arthexis 0.1.8__py3-none-any.whl → 0.1.10__py3-none-any.whl

core/admin_history.py

@@ -0,0 +1,50 @@
+import json
+from django.contrib.admin.options import ModelAdmin
+from django.contrib.admin.models import LogEntry
+from django.utils.encoding import smart_str
+
+
+def patch_admin_history():
+    if getattr(ModelAdmin, "_history_patched", False):
+        return
+
+    def construct_change_message(self, request, form, formsets, add=False):
+        fields = []
+        if add:
+            for name, value in form.cleaned_data.items():
+                fields.append({"field": name, "old": None, "new": smart_str(value)})
+            if not fields:
+                return ""
+            return json.dumps({"added": fields})
+        for name in form.changed_data:
+            fields.append(
+                {
+                    "field": name,
+                    "old": smart_str(form.initial.get(name)),
+                    "new": smart_str(form.cleaned_data.get(name)),
+                }
+            )
+        if not fields:
+            return ""
+        return json.dumps({"changed": fields})
+
+    def get_change_message(self):
+        try:
+            data = json.loads(self.change_message)
+        except Exception:
+            return self.change_message
+        if isinstance(data, dict):
+            if "added" in data:
+                parts = [f"{d['field']}='{d['new']}'" for d in data["added"]]
+                return "Added " + ", ".join(parts)
+            if "changed" in data:
+                parts = [
+                    f"{d['field']}: '{d['old']}' -> '{d['new']}'"
+                    for d in data["changed"]
+                ]
+                return "Changed " + ", ".join(parts)
+        return self.change_message
+
+    ModelAdmin.construct_change_message = construct_change_message
+    LogEntry.get_change_message = get_change_message
+    ModelAdmin._history_patched = True

core/admindocs.py

@@ -1,6 +1,15 @@
 import argparse
+import inspect
+from types import SimpleNamespace
+
+from django.apps import apps
+from django.contrib import admin
 from django.core.management import get_commands, load_command_class
-from django.contrib.admindocs.views import BaseAdminDocsView
+from django.contrib.admindocs.views import (
+    BaseAdminDocsView,
+    user_has_model_view_permission,
+)
+from django.urls import NoReverseMatch, reverse
 
 
 class CommandsView(BaseAdminDocsView):
@@ -42,3 +51,101 @@ class CommandsView(BaseAdminDocsView):
                 }
             )
         return super().get_context_data(**{**kwargs, "commands": commands})
+
+
+class OrderedModelIndexView(BaseAdminDocsView):
+    template_name = "admin_doc/model_index.html"
+
+    GROUP_OVERRIDES = {
+        "ocpp.location": "core",
+        "core.rfid": "ocpp",
+        "core.package": "teams",
+        "core.packagerelease": "teams",
+    }
+
+    def _get_docs_app_config(self, meta):
+        override_label = self.GROUP_OVERRIDES.get(meta.label_lower)
+        if override_label:
+            return apps.get_app_config(override_label)
+        return meta.app_config
+
+    def get_context_data(self, **kwargs):
+        models = []
+        for m in apps.get_models():
+            if user_has_model_view_permission(self.request.user, m._meta):
+                meta = m._meta
+                meta.docstring = inspect.getdoc(m) or ""
+                app_config = self._get_docs_app_config(meta)
+                models.append(
+                    SimpleNamespace(
+                        app_label=meta.app_label,
+                        model_name=meta.model_name,
+                        object_name=meta.object_name,
+                        docstring=meta.docstring,
+                        app_config=app_config,
+                    )
+                )
+        models.sort(key=lambda m: str(m.app_config.verbose_name))
+        return super().get_context_data(**{**kwargs, "models": models})
+
+
+class ModelGraphIndexView(BaseAdminDocsView):
+    template_name = "admin_doc/model_graphs.html"
+
+    def get_context_data(self, **kwargs):
+        sections = {}
+        user = self.request.user
+
+        for model in admin.site._registry:
+            meta = model._meta
+            if not user_has_model_view_permission(user, meta):
+                continue
+
+            app_config = apps.get_app_config(meta.app_label)
+            section = sections.setdefault(
+                app_config.label,
+                {
+                    "app_label": app_config.label,
+                    "verbose_name": str(app_config.verbose_name),
+                    "models": [],
+                },
+            )
+
+            section["models"].append(
+                {
+                    "object_name": meta.object_name,
+                    "verbose_name": str(meta.verbose_name),
+                    "doc_url": reverse(
+                        "django-admindocs-models-detail",
+                        kwargs={
+                            "app_label": meta.app_label,
+                            "model_name": meta.model_name,
+                        },
+                    ),
+                }
+            )
+
+        graph_sections = []
+        for section in sections.values():
+            section_models = section["models"]
+            section_models.sort(key=lambda model: model["verbose_name"])
+
+            try:
+                app_list_url = reverse("admin:app_list", args=[section["app_label"]])
+            except NoReverseMatch:
+                app_list_url = ""
+
+            graph_sections.append(
+                {
+                    **section,
+                    "graph_url": reverse(
+                        "admin-model-graph", args=[section["app_label"]]
+                    ),
+                    "app_list_url": app_list_url,
+                    "model_count": len(section_models),
+                }
+            )
+
+        graph_sections.sort(key=lambda section: section["verbose_name"])
+
+        return super().get_context_data(**{**kwargs, "sections": graph_sections})

