arthexis 0.1.18__py3-none-any.whl → 0.1.20__py3-none-any.whl

core/system.py

@@ -13,8 +13,10 @@ import shutil
 import logging
 from typing import Callable, Iterable, Optional
 
+from django import forms
 from django.conf import settings
 from django.contrib import admin, messages
+from django.forms import modelformset_factory
 from django.template.response import TemplateResponse
 from django.http import HttpResponseRedirect
 from django.urls import path, reverse
@@ -32,6 +34,7 @@ from core.release import (
     _remote_with_credentials,
 )
 from core.tasks import check_github_updates
+from core.models import Todo
 from utils import revision
 
 
@@ -1086,6 +1089,123 @@ def _system_upgrade_report_view(request):
     return TemplateResponse(request, "admin/system_upgrade_report.html", context)
 
 
+class PendingTodoForm(forms.ModelForm):
+    mark_done = forms.BooleanField(required=False, label=_("Approve"))
+
+    class Meta:
+        model = Todo
+        fields = [
+            "request",
+            "request_details",
+            "url",
+            "generated_for_version",
+            "generated_for_revision",
+            "on_done_condition",
+        ]
+        widgets = {
+            "request_details": forms.Textarea(attrs={"rows": 3}),
+            "on_done_condition": forms.Textarea(attrs={"rows": 2}),
+        }
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        for name in [
+            "request",
+            "url",
+            "generated_for_version",
+            "generated_for_revision",
+        ]:
+            self.fields[name].widget.attrs.setdefault("class", "vTextField")
+        for name in ["request_details", "on_done_condition"]:
+            self.fields[name].widget.attrs.setdefault("class", "vLargeTextField")
+
+
+PendingTodoFormSet = modelformset_factory(Todo, form=PendingTodoForm, extra=0)
+
+
+def _system_pending_todos_report_view(request):
+    queryset = (
+        Todo.objects.filter(is_deleted=False, done_on__isnull=True)
+        .order_by("request")
+    )
+    formset = PendingTodoFormSet(
+        request.POST or None,
+        queryset=queryset,
+        prefix="todos",
+    )
+
+    if request.method == "POST":
+        if formset.is_valid():
+            approved_count = 0
+            edited_count = 0
+            for form in formset.forms:
+                mark_done = form.cleaned_data.get("mark_done")
+                todo = form.save(commit=False)
+                has_changes = form.has_changed()
+                if mark_done and todo.done_on is None:
+                    todo.done_on = timezone.now()
+                    approved_count += 1
+                    has_changes = True
+                if has_changes:
+                    todo.save()
+                    if form.has_changed():
+                        edited_count += 1
+                if has_changes and form.has_changed():
+                    form.save_m2m()
+
+            if approved_count or edited_count:
+                message_parts: list[str] = []
+                if edited_count:
+                    message_parts.append(
+                        ngettext(
+                            "%(count)d TODO updated.",
+                            "%(count)d TODOs updated.",
+                            edited_count,
+                        )
+                        % {"count": edited_count}
+                    )
+                if approved_count:
+                    message_parts.append(
+                        ngettext(
+                            "%(count)d TODO approved.",
+                            "%(count)d TODOs approved.",
+                            approved_count,
+                        )
+                        % {"count": approved_count}
+                    )
+                messages.success(request, " ".join(message_parts))
+            else:
+                messages.info(
+                    request,
+                    _("No changes were applied to the pending TODOs."),
+                )
+            return HttpResponseRedirect(reverse("admin:system-pending-todos-report"))
+        else:
+            messages.error(request, _("Please correct the errors below."))
+
+    rows = [
+        {
+            "form": form,
+            "todo": form.instance,
+        }
+        for form in formset.forms
+    ]
+
+    context = admin.site.each_context(request)
+    context.update(
+        {
+            "title": _("Pending TODOs Report"),
+            "formset": formset,
+            "rows": rows,
+        }
+    )
+    return TemplateResponse(
+        request,
+        "admin/system_pending_todos_report.html",
+        context,
+    )
+
+
 def _trigger_upgrade_check() -> bool:
     """Return ``True`` when the upgrade check was queued asynchronously."""
 
