dashtro 0.1.0__py3-none-any.whl

cms_backend/api/utils/__init__.py

@@ -0,0 +1,49 @@
+from decouple import config
+
+from .audit_client import SqliteAuditClient
+from .postgres_audit_client import PostgresAuditClient
+from .postgres_client import PostgresAuth, PostgresData
+from .sqlite_client import SqliteAuth, SqliteData
+
+# mongodb is not yet migrated to the FastAPI data API, so it stays unsupported.
+_DB_TYPE = config("DB_TYPE", default="sqlite")
+_SUPPORTED_DB_TYPES = ("sqlite", "postgres")
+
+
+def get_data_client():
+    if _DB_TYPE == "postgres":
+        return PostgresData()
+    if _DB_TYPE == "sqlite":
+        return SqliteData()
+    raise NotImplementedError(
+        f"DB_TYPE={_DB_TYPE!r} is not supported yet; use one of {_SUPPORTED_DB_TYPES}"
+    )
+
+
+def get_auth_client():
+    if _DB_TYPE == "postgres":
+        return PostgresAuth()
+    if _DB_TYPE == "sqlite":
+        return SqliteAuth()
+    raise NotImplementedError(
+        f"DB_TYPE={_DB_TYPE!r} is not supported yet; use one of {_SUPPORTED_DB_TYPES}"
+    )
+
+
+def get_audit_client() -> SqliteAuditClient | PostgresAuditClient:
+    if _DB_TYPE == "postgres":
+        return PostgresAuditClient()
+    return SqliteAuditClient()
+
+
+__all__ = [
+    "SqliteData",
+    "SqliteAuth",
+    "SqliteAuditClient",
+    "PostgresData",
+    "PostgresAuth",
+    "PostgresAuditClient",
+    "get_data_client",
+    "get_auth_client",
+    "get_audit_client",
+]

cms_backend/api/utils/actor.py

@@ -0,0 +1,11 @@
+def get_actor(request) -> dict:
+    """Return the actor verified by CMSAuthMiddleware for this request."""
+    return request.state.actor
+
+
+def get_client_ip(request) -> str:
+    """Extract the real client IP from a FastAPI Request."""
+    forwarded_for = request.headers.get("x-forwarded-for")
+    if forwarded_for:
+        return forwarded_for.split(",")[0].strip()
+    return request.client.host if request.client else ""

cms_backend/api/utils/api_key_auth.py

@@ -0,0 +1,31 @@
+from fastapi import Header, HTTPException
+
+
+def require_api_key(operation: str):
+    """Dependency factory: verifies X-API-Key and that it carries `operation` ('read'/'write')."""
+
+    def _dependency(x_api_key: str = Header(default=None)) -> dict:
+        if not x_api_key:
+            raise HTTPException(status_code=401, detail="X-API-Key header missing")
+        from api.utils import get_auth_client
+
+        db_auth = get_auth_client()
+        key_info = db_auth.verify_api_key(x_api_key)
+        if not key_info:
+            raise HTTPException(status_code=401, detail="Invalid or revoked API key")
+        if operation not in (key_info.get("scopes") or []):
+            raise HTTPException(
+                status_code=403, detail=f"API key does not have '{operation}' access"
+            )
+        return key_info
+
+    return _dependency
+
+
+def check_key_scope(key_info: dict, project_id: str, collection_name: str):
+    """Raises 403 if the key is scoped to a different project or collection set."""
+    if key_info.get("project_id") and key_info["project_id"] != project_id:
+        raise HTTPException(status_code=403, detail="API key is not scoped to this project")
+    collections = key_info.get("collections") or []
+    if collections and collection_name not in collections:
+        raise HTTPException(status_code=403, detail="API key is not scoped to this collection")

