appmanager-server 0.2.0__py3-none-any.whl

appmanager/api/__init__.py

@@ -0,0 +1,5 @@
+from flask import Blueprint
+
+api_bp = Blueprint("api", __name__, url_prefix="/api/v1")
+
+from appmanager.api import routes  # noqa: F401, E402

appmanager/api/routes.py

@@ -0,0 +1,373 @@
+from datetime import datetime, timezone
+from functools import wraps
+
+from flask import current_app, jsonify, request
+
+from appmanager.admin.app_installer import install_from_git, install_from_zip, uninstall_app
+from appmanager.api import api_bp
+from appmanager.auth.utils import decode_jwt
+from appmanager.database import db
+from appmanager.health import check_app_health
+from appmanager.models import AppHealthLog, AppTelemetryLog, InstalledApp, Role, User
+
+
+def api_auth_required(f):
+    """
+    Decorator requiring valid API key (X-API-Key) or Bearer Admin JWT for API endpoints.
+    """
+
+    @wraps(f)
+    def decorated_function(*args, **kwargs):
+        configured_api_key = current_app.config.get("APPMANAGER_API_KEY")
+
+        # 1. Check API Key header if configured
+        api_key = request.headers.get("X-API-Key")
+        if configured_api_key and api_key == configured_api_key:
+            return f(*args, **kwargs)
+
+        # 2. Check Bearer Token (JWT)
+        auth_header = request.headers.get("Authorization", "")
+        if auth_header.startswith("Bearer "):
+            token = auth_header.split(" ")[1]
+            # Check if token matches API key
+            if configured_api_key and token == configured_api_key:
+                return f(*args, **kwargs)
+            # Check if token is admin JWT
+            payload = decode_jwt(token)
+            if payload:
+                user = db.session.get(User, payload.get("user_id"))
+                if user and user.is_active and user.is_admin():
+                    return f(*args, **kwargs)
+
+        # If no API key is set in config and no auth header, in dev/testing check if admin logged in
+        if not configured_api_key:
+            # Check cookie or JWT
+            token = request.cookies.get("appmanager_jwt")
+            if token:
+                payload = decode_jwt(token)
+                if payload:
+                    user = db.session.get(User, payload.get("user_id"))
+                    if user and user.is_active and user.is_admin():
+                        return f(*args, **kwargs)
+
+        return jsonify(
+            {
+                "success": False,
+                "error": "Unauthorized",
+                "message": "Valid X-API-Key or Admin Bearer Token is required.",
+            }
+        ), 401
+
+    return decorated_function
+
+
+@api_bp.route("/health", methods=["GET"])
+def system_health():
+    """
+    Returns overall AppManager host system health and database connectivity.
+    """
+    db_ok = True
+    db_error = None
+    try:
+        from sqlalchemy import text
+
+        db.session.execute(text("SELECT 1"))
+    except Exception as e:
+        db_ok = False
+        db_error = str(e)
+
+    total_apps = InstalledApp.query.count()
+    active_apps = InstalledApp.query.filter_by(is_active=True).count()
+
+    overall_status = "healthy" if db_ok else "unhealthy"
+
+    return jsonify(
+        {
+            "status": overall_status,
+            "timestamp": datetime.now(timezone.utc).isoformat(),
+            "database": {"connected": db_ok, "error": db_error},
+            "apps": {"total": total_apps, "active": active_apps},
+        }
+    ), 200 if db_ok else 503
+
+
+@api_bp.route("/apps", methods=["GET"])
+def list_apps():
+    """
+    Lists all installed sub-applications and their latest health status.
+    """
+    apps = InstalledApp.query.all()
+    results = []
+    for a in apps:
+        app_dict = a.to_dict()
+        latest_health = (
+            AppHealthLog.query.filter_by(app_id=a.id)
+            .order_by(AppHealthLog.checked_at.desc())
+            .first()
+        )
+        app_dict["latest_health"] = {
+            "status": latest_health.status if latest_health else "unknown",
+            "response_time_ms": latest_health.response_time_ms if latest_health else None,
+            "checked_at": latest_health.checked_at.isoformat()
+            if latest_health and latest_health.checked_at
+            else None,
+        }
+        results.append(app_dict)