@@ -1142,6 +1262,11 @@ def patch_admin_system_view() -> None:
                 admin.site.admin_view(_system_changelog_report_view),
                 name="system-changelog-report",
             ),
+            path(
+                "system/pending-todos-report/",
+                admin.site.admin_view(_system_pending_todos_report_view),
+                name="system-pending-todos-report",
+            ),
             path(
                 "system/upgrade-report/",
                 admin.site.admin_view(_system_upgrade_report_view),

core/tasks.py

@@ -2,20 +2,16 @@ from __future__ import annotations
 
 import logging
 import shutil
+import re
 import subprocess
 from pathlib import Path
 import urllib.error
 import urllib.request
 
 from celery import shared_task
-from django.conf import settings
-from django.contrib.auth import get_user_model
-from core import mailer
 from core import github_issues
 from django.utils import timezone
 
-from nodes.models import NetMessage
-
 
 AUTO_UPGRADE_HEALTH_DELAY_SECONDS = 30
 AUTO_UPGRADE_SKIP_LOCK_NAME = "auto_upgrade_skip_revisions.lck"
@@ -30,23 +26,6 @@ def heartbeat() -> None:
     logger.info("Heartbeat task executed")
 
 
-@shared_task
-def birthday_greetings() -> None:
-    """Send birthday greetings to users via Net Message and email."""
-    User = get_user_model()
-    today = timezone.localdate()
-    for user in User.objects.filter(birthday=today):
-        NetMessage.broadcast("Happy bday!", user.username)
-        if user.email:
-            mailer.send(
-                "Happy bday!",
-                f"Happy bday! {user.username}",
-                [user.email],
-                settings.DEFAULT_FROM_EMAIL,
-                fail_silently=True,
-            )
-
-
 def _auto_upgrade_log_path(base_dir: Path) -> Path:
     """Return the log file used for auto-upgrade events."""
 
@@ -124,6 +103,21 @@ def _resolve_service_url(base_dir: Path) -> str:
     return f"http://127.0.0.1:{port}/"
 
 
+def _parse_major_minor(version: str) -> tuple[int, int] | None:
+    match = re.match(r"^\s*(\d+)\.(\d+)", version)
+    if not match:
+        return None
+    return int(match.group(1)), int(match.group(2))
+
+
+def _shares_stable_series(local: str, remote: str) -> bool:
+    local_parts = _parse_major_minor(local)
+    remote_parts = _parse_major_minor(remote)
+    if not local_parts or not remote_parts:
+        return False
+    return local_parts == remote_parts
+
+
 @shared_task
 def check_github_updates() -> None:
     """Check the GitHub repo for updates and upgrade if needed."""
@@ -218,9 +212,16 @@ def check_github_updates() -> None:
             if startup:
                 startup()
             return
+        if mode == "stable" and _shares_stable_series(local, remote):
+            if startup:
+                startup()
+            return
         if notify:
             notify("Upgrading...", upgrade_stamp)
-        args = ["./upgrade.sh", "--no-restart"]
+        if mode == "stable":
+            args = ["./upgrade.sh", "--stable", "--no-restart"]
+        else:
+            args = ["./upgrade.sh", "--no-restart"]
         upgrade_was_applied = True
 
     with log_file.open("a") as fh:

core/tests.py

@@ -8,6 +8,7 @@ django.setup()
 from django.test import Client, TestCase, RequestFactory, override_settings
 from django.urls import reverse
 from django.http import HttpRequest
+from django.contrib import messages
 import csv
 import json
 import importlib.util

core/views.py

@@ -448,8 +448,11 @@ def _resolve_release_log_dir(preferred: Path) -> tuple[Path, str | None]:
 
     env_override = os.environ.pop("ARTHEXIS_LOG_DIR", None)
     fallback = select_log_dir(Path(settings.BASE_DIR))
-    if env_override and Path(env_override) != fallback:
-        os.environ["ARTHEXIS_LOG_DIR"] = str(fallback)
+    if env_override is not None:
+        if Path(env_override) == fallback:
+            os.environ["ARTHEXIS_LOG_DIR"] = env_override
+        else:
+            os.environ["ARTHEXIS_LOG_DIR"] = str(fallback)
 
     if fallback == preferred:
         if error:
@@ -608,6 +611,43 @@ def _git_authentication_missing(exc: subprocess.CalledProcessError) -> bool:
     return any(marker in message for marker in auth_markers)
 
