django-cfg 1.4.48__py3-none-any.whl → 1.5.7__py3-none-any.whl

django_cfg/apps/system/dashboard/services/charts_service.py

@@ -0,0 +1,267 @@
+"""
+Charts Service
+
+Provides chart data for dashboard analytics.
+Includes user registration charts, activity charts, and activity tracker.
+"""
+
+import logging
+from datetime import timedelta
+from typing import Any, Dict, List
+
+from django.contrib.auth import get_user_model
+from django.db.models import Count
+from django.db.models.functions import TruncDate
+from django.utils import timezone
+
+logger = logging.getLogger(__name__)
+
+
+class ChartsService:
+    """
+    Service for generating chart data.
+
+    %%PRIORITY:MEDIUM%%
+    %%AI_HINT: Generates time-series data for charts and activity tracking%%
+
+    TAGS: charts, analytics, dashboard, service
+    """
+
+    def __init__(self):
+        """Initialize charts service."""
+        self.logger = logger
+
+    def _get_user_model(self):
+        """Get the user model safely."""
+        return get_user_model()
+
+    def _get_empty_chart_data(self, label: str) -> Dict[str, Any]:
+        """Get empty chart data structure."""
+        return {
+            "labels": ["No Data"],
+            "datasets": [
+                {
+                    "label": label,
+                    "data": [0],
+                    "backgroundColor": "rgba(156, 163, 175, 0.1)",
+                    "borderColor": "rgb(156, 163, 175)",
+                    "tension": 0.4
+                }
+            ]
+        }
+
+    def get_user_registration_chart(self, days: int = 7) -> Dict[str, Any]:
+        """
+        Get user registration chart data for last N days.
+
+        Args:
+            days: Number of days to include in chart (default 7)
+
+        Returns:
+            Chart.js compatible data structure
+
+        %%AI_HINT: Real data aggregated by date from User.date_joined%%
+        """
+        try:
+            User = self._get_user_model()
+
+            # Get date range
+            end_date = timezone.now().date()
+            start_date = end_date - timedelta(days=days - 1)
+
+            # Generate date range
+            date_range = []
+            current_date = start_date
+            while current_date <= end_date:
+                date_range.append(current_date)
+                current_date += timedelta(days=1)
+
+            # Get registration counts by date
+            registration_data = (
+                User.objects.filter(date_joined__date__gte=start_date)
+                .annotate(date=TruncDate('date_joined'))
+                .values('date')
+                .annotate(count=Count('id'))
+                .order_by('date')
+            )
+
+            # Create data dictionary for easy lookup
+            data_dict = {item['date']: item['count'] for item in registration_data}
+
+            # Build chart data
+            labels = [date.strftime("%m/%d") for date in date_range]
+            data_points = [data_dict.get(date, 0) for date in date_range]
+
+            return {
+                "labels": labels,
+                "datasets": [
+                    {
+                        "label": "New Users",
+                        "data": data_points,
+                        "backgroundColor": "rgba(59, 130, 246, 0.1)",
+                        "borderColor": "rgb(59, 130, 246)",
+                        "tension": 0.4,
+                        "fill": True
+                    }
+                ]
+            }
+
+        except Exception as e:
+            self.logger.error(f"Error getting user registration chart: {e}")
+            return self._get_empty_chart_data("New Users")
+
+    def get_user_activity_chart(self, days: int = 7) -> Dict[str, Any]:
+        """
+        Get user activity chart data for last N days.