+    return jsonify({"success": True, "apps": results, "count": len(results)}), 200
+
+
+@api_bp.route("/apps/<slug>", methods=["GET"])
+def get_app(slug):
+    """
+    Retrieves details for a specific sub-app by slug.
+    """
+    app_record = InstalledApp.query.filter_by(slug=slug).first()
+    if not app_record:
+        return jsonify({"success": False, "error": f"App with slug '{slug}' not found."}), 404
+
+    app_dict = app_record.to_dict()
+    latest_health = (
+        AppHealthLog.query.filter_by(app_id=app_record.id)
+        .order_by(AppHealthLog.checked_at.desc())
+        .first()
+    )
+    app_dict["latest_health"] = {
+        "status": latest_health.status if latest_health else "unknown",
+        "response_time_ms": latest_health.response_time_ms if latest_health else None,
+        "checked_at": latest_health.checked_at.isoformat()
+        if latest_health and latest_health.checked_at
+        else None,
+    }
+    return jsonify({"success": True, "app": app_dict}), 200
+
+
+@api_bp.route("/apps/install", methods=["POST"])
+@api_auth_required
+def install_app():
+    """
+    Installs a sub-app via Git repository URL (JSON payload) or ZIP upload (multipart).
+    """
+    if request.is_json:
+        data = request.get_json() or {}
+        repo_url = data.get("repo_url", "").strip()
+        name = data.get("name", "").strip()
+        slug = data.get("slug", "").strip() or None
+        description = data.get("description", "").strip() or None
+        entry_point = data.get("entry_point", "").strip() or None
+
+        if not repo_url or not name:
+            return jsonify(
+                {"success": False, "error": "Missing required fields: repo_url, name"}
+            ), 400
+
+        try:
+            installed = install_from_git(
+                repo_url, name, slug=slug, description=description, entry_point=entry_point
+            )
+            return jsonify(
+                {
+                    "success": True,
+                    "message": f"App '{installed.name}' installed successfully.",
+                    "app": installed.to_dict(),
+                }
+            ), 201
+        except Exception as e:
+            return jsonify({"success": False, "error": str(e)}), 500
+
+    elif "zip_file" in request.files:
+        zip_file = request.files["zip_file"]
+        name = request.form.get("name", "").strip()
+        slug = request.form.get("slug", "").strip() or None
+        description = request.form.get("description", "").strip() or None
+        entry_point = request.form.get("entry_point", "").strip() or None
+
+        if not name:
+            return jsonify({"success": False, "error": "Missing required field 'name'"}), 400
+
+        try:
+            installed = install_from_zip(
+                zip_file, name, slug=slug, description=description, entry_point=entry_point
+            )
+            return jsonify(
+                {
+                    "success": True,
+                    "message": f"App '{installed.name}' installed from ZIP.",
+                    "app": installed.to_dict(),
+                }
+            ), 201
+        except Exception as e:
+            return jsonify({"success": False, "error": str(e)}), 500
+
+    return jsonify(
+        {
+            "success": False,
+            "error": "Invalid request format. Send JSON with repo_url or multipart with zip_file.",
+        }
+    ), 400
+
+
+@api_bp.route("/apps/<slug>", methods=["DELETE"])
+@api_auth_required
+def delete_app_by_slug(slug):
+    """
+    Uninstalls an application by slug.
+    """
+    app_record = InstalledApp.query.filter_by(slug=slug).first()
+    if not app_record:
+        return jsonify({"success": False, "error": f"App with slug '{slug}' not found."}), 404
+
+    success, msg = uninstall_app(app_record.id)
+    if success:
+        return jsonify({"success": True, "message": msg}), 200
+    return jsonify({"success": False, "error": msg}), 500
+
+
+@api_bp.route("/apps/<slug>/health-check", methods=["POST"])
+@api_auth_required
+def trigger_health_check(slug):
+    """
+    Triggers an immediate health check for a sub-app and returns the result.
+    """
+    app_record = InstalledApp.query.filter_by(slug=slug).first()
+    if not app_record:
+        return jsonify({"success": False, "error": f"App with slug '{slug}' not found."}), 404
+
+    log = check_app_health(app_record)
+    return jsonify(
