365)
+
+
+@router.post("/api/admin/users/{user_id}/trial")
+def admin_extend_trial(user_id: str, body: TrialIn, request: Request):
+    """Give an account `days` more of trial, counted from the later of now
+    and its current end — so extending a live trial adds to it."""
+    claims = _owner(request)
+    row = store.user_access_row(user_id)
+    if not row:
+        raise HTTPException(404, "no such account")
+    from datetime import datetime, timedelta, timezone
+    now = datetime.now(timezone.utc)
+    current = billing._parse(row.get("trial_ends_at"))
+    start = current if current and current > now else now
+    end = (start + timedelta(days=body.days)).isoformat(timespec="seconds")
+    store.set_trial_end(user_id, end)
+    billing.forget(user_id)
+    log.info("admin %s extended %s's trial to %s", claims["email"], user_id, end)
+    return {"ok": True, "trial_ends_at": end}
+
+
+# ── deleting an account ─────────────────────────────────────────────────────
+
+def _erase(user_id: str) -> dict[str, int] | None:
+    """Delete the account and everything it holds (store.delete_account).
+    Sessions end first, so an open tab stops at its next request; cached keys
+    are dropped. The reader's held news socket is released on the news
+    loop's next cycle (the account is no longer an active reader), and a live
+    price stream closes with the reader's last tab."""
+    from alphadesk.providers import registry
+    auth.invalidate_sessions(user_id)
+    gone = store.delete_account(user_id)
+    registry.forget_user_keys(user_id)
+    billing.forget(user_id)
+    auth._session_states.pop(user_id, None)
+    return gone
+
+
+class DeleteIn(BaseModel):
+    # The account's email, typed back: a delete cannot be a stray click.
+    confirm: str
+
+
+@router.post("/api/account/delete")
+def delete_my_account(body: DeleteIn, request: Request, response: Response):
+    """A reader deletes their own account and everything in it. Owners are
+    refused here — deleting the owner would lock the operator out of the
+    admin page; take the address off ALPHADESK_OWNER_EMAILS first."""
+    claims = _claims(request)
+    if body.confirm.strip().lower() != (claims.get("email") or "").lower():
+        raise HTTPException(422, "type your account's email address to confirm")
+    if billing.is_owner(claims.get("email")):
+        raise HTTPException(422, "an owner account cannot be deleted here")
+    if _erase(claims["uid"]) is None:
+        raise HTTPException(404, "no such account")
+    response.delete_cookie(auth.SESSION_COOKIE)
+    log.info("account %s deleted by its reader", claims["uid"])
+    return {"ok": True}
+
+
+@router.post("/api/admin/users/{user_id}/delete")
+def admin_delete(user_id: str, body: DeleteIn, request: Request):
+    """The owner deletes an account (a reader's written request, or abuse).
+    The account's email must be typed back, as for a reader's own delete."""
+    claims = _owner(request)
+    if user_id == claims["uid"]:
+        raise HTTPException(422, "you cannot delete your own account")
+    row = store.user_access_row(user_id)
+    if not row:
+        raise HTTPException(404, "no such account")
+    if body.confirm.strip().lower() != row["email"].lower():
+        raise HTTPException(422, "type the account's email address to confirm")
+    _erase(user_id)
+    log.info("admin %s deleted account %s", claims["email"], user_id)
+    return {"ok": True}
+
+
+# ── the reader's own plan ───────────────────────────────────────────────────
+
+def _return_url(request: Request) -> str:
+    base = os.environ.get("ALPHADESK_BASE_URL", "").strip().rstrip("/") \
+        or f"{request.url.scheme}://{request.url.netloc}"
+    return base + "/account"
+
+
+@router.get("/api/billing")
+def my_billing(request: Request):
+    claims = _claims(request)
+    return billing.access(store.user_access_row(claims["uid"]))
+
+
+def _processor() -> "billing.BillingProvider":
+    p = billing.provider()
+    if p is None:
+        raise HTTPException(503, "payments are not set up yet")
+    return p
+
+
+def _call(fn, *args, **kwargs) -> dict:
+    """A processor call as a route answer: a missing setting is 503 naming
+    it, a refusal or an unreachable processor 502 — never a bare 500."""
