appmanager-server 0.2.0__py3-none-any.whl

appmanager/health.py

@@ -0,0 +1,133 @@
+import json
+import os
+import time
+from typing import List, Tuple
+
+from werkzeug.test import Client
+from werkzeug.wrappers import Response
+
+from appmanager.admin.app_installer import load_wsgi_app_from_path, parse_manifest
+from appmanager.database import db
+from appmanager.models import AppHealthLog, InstalledApp
+from appmanager.signals import health_check_completed, health_check_failed
+
+
+def check_app_health(app_record: InstalledApp) -> AppHealthLog:
+    """
+    Evaluates health status of a single installed sub-app and logs the result.
+    Fires health_check_completed and health_check_failed signals.
+    """
+    target_dir = (
+        os.path.join(db.app.config["INSTALLED_APPS_DIR"], app_record.slug)
+        if hasattr(db, "app")
+        else None
+    )
+    if not target_dir:
+        from flask import current_app
+
+        target_dir = os.path.join(current_app.config["INSTALLED_APPS_DIR"], app_record.slug)
+
+    if not os.path.exists(target_dir):
+        log = AppHealthLog(
+            app_id=app_record.id,
+            status="unhealthy",
+            response_time_ms=0.0,
+            details=json.dumps(
+                {"error": f"App directory for '{app_record.slug}' missing on disk."}
+            ),
+        )
+        db.session.add(log)
+        db.session.commit()
+        try:
+            health_check_completed.send(
+                None, app_slug=app_record.slug, status="unhealthy", response_time_ms=0.0
+            )
+            health_check_failed.send(
+                None, app_slug=app_record.slug, status="unhealthy", details="App directory missing"
+            )
+        except Exception:
+            pass
+        return log
+
+    manifest = parse_manifest(target_dir)
+    health_path = manifest.get("health_check_path", "/health") if manifest else "/health"
+    entry_point = (
+        manifest.get("entry_point", app_record.entry_point) if manifest else app_record.entry_point
+    )
+
+    start_time = time.time()
+    try:
+        sub_app_obj = load_wsgi_app_from_path(target_dir, entry_point)
+        wsgi_callable = getattr(sub_app_obj, "wsgi_app", sub_app_obj)
+
+        # Check if sub-app exports a direct get_health() function
+        if hasattr(sub_app_obj, "get_health") and callable(getattr(sub_app_obj, "get_health")):
+            res = sub_app_obj.get_health()
+            elapsed_ms = (time.time() - start_time) * 1000
+            status = res.get("status", "healthy") if isinstance(res, dict) else "healthy"
+            log = AppHealthLog(
+                app_id=app_record.id,
+                status=status,
+                response_time_ms=elapsed_ms,
+                details=json.dumps(res) if isinstance(res, dict) else str(res),
+            )
+        else:
+            # Issue internal WSGI request to health endpoint
+            client = Client(wsgi_callable, Response)
+            res = client.get(health_path)
+            elapsed_ms = (time.time() - start_time) * 1000
+
+            if res.status_code == 200:
+                status = "healthy"
+                try:
+                    data = res.get_json() or res.get_data(as_text=True)
+                except Exception:
+                    data = res.get_data(as_text=True)
+                details = json.dumps(data) if isinstance(data, (dict, list)) else str(data)
+            else:
+                status = "degraded" if res.status_code < 500 else "unhealthy"
+                details = json.dumps(
+                    {"http_status": res.status_code, "body": res.get_data(as_text=True)}
+                )
+
+            log = AppHealthLog(
+                app_id=app_record.id, status=status, response_time_ms=elapsed_ms, details=details
+            )
+
+    except Exception as e:
+        elapsed_ms = (time.time() - start_time) * 1000
+        status = "unhealthy"
+        log = AppHealthLog(
+            app_id=app_record.id,
+            status="unhealthy",
+            response_time_ms=elapsed_ms,
+            details=json.dumps({"error": str(e)}),
+        )
+
+    db.session.add(log)
+    db.session.commit()
+
+    try:
+        health_check_completed.send(
+            None, app_slug=app_record.slug, status=log.status, response_time_ms=log.response_time_ms
+        )
+        if log.status in ("degraded", "unhealthy"):
+            health_check_failed.send(
+                None, app_slug=app_record.slug, status=log.status, details=log.details
+            )
+    except Exception:
+        pass
+
+    return log
+
+
+def check_all_apps_health() -> List[Tuple[str, str, float]]:
+    """
+    Runs health checks across all active registered sub-apps.