core/apps.py

@@ -1,22 +1,43 @@
+import logging
+
 from django.apps import AppConfig
 from django.utils.translation import gettext_lazy as _
 
 
+logger = logging.getLogger(__name__)
+
+
 class CoreConfig(AppConfig):
     default_auto_field = "django.db.models.BigAutoField"
     name = "core"
     verbose_name = _("2. Business")
 
     def ready(self):  # pragma: no cover - called by Django
+        from contextlib import suppress
+        from functools import wraps
+        import hashlib
+        import time
+        import traceback
+        from pathlib import Path
+
+        from django.conf import settings
         from django.contrib.auth import get_user_model
         from django.db.models.signals import post_migrate
+        from django.core.signals import got_request_exception
+
+        from core.github_helper import report_exception_to_github
+        from .entity import Entity
         from .user_data import (
             patch_admin_user_datum,
             patch_admin_user_data_views,
         )
         from .system import patch_admin_system_view
         from .environment import patch_admin_environment_view
-        from . import checks  # noqa: F401
+        from .sigil_builder import (
+            patch_admin_sigil_builder_view,
+            generate_model_sigils,
+        )
+        from .admin_history import patch_admin_history
 
         def create_default_arthexis(**kwargs):
             User = get_user_model()
@@ -29,17 +50,62 @@ class CoreConfig(AppConfig):
                 )
 
         post_migrate.connect(create_default_arthexis, sender=self)
+        post_migrate.connect(generate_model_sigils, sender=self)
         patch_admin_user_datum()
         patch_admin_user_data_views()
         patch_admin_system_view()
         patch_admin_environment_view()
+        patch_admin_sigil_builder_view()
+        patch_admin_history()
 
-        from pathlib import Path
-        from django.conf import settings
+        from django.core.serializers import base as serializer_base
+
+        if not hasattr(
+            serializer_base.DeserializedObject.save, "_entity_fixture_patch"
+        ):
+            original_save = serializer_base.DeserializedObject.save
+
+            @wraps(original_save)
+            def patched_save(self, save_m2m=True, using=None, **kwargs):
+                obj = self.object
+                if isinstance(obj, Entity):
+                    manager = getattr(
+                        type(obj), "all_objects", type(obj)._default_manager
+                    )
+                    if using:
+                        manager = manager.db_manager(using)
+                    for fields in obj._unique_field_groups():
+                        lookup = {}
+                        for field in fields:
+                            value = getattr(obj, field.attname)
+                            if value is None:
+                                lookup = {}
+                                break
+                            lookup[field.attname] = value
+                        if not lookup:
+                            continue
+                        existing = (
+                            manager.filter(**lookup)
+                            .only("pk", "is_seed_data", "is_user_data")
+                            .first()
+                        )
+                        if existing is not None:
+                            obj.pk = existing.pk
+                            obj.is_seed_data = existing.is_seed_data
+                            obj.is_user_data = existing.is_user_data
+                            obj._state.adding = False
+                            if using:
+                                obj._state.db = using
+                            break
+                return original_save(self, save_m2m=save_m2m, using=using, **kwargs)
+
+            patched_save._entity_fixture_patch = True
+            serializer_base.DeserializedObject.save = patched_save
 