+    try:
+        return {"url": fn(*args, **kwargs)}
+    except billing.NotConfigured as exc:
+        raise HTTPException(503, str(exc)) from None
+    except billing.ProcessorError as exc:
+        log.warning("billing processor error: %s", exc)
+        raise HTTPException(502, str(exc)) from None
+
+
+@router.post("/api/billing/checkout")
+@router.post("/api/billing/create-checkout-session")
+def checkout(request: Request, body: dict | None = Body(default=None)):
+    """{plan: "monthly" | "yearly"} → {url} of the processor's checkout."""
+    claims = _claims(request)
+    plan = str((body or {}).get("plan") or "monthly").lower()
+    if plan not in billing.PLANS:
+        raise HTTPException(400, f"plan must be one of {', '.join(billing.PLANS)}")
+    p = _processor()
+    return _call(p.checkout_url, claims["uid"], claims["email"], _return_url(request), plan=plan)
+
+
+@router.post("/api/billing/portal")
+@router.post("/api/billing/create-portal-session")
+def portal(request: Request):
+    claims = _claims(request)
+    p = _processor()
+    row = store.user_access_row(claims["uid"]) or {}
+    if not row.get("plan_customer_id"):
+        raise HTTPException(409, "no subscription to manage yet")
+    return _call(p.portal_url, row["plan_customer_id"], _return_url(request))
+
+
+async def _webhook(provider_name: str, request: Request) -> dict:
+    p = billing.provider()
+    if p is None or p.name != provider_name:
+        raise HTTPException(404, "no such processor configured")
+    body = await request.body()
+    try:
+        updates = p.parse_webhook(body, {k.lower(): v for k, v in request.headers.items()})
+    except billing.NotConfigured as exc:
+        raise HTTPException(503, str(exc)) from None
+    except Exception as exc:  # noqa: BLE001 — any verification failure is a refusal
+        log.warning("%s webhook refused: %s", provider_name, exc)
+        raise HTTPException(400, "webhook could not be verified") from None
+    return {"ok": True, "changed": billing.apply_updates(p.name, updates)}
+
+
+@router.post("/api/billing/webhook")
+async def stripe_webhook(request: Request):
+    """Stripe's endpoint. Register <base-url>/api/billing/webhook in the
+    Stripe dashboard for checkout.session.completed and
+    customer.subscription.created / updated / deleted."""
+    return await _webhook("stripe", request)
+
+
+@router.post("/api/billing/webhook/{provider_name}")
+async def webhook(provider_name: str, request: Request):
+    return await _webhook(provider_name, request)

alphadesk/app/agent_access.py

@@ -0,0 +1,134 @@
+"""Readers connect their own agent to AlphaDesk (2026-09-17).
+
+AlphaDesk does not run an agent of its own. A reader points the agent they
+already use — Claude, ChatGPT, Cursor, opencode, anything that speaks MCP —
+at this app's tool server, and every call runs as that reader on their own
+keys (app/agent_tools.py). Their agent brings what it already has (web
+browsing, memory, file uploads, their subscription); AlphaDesk brings the
+data and the tools that verify their citations.
+
+This module is the credential for that:
+
+  * ACCESS TOKENS a reader issues on the Account page, one per agent they
+    connect. A token is "adk_" plus 256 bits of randomness. It is shown once;
+    only its SHA-256 is stored — a fast hash is enough because the token is
+    random, not a password a person chose. Revoking one stops it at once:
+    every request looks the hash up, nothing is cached.
+  * A RATE LIMIT per token, so a looping agent cannot spend a reader's vendor
+    quota (or the instance's EDGAR allowance) in a burst. It is kept in
+    memory per instance: with several instances an agent may get a little
+    more than the limit, never unbounded.
+  * THE HOSTS the tool server answers: loopback, plus the instance's public
+    address from ALPHADESK_BASE_URL. A request naming any other host is
+    refused before a tool runs (the MCP library's DNS-rebinding check).