cms_backend/api/utils/audit_client.py

@@ -0,0 +1,237 @@
+import json
+import sqlite3
+import threading
+import uuid
+from datetime import UTC, datetime
+
+from decouple import config
+
+
+class SqliteAuditClient:
+    _instance = None
+
+    def __new__(cls, *args, **kwargs):
+        if not cls._instance:
+            cls._instance = super().__new__(cls)
+            cls._instance._local = threading.local()
+            cls._instance._ensure_table()
+        return cls._instance
+
+    @staticmethod
+    def _create_connection():
+        db_path = config("SQLITE_DB_PATH", default="db.sqlite3")
+        conn = sqlite3.connect(db_path, check_same_thread=False)
+        conn.row_factory = sqlite3.Row
+        return conn
+
+    @property
+    def connection(self):
+        local = self._local
+        if not hasattr(local, "conn") or local.conn is None:
+            local.conn = self._create_connection()
+        return local.conn
+
+    @connection.setter
+    def connection(self, value):
+        self._local.conn = value
+
+    def get_cursor(self):
+        try:
+            self.connection.execute("SELECT 1")
+        except (sqlite3.ProgrammingError, sqlite3.InterfaceError):
+            self.connection = self._create_connection()
+        return self.connection.cursor()
+
+    def _ensure_table(self):
+        cursor = self.get_cursor()
+        cursor.execute("""
+            CREATE TABLE IF NOT EXISTS cms_audit_logs (
+                id TEXT PRIMARY KEY,
+                user_id TEXT NOT NULL DEFAULT 'anonymous',
+                user_email TEXT NOT NULL DEFAULT 'anonymous',
+                action TEXT NOT NULL,
+                resource_type TEXT NOT NULL,
+                resource_id TEXT DEFAULT '',
+                resource_name TEXT DEFAULT '',
+                project_id TEXT DEFAULT '',
+                workspace_name TEXT DEFAULT '',
+                details TEXT DEFAULT '{}',
+                ip_address TEXT DEFAULT '',
+                created_at TEXT NOT NULL
+            );
+        """)
+        cursor.execute(
+            "CREATE INDEX IF NOT EXISTS idx_audit_created_at ON cms_audit_logs(created_at DESC);"
+        )
+        cursor.execute("CREATE INDEX IF NOT EXISTS idx_audit_action ON cms_audit_logs(action);")
+        cursor.execute(
+            "CREATE INDEX IF NOT EXISTS idx_audit_resource_type ON cms_audit_logs(resource_type);"
+        )
+        self.connection.commit()
+        cursor.close()
+
+    def log(
+        self,
+        action: str,
+        resource_type: str,
+        user_id: str = "anonymous",
+        user_email: str = "anonymous",
+        resource_id: str = "",
+        resource_name: str = "",
+        project_id: str = "",
+        workspace_name: str = "",
+        details: dict | None = None,
+        ip_address: str = "",
+    ):
+        log_id = str(uuid.uuid4().hex)
+        created_at = datetime.now(tz=UTC).isoformat()
+        details_json = json.dumps(details or {})
+        cursor = self.get_cursor()
+        cursor.execute(
+            """INSERT INTO cms_audit_logs
+               (id, user_id, user_email, action, resource_type, resource_id, resource_name,
+                project_id, workspace_name, details, ip_address, created_at)
+               VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)""",
+            (
+                log_id,
+                user_id,
+                user_email,
+                action,
+                resource_type,
+                resource_id,
+                resource_name,
+                project_id,
+                workspace_name,
+                details_json,
+                ip_address,
+                created_at,
+            ),
+        )
+        self.connection.commit()
+        cursor.close()
+
+    def get_logs(
+        self,
+        action: str | None = None,
+        resource_type: str | None = None,
+        project_id: str | None = None,
+        user_id: str | None = None,
+        from_date: str | None = None,
+        to_date: str | None = None,
+        limit: int = 100,
+        offset: int = 0,
+    ) -> dict:
+        where_clauses = []
+        params = []
+
+        if action:
