bazaar-contrib-server-access 0.3.0rc1__py3-none-any.whl

bazaar_contrib_server_access/__init__.py

@@ -0,0 +1,71 @@
+"""Sessions and the login page the server's pages and APIs are behind."""
+
+from __future__ import annotations
+
+from contextlib import asynccontextmanager
+lazy import asyncio
+lazy import logging
+lazy import os
+lazy from collections.abc import AsyncIterator
+lazy from importlib.resources import files
+lazy from pathlib import Path
+
+from bazaar_contrib_server import SERVER
+from bazaar_contrib_server_database import SERVER_DB, SERVER_SCHEMA
+from bazaar_contrib_server_migrations import SERVER_MIGRATIONS
+from bazaar_core import Context, Contrib
+from pydantic import BaseModel, ConfigDict, Field
+
+lazy from .accounts import ADMIN, Accounts
+lazy from .login import Login
+lazy from .schema import MODULE
+lazy from .sessions import Sessions, key
+
+__all__ = ["AccessConfig", "access"]
+
+
+class AccessConfig(BaseModel):
+    model_config = ConfigDict(extra="forbid", frozen=True)
+
+    # how long a login lasts before the person is asked again
+    session_minutes: int = Field(default=10, ge=1, strict=True)
+
+
+@asynccontextmanager
+async def _access(ctx: Context, config: AccessConfig) -> AsyncIterator[None]:
+    server = ctx.accept(SERVER)
+    async with ctx.accept(SERVER_SCHEMA).register(MODULE):
+        home = Path(os.environ.get("BCN_HOME") or await asyncio.to_thread(Path.home))
+        sessions = Sessions(await asyncio.to_thread(key, home / ".bcn" / "session.key"))
+        accounts = await Accounts.open(ctx.accept(SERVER_DB))
+        password = await accounts.ensure_admin()
+        if password is not None:
+            # the only time the password exists in the clear; it goes where
+            # whoever started the server is looking
+            logging.getLogger(__name__).warning(
+                "created account %s with password %s; log in and change it",
+                ADMIN,
+                password,
+            )
+        resources = Path(str(files(__name__))) / "resources"
+        async with (
+            server.module(
+                "access", static=resources / "static", locales=resources / "locales"
+            ),
+            server.login(
+                Login(
+                    await server.pages("access", __name__),
+                    sessions,
+                    accounts,
+                    config.session_minutes,
+                )
+            ),
+        ):
+            yield
+
+
+access = Contrib(
+    config=AccessConfig,
+    accepts=[SERVER, SERVER_DB, SERVER_SCHEMA, SERVER_MIGRATIONS],
+    lifespan=_access,
+)