+"""
+
+from __future__ import annotations
+
+import collections
+import hashlib
+import os
+import secrets
+import threading
+import time
+from urllib.parse import urlsplit
+
+TOKEN_PREFIX = "adk_"
+#: Live tokens one reader may hold.
+MAX_TOKENS = 10
+#: Tool-server requests one token may make per minute. An MCP tool call is
+#: one request; listing tools at connect is one more.
+RATE_PER_MIN = 120
+#: last-used is written at most this often per token.
+TOUCH_EVERY_S = 60.0
+
+
+def bearer(header_value: str | None) -> str | None:
+    """The token from an `Authorization: Bearer …` header, or None."""
+    text = (header_value or "").strip()
+    if not text.lower().startswith("bearer "):
+        return None
+    return text[7:].strip() or None
+
+
+class TokenLimit(Exception):
+    """The reader already holds MAX_TOKENS live tokens."""
+
+
+def _hash(secret: str) -> str:
+    return hashlib.sha256(secret.encode("utf-8")).hexdigest()
+
+
+def issue(user_id: str, name: str) -> tuple[dict, str]:
+    """(the stored row as listed, the token itself — shown once)."""
+    from alphadesk.ledger import store
+    if len(store.list_agent_access_tokens(user_id)) >= MAX_TOKENS:
+        raise TokenLimit(f"revoke a token first — at most {MAX_TOKENS} can be live")
+    secret = TOKEN_PREFIX + secrets.token_urlsafe(32)
+    token_id = "tok_" + secrets.token_hex(6)
+    label = (name or "").strip()[:60] or "agent"
+    store.create_agent_access_token(user_id, token_id, label, _hash(secret), secret[-4:])
+    row = next(r for r in store.list_agent_access_tokens(user_id) if r["token_id"] == token_id)
+    return row, secret
+
+
+_touched: dict[str, float] = {}
+_touch_lock = threading.Lock()
+
+
+def resolve(secret: str) -> tuple[str, str] | None:
+    """(token id, reader) for a live access token, else None."""
+    if not secret.startswith(TOKEN_PREFIX):
+        return None
+    from alphadesk.ledger import store
+    row = store.agent_access_token_by_hash(_hash(secret))
+    if row is None:
+        return None
+    now = time.monotonic()
+    with _touch_lock:
+        due = now - _touched.get(row["token_id"], -TOUCH_EVERY_S) >= TOUCH_EVERY_S
+        if due:
+            _touched[row["token_id"]] = now
+    if due:
+        store.touch_agent_access_token(row["token_id"])
+    return row["token_id"], row["user_id"]
+
+
+class RateLimit:
+    """A sliding one-minute window per key."""
+
+    def __init__(self, per_min: int = RATE_PER_MIN) -> None:
+        self.per_min = per_min
+        self._hits: dict[str, collections.deque] = {}
+        self._lock = threading.Lock()
+
+    def check(self, key: str, now: float | None = None) -> float:
+        """0 when the request may proceed (and counts it); otherwise the
+        seconds until it may."""
+        now = now if now is not None else time.monotonic()
+        with self._lock:
+            hits = self._hits.setdefault(key, collections.deque())
+            while hits and now - hits[0] >= 60.0:
+                hits.popleft()
+            if len(hits) >= self.per_min:
+                return max(0.1, 60.0 - (now - hits[0]))
+            hits.append(now)
+            return 0.0
+
+
+limiter = RateLimit()
+
+
+def allowed_hosts() -> tuple[list[str], list[str]]:
+    """(Host header values, Origin values) the tool server answers."""
+    hosts = ["127.0.0.1", "127.0.0.1:*", "localhost", "localhost:*", "[::1]", "[::1]:*"]
+    origins = ["http://127.0.0.1", "http://127.0.0.1:*", "http://localhost", "http://localhost:*"]
+    base = (os.environ.get("ALPHADESK_BASE_URL") or "").strip().rstrip("/")
+    if base:
+        parts = urlsplit(base)
+        if parts.netloc:
+            hosts.append(parts.netloc)
+            if ":" not in parts.netloc:
+                hosts.append(parts.netloc + ":*")
+            origins.append(f"{parts.scheme}://{parts.netloc}")
+    return hosts, origins