appmanager-server 0.2.0__tar.gz → 0.2.1__tar.gz

{appmanager_server-0.2.0 → appmanager_server-0.2.1}/.env.example

@@ -34,9 +34,18 @@ GOOGLE_CLIENT_ID=
 GOOGLE_CLIENT_SECRET=
 GOOGLE_DISCOVERY_URL=https://accounts.google.com/.well-known/openid-configuration
 
-# SMTP Email Configuration (Optional - logs to terminal console if left blank)
+# SMTP Email Configuration (Required for Magic Link email delivery in production)
 SMTP_SERVER=
 SMTP_PORT=587
 SMTP_USER=
 SMTP_PASSWORD=
 MAIL_DEFAULT_SENDER=noreply@appmanager.local
+
+# Developer Magic Login (Set to true to show one-click login button when SMTP is disabled)
+ALLOW_DEV_MAGIC_LOGIN=false
+
+# Role & Admin Provisioning
+# FIRST_USER_IS_ADMIN: If true, the very first user who registers will be granted the admin role
+FIRST_USER_IS_ADMIN=true
+# ADMIN_EMAILS: Comma-separated list of emails that automatically receive admin role upon registration
+ADMIN_EMAILS=

appmanager_server-0.2.1/CHANGELOG.md

@@ -0,0 +1,31 @@
+# Changelog
+
+All notable changes to **`appmanager-server`** will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+---
+
+## [0.2.1] - 2026-08-28
+
+### Added
+- **Configurable Dev Magic Login (`ALLOW_DEV_MAGIC_LOGIN`)**: Prevents showing one-click developer login buttons in production when SMTP is unconfigured unless explicitly permitted.
+- **Configurable Admin Role Provisioning (`ADMIN_EMAILS` & `FIRST_USER_IS_ADMIN`)**:
+  - `ADMIN_EMAILS`: Specify comma-separated list of admin email addresses.
+  - `FIRST_USER_IS_ADMIN`: Controls whether the very first registered user in a blank database receives the admin role (defaults to `true`).
+
+### Changed
+- Improved error messaging on `/auth/login` when SMTP is unconfigured.
+- Expanded authentication test suite.
+
+---
+
+## [0.2.0] - 2026-08-28
+
+### Added
+- Initial PyPI release under package name **`appmanager-server`**.
+- CLI commands and aliases: `appmanager-server`, `appmgr-server`, `appmanager`, and `appmgr`.
+- AST Security Scanner (`appmanager.security_scanner.SecurityScanner`) for ZIP and Git package pre-installation checks.
+- Python 3.10-3.13 support.
+- PyPI Trusted Publishing via GitHub Actions OIDC.

{appmanager_server-0.2.0 → appmanager_server-0.2.1}/MANIFEST.in

@@ -1,5 +1,6 @@
 include LICENSE
 include README.md
+include CHANGELOG.md
 include SECURITY.md
 include requirements.txt
 include .env.example

{appmanager_server-0.2.0/appmanager_server.egg-info → appmanager_server-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: appmanager-server
-Version: 0.2.0
+Version: 0.2.1
 Summary: Multi-tenant Flask sub-application portal & dynamic WSGI dispatcher with in-process isolation, telemetry, and automated health checks.
 Author: AppManager Contributors
 License: MIT

{appmanager_server-0.2.0 → appmanager_server-0.2.1}/appmanager/__init__.py

@@ -8,7 +8,7 @@ from appmanager.database import db
 from appmanager.extension import AppManager
 from appmanager.middleware import DynamicAppDispatcherMiddleware
 
-__version__ = "0.2.0"
+__version__ = "0.2.1"
 
 __all__ = [
     "AppManager",

{appmanager_server-0.2.0 → appmanager_server-0.2.1}/appmanager/auth/routes.py

@@ -39,6 +39,25 @@ def login():
     return render_template("auth/login.html", next=next_url, google_configured=google_configured)
 
 
+def resolve_initial_user_role(email: str) -> str:
+    """
+    Resolves the initial role ('admin' or 'user') for a newly created user:
+    1. Checks if email is in ADMIN_EMAILS.
+    2. If FIRST_USER_IS_ADMIN is True and no users exist in the database yet, returns 'admin'.
+    3. Defaults to 'user'.
+    """
+    clean_email = email.strip().lower()
+    admin_emails = current_app.config.get("ADMIN_EMAILS", [])
+    if clean_email in [e.strip().lower() for e in admin_emails if e.strip()]:
+        return "admin"
+
+    if current_app.config.get("FIRST_USER_IS_ADMIN", True):
+        if User.query.count() == 0:
+            return "admin"
+
+    return "user"
+
+
 @auth_bp.route("/magic-link", methods=["POST"])
 def request_magic_link():
     client_ip = request.remote_addr or "unknown"
@@ -55,11 +74,23 @@ def request_magic_link():
         flash("Please enter a valid email address.", "warning")
         return redirect(url_for("auth.login", next=next_url))
 
