PyPI - better-rtplot - Versions diffs - 0.4.2__tar.gz → 0.4.3__tar.gz - Mend

better-rtplot 0.4.2tar.gz → 0.4.3tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (13) hide show

{better_rtplot-0.4.2 → better_rtplot-0.4.3}/PKG-INFO RENAMED Viewed

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: better-rtplot
-Version: 0.4.2
+Version: 0.4.3
 Summary:
 License: GPL V3.0
 Author: jmontp

{better_rtplot-0.4.2 → better_rtplot-0.4.3}/pyproject.toml RENAMED Viewed

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "better-rtplot"
-version = "0.4.2"
+version = "0.4.3"
 description = ""
 authors = ["jmontp <jmontp@umich.edu>"]
 license = "GPL V3.0"

{better_rtplot-0.4.2 → better_rtplot-0.4.3}/rtplot/server_browser.py RENAMED Viewed

@@ -160,12 +160,26 @@ parser.add_argument(
     default=1000,
 )
+parser.add_argument(
+    "--password",
+    help=(
+        "Gate the whole UI behind a shared password (HTTP Basic). Any"
+        " username is accepted. Can also be set via RTPLOT_PASSWORD env"
+        " var; the flag wins if both are given. Leave unset to serve"
+        " without auth."
+    ),
+    action="store",
+    type=str,
+    default=None,
+)
 args = parser.parse_args()
 NEW_SUBPLOT_IN_ROW = args.column
 DEBUG_TEXT_ENABLED = args.debug
 SKIP_PLOT_DATAPOINTS = args.skip
 ADAPT_SKIP_PLOT_DATAPOINTS = args.adaptable
+AUTH_PASSWORD = args.password if args.password is not None else os.environ.get("RTPLOT_PASSWORD")
 ###############################
@@ -1310,9 +1324,140 @@ async def on_cleanup(app):
     zmq_ctx.term()
+###############################
+# Cookie-based password auth #
+###############################
+# A single shared password unlocks the UI for every browser. We deliberately
+# don't model users: the browser's native Basic-Auth popup forces a username
+# field, which was confusing — one password is enough for LAN deployments.
+# On successful POST /login, the server mints a random session token, stashes
+# it in an in-memory set, and drops it as an HttpOnly cookie. All other
+# routes (including the WebSocket upgrade) require that cookie.
+import hmac as _hmac
+import secrets as _secrets
+SESSION_COOKIE = "rtplot_session"
+_AUTH_REQUIRED = AUTH_PASSWORD is not None
+_AUTH_EXPECTED = AUTH_PASSWORD.encode("utf-8") if AUTH_PASSWORD else None
+_valid_tokens: set = set()
+_LOGIN_HTML = """<!doctype html>
+<html lang=\"en\">
+<head>
+<meta charset=\"utf-8\" />
+<title>rtplot \u2014 sign in</title>
+<style>
+  html, body { margin: 0; padding: 0; min-height: 100%; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; background: #eef1f5; color: #222; }
+  body { display: flex; align-items: center; justify-content: center; min-height: 100vh; }
+  form { background: #fff; border: 1px solid #d2d8e0; border-radius: 8px; padding: 28px 32px; box-shadow: 0 6px 24px rgba(30,40,60,0.08); width: 320px; }
+  h1 { margin: 0 0 6px 0; font-size: 20px; color: #1d3566; }
+  p { margin: 0 0 18px 0; color: #666; font-size: 13px; }
+  label { display: block; font-size: 12px; color: #555; margin-bottom: 6px; }
+  input[type=password] { width: 100%; box-sizing: border-box; padding: 9px 10px; font-size: 14px; border: 1px solid #bfc7d2; border-radius: 4px; font-family: inherit; }
+  input[type=password]:focus { outline: none; border-color: #2a5db0; box-shadow: 0 0 0 2px rgba(42,93,176,0.15); }
+  button { margin-top: 14px; width: 100%; padding: 10px; font-size: 14px; border: none; border-radius: 4px; background: #2a5db0; color: #fff; cursor: pointer; font-weight: 600; }
+  button:hover { background: #244f95; }
+  .err { background: #fce8e8; color: #a11; border: 1px solid #f0c2c2; padding: 8px 10px; border-radius: 4px; font-size: 13px; margin-bottom: 14px; }
+</style>
+</head>
+<body>
+<form method=\"post\" action=\"/login\" autocomplete=\"on\">
+  <h1>rtplot</h1>
