appmanager-server 0.2.0__py3-none-any.whl

appmanager/auth/routes.py

@@ -0,0 +1,224 @@
+from datetime import datetime, timezone
+
+from flask import (
+    Blueprint,
+    current_app,
+    flash,
+    make_response,
+    redirect,
+    render_template,
+    request,
+    url_for,
+)
+
+from appmanager.auth.oauth import get_google_auth_url, process_google_callback
+from appmanager.auth.utils import (
+    JWT_COOKIE_NAME,
+    create_magic_link,
+    generate_jwt,
+    get_current_user,
+    login_required,
+)
+from appmanager.database import db
+from appmanager.models import InstalledApp, MagicLinkToken, User, UserAppPermission
+from appmanager.security import check_rate_limit, is_safe_redirect_url
+
+auth_bp = Blueprint("auth", __name__, url_prefix="/auth")
+
+
+@auth_bp.route("/login", methods=["GET"])
+def login():
+    user = get_current_user()
+    if user:
+        return redirect(url_for("auth.profile"))
+
+    next_url = request.args.get("next", "")
+    if next_url and not is_safe_redirect_url(next_url):
+        next_url = ""
+    google_configured = bool(current_app.config.get("GOOGLE_CLIENT_ID"))
+    return render_template("auth/login.html", next=next_url, google_configured=google_configured)
+
+
+@auth_bp.route("/magic-link", methods=["POST"])
+def request_magic_link():
+    client_ip = request.remote_addr or "unknown"
+    if not check_rate_limit(f"magic_link_{client_ip}", limit=5, window_seconds=60):
+        flash("Too many login requests. Please wait a minute and try again.", "danger")
+        return redirect(url_for("auth.login"))
+
+    email = request.form.get("email", "").strip().lower()
+    next_url = request.form.get("next", "")
+    if next_url and not is_safe_redirect_url(next_url):
+        next_url = ""
+
+    if not email or "@" not in email:
+        flash("Please enter a valid email address.", "warning")
+        return redirect(url_for("auth.login", next=next_url))
+
+    magic_url = create_magic_link(email)
+
+    # In dev mode without SMTP, pass the magic link URL to the template for quick developer login
+    dev_magic_url = None
+    if not current_app.config.get("SMTP_SERVER"):
+        dev_magic_url = magic_url
+
+    return render_template(
+        "auth/login.html",
+        magic_sent=True,
+        email=email,
+        dev_magic_url=dev_magic_url,
+        google_configured=bool(current_app.config.get("GOOGLE_CLIENT_ID")),
+    )
+
+
+@auth_bp.route("/verify-magic", methods=["GET"])
+def verify_magic():
+    token_str = request.args.get("token")
+    if not token_str:
+        flash("Invalid or missing magic link token.", "danger")
+        return redirect(url_for("auth.login"))
+
+    magic_token = MagicLinkToken.query.filter_by(token=token_str).first()
+    if not magic_token or magic_token.used:
+        flash("This magic link is invalid or has already been used.", "danger")
+        return redirect(url_for("auth.login"))
+
+    # Check expiration (naive/aware comparison handling)
+    expires_at = magic_token.expires_at
+    if expires_at.tzinfo is None:
+        expires_at = expires_at.replace(tzinfo=timezone.utc)
+
+    if datetime.now(timezone.utc) > expires_at:
+        flash("This magic link has expired. Please request a new one.", "warning")
+        return redirect(url_for("auth.login"))
+
+    # Mark token as used
+    magic_token.used = True
+    db.session.commit()
+
+    # Find or create user
+    user = User.query.filter_by(email=magic_token.email).first()
+    if not user:
+        # First user created in the system becomes Admin automatically
+        user_count = User.query.count()
+        user_role = "admin" if user_count == 0 else "user"
+        user = User(
+            email=magic_token.email,
+            name=magic_token.email.split("@")[0].capitalize(),
+            role=user_role,
+        )
+        db.session.add(user)
+        db.session.commit()
+
+        # If non-admin user, assign default permissions for active apps
+        if user_role != "admin":
+            active_apps = InstalledApp.query.filter_by(is_active=True).all()
+            for app in active_apps:
+                perm = UserAppPermission(user_id=user.id, app_id=app.id, can_access=True)