+            where_clauses.append("action = ?")
+            params.append(action)
+        if resource_type:
+            where_clauses.append("resource_type = ?")
+            params.append(resource_type)
+        if project_id:
+            where_clauses.append("project_id = ?")
+            params.append(project_id)
+        if user_id:
+            where_clauses.append("user_id = ?")
+            params.append(user_id)
+        if from_date:
+            where_clauses.append("created_at >= ?")
+            params.append(from_date)
+        if to_date:
+            where_clauses.append("created_at <= ?")
+            params.append(to_date)
+
+        where_sql = f"WHERE {' AND '.join(where_clauses)}" if where_clauses else ""
+
+        cursor = self.get_cursor()
+        cursor.execute(f"SELECT COUNT(*) FROM cms_audit_logs {where_sql}", params)
+        total = cursor.fetchone()[0]
+
+        cursor.execute(
+            f"SELECT * FROM cms_audit_logs {where_sql} ORDER BY created_at DESC LIMIT ? OFFSET ?",
+            [*params, limit, offset],
+        )
+        rows = cursor.fetchall()
+        cursor.close()
+
+        logs = []
+        for r in rows:
+            logs.append(
+                {
+                    "id": r["id"],
+                    "user_id": r["user_id"],
+                    "user_email": r["user_email"],
+                    "action": r["action"],
+                    "resource_type": r["resource_type"],
+                    "resource_id": r["resource_id"],
+                    "resource_name": r["resource_name"],
+                    "project_id": r["project_id"],
+                    "workspace_name": r["workspace_name"],
+                    "details": json.loads(r["details"] or "{}"),
+                    "ip_address": r["ip_address"],
+                    "created_at": r["created_at"],
+                }
+            )
+
+        return {"total": total, "logs": logs}
+
+    def get_heatmap_data(self, year: int, month: int | None = None) -> list[dict]:
+        """Return per-day operation counts and top action for a year or a single month."""
+        import calendar as cal
+
+        if month:
+            days_in_month = cal.monthrange(year, month)[1]
+            start = f"{year:04d}-{month:02d}-01"
+            end = f"{year:04d}-{month:02d}-{days_in_month:02d}"
+        else:
+            start = f"{year:04d}-01-01"
+            end = f"{year:04d}-12-31"
+
+        cursor = self.get_cursor()
+        cursor.execute(
+            """
+            SELECT date(created_at) AS day, action, COUNT(*) AS cnt
+            FROM cms_audit_logs
+            WHERE date(created_at) BETWEEN ? AND ?
+            GROUP BY day, action
+            ORDER BY day, cnt DESC
+            """,
+            (start, end),
+        )
+        rows = cursor.fetchall()
+        cursor.close()
+
+        # Aggregate: total count per day + top action
+        day_map: dict[str, dict] = {}
+        for r in rows:
+            day = r["day"]
+            if day not in day_map:
+                day_map[day] = {"count": 0, "top_action": r["action"]}
+            day_map[day]["count"] += r["cnt"]
+
+        # Fill in every calendar day (zero counts included)
+        result = []
+        if month:
+            days_in_month = cal.monthrange(year, month)[1]
+            for d in range(1, days_in_month + 1):
+                day_str = f"{year:04d}-{month:02d}-{d:02d}"
+                entry = day_map.get(day_str, {"count": 0, "top_action": None})
+                result.append(
+                    {"date": day_str, "count": entry["count"], "top_action": entry["top_action"]}
+                )
+        else:
+            import datetime
+
+            current = datetime.date(year, 1, 1)
+            end_date = datetime.date(year, 12, 31)
+            while current <= end_date:
+                day_str = current.isoformat()
+                entry = day_map.get(day_str, {"count": 0, "top_action": None})
+                result.append(
+                    {"date": day_str, "count": entry["count"], "top_action": entry["top_action"]}
+                )
+                current += datetime.timedelta(days=1)
+
+        return result