+        {
+            "success": True,
+            "app_slug": slug,
+            "status": log.status,
+            "response_time_ms": log.response_time_ms,
+            "details": log.details,
+            "checked_at": log.checked_at.isoformat() if log.checked_at else None,
+        }
+    ), 200
+
+
+@api_bp.route("/apps/<slug>/reload", methods=["POST"])
+@api_auth_required
+def reload_app(slug):
+    """
+    Invalidates the in-memory WSGI cache for a sub-app to trigger live reload.
+    """
+    app_record = InstalledApp.query.filter_by(slug=slug).first()
+    if not app_record:
+        return jsonify({"success": False, "error": f"App with slug '{slug}' not found."}), 404
+
+    if hasattr(current_app, "extensions") and "appmanager" in current_app.extensions:
+        current_app.extensions["appmanager"].clear_cache(slug=slug)
+
+    return jsonify({"success": True, "message": f"Cache cleared for sub-app '{slug}'."}), 200
+
+
+@api_bp.route("/metrics", methods=["GET"])
+def get_metrics():
+    """
+    Returns telemetry metrics summary.
+    """
+    recent_logs = AppTelemetryLog.query.order_by(AppTelemetryLog.created_at.desc()).limit(100).all()
+    metrics_summary = {}
+    for log in recent_logs:
+        if log.app_slug not in metrics_summary:
+            metrics_summary[log.app_slug] = {"total_events": 0, "latest_event": None}
+        metrics_summary[log.app_slug]["total_events"] += 1
+        if not metrics_summary[log.app_slug]["latest_event"]:
+            metrics_summary[log.app_slug]["latest_event"] = {
+                "event_type": log.event_type,
+                "created_at": log.created_at.isoformat() if log.created_at else None,
+            }
+
+    return jsonify(
+        {
+            "success": True,
+            "timestamp": datetime.now(timezone.utc).isoformat(),
+            "metrics": metrics_summary,
+        }
+    ), 200
+
+
+@api_bp.route("/roles", methods=["GET"])
+@api_auth_required
+def list_roles_api():
+    """
+    Returns list of all configured roles and member counts.
+    """
+    roles = Role.query.order_by(Role.name).all()
+    data = []
+    for r in roles:
+        r_dict = r.to_dict()
+        r_dict["member_count"] = User.query.filter_by(role=r.slug).count()
+        data.append(r_dict)
+    return jsonify({"success": True, "count": len(data), "roles": data})
+
+
+@api_bp.route("/roles", methods=["POST"])
+@api_auth_required
+def create_role_api():
+    """
+    Creates a new custom role.
+    """
+    from appmanager.admin.app_installer import sanitize_slug
+
+    data = request.get_json() or {}
+    name = data.get("name", "").strip()
+    slug = data.get("slug", "").strip() or sanitize_slug(name)
+    description = data.get("description", "").strip()
+
+    if not name:
+        return jsonify({"error": "Role name is required", "success": False}), 400
+
+    clean_slug = sanitize_slug(slug)
+    existing = Role.query.filter((Role.slug == clean_slug) | (Role.name == name)).first()
+    if existing:
+        return jsonify(
+            {
+                "error": f"Role with slug '{clean_slug}' or name '{name}' already exists",
+                "success": False,
+            }
+        ), 409
+
+    role = Role(name=name, slug=clean_slug, description=description, is_system=False)
+    db.session.add(role)
+    db.session.commit()
+
+    return jsonify(
+        {
+            "success": True,
+            "message": f"Role '{role.name}' created successfully",
+            "role": role.to_dict(),
+        }
+    ), 201
+
+
+@api_bp.route("/roles/<string:slug>", methods=["DELETE"])
+@api_auth_required
+def delete_role_api(slug: str):
+    """
+    Deletes a custom role.
+    """
+    role = Role.query.filter_by(slug=slug).first()
+    if not role:
+        return jsonify({"error": "Role not found", "success": False}), 404
+
+    if role.is_system:
+        return jsonify(
+            {"error": f"Cannot delete core system role '{role.name}'", "success": False}
+        ), 400
+
+    # Reassign affected users
+    affected = User.query.filter_by(role=role.slug).all()
+    for u in affected:
+        u.role = "user"
+
+    db.session.delete(role)
+    db.session.commit()
+
+    return jsonify(
+        {
+            "success": True,
+            "message": f"Role '{role.name}' deleted successfully",
+            "reassigned_members": len(affected),
+        }
+    )