+                db.session.add(perm)
+            db.session.commit()
+
+    # Track login metrics
+    user.last_login_at = datetime.now(timezone.utc)
+    user.last_active_at = datetime.now(timezone.utc)
+    user.login_count = (user.login_count or 0) + 1
+    user.last_ip = request.remote_addr
+    db.session.commit()
+
+    jwt_token = generate_jwt(user)
+    flash(f"Welcome back, {user.name}!", "success")
+
+    next_url = request.args.get("next", "")
+    target_redirect = next_url if is_safe_redirect_url(next_url) else url_for("auth.profile")
+
+    response = make_response(redirect(target_redirect))
+
+    response.set_cookie(
+        JWT_COOKIE_NAME,
+        jwt_token,
+        httponly=True,
+        samesite=current_app.config.get("SESSION_COOKIE_SAMESITE", "Lax"),
+        secure=current_app.config.get("SESSION_COOKIE_SECURE", False),
+        max_age=7 * 24 * 3600,
+    )
+    return response
+
+
+@auth_bp.route("/google")
+def google_login():
+    auth_url, error = get_google_auth_url()
+    if error:
+        flash(f"Google OAuth Error: {error}", "danger")
+        return redirect(url_for("auth.login"))
+    return redirect(auth_url)
+
+
+@auth_bp.route("/google/callback")
+def google_callback():
+    user_data, error = process_google_callback()
+    if error:
+        flash(f"Google Login Failed: {error}", "danger")
+        return redirect(url_for("auth.login"))
+
+    email = user_data.get("email", "").lower()
+    google_id = user_data.get("sub")
+    name = user_data.get("name", email.split("@")[0])
+
+    if not email:
+        flash("Could not retrieve email from Google account.", "danger")
+        return redirect(url_for("auth.login"))
+
+    user = User.query.filter((User.google_id == google_id) | (User.email == email)).first()
+    if not user:
+        user_count = User.query.count()
+        user_role = "admin" if user_count == 0 else "user"
+        user = User(email=email, name=name, google_id=google_id, role=user_role)
+        db.session.add(user)
+        db.session.commit()
+    else:
+        if not user.google_id:
+            user.google_id = google_id
+            db.session.commit()
+
+    jwt_token = generate_jwt(user)
+    flash(f"Logged in with Google as {user.email}", "success")
+
+    response = make_response(redirect(url_for("auth.profile")))
+    response.set_cookie(
+        JWT_COOKIE_NAME,
+        jwt_token,
+        httponly=True,
+        samesite=current_app.config.get("SESSION_COOKIE_SAMESITE", "Lax"),
+        secure=current_app.config.get("SESSION_COOKIE_SECURE", False),
+        max_age=7 * 24 * 3600,
+    )
+    return response
+
+
+@auth_bp.route("/logout")
+def logout():
+    flash("Logged out successfully.", "info")
+    response = make_response(redirect(url_for("auth.login")))
+    response.delete_cookie(JWT_COOKIE_NAME)
+    return response
+
+
+@auth_bp.route("/profile")
+@login_required
+def profile():
+    user = get_current_user()
+    if user.is_admin():
+        accessible_apps = InstalledApp.query.filter_by(is_active=True).all()
+    else:
+        accessible_apps = (
+            db.session.query(InstalledApp)
+            .join(UserAppPermission, UserAppPermission.app_id == InstalledApp.id)
+            .filter(
+                UserAppPermission.user_id == user.id,
+                UserAppPermission.can_access.is_(True),
+                InstalledApp.is_active.is_(True),
+            )
+            .all()
+        )
+
+    return render_template("auth/profile.html", user=user, apps=accessible_apps)

appmanager/auth/utils.py

@@ -0,0 +1,175 @@
+import secrets
+import smtplib
+from datetime import datetime, timedelta, timezone
+from email.mime.multipart import MIMEMultipart
+from email.mime.text import MIMEText
+from functools import wraps
+
+import jwt
+from flask import current_app, flash, g, redirect, request, url_for
+
+from appmanager.database import db
+from appmanager.models import MagicLinkToken, User
+
+JWT_COOKIE_NAME = "appmanager_jwt"
+
+
+def generate_jwt(user):
+    payload = {
+        "user_id": user.id,
+        "email": user.email,
+        "role": user.role,