bazaar_contrib_server_access/accounts.py

@@ -0,0 +1,120 @@
+"""The accounts that may log in, read from the server's database."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+lazy from time import time_ns
+lazy from typing import cast
+lazy from uuid import uuid7
+
+lazy from bazaar_contrib_storage import (
+    Column,
+    Compare,
+    Database,
+    Insert,
+    Record,
+    Select,
+    Value,
+)
+
+from .secrets import derive, hash_secret, new_secret, verify_secret
+
+# the account made at first start; on its own, the only one there is
+ADMIN = "admin"
+# base64url of this many bytes: long enough that printing it once is safe
+_PASSWORD_BYTES = 24
+
+
+@dataclass(frozen=True, slots=True)
+class Stored:
+    id: str
+    name: str
+    password_hash: str
+    language: str | None
+    theme: str | None
+    auth_type: str
+    session_version: int
+
+    @property
+    def admin(self) -> bool:
+        return self.name == ADMIN and self.auth_type == "local"
+
+
+def _stored(row: Record) -> Stored:
+    return Stored(
+        id=cast(str, row["id"]),
+        name=cast(str, row["name"]),
+        password_hash=cast(str, row["password_hash"]),
+        language=cast(str | None, row["language"]),
+        theme=cast(str | None, row["theme"]),
+        auth_type=cast(str, row["auth_type"]),
+        session_version=cast(int, row["session_version"]),
+    )
+
+
+class Accounts:
+    def __init__(self, database: Database, nobody: str) -> None:
+        self._database = database
+        # a hash nobody's password matches, verified for names nobody has
+        self._nobody = nobody
+
+    @classmethod
+    async def open(cls, database: Database) -> Accounts:
+        return cls(database, await derive(hash_secret, new_secret()))
+
+    async def get(self, account_id: str) -> Stored | None:
+        return await self._one("id", account_id)
+
+    async def named(self, name: str) -> Stored | None:
+        return await self._one("name", name)
+
+    async def ensure_admin(self) -> str | None:
+        """The password the admin was just given, when it is new; it is shown
+        once and never kept in the clear."""
+        if await self.named(ADMIN) is not None:
+            return None
+        password = new_secret(_PASSWORD_BYTES)
+        password_hash = await derive(hash_secret, password)
+        await self._database.write(
+            lambda session: session.insert(
+                Insert(
+                    table="accounts",
+                    rows=(
+                        {
+                            "id": str(uuid7()),
+                            "name": ADMIN,
+                            "password_hash": password_hash,
+                            "created_at_ms": time_ns() // 1_000_000,
+                        },
+                    ),
+                )
+            )
+        )
+        return password
+
+    async def verify(self, name: str, password: str) -> Stored | None:
+        account = await self.named(name)
+        # an unknown name costs the same as a wrong password, so neither can
+        # be told apart by timing
+        stored = (
+            self._nobody
+            if account is None or account.auth_type != "local"
+            else account.password_hash
+        )
+        if not await derive(verify_secret, password, stored):
+            return None
+        return account
+
+    async def _one(self, column: str, value: str) -> Stored | None:
+        rows = await self._database.read(
+            lambda session: session.select(
+                Select(
+                    table="accounts",
+                    where=Compare(
+                        left=Column(name=column), operator="=", right=Value(value=value)
+                    ),
+                    limit=1,
+                )
+            )
+        )
+        return _stored(rows[0]) if rows else None

bazaar_contrib_server_access/login.py

@@ -0,0 +1,118 @@
+"""Logging in and out, and who each request behind the login is from."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+lazy from bazaar_contrib_server import Pages
+lazy from pydantic import BaseModel, ValidationError
+lazy from starlette.requests import HTTPConnection, Request
+lazy from starlette.responses import RedirectResponse, Response
+lazy from starlette.routing import Route
+lazy from starlette.types import ASGIApp
+
+lazy from .accounts import Accounts
+lazy from .sessions import COOKIE, Sessions
+
+LOGIN = "/login/"
+HOME = "/"
+# the hint OIDC leaves for signing in again without being asked
+REAUTH = "bcs_reauth"
+
+
+@dataclass(frozen=True, slots=True)
+class Viewer:
+    """An account as the server's pages see it."""
+
+    id: str
+    name: str
+    theme: str | None
+    language: str | None
+    admin: bool
+
+    def allows(self, point: str) -> bool:
+        del point
+        return self.admin
+
+
+class _Credentials(BaseModel):
+    name: str
+    password: str
+
+
+class Login:
+    """The login module the server's pages and APIs are behind."""
+
+    def __init__(
+        self, pages: Pages, sessions: Sessions, accounts: Accounts, minutes: int
+    ) -> None:
+        self._pages = pages
+        self._sessions = sessions
+        self._accounts = accounts
+        self._minutes = minutes
+        self.app: ASGIApp = pages.application(
+            [
+                Route("/", self._form),
+                Route("/", self._login, methods=["POST"]),
+                Route("/logout", self._logout, methods=["POST"]),
+            ]
+        )
+
+    async def account(self, connection: HTTPConnection) -> Viewer | Response:
+        claim = self._sessions.read(connection.cookies.get(COOKIE))
+        stored = None if claim is None else await self._accounts.get(claim.account_id)
+        if (
+            claim is None
+            or stored is None
+            or claim.session_version != stored.session_version
+        ):
+            # htmx cannot follow a redirect into another page; it is told to go
+            if connection.headers.get("HX-Request") == "true":
+                return Response(status_code=401, headers={"HX-Redirect": LOGIN})
+            return RedirectResponse(LOGIN, status_code=303)
+        return Viewer(
+            id=stored.id,
+            name=stored.name,
+            theme=stored.theme,
+            language=stored.language,
+            admin=stored.admin,
+        )
+
+    async def _form(self, request: Request) -> Response:
+        return await self._pages.render(request, "access/login.html", failed=False)
+
+    async def _login(self, request: Request) -> Response:
+        try:
+            given = _Credentials.model_validate(dict(await request.form()))
+        except ValidationError:
+            given = None
+        stored = (
+            None
+            if given is None
+            else await self._accounts.verify(given.name.strip(), given.password)
+        )
+        if stored is None:
+            # a failed login is a fragment too: htmx swaps it into the form
+            return await self._pages.render(
+                request, "access/login_form.html", status_code=401, failed=True
+            )
+        response = Response(status_code=204, headers={"HX-Redirect": HOME})
+        response.delete_cookie(REAUTH, path="/")
+        response.set_cookie(
+            COOKIE,
+            self._sessions.issue(stored.id, stored.session_version, self._minutes),
+            max_age=self._minutes * 60,
+            path="/",
+            httponly=True,
+            samesite="lax",
+            # a cookie issued over https never travels over plain http
+            secure=request.url.scheme == "https",
+        )
+        return response
+
+    async def _logout(self, request: Request) -> Response:
+        del request
+        response = Response(status_code=204, headers={"HX-Redirect": LOGIN})
+        response.delete_cookie(COOKIE, path="/")
+        response.delete_cookie(REAUTH, path="/")
+        return response