 
+def _push_release_changes(log_path: Path) -> bool:
+    """Push release commits to ``origin`` and log the outcome."""
+
+    if not _has_remote("origin"):
+        _append_log(
+            log_path, "No git remote configured; skipping push of release changes"
+        )
+        return False
+
+    try:
+        branch = _current_branch()
+        if branch is None:
+            push_cmd = ["git", "push", "origin", "HEAD"]
+        elif _has_upstream(branch):
+            push_cmd = ["git", "push"]
+        else:
+            push_cmd = ["git", "push", "--set-upstream", "origin", branch]
+        subprocess.run(push_cmd, check=True, capture_output=True, text=True)
+    except subprocess.CalledProcessError as exc:
+        details = _format_subprocess_error(exc)
+        if _git_authentication_missing(exc):
+            _append_log(
+                log_path,
+                "Authentication is required to push release changes to origin; skipping push",
+            )
+            if details:
+                _append_log(log_path, details)
+            return False
+        _append_log(
+            log_path, f"Failed to push release changes to origin: {details}"
+        )
+        raise Exception("Failed to push release changes") from exc
+
+    _append_log(log_path, "Pushed release changes to origin")
+    return True
+
+
 def _ensure_origin_main_unchanged(log_path: Path) -> None:
     """Verify that ``origin/main`` has not advanced during the release."""
 
@@ -736,6 +776,34 @@ def _ensure_release_todo(
     return todo, fixture_path
 
 
+def _todo_blocks_publish(todo: Todo, release: PackageRelease) -> bool:
+    """Return ``True`` when ``todo`` should block the release workflow."""
+
+    request = (todo.request or "").strip()
+    release_name = (release.package.name or "").strip()
+    if not request or not release_name:
+        return True
+
+    prefix = f"create release {release_name.lower()} "
+    if not request.lower().startswith(prefix):
+        return True
+
+    release_version = (release.version or "").strip()
+    generated_version = (todo.generated_for_version or "").strip()
+    if not release_version or release_version != generated_version:
+        return True
+
+    generated_revision = (todo.generated_for_revision or "").strip()
+    release_revision = (release.revision or "").strip()
+    if generated_revision and release_revision and generated_revision != release_revision:
+        return True
+
+    if not todo.is_seed_data:
+        return True
+
+    return False
+
+
 def _sync_release_with_revision(release: PackageRelease) -> tuple[bool, str]:
     """Ensure ``release`` matches the repository revision and version.
 
@@ -1312,37 +1380,7 @@ def _step_promote_build(release, ctx, log_path: Path) -> None:
                 log_path,
                 f"Committed release metadata for v{release.version}",
             )
-        if _has_remote("origin"):
-            try:
-                branch = _current_branch()
-                if branch is None:
-                    push_cmd = ["git", "push", "origin", "HEAD"]
-                elif _has_upstream(branch):
-                    push_cmd = ["git", "push"]
-                else:
-                    push_cmd = ["git", "push", "--set-upstream", "origin", branch]
-                subprocess.run(push_cmd, check=True, capture_output=True, text=True)
-            except subprocess.CalledProcessError as exc:
-                details = _format_subprocess_error(exc)
-                if _git_authentication_missing(exc):
-                    _append_log(
-                        log_path,
-                        "Authentication is required to push release changes to origin; skipping push",
-                    )
-                    if details:
-                        _append_log(log_path, details)
-                else:
-                    _append_log(
-                        log_path, f"Failed to push release changes to origin: {details}"
-                    )
-                    raise Exception("Failed to push release changes") from exc
-            else:
-                _append_log(log_path, "Pushed release changes to origin")
-        else:
-            _append_log(
-                log_path,
-                "No git remote configured; skipping push of release changes",
-            )
+        _push_release_changes(log_path)
         PackageRelease.dump_fixture()
         _append_log(log_path, "Updated release fixtures")
         _record_release_todo(release, ctx, log_path)
@@ -1533,6 +1571,30 @@ def _step_publish(release, ctx, log_path: Path) -> None:
     _append_log(log_path, f"Recorded PyPI URL: {release.pypi_url}")
     if release.github_url:
         _append_log(log_path, f"Recorded GitHub URL: {release.github_url}")
+    fixture_paths = [
+        str(path) for path in Path("core/fixtures").glob("releases__*.json")
+    ]
+    if fixture_paths:
+        status = subprocess.run(
+            ["git", "status", "--porcelain", "--", *fixture_paths],
+            capture_output=True,
+            text=True,
+            check=True,
+        )
+        if status.stdout.strip():
+            subprocess.run(["git", "add", *fixture_paths], check=True)
+            _append_log(log_path, "Staged publish metadata updates")
+            commit_message = f"chore: record publish metadata for v{release.version}"
+            subprocess.run(["git", "commit", "-m", commit_message], check=True)
+            _append_log(
+                log_path, f"Committed publish metadata for v{release.version}"
+            )
+            _push_release_changes(log_path)
+        else:
+            _append_log(
+                log_path,
+                "No release metadata updates detected after publish; skipping commit",
+            )
     _append_log(log_path, "Upload complete")
 