+    """
+    apps = InstalledApp.query.filter_by(is_active=True).all()
+    results = []
+    for app_record in apps:
+        log = check_app_health(app_record)
+        results.append((app_record.slug, log.status, log.response_time_ms))
+    return results

appmanager/hooks.py

@@ -0,0 +1,187 @@
+"""
+AppManager Hook and UI Slot Registry System.
+Provides a decoupled, pluggable architecture for UI mount points and lifecycle hooks.
+"""
+
+from typing import Any, Callable, Dict, List, Optional
+
+from markupsafe import Markup
+
+
+class HookRegistry:
+    """
+    Central registry managing UI slots and lifecycle hooks for AppManager and its extensions.
+    """
+
+    def __init__(self) -> None:
+        # slot_name -> list of dicts: {'callback': fn, 'priority': int, 'app_slug': str}
+        self._slots: Dict[str, List[Dict[str, Any]]] = {}
+        # hook_name -> list of dicts: {'callback': fn, 'priority': int, 'app_slug': str}
+        self._hooks: Dict[str, List[Dict[str, Any]]] = {}
+
+    def register_slot(
+        self,
+        slot_name: str,
+        callback: Callable[..., Any],
+        priority: int = 10,
+        app_slug: Optional[str] = None,
+    ) -> None:
+        """
+        Registers a UI slot renderer.
+        Callback should return HTML string or Markup.
+        Lower priority value runs earlier.
+        """
+        if slot_name not in self._slots:
+            self._slots[slot_name] = []
+
+        # Check if already registered to prevent duplicates
+        for item in self._slots[slot_name]:
+            if item["callback"] == callback and item.get("app_slug") == app_slug:
+                item["priority"] = priority
+                return
+
+        self._slots[slot_name].append(
+            {"callback": callback, "priority": priority, "app_slug": app_slug}
+        )
+        self._slots[slot_name].sort(key=lambda x: x["priority"])
+
+    def unregister_slot(self, slot_name: str, app_slug: Optional[str] = None) -> None:
+        """
+        Unregisters all slot callbacks for a given app_slug or slot.
+        """
+        if slot_name in self._slots:
+            if app_slug:
+                self._slots[slot_name] = [
+                    x for x in self._slots[slot_name] if x.get("app_slug") != app_slug
+                ]
+            else:
+                del self._slots[slot_name]
+
+    def render_slot(self, slot_name: str, *args: Any, **kwargs: Any) -> Markup:
+        """
+        Executes all registered callbacks for the slot in priority order
+        and concatenates the rendered outputs safely as Jinja Markup.
+        """
+        entries = self._slots.get(slot_name, [])
+        output_parts: List[str] = []
+
+        for entry in entries:
+            try:
+                result = entry["callback"](*args, **kwargs)
+                if result:
+                    output_parts.append(str(result))
+            except Exception as e:
+                print(
+                    f"[HOOK ERROR] Error rendering slot '{slot_name}' in app '{entry.get('app_slug')}': {e}"
+                )
+
+        return Markup("".join(output_parts))
+
+    def register_hook(
+        self,
+        hook_name: str,
+        callback: Callable[..., Any],
+        priority: int = 10,
+        app_slug: Optional[str] = None,
+    ) -> None:
+        """
+        Registers a lifecycle hook callback.
+        """
+        if hook_name not in self._hooks:
+            self._hooks[hook_name] = []
+
+        for item in self._hooks[hook_name]:
+            if item["callback"] == callback and item.get("app_slug") == app_slug:
+                item["priority"] = priority
+                return
+
+        self._hooks[hook_name].append(
+            {"callback": callback, "priority": priority, "app_slug": app_slug}
+        )
+        self._hooks[hook_name].sort(key=lambda x: x["priority"])
+
+    def unregister_hook(self, hook_name: str, app_slug: Optional[str] = None) -> None:
+        """
+        Unregisters lifecycle hook callbacks.
