appmanager-server 0.2.0__py3-none-any.whl

appmanager/models.py

@@ -0,0 +1,307 @@
+from datetime import datetime, timezone
+
+from appmanager.database import db
+
+
+class Role(db.Model):
+    __tablename__ = "roles"
+
+    id = db.Column(db.Integer, primary_key=True)
+    name = db.Column(db.String(100), unique=True, nullable=False)
+    slug = db.Column(db.String(100), unique=True, nullable=False, index=True)
+    description = db.Column(db.String(255), nullable=True)
+    is_system = db.Column(db.Boolean, default=False, nullable=False)
+    created_at = db.Column(db.DateTime, default=lambda: datetime.now(timezone.utc))
+
+    def to_dict(self):
+        return {
+            "id": self.id,
+            "name": self.name,
+            "slug": self.slug,
+            "description": self.description or "",
+            "is_system": self.is_system,
+            "created_at": self.created_at.isoformat() if self.created_at else None,
+        }
+
+
+class User(db.Model):
+    __tablename__ = "users"
+
+    id = db.Column(db.Integer, primary_key=True)
+    email = db.Column(db.String(255), unique=True, nullable=False, index=True)
+    name = db.Column(db.String(255), nullable=True)
+    google_id = db.Column(db.String(255), unique=True, nullable=True)
+    role = db.Column(db.String(50), nullable=False, default="user")  # 'admin' or 'user'
+    is_active = db.Column(db.Boolean, default=True)
+    created_at = db.Column(db.DateTime, default=lambda: datetime.now(timezone.utc))
+    last_login_at = db.Column(db.DateTime, nullable=True)
+    last_active_at = db.Column(db.DateTime, nullable=True)
+    login_count = db.Column(db.Integer, default=0, nullable=False)
+    last_ip = db.Column(db.String(100), nullable=True)
+
+    permissions = db.relationship("UserAppPermission", backref="user", cascade="all, delete-orphan")
+
+    def is_admin(self):
+        return self.role == "admin"
+
+    def is_online(self):
+        if not self.last_active_at:
+            return False
+        dt = self.last_active_at
+        if dt.tzinfo is None:
+            dt = dt.replace(tzinfo=timezone.utc)
+        diff = (datetime.now(timezone.utc) - dt).total_seconds()
+        return diff < 300  # 5 minutes
+
+    def to_dict(self):
+        return {
+            "id": self.id,
+            "email": self.email,
+            "name": self.name or self.email,
+            "role": self.role,
+            "is_active": self.is_active,
+            "is_online": self.is_online(),
+            "created_at": self.created_at.isoformat() if self.created_at else None,
+            "last_login_at": self.last_login_at.isoformat() if self.last_login_at else None,
+            "last_active_at": self.last_active_at.isoformat() if self.last_active_at else None,
+            "login_count": self.login_count,
+            "last_ip": self.last_ip,
+        }
+
+
+class InstalledApp(db.Model):
+    __tablename__ = "installed_apps"
+
+    id = db.Column(db.Integer, primary_key=True)
+    name = db.Column(db.String(255), nullable=False)
+    slug = db.Column(
+        db.String(100), unique=True, nullable=False, index=True
+    )  # URL path under /apps/<slug>
+    description = db.Column(db.Text, nullable=True)
+    source_type = db.Column(db.String(50), nullable=False)  # 'git' or 'zip'
+    source_url = db.Column(db.String(500), nullable=True)  # Git repo URL or original ZIP filename
+    entry_point = db.Column(
+        db.String(255), nullable=False, default="app:app"
+    )  # e.g., app:app or main:create_app()
+    installed_at = db.Column(db.DateTime, default=lambda: datetime.now(timezone.utc))
+    is_active = db.Column(db.Boolean, default=True)
+    requires_auth = db.Column(db.Boolean, default=True, nullable=False)
+    is_default = db.Column(db.Boolean, default=False, nullable=False)
+    app_type = db.Column(
+        db.String(50), default="standalone", nullable=False
+    )  # 'standalone' or 'extension'
+    target_app = db.Column(
+        db.String(100), nullable=True
+    )  # Target app slug if app_type is 'extension'
+    has_web_ui = db.Column(db.Boolean, default=True, nullable=False)
+    settings_json = db.Column(db.Text, nullable=True)
+
+    permissions = db.relationship("UserAppPermission", backref="app", cascade="all, delete-orphan")