+  <p>Enter the shared password to continue.</p>
+  __ERROR_BLOCK__
+  <label for=\"pw\">Password</label>
+  <input id=\"pw\" type=\"password\" name=\"password\" autofocus required />
+  <button type=\"submit\">Sign in</button>
+</form>
+</body>
+</html>
+"""
+def _render_login_page(error: bool = False) -> str:
+    err = '<div class="err">Wrong password. Try again.</div>' if error else ""
+    return _LOGIN_HTML.replace("__ERROR_BLOCK__", err)
+def _has_valid_session(request) -> bool:
+    tok = request.cookies.get(SESSION_COOKIE)
+    return bool(tok) and tok in _valid_tokens
+async def handle_login(request):
+    # GET  /login  -> render form
+    # POST /login  -> check password, set cookie on success
+    if request.method == "GET":
+        if _has_valid_session(request):
+            raise web.HTTPFound("/")
+        return web.Response(
+            text=_render_login_page(),
+            content_type="text/html",
+            headers={"Cache-Control": "no-store"},
+        )
+    if not _AUTH_REQUIRED:
+        raise web.HTTPFound("/")
+    data = await request.post()
+    supplied = (data.get("password") or "").encode("utf-8")
+    if _hmac.compare_digest(supplied, _AUTH_EXPECTED or b""):
+        token = _secrets.token_urlsafe(32)
+        _valid_tokens.add(token)
+        resp = web.HTTPFound("/")
+        resp.set_cookie(
+            SESSION_COOKIE,
+            token,
+            httponly=True,
+            samesite="Lax",
+            max_age=30 * 24 * 3600,  # 30 days
+            path="/",
+        )
+        raise resp
+    return web.Response(
+        text=_render_login_page(error=True),
+        content_type="text/html",
+        status=401,
+        headers={"Cache-Control": "no-store"},
+    )
+async def handle_logout(request):
+    tok = request.cookies.get(SESSION_COOKIE)
+    if tok:
+        _valid_tokens.discard(tok)
+    resp = web.HTTPFound("/login")
+    resp.del_cookie(SESSION_COOKIE, path="/")
+    raise resp
+@web.middleware
+async def session_auth_middleware(request, handler):
+    if not _AUTH_REQUIRED:
+        return await handler(request)
+    path = request.path
+    # Login page and its form post must stay open; the uPlot assets that
+    # the main page pulls in are gated too, which is consistent with the
+    # rest of the UI.
+    if path == "/login" or path == "/logout":
+        return await handler(request)
+    if _has_valid_session(request):
+        return await handler(request)
+    # WebSocket upgrade can't follow a redirect — respond with 401 so the
+    # browser-side reconnect loop surfaces a clear error.
+    if path == "/ws":
+        return web.Response(status=401, text="Not signed in.\n")
+    raise web.HTTPFound("/login")
 def build_app():
-    app = web.Application()
+    middlewares = [session_auth_middleware] if _AUTH_REQUIRED else []
+    app = web.Application(middlewares=middlewares)
     app.router.add_get("/", handle_index)
+    app.router.add_get("/login", handle_login)
+    app.router.add_post("/login", handle_login)
+    app.router.add_get("/logout", handle_logout)
     app.router.add_get("/ws", handle_ws)
     app.router.add_get("/snapshot.html", handle_snapshot)
     static_dir = os.path.join(os.path.dirname(os.path.abspath(__file__)), "static")
@@ -1341,6 +1486,10 @@ def _detect_lan_ips():
 def main():
     app = build_app()
     print(f"rtplot browser server listening on http://localhost:{args.port}")
+    if _AUTH_REQUIRED:
+        print("  auth: shared password required (browsers see a login page)")
+    else:
+        print("  auth: none (set --password or RTPLOT_PASSWORD to gate the UI)")
     for ip in _detect_lan_ips():
         print(f"  also reachable at  http://{ip}:{args.port}")
     is_wsl = "WSL_DISTRO_NAME" in os.environ or "WSL_INTEROP" in os.environ