         lock = Path(settings.BASE_DIR) / "locks" / "celery.lck"
 
         if lock.exists():
+            from .auto_upgrade import ensure_auto_upgrade_periodic_task
 
             def ensure_email_collector_task(**kwargs):
                 try:  # pragma: no cover - optional dependency
@@ -66,3 +132,95 @@ class CoreConfig(AppConfig):
                     pass
 
             post_migrate.connect(ensure_email_collector_task, sender=self)
+            post_migrate.connect(ensure_auto_upgrade_periodic_task, sender=self)
+            ensure_auto_upgrade_periodic_task()
+
+        from django.db.backends.signals import connection_created
+
+        def enable_sqlite_wal(**kwargs):
+            connection = kwargs.get("connection")
+            if connection.vendor == "sqlite":
+                cursor = connection.cursor()
+                cursor.execute("PRAGMA journal_mode=WAL;")
+                cursor.execute("PRAGMA busy_timeout=60000;")
+                cursor.close()
+
+        connection_created.connect(enable_sqlite_wal)
+
+        def queue_github_issue(sender, request=None, **kwargs):
+            if not getattr(settings, "GITHUB_ISSUE_REPORTING_ENABLED", True):
+                return
+            if request is None:
+                return
+
+            exception = kwargs.get("exception")
+            if exception is None:
+                return
+
+            try:
+                tb_exc = traceback.TracebackException.from_exception(exception)
+                stack = tb_exc.stack
+                top_frame = stack[-1] if stack else None
+                fingerprint_parts = [
+                    exception.__class__.__module__,
+                    exception.__class__.__name__,
+                ]
+                if top_frame:
+                    fingerprint_parts.extend(
+                        [
+                            top_frame.filename,
+                            str(top_frame.lineno),
+                            top_frame.name,
+                        ]
+                    )
+                fingerprint = hashlib.sha256(
+                    "|".join(fingerprint_parts).encode("utf-8")
+                ).hexdigest()
+
+                cooldown = getattr(settings, "GITHUB_ISSUE_REPORTING_COOLDOWN", 3600)
+                lock_dir = Path(settings.BASE_DIR) / "locks" / "github-issues"
+                fingerprint_path = None
+                now = time.time()
+
+                with suppress(OSError):
+                    lock_dir.mkdir(parents=True, exist_ok=True)
+                    fingerprint_path = lock_dir / fingerprint
+                    if fingerprint_path.exists():
+                        age = now - fingerprint_path.stat().st_mtime
+                        if age < cooldown:
+                            return
+
+                if fingerprint_path is not None:
+                    with suppress(OSError):
+                        fingerprint_path.write_text(str(now))
+
+                user_repr = None
+                user = getattr(request, "user", None)
+                if user is not None:
+                    try:
+                        if getattr(user, "is_authenticated", False):
+                            user_repr = user.get_username()
+                        else:
+                            user_repr = "anonymous"
+                    except Exception:  # pragma: no cover - defensive
+                        user_repr = str(user)
+
+                payload = {
+                    "path": getattr(request, "path", None),
+                    "method": getattr(request, "method", None),
+                    "user": user_repr,
+                    "active_app": getattr(request, "active_app", None),
+                    "fingerprint": fingerprint,
+                    "exception_class": f"{exception.__class__.__module__}.{exception.__class__.__name__}",
+                    "traceback": "".join(tb_exc.format()),
+                }
+
+                report_exception_to_github.delay(payload)
+            except Exception:  # pragma: no cover - defensive
+                logger.exception("Failed to queue GitHub issue from request exception")
+
+        got_request_exception.connect(
+            queue_github_issue,
+            dispatch_uid="core.github_issue_reporter",
+            weak=False,
+        )