+
+    def get_settings(self):
+        import json
+
+        if self.settings_json:
+            try:
+                return json.loads(self.settings_json)
+            except Exception:
+                return {}
+        return {}
+
+    def set_settings(self, settings_dict):
+        import json
+
+        self.settings_json = json.dumps(settings_dict) if settings_dict is not None else None
+
+    def to_dict(self):
+        return {
+            "id": self.id,
+            "name": self.name,
+            "slug": self.slug,
+            "description": self.description or "",
+            "source_type": self.source_type,
+            "source_url": self.source_url,
+            "entry_point": self.entry_point,
+            "installed_at": self.installed_at.isoformat() if self.installed_at else None,
+            "is_active": self.is_active,
+            "requires_auth": self.requires_auth,
+            "is_default": self.is_default,
+            "app_type": self.app_type,
+            "target_app": self.target_app,
+            "has_web_ui": self.has_web_ui,
+            "settings": self.get_settings(),
+        }
+
+
+class UserAppPermission(db.Model):
+    __tablename__ = "user_app_permissions"
+
+    id = db.Column(db.Integer, primary_key=True)
+    user_id = db.Column(db.Integer, db.ForeignKey("users.id"), nullable=False)
+    app_id = db.Column(db.Integer, db.ForeignKey("installed_apps.id"), nullable=False)
+    can_access = db.Column(db.Boolean, default=True)
+    created_at = db.Column(db.DateTime, default=lambda: datetime.now(timezone.utc))
+
+    __table_args__ = (db.UniqueConstraint("user_id", "app_id", name="_user_app_uc"),)
+
+
+class MagicLinkToken(db.Model):
+    __tablename__ = "magic_link_tokens"
+
+    id = db.Column(db.Integer, primary_key=True)
+    email = db.Column(db.String(255), nullable=False, index=True)
+    token = db.Column(db.String(255), unique=True, nullable=False, index=True)
+    expires_at = db.Column(db.DateTime, nullable=False)
+    used = db.Column(db.Boolean, default=False)
+    created_at = db.Column(db.DateTime, default=lambda: datetime.now(timezone.utc))
+
+
+class AppHealthLog(db.Model):
+    __tablename__ = "app_health_logs"
+
+    id = db.Column(db.Integer, primary_key=True)
+    app_id = db.Column(db.Integer, db.ForeignKey("installed_apps.id"), nullable=False)
+    status = db.Column(
+        db.String(50), nullable=False, default="healthy"
+    )  # healthy, degraded, unhealthy
+    response_time_ms = db.Column(db.Float, nullable=True)
+    details = db.Column(db.Text, nullable=True)
+    checked_at = db.Column(db.DateTime, default=lambda: datetime.now(timezone.utc))
+
+    app = db.relationship(
+        "InstalledApp", backref=db.backref("health_logs", cascade="all, delete-orphan")
+    )
+
+
+class AppTelemetryLog(db.Model):
+    __tablename__ = "app_telemetry_logs"
+
+    id = db.Column(db.Integer, primary_key=True)
+    app_slug = db.Column(db.String(100), nullable=False, index=True)
+    event_type = db.Column(db.String(100), nullable=False)  # event, metric, error
+    payload_json = db.Column(db.Text, nullable=True)
+    created_at = db.Column(db.DateTime, default=lambda: datetime.now(timezone.utc))
+
+
+class AppExtensionData(db.Model):
+    __tablename__ = "app_extension_data"
+
+    id = db.Column(db.Integer, primary_key=True)
+    extension_slug = db.Column(db.String(100), nullable=False, index=True)
+    entity_type = db.Column(db.String(50), nullable=False, index=True)  # e.g., 'user'
+    entity_id = db.Column(db.Integer, nullable=False, index=True)
+    data_json = db.Column(db.Text, nullable=True)
+    updated_at = db.Column(
+        db.DateTime,
+        default=lambda: datetime.now(timezone.utc),
+        onupdate=lambda: datetime.now(timezone.utc),
+    )
+
+    __table_args__ = (
+        db.UniqueConstraint("extension_slug", "entity_type", "entity_id", name="_ext_entity_uc"),
+    )
+
+
+class AppConfig(db.Model):
+    """
+    Typed per-app configuration store. Replaces the freeform `settings_json`
+    blob as the primary settings interface. Each setting is a row — queryable,
+    auditable, and safe for concurrent updates (no read-modify-write on a blob).