 
@@ -1726,9 +1788,9 @@ def rfid_batch(request):
             else:
                 post_auth_command = post_auth_command.strip()
 
-            tag, _ = RFID.objects.update_or_create(
-                rfid=rfid.upper(),
-                defaults={
+            tag, _ = RFID.update_or_create_from_code(
+                rfid,
+                {
                     "allowed": allowed,
                     "color": color,
                     "released": released,
@@ -1885,12 +1947,15 @@ def release_progress(request, pk: int, action: str):
 
     pending_qs = Todo.objects.filter(is_deleted=False, done_on__isnull=True)
     pending_items = list(pending_qs)
-    if not pending_items:
+    blocking_todos = [
+        todo for todo in pending_items if _todo_blocks_publish(todo, release)
+    ]
+    if not blocking_todos:
         ctx["todos_ack"] = True
         ctx["todos_ack_auto"] = True
     elif ack_todos_requested:
         failures = []
-        for todo in pending_items:
+        for todo in blocking_todos:
             result = todo.check_on_done_condition()
             if not result.passed:
                 failures.append((todo, result))
@@ -1920,7 +1985,7 @@ def release_progress(request, pk: int, action: str):
                 "url": todo.url,
                 "request_details": todo.request_details,
             }
-            for todo in pending_items
+            for todo in blocking_todos
         ]
         ctx["todos_required"] = True
 
@@ -1932,7 +1997,7 @@ def release_progress(request, pk: int, action: str):
             "started": ctx.get("started", False),
         }
         step_count = 0
-        if not pending_items:
+        if not blocking_todos:
             ctx["todos_ack"] = True
     log_path = log_dir / log_name
     ctx.setdefault("log", log_name)

nodes/admin.py

@@ -8,7 +8,7 @@ from django.contrib.admin import helpers
 from django.contrib.admin.widgets import FilteredSelectMultiple
 from django.core.exceptions import PermissionDenied
 from django.db.models import Count
-from django.http import HttpResponse, JsonResponse
+from django.http import Http404, HttpResponse, JsonResponse
 from django.shortcuts import redirect, render
 from django.template.response import TemplateResponse
 from django.urls import NoReverseMatch, path, reverse
@@ -233,6 +233,7 @@ class NodeAdmin(EntityModelAdmin):
         "role",
         "relation",
         "last_seen",
+        "proxy_link",
     )
     search_fields = ("hostname", "address", "mac_address")
     change_list_template = "admin/nodes/node/change_list.html"
@@ -247,6 +248,7 @@ class NodeAdmin(EntityModelAdmin):
                     "address",
                     "mac_address",
                     "port",
+                    "message_queue_length",
                     "role",
                     "current_relation",
                 )
@@ -290,6 +292,16 @@ class NodeAdmin(EntityModelAdmin):
     def relation(self, obj):
         return obj.get_current_relation_display()
 
+    @admin.display(description=_("Proxy"))
+    def proxy_link(self, obj):
+        if not obj or obj.is_local:
+            return ""
+        try:
+            url = reverse("admin:nodes_node_proxy", args=[obj.pk])
+        except NoReverseMatch:
+            return ""
+        return format_html('<a class="button" href="{}">{}</a>', url, _("Proxy"))
+
     def get_urls(self):
         urls = super().get_urls()
         custom = [
@@ -313,6 +325,11 @@ class NodeAdmin(EntityModelAdmin):
                 self.admin_site.admin_view(self.update_selected_progress),
                 name="nodes_node_update_selected_progress",
             ),
+            path(
+                "<int:node_id>/proxy/",
+                self.admin_site.admin_view(self.proxy_node),
+                name="nodes_node_proxy",
+            ),
         ]
         return custom + urls
 
@@ -332,6 +349,121 @@ class NodeAdmin(EntityModelAdmin):
         }
         return render(request, "admin/nodes/node/register_remote.html", context)
 