+
+        Args:
+            days: Number of days to include in chart (default 7)
+
+        Returns:
+            Chart.js compatible data structure
+
+        %%AI_HINT: Real data aggregated by date from User.last_login%%
+        """
+        try:
+            User = self._get_user_model()
+
+            # Get date range
+            end_date = timezone.now().date()
+            start_date = end_date - timedelta(days=days - 1)
+
+            # Generate date range
+            date_range = []
+            current_date = start_date
+            while current_date <= end_date:
+                date_range.append(current_date)
+                current_date += timedelta(days=1)
+
+            # Get login activity (users who logged in each day)
+            activity_data = (
+                User.objects.filter(last_login__date__gte=start_date, last_login__isnull=False)
+                .annotate(date=TruncDate('last_login'))
+                .values('date')
+                .annotate(count=Count('id'))
+                .order_by('date')
+            )
+
+            # Create data dictionary for easy lookup
+            data_dict = {item['date']: item['count'] for item in activity_data}
+
+            # Build chart data
+            labels = [date.strftime("%m/%d") for date in date_range]
+            data_points = [data_dict.get(date, 0) for date in date_range]
+
+            return {
+                "labels": labels,
+                "datasets": [
+                    {
+                        "label": "Active Users",
+                        "data": data_points,
+                        "backgroundColor": "rgba(34, 197, 94, 0.1)",
+                        "borderColor": "rgb(34, 197, 94)",
+                        "tension": 0.4,
+                        "fill": True
+                    }
+                ]
+            }
+
+        except Exception as e:
+            self.logger.error(f"Error getting user activity chart: {e}")
+            return self._get_empty_chart_data("Active Users")
+
+    def get_activity_tracker(self, weeks: int = 52) -> List[Dict[str, Any]]:
+        """
+        Get activity tracker data (GitHub-style contribution graph).
+
+        Args:
+            weeks: Number of weeks to include (default 52)
+
+        Returns:
+            List of day objects with activity levels
+
+        %%AI_HINT: 365 days of activity data for heatmap visualization%%
+        """
+        try:
+            User = self._get_user_model()
+
+            # Get data for specified weeks
+            days = weeks * 7
+            end_date = timezone.now().date()
+            start_date = end_date - timedelta(days=days - 1)
+
+            # Get activity data by date
+            activity_data = (
+                User.objects.filter(last_login__date__gte=start_date, last_login__isnull=False)
+                .annotate(date=TruncDate('last_login'))
+                .values('date')
+                .annotate(count=Count('id'))
+                .order_by('date')
+            )
+
+            # Create data dictionary for easy lookup
+            data_dict = {item['date']: item['count'] for item in activity_data}
+
+            # Generate tracker data for each day
+            tracker_data = []
+            current_date = start_date
+
+            while current_date <= end_date:
+                activity_count = data_dict.get(current_date, 0)
+
+                # Determine level based on activity count
+                if activity_count == 0:
+                    level = 0
+                    color = "#ebedf0"
+                    intensity = "No activity"
+                elif activity_count <= 2:
+                    level = 1
+                    color = "#9be9a8"
+                    intensity = "Low"
+                elif activity_count <= 5:
+                    level = 2
+                    color = "#40c463"
+                    intensity = "Medium"
+                elif activity_count <= 10:
+                    level = 3
+                    color = "#30a14e"
+                    intensity = "High"
+                else:
+                    level = 4
+                    color = "#216e39"
+                    intensity = "Very high"
+
+                tracker_data.append({
+                    "date": current_date.isoformat(),
+                    "count": activity_count,
+                    "level": level,
+                    "color": color,
+                    "tooltip": f"{current_date.strftime('%Y-%m-%d')}: {activity_count} active users ({intensity})"
+                })
+
+                current_date += timedelta(days=1)
+
+            return tracker_data
+
+        except Exception as e:
+            self.logger.error(f"Error getting activity tracker: {e}")
+            return self._get_empty_tracker_data(weeks * 7)
+
+    def _get_empty_tracker_data(self, days: int) -> List[Dict[str, Any]]:
+        """Get empty tracker data."""
+        tracker_data = []
+        end_date = timezone.now().date()
+        start_date = end_date - timedelta(days=days - 1)
+        current_date = start_date
+
+        while current_date <= end_date:
+            tracker_data.append({
+                "date": current_date.isoformat(),
+                "count": 0,
+                "level": 0,
+                "color": "#ebedf0",
+                "tooltip": f"{current_date.strftime('%Y-%m-%d')}: No data"
+            })
+            current_date += timedelta(days=1)
+
+        return tracker_data

django_cfg/apps/system/dashboard/services/commands_security.py

@@ -0,0 +1,228 @@
+"""
+Commands Security Module
+
+Self-contained security logic for Django management commands execution.