{better_rtplot-0.4.2 → better_rtplot-0.4.3}/rtplot/server_browser_gui.py RENAMED Viewed

@@ -68,6 +68,10 @@ def _settings_path():
 DEFAULT_SETTINGS = {
     # Most recent demo-sender targets, newest first, capped at 8.
     "recent_hosts": [],
+    # Optional shared password that gates the browser UI. Empty string
+    # means "no auth". Stored in plaintext alongside the exe — the
+    # threat model is LAN convenience, not cryptographic secrecy.
+    "password": "",
 }
 MAX_RECENT_HOSTS = 8
@@ -222,10 +226,31 @@ def _parse_wrapper_args(argv):
             "machine that only has the exe (no Python install)."
         ),
     )
+    parser.add_argument(
+        "--password",
+        default=None,
+        help=(
+            "Gate the UI behind a shared password (HTTP login page). "
+            "Overrides the password saved by the GUI's settings file. "
+            "Leave unset to use the saved password (or no auth if none "
+            "has been set)."
+        ),
+    )
     args, rest = parser.parse_known_args(argv)
     return args, rest
+def _resolve_password(args) -> str:
+    """Return the effective password: CLI flag wins, else saved setting.
+    Empty string means "no auth"; anything else gates the UI.
+    """
+    if args.password is not None:
+        return args.password
+    settings = _load_settings()
+    return settings.get("password", "") or ""
 def _run_headless(args, rest):
     """Delegate straight to rtplot.server_browser's __main__."""
     import runpy
@@ -233,6 +258,9 @@ def _run_headless(args, rest):
     forwarded = [sys.argv[0], "--port", str(args.port), "--host", args.host]
     if args.pi_ip:
         forwarded += ["-p", args.pi_ip]
+    pw = _resolve_password(args)
+    if pw:
+        forwarded += ["--password", pw]
     forwarded += rest
     sys.argv = forwarded
     runpy.run_module("rtplot.server_browser", run_name="__main__")
@@ -397,6 +425,11 @@ def _run_with_gui(args, rest):
     settings = _load_settings()
+    # Password resolution order: CLI flag > saved setting > none. Whatever
+    # wins is forwarded to server_browser via --password so the server's
+    # auth middleware picks it up at import time.
+    effective_password = _resolve_password(args)
     # Seed sys.argv so server_browser's module-level argparse sees what we
     # want. --no-browser is always forced in GUI mode because the window
     # has its own "Open in browser" button.
@@ -410,6 +443,8 @@ def _run_with_gui(args, rest):
     ]
     if args.pi_ip:
         forwarded += ["-p", args.pi_ip]
+    if effective_password:
+        forwarded += ["--password", effective_password]
     forwarded += rest
     sys.argv = forwarded
@@ -590,6 +625,13 @@ def _run_with_gui(args, rest):
         style="Subhead.TLabel",
     ).pack(anchor="w", pady=(4, 10))
+    if effective_password:
+        ttk.Label(
+            main,
+            text="\U0001F512  Password protection is on \u2014 viewers need the shared password.",
+            style="Muted.TLabel",
+        ).pack(anchor="w", pady=(0, 8))
     # ---- Big URL display (clickable, copy-able) ----
     url = f"http://localhost:{args.port}"
     url_var = tk.StringVar(value=url)
@@ -855,6 +897,124 @@ def _run_with_gui(args, rest):
     poll_demo_stats()
+    # --- Access control sub-section ---
+    ttk.Separator(advanced_frame, orient="horizontal").pack(fill="x", pady=(14, 10))
+    ttk.Label(
+        advanced_frame, text="Access control", style="Section.TLabel"
+    ).pack(anchor="w")
+    ttk.Label(
+        advanced_frame,
+        text=(
+            "Set a shared password so the browser UI asks anyone on the\n"
+            "network to sign in before they can see your plots."
+        ),
+        style="Help.TLabel",
+    ).pack(anchor="w", pady=(2, 6))
+    pw_state_var = tk.StringVar()