core/auto_upgrade.py

@@ -0,0 +1,57 @@
+"""Helpers for managing the auto-upgrade scheduler."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from django.conf import settings
+
+
+AUTO_UPGRADE_TASK_NAME = "auto-upgrade-check"
+AUTO_UPGRADE_TASK_PATH = "core.tasks.check_github_updates"
+
+
+def ensure_auto_upgrade_periodic_task(
+    sender=None, *, base_dir: Path | None = None, **kwargs
+) -> None:
+    """Ensure the auto-upgrade periodic task exists.
+
+    The function is signal-safe so it can be wired to Django's
+    ``post_migrate`` hook. When called directly the ``sender`` and
+    ``**kwargs`` parameters are ignored.
+    """
+
+    del sender, kwargs  # Unused when invoked as a Django signal handler.
+
+    if base_dir is None:
+        base_dir = Path(settings.BASE_DIR)
+    else:
+        base_dir = Path(base_dir)
+
+    lock_dir = base_dir / "locks"
+    mode_file = lock_dir / "auto_upgrade.lck"
+    if not mode_file.exists():
+        return
+
+    try:  # pragma: no cover - optional dependency failures
+        from django_celery_beat.models import IntervalSchedule, PeriodicTask
+        from django.db.utils import OperationalError, ProgrammingError
+    except Exception:
+        return
+
+    mode = mode_file.read_text().strip() or "version"
+    interval_minutes = 5 if mode == "latest" else 10
+
+    try:
+        schedule, _ = IntervalSchedule.objects.get_or_create(
+            every=interval_minutes, period=IntervalSchedule.MINUTES
+        )
+        PeriodicTask.objects.update_or_create(
+            name=AUTO_UPGRADE_TASK_NAME,
+            defaults={
+                "interval": schedule,
+                "task": AUTO_UPGRADE_TASK_PATH,
+            },
+        )
+    except (OperationalError, ProgrammingError):  # pragma: no cover - DB not ready
+        return

core/backends.py

@@ -1,12 +1,69 @@
 """Custom authentication backends for the core app."""
 
+import contextlib
+import ipaddress
+import socket
+
+from django.conf import settings
 from django.contrib.auth import get_user_model
 from django.contrib.auth.backends import ModelBackend
-import ipaddress
+from django.core.exceptions import DisallowedHost
+from django.http.request import split_domain_port
+from django_otp.plugins.otp_totp.models import TOTPDevice
 
 from .models import EnergyAccount
 
 
+TOTP_DEVICE_NAME = "authenticator"
+
+
+class TOTPBackend(ModelBackend):
+    """Authenticate using a TOTP code from an enrolled authenticator app."""
+
+    def authenticate(self, request, username=None, otp_token=None, **kwargs):
+        if not username or otp_token in (None, ""):
+            return None
+
+        token = str(otp_token).strip().replace(" ", "")
+        if not token:
+            return None
+
+        UserModel = get_user_model()
+        try:
+            user = UserModel._default_manager.get_by_natural_key(username)
+        except UserModel.DoesNotExist:
+            return None
+
+        if not user.is_active:
+            return None
+
+        device_qs = TOTPDevice.objects.filter(user=user, confirmed=True)
+        if TOTP_DEVICE_NAME:
+            device_qs = device_qs.filter(name=TOTP_DEVICE_NAME)
+
+        device = device_qs.order_by("-id").first()
+        if device is None:
+            return None
+
+        try:
+            verified = device.verify_token(token)
+        except Exception:
+            return None
+
+        if not verified:
+            return None
+
+        user.otp_device = device
+        return user
+
+    def get_user(self, user_id):
+        UserModel = get_user_model()
+        try:
+            return UserModel._default_manager.get(pk=user_id)
+        except UserModel.DoesNotExist:
+            return None
+
+
 class RFIDBackend:
     """Authenticate using a user's RFID."""
 