+
+    Extensions declare their config schema on install; the framework seeds
+    default rows and renders a generated form (or the extension provides a
+    custom admin panel).
+    """
+
+    __tablename__ = "app_configs"
+
+    id = db.Column(db.Integer, primary_key=True)
+    app_id = db.Column(db.Integer, db.ForeignKey("installed_apps.id"), nullable=False, index=True)
+    key = db.Column(db.String(64), nullable=False)
+    value = db.Column(db.Text, nullable=True)  # JSON string or plain text
+    value_type = db.Column(
+        db.String(16), default="json", nullable=False
+    )  # json|string|boolean|integer|color
+    is_secret = db.Column(db.Boolean, default=False, nullable=False)
+    updated_at = db.Column(
+        db.DateTime,
+        default=lambda: datetime.now(timezone.utc),
+        onupdate=lambda: datetime.now(timezone.utc),
+    )
+
+    __table_args__ = (db.UniqueConstraint("app_id", "key", name="uq_app_config_key"),)
+
+    def get_value(self):
+        """Decode the stored value into a Python object based on value_type."""
+        import json
+
+        if self.value is None:
+            return None
+        if self.value_type == "json":
+            try:
+                return json.loads(self.value)
+            except Exception:
+                return self.value
+        if self.value_type == "boolean":
+            return self.value.lower() in ("1", "true", "yes", "on")
+        if self.value_type == "integer":
+            try:
+                return int(self.value)
+            except Exception:
+                return None
+        return self.value  # string, color
+
+    def set_value(self, val):
+        """Encode a Python value into the stored string based on value_type."""
+        import json
+
+        if val is None:
+            self.value = None
+        elif self.value_type == "json":
+            self.value = json.dumps(val) if not isinstance(val, str) else val
+        elif self.value_type == "boolean":
+            self.value = "1" if val else "0"
+        elif self.value_type == "integer":
+            self.value = str(int(val))
+        else:
+            self.value = str(val)
+
+    def to_dict(self):
+        return {
+            "key": self.key,
+            "value": self.get_value(),
+            "value_type": self.value_type,
+            "is_secret": self.is_secret,
+            "updated_at": self.updated_at.isoformat() if self.updated_at else None,
+        }
+
+
+class AppAdminPanel(db.Model):
+    """
+    Declared admin panel for an installed app, parsed from its manifest on
+    install/upgrade. The framework mounts these at `/admin/apps/<slug>/<panel>`
+    with admin auth enforced at mount time.
+    """
+
+    __tablename__ = "app_admin_panels"
+
+    id = db.Column(db.Integer, primary_key=True)
+    app_id = db.Column(db.Integer, db.ForeignKey("installed_apps.id"), nullable=False, index=True)
+    panel_id = db.Column(db.String(64), nullable=False)  # e.g. 'flair-presets'
+    label = db.Column(db.String(100), nullable=False)  # e.g. 'Flair presets'
+    icon = db.Column(db.String(50), nullable=True)
+    endpoint = db.Column(
+        db.String(255), nullable=True
+    )  # 'blueprint_name:endpoint' or None for generated form
+    sort_order = db.Column(db.Integer, default=0, nullable=False)
+
+    __table_args__ = (db.UniqueConstraint("app_id", "panel_id", name="uq_app_panel"),)
+
+    def to_dict(self):
+        return {
+            "panel_id": self.panel_id,
+            "label": self.label,
+            "icon": self.icon,
+            "endpoint": self.endpoint,
+            "sort_order": self.sort_order,
+        }

appmanager/py.typed

@@ -0,0 +1 @@
+# Marker file for PEP 561.

appmanager/sdk.py

@@ -0,0 +1,30 @@
+"""
+AppManager Developer SDK.
+
+Re-exports the lightweight `appmanager_sdk` package components for sub-applications and extensions,
+providing a single, unified developer API across the platform.