+        """
+        if hook_name in self._hooks:
+            if app_slug:
+                self._hooks[hook_name] = [
+                    x for x in self._hooks[hook_name] if x.get("app_slug") != app_slug
+                ]
+            else:
+                del self._hooks[hook_name]
+
+    def trigger_hook(self, hook_name: str, *args: Any, **kwargs: Any) -> List[Any]:
+        """
+        Triggers all registered callbacks for the lifecycle hook in priority order.
+        Returns a list of non-None return values from callbacks.
+        """
+        entries = self._hooks.get(hook_name, [])
+        results: List[Any] = []
+
+        for entry in entries:
+            try:
+                res = entry["callback"](*args, **kwargs)
+                if res is not None:
+                    results.append(res)
+            except Exception as e:
+                print(
+                    f"[HOOK ERROR] Error triggering hook '{hook_name}' in app '{entry.get('app_slug')}': {e}"
+                )
+
+        return results
+
+    def get_registered_slots(self) -> Dict[str, List[Dict[str, Any]]]:
+        """
+        Returns snapshot of registered UI slots for inspection.
+        """
+        return {
+            name: [
+                {"app_slug": item.get("app_slug"), "priority": item["priority"]} for item in items
+            ]
+            for name, items in self._slots.items()
+        }
+
+    def get_registered_hooks(self) -> Dict[str, List[Dict[str, Any]]]:
+        """
+        Returns snapshot of registered lifecycle hooks for inspection.
+        """
+        return {
+            name: [
+                {"app_slug": item.get("app_slug"), "priority": item["priority"]} for item in items
+            ]
+            for name, items in self._hooks.items()
+        }
+
+    def clear(self) -> None:
+        """
+        Clears all registered slots and hooks.
+        """
+        self._slots.clear()
+        self._hooks.clear()
+
+
+# Global singleton instance
+hooks = HookRegistry()
+
+
+# Public helper functions
+def register_slot(
+    slot_name: str, callback: Callable[..., Any], priority: int = 10, app_slug: Optional[str] = None
+) -> None:
+    hooks.register_slot(slot_name, callback, priority, app_slug)
+
+
+def render_slot(slot_name: str, *args: Any, **kwargs: Any) -> Markup:
+    return hooks.render_slot(slot_name, *args, **kwargs)
+
+
+def register_hook(
+    hook_name: str, callback: Callable[..., Any], priority: int = 10, app_slug: Optional[str] = None
+) -> None:
+    hooks.register_hook(hook_name, callback, priority, app_slug)
+
+
+def trigger_hook(hook_name: str, *args: Any, **kwargs: Any) -> List[Any]:
+    return hooks.trigger_hook(hook_name, *args, **kwargs)

appmanager/middleware.py

@@ -0,0 +1,256 @@
+import os
+import re
+from typing import Any, Callable, Dict, Optional
+
+import jwt
+from flask import Flask
+
+from appmanager.admin.app_installer import load_wsgi_app_from_path
+from appmanager.database import db
+from appmanager.models import InstalledApp, User, UserAppPermission
+from appmanager.signals import subapp_reloaded
+
+VALID_SLUG_PATTERN = re.compile(r"^[a-zA-Z0-9_-]+$")
+
+
+class DynamicAppDispatcherMiddleware:
+    """
+    WSGI middleware for dynamically dispatching requests to installed sub-apps under `/apps/<slug>/*`.
+    Provides namespace isolation, user header propagation, and in-memory callable caching.
+    """
+
+    def __init__(self, main_app: Flask) -> None:
+        self.main_app = main_app
+        self.sub_app_cache: Dict[str, Callable] = {}
+
+    def clear_cache(self, slug: Optional[str] = None) -> None:
+        """
+        Clears the in-memory cache for a single sub-app or all sub-apps.