+    def _load_local_private_key(self, node):
+        security_dir = Path(node.base_path or settings.BASE_DIR) / "security"
+        priv_path = security_dir / f"{node.public_endpoint}"
+        if not priv_path.exists():
+            return None, _("Local node private key not found.")
+        try:
+            return (
+                serialization.load_pem_private_key(
+                    priv_path.read_bytes(), password=None
+                ),
+                "",
+            )
+        except Exception as exc:  # pragma: no cover - unexpected errors
+            return None, str(exc)
+
+    def _build_proxy_payload(self, request, local_node):
+        user = request.user
+        payload = {
+            "requester": str(local_node.uuid),
+            "user": {
+                "username": user.get_username(),
+                "email": user.email or "",
+                "first_name": user.first_name or "",
+                "last_name": user.last_name or "",
+                "is_staff": user.is_staff,
+                "is_superuser": user.is_superuser,
+                "groups": list(user.groups.values_list("name", flat=True)),
+                "permissions": sorted(user.get_all_permissions()),
+            },
+            "target": reverse("admin:index"),
+        }
+        return payload
+
+    def _start_proxy_session(self, request, node):
+        if node.is_local:
+            return {"ok": False, "message": _("Local node cannot be proxied.")}
+
+        local_node = Node.get_local()
+        if local_node is None:
+            try:
+                local_node, _ = Node.register_current()
+            except Exception as exc:  # pragma: no cover - unexpected errors
+                return {"ok": False, "message": str(exc)}
+
+        private_key, error = self._load_local_private_key(local_node)
+        if private_key is None:
+            return {"ok": False, "message": error}
+
+        payload = self._build_proxy_payload(request, local_node)
+        body = json.dumps(payload, separators=(",", ":"), sort_keys=True)
+        try:
+            signature = private_key.sign(
+                body.encode(),
+                padding.PKCS1v15(),
+                hashes.SHA256(),
+            )
+        except Exception as exc:  # pragma: no cover - unexpected errors
+            return {"ok": False, "message": str(exc)}
+
+        headers = {
+            "Content-Type": "application/json",
+            "X-Signature": base64.b64encode(signature).decode(),
+        }
+
+        last_error = ""
+        for url in self._iter_remote_urls(node, "/nodes/proxy/session/"):
+            try:
+                response = requests.post(url, data=body, headers=headers, timeout=5)
+            except RequestException as exc:
+                last_error = str(exc)
+                continue
+            if not response.ok:
+                last_error = f"{response.status_code} {response.text}"
+                continue
+            try:
+                data = response.json()
+            except ValueError:
+                last_error = "Invalid JSON response"
+                continue
+            login_url = data.get("login_url")
+            if not login_url:
+                last_error = "login_url missing"
+                continue
+            return {
+                "ok": True,
+                "login_url": login_url,
+                "expires": data.get("expires"),
+            }
+
+        return {
+            "ok": False,
+            "message": last_error or "Unable to initiate proxy.",
+        }
+
+    def proxy_node(self, request, node_id):
+        node = self.get_queryset(request).filter(pk=node_id).first()
+        if not node:
+            raise Http404
+        if not self.has_view_permission(request):
+            raise PermissionDenied
+        result = self._start_proxy_session(request, node)
+        if not result.get("ok"):
+            message = result.get("message") or _("Unable to proxy node.")
+            self.message_user(request, message, messages.ERROR)
+            return redirect("admin:nodes_node_changelist")
+
+        context = {
+            **self.admin_site.each_context(request),
+            "opts": self.model._meta,
+            "node": node,
+            "frame_url": result.get("login_url"),
+            "expires": result.get("expires"),
+        }
+        return TemplateResponse(request, "admin/nodes/node/proxy.html", context)
+
     @admin.action(description="Register Visitor")
     def register_visitor(self, request, queryset=None):
         return self.register_visitor_view(request)
@@ -1565,7 +1697,7 @@ class NetMessageAdmin(EntityModelAdmin):
     search_fields = ("subject", "body")
     list_filter = ("complete", "filter_node_role", "filter_current_relation")
     ordering = ("-created",)
-    readonly_fields = ("complete", "confirmed_peers")
+    readonly_fields = ("complete",)
     actions = ["send_messages"]
     fieldsets = (
         (None, {"fields": ("subject", "body")}),
@@ -1590,7 +1722,6 @@ class NetMessageAdmin(EntityModelAdmin):
                     "node_origin",
                     "target_limit",
                     "propagated_to",
-                    "confirmed_peers",
                     "complete",
                 )
             },