+    pw_restart_note_var = tk.StringVar(value="")
+    def _refresh_pw_state():
+        if effective_password:
+            pw_state_var.set("\U0001F512  Password is set")
+        else:
+            pw_state_var.set("No password (UI is open to anyone who can reach it)")
+    _refresh_pw_state()
+    ttk.Label(advanced_frame, textvariable=pw_state_var, style="Muted.TLabel").pack(
+        anchor="w"
+    )
+    def _open_password_dialog():
+        dlg = tk.Toplevel(root)
+        dlg.title("Set password")
+        dlg.transient(root)
+        dlg.grab_set()
+        dlg.resizable(False, False)
+        try:
+            dlg.configure(bg=BG)
+        except tk.TclError:
+            pass
+        body = ttk.Frame(dlg, padding=18)
+        body.pack(fill="both", expand=True)
+        ttk.Label(
+            body,
+            text="Shared password",
+            style="Section.TLabel",
+        ).pack(anchor="w")
+        ttk.Label(
+            body,
+            text=(
+                "Everyone who opens the rtplot page will be asked for this\n"
+                "password. Leave blank + Save to remove password protection."
+            ),
+            style="Help.TLabel",
+        ).pack(anchor="w", pady=(2, 8))
+        pw_var = tk.StringVar(value=settings.get("password", ""))
+        show_var = tk.BooleanVar(value=False)
+        entry = ttk.Entry(body, textvariable=pw_var, show="\u2022", width=32)
+        entry.pack(anchor="w", fill="x")
+        entry.focus_set()
+        def _toggle_show():
+            entry.configure(show="" if show_var.get() else "\u2022")
+        ttk.Checkbutton(
+            body, text="Show password", variable=show_var, command=_toggle_show
+        ).pack(anchor="w", pady=(6, 10))
+        err_var = tk.StringVar(value="")
+        ttk.Label(body, textvariable=err_var, foreground="#a11", background=BG).pack(
+            anchor="w"
+        )
+        def _save_and_close():
+            new_pw = pw_var.get()
+            settings["password"] = new_pw
+            _save_settings(settings)
+            if new_pw == effective_password:
+                pw_restart_note_var.set("Password unchanged.")
+            else:
+                pw_restart_note_var.set(
+                    "Saved. Close and reopen rtplot-server.exe to apply."
+                )
+            _refresh_pw_state()
+            dlg.destroy()
+        def _cancel():
+            dlg.destroy()
+        btn_row = ttk.Frame(body)
+        btn_row.pack(fill="x", pady=(10, 0))
+        ttk.Button(btn_row, text="Save", command=_save_and_close).pack(side="right")
+        ttk.Button(btn_row, text="Cancel", command=_cancel).pack(
+            side="right", padx=(0, 6)
+        )
+        # Enter saves, Escape cancels — matches typical form UX.
+        dlg.bind("<Return>", lambda _e: _save_and_close())
+        dlg.bind("<Escape>", lambda _e: _cancel())
+        # Center over the main window.
+        dlg.update_idletasks()
+        rx, ry = root.winfo_rootx(), root.winfo_rooty()
+        rw, rh = root.winfo_width(), root.winfo_height()
+        dw, dh = dlg.winfo_reqwidth(), dlg.winfo_reqheight()
+        dlg.geometry(f"+{rx + (rw - dw) // 2}+{ry + (rh - dh) // 2}")
+    pw_btn_row = ttk.Frame(advanced_frame)
+    pw_btn_row.pack(anchor="w", pady=(6, 0))
+    ttk.Button(
+        pw_btn_row,
+        text=("Change password" if effective_password else "Set password"),
+        command=_open_password_dialog,
+    ).pack(side="left")
+    ttk.Label(
+        pw_btn_row, textvariable=pw_restart_note_var, style="Muted.TLabel"
+    ).pack(side="left", padx=(8, 0))
     # --- Log sub-section (further collapsable inside advanced) ---
     ttk.Separator(advanced_frame, orient="horizontal").pack(fill="x", pady=(14, 10))
     log_state = {"expanded": False}