+Determines which commands are safe to execute via web interface.
+
+TAGS: commands, security, validation, safety
+"""
+
+import importlib
+import inspect
+import logging
+from typing import Any, Dict, Set
+
+from django.core.management.base import BaseCommand
+
+logger = logging.getLogger(__name__)
+
+
+# Keywords in docstring/code that indicate command should not be in web UI
+DANGEROUS_KEYWORDS: Set[str] = {
+    'questionary', 'input(', 'stdin', 'interactive',  # Requires user input
+    'destructive', 'dangerous', 'irreversible',  # Explicitly marked as dangerous
+    'runserver', 'testserver',  # Dev servers
+}
+
+# Commands that should NEVER appear (absolute blacklist)
+ABSOLUTE_BLACKLIST: Set[str] = {
+    # Destructive database commands
+    'flush', 'sqlflush', 'dbshell',
+
+    # Shell access (security risk)
+    'shell', 'shell_plus',
+
+    # Development server (not for web execution)
+    'runserver', 'testserver', 'runserver_ngrok',
+
+    # Project generation (not applicable in running app)
+    'startapp', 'startproject',
+
+    # SQL commands (direct SQL, potentially dangerous)
+    'sqlmigrate', 'sqlsequencereset',
+}
+
+
+def analyze_command_safety(command_class: BaseCommand, command_name: str) -> Dict[str, Any]:
+    """
+    Analyze command to determine if it's safe for web execution.
+
+    Checks:
+    1. Explicit metadata (web_executable, requires_input, is_destructive)
+    2. Docstring analysis for dangerous keywords
+    3. Source code analysis for interactive input
+    4. Required arguments analysis
+
+    Returns:
+        Dict with safety analysis results
+    """
+    analysis = {
+        'is_safe': True,
+        'reasons': [],
+        'requires_input': False,
+        'is_destructive': False,
+        'web_executable': None,
+    }
+
+    # Check explicit metadata (highest priority)
+    if hasattr(command_class, 'web_executable'):
+        analysis['web_executable'] = command_class.web_executable
+        if not command_class.web_executable:
+            analysis['is_safe'] = False
+            analysis['reasons'].append('Command explicitly marked as not web-executable')
+            return analysis
+
+    if hasattr(command_class, 'requires_input'):
+        analysis['requires_input'] = command_class.requires_input
+        if command_class.requires_input:
+            analysis['is_safe'] = False
+            analysis['reasons'].append('Command requires interactive input')
+            return analysis
+
+    if hasattr(command_class, 'is_destructive'):
+        analysis['is_destructive'] = command_class.is_destructive
+        if command_class.is_destructive:
+            analysis['is_safe'] = False
+            analysis['reasons'].append('Command is marked as destructive')
+            return analysis
+
+    # Analyze docstring for dangerous keywords
+    docstring = (inspect.getdoc(command_class) or '').lower()
+    for keyword in DANGEROUS_KEYWORDS:
+        if keyword in docstring:
+            analysis['is_safe'] = False
+            analysis['reasons'].append(f'Docstring contains dangerous keyword: {keyword}')
+            return analysis
+
+    # Analyze source code for interactive input
+    try:
+        source = inspect.getsource(command_class)
+        if 'questionary' in source or 'input(' in source:
+            analysis['is_safe'] = False
+            analysis['requires_input'] = True
+            analysis['reasons'].append('Command requires interactive user input')
+            return analysis
+    except Exception:
+        # Can't analyze source, be safe
+        pass
+
+    return analysis
+
+
+def is_command_allowed(command_name: str, app_name: str) -> bool:
+    """
+    Check if command should be allowed for web execution.