bazaar_contrib_server_access/resources/locales/en.toml

@@ -0,0 +1,8 @@
+"access.login.title" = "Log in"
+"access.login.welcome" = "Welcome back. Choose a way into the bazaar."
+"access.login.name" = "Account"
+"access.login.password" = "Password"
+"access.login.submit" = "Log in"
+"access.login.failed" = "Incorrect account or password."
+"access.login.slogan" = "Don't build alone —<br>bring your <span>agents</span> to the bazaar."
+"access.login.tagline" = "Bring your own agents to the bazaar, and build with your teams in the open."

bazaar_contrib_server_access/resources/locales/zh-CN.toml

@@ -0,0 +1,8 @@
+"access.login.title" = "登录"
+"access.login.welcome" = "欢迎回来。选择一种方式进入集市。"
+"access.login.name" = "账号"
+"access.login.password" = "密码"
+"access.login.submit" = "登录"
+"access.login.failed" = "账号或密码不正确。"
+"access.login.slogan" = "不必独自建造——<br>带上你的<span>智能体</span>，来集市。"
+"access.login.tagline" = "Bring your own agents to the bazaar, and build with your teams in the open."

bazaar_contrib_server_access/resources/static/access.css

@@ -0,0 +1,98 @@
+/* The login page: the market street beside the form on a wide screen, below
+   it on a narrow one. Every colour is the theme's; the street's come from its
+   scene tokens, mixed for shade and light, never graded. */
+
+html, body { height: 100%; }
+body { background: var(--bg); }
+.login { display: grid; grid-template-columns: 1fr 600px; min-height: 100vh; min-height: 100dvh; }
+
+.art { position: relative; overflow: hidden; background: var(--scene-sky); }
+.art svg.street-art { position: absolute; inset: 0; width: 100%; height: 100%; }
+.copy { position: absolute; z-index: 1; }
+.art .copy { left: 72px; top: 300px; right: 72px; }
+.copy .eyebrow { font: 700 12px var(--font-ui); letter-spacing: .32em; color: var(--saffron); }
+.copy h1, .copy h2 { margin: 18px 0 0; font-family: var(--font-display); font-weight: 900; font-size: 52px; line-height: 1.22; color: var(--text); letter-spacing: .02em; }
+.copy h1 span, .copy h2 span { color: var(--saffron); }
+.copy p { margin: 20px 0 0; font: italic 400 19px/1.5 var(--font-display); color: var(--text-2); font-variation-settings: "opsz" 24, "SOFT" 80; max-width: 520px; }
+
+.panel { background: var(--surface); border-left: 1px solid var(--line); display: flex; flex-direction: column; padding: 40px 72px 28px; }
+.brand { display: flex; align-items: center; gap: 10px; }
+.brand .mark { width: 30px; height: 30px; }
+.brand .word { font-family: var(--font-display); font-weight: 650; font-size: 21px; letter-spacing: -.01em; font-variation-settings: "opsz" 72, "SOFT" 60; }
+.panel h2 { margin: 54px 0 6px; font-family: var(--font-display); font-size: 32px; font-weight: 650; letter-spacing: -.01em; }
+.panel .sub { color: var(--muted); font-size: 14px; }
+
+/* the form: labels above, quiet fields, one flat amber button */
+.signin { display: grid; gap: 18px; margin-top: 30px; }
+.fld { display: grid; gap: 8px; }
+.fld label { font-size: 13px; font-weight: 500; color: var(--text-2); }
+.fld input { height: 46px; padding: 0 14px; border-radius: 10px; border: 1px solid var(--line-soft); background: var(--sunken); color: var(--text); font: 15px var(--font-ui); outline: 0; }
+.fld input:focus { border-color: var(--saffron-line); box-shadow: 0 0 0 3px var(--saffron-soft); }
+.fld input[type="password"] { letter-spacing: .14em; }
+.err { display: flex; align-items: center; gap: 7px; margin: 0; color: var(--crimson); font-size: 13px; }
+.err .i svg { width: 14px; height: 14px; }
+.go { margin-top: 6px; height: 46px; border: 0; border-radius: 10px; font: 600 15px var(--font-ui); background: var(--saffron); color: var(--saffron-ink); box-shadow: inset 0 1px 0 rgba(255, 255, 255, .22), inset 0 -1px 0 rgba(0, 0, 0, .14); }