+    smtp_configured = bool(current_app.config.get("SMTP_SERVER"))
+    allow_dev_magic = current_app.config.get("ALLOW_DEV_MAGIC_LOGIN", False)
+
+    # If SMTP is not configured and developer preview is disabled, block and show error
+    if not smtp_configured and not allow_dev_magic:
+        flash(
+            "Email delivery (SMTP) is not configured on this server. "
+            "Please configure SMTP settings in .env (or enable ALLOW_DEV_MAGIC_LOGIN=true for local testing).",
+            "danger",
+        )
+        return redirect(url_for("auth.login", next=next_url))
+
     magic_url = create_magic_link(email)
 
-    # In dev mode without SMTP, pass the magic link URL to the template for quick developer login
+    # In dev mode with ALLOW_DEV_MAGIC_LOGIN=True, pass the magic link URL to the template for quick login
     dev_magic_url = None
-    if not current_app.config.get("SMTP_SERVER"):
+    if not smtp_configured and allow_dev_magic:
         dev_magic_url = magic_url
 
     return render_template(
@@ -99,9 +130,7 @@ def verify_magic():
     # Find or create user
     user = User.query.filter_by(email=magic_token.email).first()
     if not user:
-        # First user created in the system becomes Admin automatically
-        user_count = User.query.count()
-        user_role = "admin" if user_count == 0 else "user"
+        user_role = resolve_initial_user_role(magic_token.email)
         user = User(
             email=magic_token.email,
             name=magic_token.email.split("@")[0].capitalize(),
@@ -128,10 +157,7 @@ def verify_magic():
     jwt_token = generate_jwt(user)
     flash(f"Welcome back, {user.name}!", "success")
 
-    next_url = request.args.get("next", "")
-    target_redirect = next_url if is_safe_redirect_url(next_url) else url_for("auth.profile")
-
-    response = make_response(redirect(target_redirect))
+    response = make_response(redirect(url_for("auth.profile")))
 
     response.set_cookie(
         JWT_COOKIE_NAME,
@@ -148,7 +174,7 @@ def verify_magic():
 def google_login():
     auth_url, error = get_google_auth_url()
     if error:
-        flash(f"Google OAuth Error: {error}", "danger")
+        flash(f"Google Login Error: {error}", "danger")
         return redirect(url_for("auth.login"))
     return redirect(auth_url)
 
@@ -170,11 +196,18 @@ def google_callback():
 
     user = User.query.filter((User.google_id == google_id) | (User.email == email)).first()
     if not user:
-        user_count = User.query.count()
-        user_role = "admin" if user_count == 0 else "user"
+        user_role = resolve_initial_user_role(email)
         user = User(email=email, name=name, google_id=google_id, role=user_role)
         db.session.add(user)
         db.session.commit()
+
+        # If non-admin user, assign default permissions for active apps
+        if user_role != "admin":
+            active_apps = InstalledApp.query.filter_by(is_active=True).all()
+            for app in active_apps:
+                perm = UserAppPermission(user_id=user.id, app_id=app.id, can_access=True)
+                db.session.add(perm)
+            db.session.commit()
     else:
         if not user.google_id:
             user.google_id = google_id

{appmanager_server-0.2.0 → appmanager_server-0.2.1}/appmanager/config.py

@@ -48,6 +48,21 @@ class Config:
     MAIL_DEFAULT_SENDER = os.getenv("MAIL_DEFAULT_SENDER", "noreply@appmanager.local")
     APP_BASE_URL = os.getenv("APP_BASE_URL", "http://localhost:5000")
 
+    # Developer & Admin Provisioning Settings
+    ALLOW_DEV_MAGIC_LOGIN = os.getenv("ALLOW_DEV_MAGIC_LOGIN", "false").lower() in (
+        "true",
+        "1",
+        "yes",
+    )
+    FIRST_USER_IS_ADMIN = os.getenv("FIRST_USER_IS_ADMIN", "true").lower() in (
+        "true",
+        "1",
+        "yes",
+    )
+    ADMIN_EMAILS = [
+        e.strip().lower() for e in os.getenv("ADMIN_EMAILS", "").split(",") if e.strip()
+    ]
+
     # Security settings
     SESSION_COOKIE_HTTPONLY = True
     SESSION_COOKIE_SAMESITE = os.getenv("SESSION_COOKIE_SAMESITE", "Lax")