+        """
+        if slug:
+            self.sub_app_cache.pop(slug, None)
+        else:
+            self.sub_app_cache.clear()
+
+    def _get_user_from_environ(
+        self, environ: Dict[str, Any], app_context_app: Flask
+    ) -> Optional[User]:
+        """
+        Extracts user and checks auth from WSGI request environ
+        """
+        token = None
+        cookie_header = environ.get("HTTP_COOKIE", "")
+        if cookie_header:
+            from http.cookies import SimpleCookie
+
+            cookie = SimpleCookie()
+            try:
+                cookie.load(cookie_header)
+                if "appmanager_jwt" in cookie:
+                    token = cookie["appmanager_jwt"].value
+            except Exception:
+                pass
+
+        if not token:
+            auth_header = environ.get("HTTP_AUTHORIZATION", "")
+            if auth_header.startswith("Bearer "):
+                token = auth_header.split(" ")[1]
+
+        if not token:
+            return None
+
+        try:
+            jwt_secret = app_context_app.config["JWT_SECRET"]
+            payload = jwt.decode(token, jwt_secret, algorithms=["HS256"])
+            user_id = payload.get("user_id")
+            user = db.session.get(User, user_id)
+            if user and user.is_active:
+                return user
+        except Exception:
+            return None
+
+        return None
+
+    def _send_html_response(
+        self,
+        start_response: Callable,
+        status_code: int,
+        title: str,
+        message: str,
+        link_url: Optional[str] = None,
+        link_text: Optional[str] = None,
+    ):
+        status_names = {
+            400: "Bad Request",
+            401: "Unauthorized",
+            403: "Forbidden",
+            404: "Not Found",
+            500: "Internal Server Error",
+        }
+        status = f"{status_code} " + status_names.get(status_code, "Error")
+        headers = [
+            ("Content-Type", "text/html; charset=utf-8"),
+            ("X-Content-Type-Options", "nosniff"),
+            ("X-Frame-Options", "SAMEORIGIN"),
+        ]
+        code_color = (
+            "#6366f1"
+            if status_code == 401
+            else "#ef4444"
+            if status_code in (403, 404)
+            else "#f59e0b"
+        )
+        link_html = (
+            f'<p><a href="{link_url}" style="background-color:#6366f1;color:white;padding:10px 20px;text-decoration:none;border-radius:8px;font-weight:500;display:inline-block;transition:all 0.2s;">{link_text}</a></p>'
+            if link_url
+            else ""
+        )
+        html = f"""<!DOCTYPE html>
+<html>
+<head>
+    <title>{title} - AppManager</title>
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <link rel="preconnect" href="https://fonts.googleapis.com">
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+    <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet">
+    <style>
+        body {{ font-family: 'Inter', -apple-system, BlinkMacSystemFont, sans-serif; background: #0f172a; color: #f8fafc; display: flex; align-items: center; justify-content: center; min-height: 100vh; margin: 0; padding: 20px; box-sizing: border-box; }}
+        .card {{ background: #1e293b; padding: 40px; border-radius: 16px; max-width: 480px; width: 100%; text-align: center; border: 1px solid #334155; box-shadow: 0 20px 25px -5px rgba(0,0,0,0.5); }}
+        .code {{ font-size: 64px; font-weight: 800; color: {code_color}; margin-bottom: 8px; line-height: 1; }}
+        h1 {{ color: #f8fafc; font-size: 22px; font-weight: 700; margin-top: 0; margin-bottom: 12px; }}
+        p {{ color: #94a3b8; line-height: 1.6; font-size: 14px; margin-bottom: 24px; }}
+    </style>
+</head>
+<body>
+    <div class="card">
+        <div class="code">{status_code}</div>
+        <h1>{title}</h1>
+        <p>{message}</p>
+        {link_html}
+    </div>
+</body>
+</html>"""
+        start_response(status, headers)
+        return [html.encode("utf-8")]
+
+    def __call__(self, environ: Dict[str, Any], start_response: Callable):
+        # 1. Strip any client-supplied spoofed AppManager internal headers from incoming environ
+        for header_key in [k for k in environ.keys() if k.startswith("HTTP_X_APPMANAGER_")]:
+            del environ[header_key]
+
+        path_info = environ.get("PATH_INFO", "")
+
+        # Check if the request is targeting an installed sub-app (/apps/<slug>/...)