+
+.band { display: none; }
+
+/* narrow screens: the form first, the street under a downward arc */
+@media (max-width: 959px) {
+  .login { grid-template-columns: 1fr; grid-template-rows: auto 1fr; }
+  .art { display: none; }
+  .panel { border-left: 0; padding: 26px 22px 10px; }
+  .panel h2 { margin: 18px 0 4px; font-size: 26px; }
+  .panel .sub { font-size: 13.5px; }
+  .signin { gap: 14px; margin-top: 20px; }
+  .fld input { font-size: 16px; }
+  .band { display: block; position: relative; min-height: 270px; overflow: hidden; background: var(--scene-sky); }
+  .band svg.street-top { position: absolute; left: 0; top: 0; width: 100%; height: auto; }
+  .band svg.street-bottom { position: absolute; left: 0; bottom: 0; width: 100%; height: auto; }
+  .band .copy { left: 22px; right: 22px; bottom: 178px; }
+  .band .eyebrow { font-size: 11px; letter-spacing: .3em; }
+  .band h2 { margin-top: 10px; font-size: 20px; line-height: 1.3; }
+}
+
+/* the street */
+.s-sky { fill: var(--scene-sky); }
+.s-edge { fill: var(--surface); }
+.s-star { fill: var(--scene-star); }
+.s-moon { fill: var(--scene-moon); }
+.s-bite { fill: var(--scene-bite); }
+.s-far { fill: var(--scene-far); }
+.s-far2 { fill: var(--scene-far-roof); }
+.s-window { fill: var(--scene-window); }
+.s-cord { stroke: var(--scene-cord); stroke-width: 1.4; fill: none; }
+.s-cap { fill: var(--scene-cap); }
+.s-rib { stroke: rgba(0, 0, 0, .2); stroke-width: 1; fill: none; }
+.s-wood { fill: var(--scene-wood); }
+.s-wood-light { fill: var(--scene-wood-light); }
+.s-wood-shade { fill: var(--scene-wood-shade); }
+.s-inside { fill: var(--scene-inside); }
+.s-inside-shade { fill: var(--scene-inside-shade); }
+.s-alt { fill: var(--scene-alt); }
+.s-alt-shade { fill: color-mix(in srgb, var(--scene-alt) 78%, #000); }
+.s-bulb { fill: var(--scene-bulb); }
+.s-ground { fill: var(--scene-ground); }
+.s-ground-light { fill: var(--scene-ground-light); }
+.s-ground-shade { fill: var(--scene-ground-shade); }
+.s-pot { fill: var(--scene-pot); }
+.s-pot-shade { fill: color-mix(in srgb, var(--scene-pot) 70%, #000); }
+.s-steam { stroke: var(--scene-steam); stroke-width: 4; stroke-linecap: round; }
+.f-paper, .f-cap, .f-cord, .f-rib { opacity: var(--scene-far-fade); }
+.s-saffron { fill: var(--saffron); } .s-jade { fill: var(--jade); } .s-crimson { fill: var(--crimson); }
+.s-indigo { fill: var(--indigo); } .s-plum { fill: var(--plum); }
+.s-saffron-shade { fill: color-mix(in srgb, var(--saffron) 70%, #000); }
+.s-jade-shade { fill: color-mix(in srgb, var(--jade) 70%, #000); }
+.s-crimson-shade { fill: color-mix(in srgb, var(--crimson) 70%, #000); }
+.s-indigo-shade { fill: color-mix(in srgb, var(--indigo) 70%, #000); }
+.s-plum-shade { fill: color-mix(in srgb, var(--plum) 70%, #000); }
+.s-saffron-glow { fill: color-mix(in srgb, var(--saffron) 45%, var(--scene-glow)); }
+.s-jade-glow { fill: color-mix(in srgb, var(--jade) 45%, var(--scene-glow)); }
+.s-crimson-glow { fill: color-mix(in srgb, var(--crimson) 45%, var(--scene-glow)); }
+.s-indigo-glow { fill: color-mix(in srgb, var(--indigo) 45%, var(--scene-glow)); }
+.s-plum-glow { fill: color-mix(in srgb, var(--plum) 45%, var(--scene-glow)); }
+.s-saffron-dim { fill: color-mix(in srgb, var(--saffron) 60%, var(--scene-inside)); }
+.s-jade-dim { fill: color-mix(in srgb, var(--jade) 60%, var(--scene-inside)); }
+.s-crimson-dim { fill: color-mix(in srgb, var(--crimson) 60%, var(--scene-inside)); }
+.s-indigo-dim { fill: color-mix(in srgb, var(--indigo) 60%, var(--scene-inside)); }
+.s-plum-dim { fill: color-mix(in srgb, var(--plum) 60%, var(--scene-inside)); }