+        "exp": datetime.now(timezone.utc) + current_app.config["JWT_ACCESS_TOKEN_EXPIRES"],
+        "iat": datetime.now(timezone.utc),
+    }
+    token = jwt.encode(payload, current_app.config["JWT_SECRET"], algorithm="HS256")
+    return token
+
+
+def decode_jwt(token):
+    try:
+        payload = jwt.decode(token, current_app.config["JWT_SECRET"], algorithms=["HS256"])
+        return payload
+    except (jwt.ExpiredSignatureError, jwt.InvalidTokenError):
+        return None
+
+
+def get_current_user():
+    if hasattr(g, "current_user") and g.current_user is not None:
+        return g.current_user
+
+    token = None
+    # 1. Check Authorization header
+    auth_header = request.headers.get("Authorization")
+    if auth_header and auth_header.startswith("Bearer "):
+        token = auth_header.split(" ")[1]
+
+    # 2. Check HTTP-only cookie
+    if not token:
+        token = request.cookies.get(JWT_COOKIE_NAME)
+
+    if not token:
+        g.current_user = None
+        return None
+
+    payload = decode_jwt(token)
+    if not payload:
+        g.current_user = None
+        return None
+
+    user = db.session.get(User, payload["user_id"])
+    if user and user.is_active:
+        # Update last_active_at timestamp (throttled to once per minute)
+        now = datetime.now(timezone.utc)
+        last_act = user.last_active_at
+        if last_act and last_act.tzinfo is None:
+            last_act = last_act.replace(tzinfo=timezone.utc)
+        if not last_act or (now - last_act).total_seconds() > 60:
+            user.last_active_at = now
+            try:
+                db.session.commit()
+            except Exception:
+                db.session.rollback()
+
+        g.current_user = user
+        return user
+
+    g.current_user = None
+    return None
+
+
+def login_required(f):
+    @wraps(f)
+    def decorated_function(*args, **kwargs):
+        user = get_current_user()
+        if not user:
+            if request.is_json or request.path.startswith("/api/"):
+                return {"error": "Authentication required"}, 401
+            return redirect(url_for("auth.login", next=request.url))
+        return f(*args, **kwargs)
+
+    return decorated_function
+
+
+def admin_required(f):
+    @wraps(f)
+    def decorated_function(*args, **kwargs):
+        user = get_current_user()
+        if not user:
+            if request.is_json or request.path.startswith("/api/"):
+                return {"error": "Authentication required"}, 401
+            return redirect(url_for("auth.login", next=request.url))
+        if not user.is_admin():
+            if request.is_json or request.path.startswith("/api/"):
+                return {"error": "Admin privilege required"}, 403
+            flash("Admin privilege required to access this area.", "danger")
+            return redirect(url_for("auth.profile"))
+        return f(*args, **kwargs)
+
+    return decorated_function
+
+
+def create_magic_link(email):
+    token_str = secrets.token_urlsafe(32)
+    expires_at = datetime.now(timezone.utc) + timedelta(
+        minutes=current_app.config["MAGIC_LINK_EXPIRES_MINUTES"]
+    )
+
+    # Clean up old unused tokens for this email
+    MagicLinkToken.query.filter_by(email=email, used=False).delete()
+
+    magic_token = MagicLinkToken(email=email, token=token_str, expires_at=expires_at, used=False)
+    db.session.add(magic_token)
+    db.session.commit()
+
+    if request:
+        base_url = request.host_url.rstrip("/")
+    else:
+        base_url = current_app.config["APP_BASE_URL"].rstrip("/")
+
+    verify_url = f"{base_url}/auth/verify-magic?token={token_str}"
+
+    send_magic_link_email(email, verify_url)
+    return verify_url
+
+
+def send_magic_link_email(email, magic_url):
+    smtp_server = current_app.config.get("SMTP_SERVER")
+    if smtp_server:
+        try:
+            msg = MIMEMultipart("alternative")
+            msg["Subject"] = "Your Magic Login Link - AppManager"
+            msg["From"] = current_app.config["MAIL_DEFAULT_SENDER"]
+            msg["To"] = email
+
+            text = f"Click here to log into AppManager: {magic_url}\nThis link expires in {current_app.config['MAGIC_LINK_EXPIRES_MINUTES']} minutes."