@@ -32,19 +89,67 @@ class RFIDBackend:
             return None
 
 
+def _collect_local_ip_addresses():
+    """Return IP addresses assigned to the current machine."""
+
+    hosts = {socket.gethostname().strip()}
+    with contextlib.suppress(Exception):
+        hosts.add(socket.getfqdn().strip())
+
+    addresses = set()
+    for host in filter(None, hosts):
+        with contextlib.suppress(OSError):
+            _, _, ip_list = socket.gethostbyname_ex(host)
+            for candidate in ip_list:
+                with contextlib.suppress(ValueError):
+                    addresses.add(ipaddress.ip_address(candidate))
+        with contextlib.suppress(OSError):
+            for info in socket.getaddrinfo(host, None, family=socket.AF_UNSPEC):
+                sockaddr = info[-1]
+                if not sockaddr:
+                    continue
+                raw_address = sockaddr[0]
+                if isinstance(raw_address, bytes):
+                    with contextlib.suppress(UnicodeDecodeError):
+                        raw_address = raw_address.decode()
+                if isinstance(raw_address, str):
+                    if "%" in raw_address:
+                        raw_address = raw_address.split("%", 1)[0]
+                    with contextlib.suppress(ValueError):
+                        addresses.add(ipaddress.ip_address(raw_address))
+    return tuple(sorted(addresses, key=str))
+
+
 class LocalhostAdminBackend(ModelBackend):
     """Allow default admin credentials only from local networks."""
 
-    _ALLOWED_NETWORKS = [
+    _ALLOWED_NETWORKS = (
         ipaddress.ip_network("::1/128"),
         ipaddress.ip_network("127.0.0.0/8"),
-        ipaddress.ip_network("192.168.0.0/16"),
-        ipaddress.ip_network("172.16.0.0/12"),
         ipaddress.ip_network("10.42.0.0/16"),
-    ]
+        ipaddress.ip_network("192.168.0.0/16"),
+    )
+    _CONTROL_ALLOWED_NETWORKS = (ipaddress.ip_network("10.0.0.0/8"),)
+    _LOCAL_IPS = _collect_local_ip_addresses()
+
+    def _iter_allowed_networks(self):
+        yield from self._ALLOWED_NETWORKS
+        if getattr(settings, "NODE_ROLE", "") == "Control":
+            yield from self._CONTROL_ALLOWED_NETWORKS
 
     def authenticate(self, request, username=None, password=None, **kwargs):
         if username == "admin" and password == "admin" and request is not None:
+            try:
+                host = request.get_host()
+            except DisallowedHost:
+                return None
+            host, _port = split_domain_port(host)
+            if host.startswith("[") and host.endswith("]"):
+                host = host[1:-1]
+            try:
+                ipaddress.ip_address(host)
+            except ValueError:
+                return None
             forwarded = request.META.get("HTTP_X_FORWARDED_FOR")
             if forwarded:
                 remote = forwarded.split(",")[0].strip()
@@ -54,7 +159,9 @@ class LocalhostAdminBackend(ModelBackend):
                 ip = ipaddress.ip_address(remote)
             except ValueError:
                 return None
-            allowed = any(ip in net for net in self._ALLOWED_NETWORKS)
+            allowed = any(ip in net for net in self._iter_allowed_networks())
+            if not allowed and ip in self._LOCAL_IPS:
+                allowed = True
             if not allowed:
                 return None
             User = get_user_model()
@@ -65,11 +172,21 @@ class LocalhostAdminBackend(ModelBackend):
                     "is_superuser": True,
                 },
             )
+            if not created and not user.is_active:
+                return None
+            arthexis_user = (
+                User.all_objects.filter(username="arthexis").exclude(pk=user.pk).first()
+            )
             if created:
+                if arthexis_user and user.operate_as_id is None:
+                    user.operate_as = arthexis_user
                 user.set_password("admin")
                 user.save()
             elif not user.check_password("admin"):
                 return None
+            elif arthexis_user and user.operate_as_id is None:
+                user.operate_as = arthexis_user
+                user.save(update_fields=["operate_as"])
             return user
         return super().authenticate(request, username, password, **kwargs)
 
@@ -79,4 +196,3 @@ class LocalhostAdminBackend(ModelBackend):
             return User.all_objects.get(pk=user_id)
         except User.DoesNotExist:
             return None
-