+"""
+
+from appmanager_sdk import (
+    AdminSection,
+    AppManager,
+    AppManagerClient,
+    AppManifest,
+    ScheduledTask,
+    Setting,
+    client,
+    get_current_user,
+    require_auth,
+)
+
+__all__ = [
+    "AppManifest",
+    "Setting",
+    "AdminSection",
+    "ScheduledTask",
+    "AppManagerClient",
+    "AppManager",
+    "client",
+    "get_current_user",
+    "require_auth",
+]

appmanager/security.py

@@ -0,0 +1,227 @@
+import hashlib
+import hmac
+import os
+import re
+import shutil
+import stat
+import time
+import zipfile
+from functools import wraps
+from typing import Dict, Optional, Tuple
+from urllib.parse import urljoin, urlparse
+
+from flask import abort, current_app, g, jsonify, request
+
+# Security Constants
+MAX_ZIP_EXTRACT_SIZE = 50 * 1024 * 1024  # 50 MB
+MAX_ZIP_FILE_COUNT = 1000
+CSRF_TOKEN_MAX_AGE = 3600 * 4  # 4 hours
+
+_rate_limit_records: Dict[str, list] = {}
+
+
+def get_security_secret() -> str:
+    """
+    Retrieves the application secret key for HMAC operations.
+    """
+    return current_app.config.get("SECRET_KEY", "default-appmanager-security-secret")
+
+
+def generate_csrf_token() -> str:
+    """
+    Generates a cryptographically signed HMAC CSRF token containing a timestamp.
+    """
+    secret = get_security_secret()
+    timestamp = str(int(time.time()))
+    # Use user ID if authenticated, else remote IP
+    identity = str(getattr(g, "current_user_id", request.remote_addr or "anon"))
+    signature = hmac.new(
+        secret.encode("utf-8"), f"{identity}:{timestamp}".encode("utf-8"), hashlib.sha256
+    ).hexdigest()
+    return f"{timestamp}:{signature}"
+
+
+def validate_csrf_token(token: Optional[str]) -> bool:
+    """
+    Validates a submitted CSRF token.
+    """
+    if not token or ":" not in token:
+        return False
+    try:
+        timestamp_str, signature = token.split(":", 1)
+        token_time = int(timestamp_str)
+        current_time = int(time.time())
+
+        # Check expiration
+        if current_time - token_time > CSRF_TOKEN_MAX_AGE or token_time > current_time + 60:
+            return False
+
+        secret = get_security_secret()
+        identity = str(getattr(g, "current_user_id", request.remote_addr or "anon"))
+        expected_sig = hmac.new(
+            secret.encode("utf-8"), f"{identity}:{timestamp_str}".encode("utf-8"), hashlib.sha256
+        ).hexdigest()
+
+        return hmac.compare_digest(signature, expected_sig)
+    except Exception:
+        return False
+
+
+def csrf_protect_required(f):
+    """
+    Decorator for route handlers requiring CSRF validation on non-safe HTTP methods.
+    """
+
+    @wraps(f)
+    def decorated_function(*args, **kwargs):
+        if request.method in ("POST", "PUT", "DELETE", "PATCH"):
+            token = (
+                request.form.get("csrf_token")
+                or request.headers.get("X-CSRFToken")
+                or request.headers.get("X-CSRF-Token")
+            )
+            if not validate_csrf_token(token):
+                if request.is_json or request.path.startswith("/api/"):
+                    return jsonify({"error": "CSRF validation failed", "success": False}), 400
+                abort(400, description="CSRF validation failed. Please refresh and try again.")
+        return f(*args, **kwargs)
+
+    return decorated_function
+
+
+def is_safe_redirect_url(target: Optional[str]) -> bool:
+    """
+    Ensures that a redirect target URL is safe and relative to the current host (prevents Open Redirect).
+    """
+    if not target:
+        return False
+    # Avoid javascript:, data:, or protocol-relative // URLs
+    if target.startswith(("javascript:", "data:", "vbscript:")) or target.startswith("//"):
+        return False
+    ref_url = urlparse(request.host_url)
+    test_url = urlparse(urljoin(request.host_url, target))
+    return test_url.scheme in ("http", "https") and ref_url.netloc == test_url.netloc
+
+
+def is_safe_repo_url(repo_url: str) -> bool:
+    """
+    Validates that a git repository URL is safe and does not contain option injection flags.
+    """
+    if not repo_url or repo_url.startswith("-"):
+        return False
+    pattern = r"^(https?|git|ssh)://[^\s]+$|^git@[^\s]+:[^\s]+$"
+    return bool(re.match(pattern, repo_url.strip()))
+
+
+def validate_entrypoint_path(app_dir: str, entry_point: str) -> Tuple[bool, str]:
+    """
+    Ensures an entrypoint string does not escape the app directory via directory traversal.