+        if path_info.startswith("/apps/"):
+            parts = path_info.strip("/").split("/")
+            if len(parts) >= 2:
+                slug = parts[1]
+
+                # Validate slug to prevent path traversal
+                if not VALID_SLUG_PATTERN.match(slug):
+                    return self._send_html_response(
+                        start_response,
+                        400,
+                        "Invalid App Identifier",
+                        "The requested app path contains invalid characters.",
+                        link_url="/",
+                        link_text="Return to Home",
+                    )
+
+                # Use main app context to query database
+                with self.main_app.app_context():
+                    app_record = InstalledApp.query.filter_by(slug=slug, is_active=True).first()
+                    if not app_record:
+                        return self._send_html_response(
+                            start_response,
+                            404,
+                            "App Not Found",
+                            f"No active Flask app is installed at path '/apps/{slug}'.",
+                            link_url="/",
+                            link_text="Return to Home",
+                        )
+
+                    # 1. Authenticate User & Check Permission
+                    user = self._get_user_from_environ(environ, self.main_app)
+                    if app_record.requires_auth:
+                        if not user:
+                            redirect_path = f"/auth/login?next=/apps/{slug}"
+                            return self._send_html_response(
+                                start_response,
+                                401,
+                                "Authentication Required",
+                                f"You must be logged into AppManager to access '{app_record.name}'.",
+                                link_url=redirect_path,
+                                link_text="Log In to Continue",
+                            )
+
+                        if not user.is_admin():
+                            perm = UserAppPermission.query.filter_by(
+                                user_id=user.id, app_id=app_record.id
+                            ).first()
+                            if not perm or not perm.can_access:
+                                return self._send_html_response(
+                                    start_response,
+                                    403,
+                                    "Access Denied",
+                                    f"You do not have permission to access the '{app_record.name}' application. Contact your administrator.",
+                                    link_url="/auth/profile",
+                                    link_text="Go to My Profile",
+                                )
+
+                    # 2. Inject Verified User & Sub-App Context Headers (Guaranteed non-spoofed)
+                    if user:
+                        environ["HTTP_X_APPMANAGER_USER_ID"] = str(user.id)
+                        environ["HTTP_X_APPMANAGER_USER_EMAIL"] = user.email
+                        environ["HTTP_X_APPMANAGER_USER_ROLE"] = user.role
+                    environ["HTTP_X_APPMANAGER_SUBAPP_SLUG"] = slug
+                    environ["HTTP_X_FORWARDED_PREFIX"] = f"/apps/{slug}"
+
+                    # 3. Load or Retrieve Sub-App WSGI Instance
+                    app_dir = os.path.join(
+                        self.main_app.config["INSTALLED_APPS_DIR"], app_record.slug
+                    )
+                    if not os.path.exists(app_dir):
+                        return self._send_html_response(
+                            start_response,
+                            500,
+                            "Installation Error",
+                            f"App directory for '{app_record.name}' was not found on the server filesystem.",
+                            link_url="/",
+                            link_text="Return to Home",
+                        )
+
+                    try:
+                        if slug not in self.sub_app_cache:
+                            sub_app_obj = load_wsgi_app_from_path(app_dir, app_record.entry_point)
+                            # Get standard wsgi_app callable if it's a Flask instance
+                            wsgi_callable = getattr(sub_app_obj, "wsgi_app", sub_app_obj)
+                            self.sub_app_cache[slug] = wsgi_callable
+                            try:
+                                subapp_reloaded.send(self, slug=slug)
+                            except Exception:
+                                pass
+
+                        wsgi_callable = self.sub_app_cache[slug]
+                    except Exception as e:
+                        return self._send_html_response(
+                            start_response,
+                            500,
+                            "App Load Error",
+                            f"Failed to load Flask sub-app '{app_record.name}': {str(e)}",
+                            link_url="/",
+                            link_text="Return to Home",
+                        )
+
+                # Rewrite SCRIPT_NAME and PATH_INFO for WSGI sub-app routing
+                prefix = f"/apps/{slug}"
+                environ["SCRIPT_NAME"] = environ.get("SCRIPT_NAME", "") + prefix
+                new_path_info = path_info[len(prefix) :]
+                if not new_path_info:
+                    new_path_info = "/"
+                environ["PATH_INFO"] = new_path_info
+
+                return wsgi_callable(environ, start_response)
+
+        # Fall through to master AppManager Flask app
+        return self.main_app(environ, start_response)