cms_backend/api/utils/mongodb_client.py

@@ -0,0 +1,183 @@
+import hashlib
+import os
+import uuid
+from datetime import UTC, datetime, timedelta
+
+import certifi
+import jwt
+from api.utils.schema import Schema
+from decouple import config
+from pymongo import MongoClient
+
+
+class MongoDBClient:
+    _instance = None
+
+    def __new__(cls, *args, **kwargs):
+        if not cls._instance:
+            cls._instance = super().__new__(cls, *args, **kwargs)
+            mongo_uri = config("MONGO_URI")
+            db_name = config("MONGO_DB_NAME")
+            client = MongoClient(mongo_uri, tlsCAFile=certifi.where())
+            cls._instance.db = client[db_name]
+        return cls._instance
+
+
+class MongoDBAuth(MongoDBClient):
+    def __init__(self):
+        MongoDBClient.__init__(self)
+
+    def create_user(self, email: str, password: str):
+        user_id = str(uuid.uuid4().hex)
+        salt = os.urandom(16).hex()
+        hashed = hashlib.pbkdf2_hmac("sha256", password.encode(), salt.encode(), 260000).hex()
+        self.db["cms_users"].insert_one(
+            {
+                "_id": user_id,
+                "email": email,
+                "password": f"{salt}${hashed}",
+            }
+        )
+        return user_id
+
+    def verify_id_token(self, id_token):
+        secret = config("JWT_SECRET_KEY")
+        try:
+            payload = jwt.decode(id_token, secret, algorithms=["HS256"])
+            return {
+                "uid": payload["uid"],
+                "email": payload["email"],
+                "email_verified": payload.get("email_verified", True),
+            }
+        except jwt.ExpiredSignatureError:
+            raise Exception("Token verification failed: Token has expired") from None
+        except jwt.InvalidTokenError as e:
+            raise Exception(f"Token verification failed: {str(e)}") from e
+
+    def login_user(self, email: str, password: str):
+        user = self.db["cms_users"].find_one({"email": email})
+        stored = user.get("password", "")
+        salt, _, hashed = stored.partition("$")
+        check = hashlib.pbkdf2_hmac("sha256", password.encode(), salt.encode(), 260000).hex()
+        if not user or check != hashed:
+            raise Exception("Login failed: INVALID_CREDENTIALS")
+
+        secret = config("JWT_SECRET_KEY")
+        now = datetime.now(tz=UTC)
+        payload = {
+            "uid": str(user["_id"]),
+            "email": user["email"],
+            "email_verified": True,
+            "exp": now + timedelta(hours=1),
+            "iat": now,
+        }
+        id_token = jwt.encode(payload, secret, algorithm="HS256")
+        refresh_payload = {**payload, "exp": now + timedelta(days=30)}
+        refresh_token = jwt.encode(refresh_payload, secret, algorithm="HS256")
+
+        return {
+            "idToken": id_token,
+            "refreshToken": refresh_token,
+            "localId": str(user["_id"]),
+        }
+
+    def get_admin_token_id(self):
+        admin_email = config("ADMIN_EMAIL")
+        admin_password = config("ADMIN_PASSWORD")
+        return self.login_user(admin_email, admin_password).get("idToken")
+
+
+class MongoDBData(MongoDBClient, Schema):
+    def __init__(self):
+        MongoDBClient.__init__(self)
+        schema_data = list(self.db["cms_schema"].find())
+        schema_collections_data = list(self.db["cms_schema_collections"].find())
+        Schema.__init__(self, schema_data, schema_collections_data)
+
+    def get_schema(self, raw_schema_data: list):
+        return {str(doc["_id"]): doc.get("data", {}) for doc in raw_schema_data}
+
+    async def fetch_document_data(self, workspace_name, collection_id, document_id):
+        doc = self.db["cms_workspace_data"].find_one(
+            {
+                "workspace_name": workspace_name,
+                "collection_id": collection_id,
+                "document_id": document_id,
+            }
+        )
+        return doc["data"] if doc else None
+
+    def set_document_data(self, path, data):
+        parts = path.strip("/").split("/")
+
+        if parts[0] == "_schema" and len(parts) == 2:
+            self.db["cms_schema"].replace_one(
+                {"_id": parts[1]}, {"_id": parts[1], "data": data}, upsert=True
+            )
+        elif parts[0] == "_schema_collections" and len(parts) == 2:
+            self.db["cms_schema_collections"].replace_one(
+                {"_id": parts[1]}, {"_id": parts[1], "data": data}, upsert=True
+            )
+        elif parts[0] == "_workspace" and len(parts) == 4:
+            workspace_name, collection_id, document_id = parts[1], parts[2], parts[3]
+            self.db["cms_workspace_data"].replace_one(
+                {
+                    "workspace_name": workspace_name,
+                    "collection_id": collection_id,
+                    "document_id": document_id,
+                },
+                {
+                    "workspace_name": workspace_name,
+                    "collection_id": collection_id,
+                    "document_id": document_id,
+                    "data": data,
+                },
+                upsert=True,
+            )
+
+    def delete_document_data(self, path):
+        parts = path.strip("/").split("/")
+
+        if parts[0] == "_schema" and len(parts) == 2:
+            self.db["cms_schema"].delete_one({"_id": parts[1]})
+        elif parts[0] == "_schema_collections" and len(parts) == 2:
+            self.db["cms_schema_collections"].delete_one({"_id": parts[1]})
+        elif parts[0] == "_workspace" and len(parts) == 4:
+            workspace_name, collection_id, document_id = parts[1], parts[2], parts[3]
+            self.db["cms_workspace_data"].delete_one(
+                {
+                    "workspace_name": workspace_name,
+                    "collection_id": collection_id,
+                    "document_id": document_id,
+                }
+            )
+
+    def delete_collection_data(self, path):
+        parts = path.strip("/").split("/")
+        if parts[0] != "_workspace" or len(parts) != 3:
+            return
+        workspace_name, collection_id = parts[1], parts[2]
+        self.db["cms_workspace_data"].delete_many(
+            {
+                "workspace_name": workspace_name,
+                "collection_id": collection_id,
+            }
+        )
+
+    @staticmethod
+    def get_realtime_content(path):
+        client = MongoDBClient()
+        doc = client.db["cms_realtime"].find_one({"_id": path})
+        return doc["data"] if doc else None
+
+    @staticmethod
+    def set_realtime_content(path, value):
+        client = MongoDBClient()
+        client.db["cms_realtime"].replace_one(
+            {"_id": path}, {"_id": path, "data": value}, upsert=True
+        )
+
+    @staticmethod
+    def delete_realtime_content(path):
+        client = MongoDBClient()
+        client.db["cms_realtime"].delete_one({"_id": path})