+            html = f"""
+            <html>
+              <body>
+                <h2>AppManager Login</h2>
+                <p>Click the button below to log in to your account. This link will expire in {current_app.config["MAGIC_LINK_EXPIRES_MINUTES"]} minutes.</p>
+                <p><a href="{magic_url}" style="background-color: #4F46E5; color: white; padding: 10px 20px; text-decoration: none; border-radius: 5px;">Log In to AppManager</a></p>
+                <p>Or copy this link into your browser: <br><code>{magic_url}</code></p>
+              </body>
+            </html>
+            """
+            msg.attach(MIMEText(text, "plain"))
+            msg.attach(MIMEText(html, "html"))
+
+            with smtplib.SMTP(smtp_server, current_app.config["SMTP_PORT"]) as server:
+                server.starttls()
+                server.login(current_app.config["SMTP_USER"], current_app.config["SMTP_PASSWORD"])
+                server.send_message(msg)
+            print(f"[AUTH] Magic link email successfully sent to {email}")
+        except Exception as e:
+            print(
+                f"[AUTH ERROR] Failed to send email via SMTP: {e}. Falling back to console output."
+            )
+            print(f"================ MAGIC LINK FOR {email} ================")
+            print(f"URL: {magic_url}")
+            print("=======================================================")
+    else:
+        print("\n================ MAGIC LINK (DEV CONSOLE LOG) ================")
+        print(f"Target Email: {email}")
+        print(f"Login URL:    {magic_url}")
+        print("==============================================================\n")

appmanager/bridge.py

@@ -0,0 +1,90 @@
+import json
+from datetime import datetime, timezone
+from typing import Any, Dict, Optional, Union
+
+from appmanager.database import db
+from appmanager.models import AppTelemetryLog
+from appmanager.signals import telemetry_received
+
+
+def report_event(app_slug: str, event_type: str, data: Optional[Dict[str, Any]] = None) -> bool:
+    """
+    Sub-apps can call report_event to log events directly to AppManager host telemetry.
+    Zero-network overhead in-process communication.
+    """
+    try:
+        payload = json.dumps(data) if data is not None else None
+        log_entry = AppTelemetryLog(
+            app_slug=app_slug,
+            event_type=event_type,
+            payload_json=payload,
+            created_at=datetime.now(timezone.utc),
+        )
+        db.session.add(log_entry)
+        db.session.commit()
+
+        try:
+            telemetry_received.send(None, app_slug=app_slug, event_type=event_type, data=data)
+        except Exception:
+            pass
+
+        return True
+    except Exception as e:
+        db.session.rollback()
+        print(f"[BRIDGE ERROR] Failed to record event for '{app_slug}': {e}")
+        return False
+
+
+def report_metric(
+    app_slug: str, metric_name: str, value: Union[int, float], unit: Optional[str] = None
+) -> bool:
+    """
+    Sub-apps can call report_metric to log numeric metrics.
+    """
+    data = {"value": value}
+    if unit:
+        data["unit"] = unit
+    return report_event(app_slug, event_type=f"metric:{metric_name}", data=data)
+
+
+def get_current_user_from_headers(headers: Optional[Any] = None) -> Optional[Dict[str, Any]]:
+    """
+    Helper for sub-apps to extract the authenticated user identity forwarded by AppManager.
+    If headers is None, attempts to read from flask.request.headers or os.environ.
+    """
+    if headers is None:
+        try:
+            from flask import request
+
+            headers = request.headers
+        except Exception:
+            headers = {}
+
+    user_id = headers.get("X-AppManager-User-Id") or headers.get("HTTP_X_APPMANAGER_USER_ID")
+    user_email = headers.get("X-AppManager-User-Email") or headers.get(
+        "HTTP_X_APPMANAGER_USER_EMAIL"
+    )
+    user_role = headers.get("X-AppManager-User-Role") or headers.get("HTTP_X_APPMANAGER_USER_ROLE")
+
+    if user_id or user_email:
+        return {
+            "id": int(user_id) if user_id and str(user_id).isdigit() else user_id,
+            "email": user_email,
+            "role": user_role or "user",
+        }
+    return None
+
+
+def get_app_settings(app_slug: str) -> Dict[str, Any]:
+    """
+    Helper to retrieve configured settings dictionary for a sub-app.
+    """
+    from appmanager.models import InstalledApp
+
+    try:
+        app_rec = InstalledApp.query.filter_by(slug=app_slug).first()
+        if app_rec:
+            return app_rec.get_settings()
+    except Exception:
+        pass
+    return {}