+    """
+    if ":" in entry_point:
+        module_name = entry_point.split(":", 1)[0]
+    else:
+        module_name = entry_point
+
+    # Disallow path separators in module name
+    if "/" in module_name or "\\" in module_name or ".." in module_name:
+        return False, "Entrypoint module name cannot contain path separators or parent references."
+
+    module_file = os.path.join(app_dir, f"{module_name}.py")
+    abs_module = os.path.abspath(module_file)
+    abs_app_dir = os.path.abspath(app_dir)
+
+    if not abs_module.startswith(abs_app_dir):
+        return False, "Entrypoint file escapes application directory."
+
+    return True, abs_module
+
+
+def check_rate_limit(key: str, limit: int = 5, window_seconds: int = 60) -> bool:
+    """
+    In-memory sliding window rate limiter. Returns True if allowed, False if limit exceeded.
+    """
+    now = time.time()
+    records = _rate_limit_records.get(key, [])
+    # Filter out entries outside the window
+    records = [t for t in records if now - t < window_seconds]
+    if len(records) >= limit:
+        _rate_limit_records[key] = records
+        return False
+    records.append(now)
+    _rate_limit_records[key] = records
+    return True
+
+
+def extract_zip_safely(zip_path: str, target_dir: str) -> None:
+    """
+    Extracts a zip file safely, rejecting symlinks, decompression bombs, and directory traversal.
+    Handles cross-platform archives, Windows backslashes, and ignores macOS resource forks.
+    """
+    total_size = 0
+    total_files = 0
+    abs_target_dir = os.path.abspath(target_dir)
+    real_target_dir = os.path.realpath(abs_target_dir)
+
+    os.makedirs(abs_target_dir, exist_ok=True)
+
+    with zipfile.ZipFile(zip_path, "r") as zip_ref:
+        for member in zip_ref.infolist():
+            total_files += 1
+            total_size += member.file_size
+
+            if total_files > MAX_ZIP_FILE_COUNT:
+                raise ValueError(
+                    f"Security error: ZIP contains too many files (limit: {MAX_ZIP_FILE_COUNT})."
+                )
+            if total_size > MAX_ZIP_EXTRACT_SIZE:
+                raise ValueError(
+                    f"Security error: ZIP uncompressed size exceeds {MAX_ZIP_EXTRACT_SIZE // (1024 * 1024)}MB."
+                )
+
+            # Skip OS junk like __MACOSX resource forks and .DS_Store
+            clean_name = member.filename.replace("\\", "/")
+            if (
+                clean_name.startswith("__MACOSX/")
+                or "/__MACOSX/" in clean_name
+                or os.path.basename(clean_name).startswith("._")
+                or clean_name.endswith(".DS_Store")
+            ):
+                continue
+
+            # Check for symlink attribute only on Unix-created zip entries (create_system == 3)
+            if getattr(member, "create_system", 0) == 3:
+                mode = (member.external_attr >> 16) & 0xFFFF
+                if mode != 0 and stat.S_ISLNK(mode):
+                    raise ValueError(
+                        f"Security error: ZIP entry '{member.filename}' is a forbidden symlink."
+                    )
+
+            # Check for directory traversal attempts
+            clean_rel = os.path.normpath(clean_name).lstrip("/\\")
+            if (
+                clean_rel.startswith("..")
+                or clean_rel.startswith("/")
+                or clean_rel.startswith("\\")
+            ):
+                raise ValueError(
+                    f"Security error: ZIP entry '{member.filename}' attempts path traversal."
+                )
+
+            dest_path = os.path.abspath(os.path.join(abs_target_dir, clean_rel))
+            # Verify destination path stays inside target_dir
+            if not (
+                dest_path == abs_target_dir
+                or dest_path.startswith(abs_target_dir + os.sep)
+                or os.path.realpath(dest_path).startswith(real_target_dir + os.sep)
+            ):
+                raise ValueError(
+                    f"Security error: ZIP entry '{member.filename}' attempts path traversal."
+                )
+
+            if member.is_dir() or clean_name.endswith("/"):
+                os.makedirs(dest_path, exist_ok=True)
+                continue
+
+            os.makedirs(os.path.dirname(dest_path), exist_ok=True)
+            with zip_ref.open(member) as src, open(dest_path, "wb") as dst:
+                shutil.copyfileobj(src, dst)