{appmanager_server-0.2.0 → appmanager_server-0.2.1/appmanager_server.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: appmanager-server
-Version: 0.2.0
+Version: 0.2.1
 Summary: Multi-tenant Flask sub-application portal & dynamic WSGI dispatcher with in-process isolation, telemetry, and automated health checks.
 Author: AppManager Contributors
 License: MIT

{appmanager_server-0.2.0 → appmanager_server-0.2.1}/appmanager_server.egg-info/SOURCES.txt

@@ -1,4 +1,5 @@
 .env.example
+CHANGELOG.md
 LICENSE
 MANIFEST.in
 README.md

{appmanager_server-0.2.0 → appmanager_server-0.2.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "appmanager-server"
-version = "0.2.0"
+version = "0.2.1"
 description = "Multi-tenant Flask sub-application portal & dynamic WSGI dispatcher with in-process isolation, telemetry, and automated health checks."
 readme = "README.md"
 authors = [

{appmanager_server-0.2.0 → appmanager_server-0.2.1}/tests/test_auth.py

@@ -17,6 +17,7 @@ def app():
             "INSTALLED_APPS_DIR": "/tmp/test_installed_apps",
             "TEMP_UPLOAD_DIR": "/tmp/test_uploads",
             "BASE_DIR": "/tmp",
+            "ALLOW_DEV_MAGIC_LOGIN": True,  # Default to True in base test fixture
         }
     )
     with app.app_context():
@@ -31,10 +32,11 @@ def client(app):
     return app.test_client()
 
 
-def test_magic_link_flow(client, app):
-    # 1. Request magic link
+def test_magic_link_flow_dev_mode(client, app):
+    # 1. Request magic link with ALLOW_DEV_MAGIC_LOGIN=True
     res = client.post("/auth/magic-link", data={"email": "test@example.com"})
     assert res.status_code == 200
+    assert b"Developer Mode Preview" in res.data
 
     # 2. Check token in DB
     with app.app_context():
@@ -54,6 +56,49 @@ def test_magic_link_flow(client, app):
         assert user.role == "admin"
 
 
+def test_magic_link_fails_when_smtp_and_dev_mode_disabled(app):
+    app.config["ALLOW_DEV_MAGIC_LOGIN"] = False
+    app.config["SMTP_SERVER"] = ""
+    client = app.test_client()
+
+    res = client.post("/auth/magic-link", data={"email": "user@example.com"}, follow_redirects=True)
+    assert res.status_code == 200
+    assert b"Email delivery (SMTP) is not configured" in res.data
+
+    with app.app_context():
+        token = MagicLinkToken.query.filter_by(email="user@example.com").first()
+        assert token is None
+
+
+def test_admin_emails_config_provisioning(client, app):
+    app.config["ADMIN_EMAILS"] = ["designated-admin@example.com"]
+    app.config["FIRST_USER_IS_ADMIN"] = False
+
+    # First user who is NOT in ADMIN_EMAILS
+    client.post("/auth/magic-link", data={"email": "regular@example.com"})
+    with app.app_context():
+        t1 = MagicLinkToken.query.filter_by(email="regular@example.com").first()
+        token1 = t1.token
+
+    client.get(f"/auth/verify-magic?token={token1}")
+    with app.app_context():
+        u1 = User.query.filter_by(email="regular@example.com").first()
+        assert u1 is not None
+        assert u1.role == "user"
+
+    # Second user who IS in ADMIN_EMAILS
+    client.post("/auth/magic-link", data={"email": "designated-admin@example.com"})
+    with app.app_context():
+        t2 = MagicLinkToken.query.filter_by(email="designated-admin@example.com").first()
+        token2 = t2.token
+
+    client.get(f"/auth/verify-magic?token={token2}")
+    with app.app_context():
+        u2 = User.query.filter_by(email="designated-admin@example.com").first()
+        assert u2 is not None
+        assert u2.role == "admin"
+
+
 def test_second_user_is_regular_user(client, app):
     # Create first user
     with app.app_context():

{appmanager_server-0.2.0 → appmanager_server-0.2.1}/tests/test_packaging_and_cli.py

@@ -12,7 +12,7 @@ from appmanager.cli import main
 
 
 def test_package_exports():
-    assert __version__ == "0.2.0"
+    assert __version__ == "0.2.1"
     assert callable(create_app)
     assert callable(create_dispatchable_app)
     assert DynamicAppDispatcherMiddleware is not None
@@ -25,7 +25,7 @@ def test_cli_version(capsys):
         main(["--version"])
     assert exc.value.code == 0
     captured = capsys.readouterr()
-    assert "0.2.0" in captured.out or "0.2.0" in captured.err
+    assert "0.2.1" in captured.out or "0.2.1" in captured.err
 
 
 def test_cli_help(capsys):