bazaar_contrib_server_access/resources/templates/access/login.html

@@ -0,0 +1,17 @@
+{% extends "server/base.html" %}
+{# the login page fills the window, whatever frame it was asked for in #}
+{% block root %} data-top{% endblock %}
+{% block title %}{{ t.text("access.login.title") }}{% endblock %}
+{% block head %}<link rel="stylesheet" href="{{ asset('access.css') }}">{% endblock %}
+{% block body %}
+<div class="login">
+{% include "access/street.html" %}
+  <div class="panel">
+    <div class="brand">{% include "server/mark.svg" %}<span class="word">Bazaar</span></div>
+    <h2>{{ t.text("access.login.title") }}</h2>
+    <div class="sub">{{ t.text("access.login.welcome") }}</div>
+    {% include "access/login_form.html" %}
+  </div>
+{% include "access/street_phone.html" %}
+</div>
+{% endblock %}

bazaar_contrib_server_access/resources/templates/access/login_form.html

@@ -0,0 +1,6 @@
+<form class="signin" hx-post="/login/" hx-target="this" hx-swap="outerHTML">
+  <div class="fld"><label for="name">{{ t.text("access.login.name") }}</label><input id="name" name="name" required autocomplete="username" spellcheck="false" autocapitalize="off"></div>
+  <div class="fld"><label for="password">{{ t.text("access.login.password") }}</label><input id="password" name="password" type="password" required autocomplete="current-password"></div>
+  {% if failed %}<p class="err" role="alert"><span class="i">{% include "access/triangle-alert.svg" %}</span>{{ t.text("access.login.failed") }}</p>{% endif %}
+  <button class="go" type="submit">{{ t.text("access.login.submit") }}</button>
+</form>