appmanager/app_config.py

@@ -0,0 +1,101 @@
+"""
+Typed per-app configuration helpers.
+
+Provides CRUD over the `app_configs` table and a one-time migration from the
+legacy `settings_json` blob. Extensions and the admin console both use these
+helpers so settings stay consistent and queryable.
+"""
+
+from appmanager.database import db
+from appmanager.models import AppConfig, InstalledApp
+
+
+def get_config(app_id, key, default=None):
+    """Fetch a single config value (decoded)."""
+    row = AppConfig.query.filter_by(app_id=app_id, key=key).first()
+    if row is None:
+        return default
+    return row.get_value()
+
+
+def get_configs(app_id):
+    """Fetch all configs for an app as {key: decoded_value}."""
+    rows = AppConfig.query.filter_by(app_id=app_id).all()
+    return {r.key: r.get_value() for r in rows}
+
+
+def set_config(app_id, key, value, value_type="json", is_secret=False):
+    """Create or update a single config row."""
+    row = AppConfig.query.filter_by(app_id=app_id, key=key).first()
+    if not row:
+        row = AppConfig(app_id=app_id, key=key, value_type=value_type, is_secret=is_secret)
+        db.session.add(row)
+    row.set_value(value)
+    db.session.commit()
+    return row
+
+
+def set_configs(app_id, config_dict, schema=None):
+    """
+    Bulk upsert configs from a dict. `schema` is an optional list of
+    {key, type, default, is_secret} descriptors used to set value_type.
+    """
+    schema_map = {s.get("key"): s for s in (schema or [])}
+    for key, value in config_dict.items():
+        desc = schema_map.get(key, {})
+        set_config(
+            app_id,
+            key,
+            value,
+            value_type=desc.get("type", "json"),
+            is_secret=desc.get("is_secret", False),
+        )
+
+
+def seed_defaults(app_id, schema):
+    """
+    Seed default config rows for an app from a settings_schema manifest.
+    Only creates rows that don't already exist (doesn't overwrite user edits).
+    """
+    for desc in schema or []:
+        key = desc.get("key")
+        if not key:
+            continue
+        existing = AppConfig.query.filter_by(app_id=app_id, key=key).first()
+        if existing is None:
+            row = AppConfig(
+                app_id=app_id,
+                key=key,
+                value_type=desc.get("type", "json"),
+                is_secret=desc.get("is_secret", False),
+            )
+            row.set_value(desc.get("default"))
+            db.session.add(row)
+    db.session.commit()
+
+
+def migrate_from_settings_json(app_id=None):
+    """
+    One-time migration: parse each app's legacy `settings_json` blob and seed
+    `app_configs` rows. Idempotent — skips apps that already have config rows.
+    Returns number of apps migrated.
+    """
+    query = InstalledApp.query
+    if app_id is not None:
+        query = query.filter_by(id=app_id)
+    apps = query.all()
+    migrated = 0
+    for a in apps:
+        existing = AppConfig.query.filter_by(app_id=a.id).first()
+        if existing is not None:
+            continue
+        settings = a.get_settings()
+        if not settings:
+            continue
+        for key, value in settings.items():
+            row = AppConfig(app_id=a.id, key=str(key), value_type="json")
+            row.set_value(value)
+            db.session.add(row)
+        migrated += 1
+    db.session.commit()
+    return migrated

appmanager/auth/__init__.py

@@ -0,0 +1,3 @@
+from appmanager.auth.routes import auth_bp
+
+__all__ = ["auth_bp"]

appmanager/auth/oauth.py

@@ -0,0 +1,77 @@
+import secrets
+import urllib.parse
+
+import requests
+from flask import current_app, request, session, url_for
+
+
+def get_google_auth_url():
+    client_id = current_app.config.get("GOOGLE_CLIENT_ID")
+    if not client_id:
+        return None, "Google Client ID is not configured."
+
+    state = secrets.token_urlsafe(16)
+    session["oauth_state"] = state
+
+    redirect_uri = url_for("auth.google_callback", _external=True)
+
+    params = {
+        "client_id": client_id,
+        "redirect_uri": redirect_uri,
+        "response_type": "code",
+        "scope": "openid email profile",
+        "state": state,
+        "access_type": "offline",
+        "prompt": "select_account",
+    }
+
+    auth_url = f"https://accounts.google.com/o/oauth2/v2/auth?{urllib.parse.urlencode(params)}"
+    return auth_url, None
+
+
+def process_google_callback():
+    client_id = current_app.config.get("GOOGLE_CLIENT_ID")
+    client_secret = current_app.config.get("GOOGLE_CLIENT_SECRET")
+
+    if not client_id or not client_secret:
+        return None, "Google Client ID or Secret missing."
+
+    state = request.args.get("state")
+    saved_state = session.pop("oauth_state", None)
+
+    if not state or state != saved_state:
+        return None, "Invalid OAuth state parameter."
+
+    code = request.args.get("code")
+    if not code:
+        return None, "Authorization code not provided by Google."
+
+    redirect_uri = url_for("auth.google_callback", _external=True)
+
+    # Exchange code for token
+    token_url = "https://oauth2.googleapis.com/token"
+    token_data = {
+        "code": code,
+        "client_id": client_id,
+        "client_secret": client_secret,
+        "redirect_uri": redirect_uri,
+        "grant_type": "authorization_code",
+    }
+
+    token_res = requests.post(token_url, data=token_data, timeout=10)
+    if token_res.status_code != 200:
+        return None, f"Failed to exchange token with Google: {token_res.text}"
+
+    tokens = token_res.json()
+    access_token = tokens.get("access_token")
+
+    # Get User Info
+    userinfo_url = "https://www.googleapis.com/oauth2/v3/userinfo"
+    userinfo_res = requests.get(
+        userinfo_url, headers={"Authorization": f"Bearer {access_token}"}, timeout=10
+    )
+    if userinfo_res.status_code != 200:
+        return None, "Failed to retrieve user profile from Google."
+
+    user_data = userinfo_res.json()
+    return user_data, None