+
+    Priority:
+    1. Custom blacklist from settings (DJANGO_CFG_COMMANDS_BLACKLIST)
+    2. Absolute blacklist - always exclude
+    3. Custom whitelist from settings (DJANGO_CFG_COMMANDS_WHITELIST)
+    4. Command metadata analysis (web_executable, requires_input, etc.)
+    5. django_cfg apps - analyze each command
+    6. Django core - be selective (only safe utility commands)
+    7. Third party - only if explicitly whitelisted
+
+    You can customize filtering in settings.py:
+
+        DJANGO_CFG_COMMANDS_BLACKLIST = {'my_dangerous_command'}
+        DJANGO_CFG_COMMANDS_WHITELIST = {'my_safe_command'}
+
+    Or add metadata to your Command class:
+
+        class Command(BaseCommand):
+            web_executable = True  # Allow in web UI
+            requires_input = False  # Doesn't need interactive input
+            is_destructive = False  # Not destructive
+    """
+    from django.conf import settings
+
+    # Custom blacklist from settings (highest priority)
+    custom_blacklist = getattr(settings, 'DJANGO_CFG_COMMANDS_BLACKLIST', set())
+    if command_name in custom_blacklist:
+        logger.info(f"Command {command_name} blocked by custom blacklist")
+        return False
+
+    # Absolute blacklist
+    if command_name in ABSOLUTE_BLACKLIST:
+        logger.info(f"Command {command_name} blocked by absolute blacklist")
+        return False
+
+    # Custom whitelist from settings
+    custom_whitelist = getattr(settings, 'DJANGO_CFG_COMMANDS_WHITELIST', set())
+    if command_name in custom_whitelist:
+        logger.info(f"Command {command_name} allowed by custom whitelist")
+        return True
+
+    # Load and analyze command
+    try:
+        # Determine module path
+        if app_name == 'django_cfg':
+            module_path = f'django_cfg.management.commands.{command_name}'
+        elif app_name.startswith('django.'):
+            module_path = f'{app_name}.management.commands.{command_name}'
+        else:
+            module_path = f'{app_name}.management.commands.{command_name}'
+
+        command_module = importlib.import_module(module_path)
+        if hasattr(command_module, 'Command'):
+            command_class = command_module.Command
+
+            # Analyze command safety
+            analysis = analyze_command_safety(command_class, command_name)
+
+            # If command has explicit web_executable metadata, use it
+            if analysis['web_executable'] is not None:
+                return analysis['web_executable']
+
+            # If analysis says it's unsafe, exclude
+            if not analysis['is_safe']:
+                logger.debug(f"Command {command_name} excluded: {', '.join(analysis['reasons'])}")
+                return False
+    except Exception as e:
+        # Can't load/analyze command
+        logger.debug(f"Could not analyze command {command_name}: {e}")
+        # Be conservative - if we can't analyze, exclude unless from trusted source
+        pass
+
+    # Django CFG commands - include if analysis passed
+    if app_name == 'django_cfg':
+        return True
+
+    # Safe Django core commands (utility/read-only)
+    safe_django_core = {
+        'check', 'diffsettings', 'showmigrations',
+        'createcachetable', 'sendtestemail',
+    }
+    if app_name.startswith('django.') and command_name in safe_django_core:
+        return True
+
+    # Exclude other Django core by default
+    if app_name.startswith('django.'):
+        logger.debug(f"Command {command_name} excluded (Django core, not in safe list)")
+        return False
+
+    # Third-party apps - only whitelisted
+    logger.debug(f"Command {command_name} excluded (third-party, not whitelisted)")
+    return False
+
+
+def get_command_risk_level(command_name: str, app_name: str) -> str:
+    """
+    Get risk level for a command.
+
+    Returns:
+        'safe', 'caution', or 'dangerous'
+    """
+    if command_name in ABSOLUTE_BLACKLIST:
+        return 'dangerous'
+
+    if app_name == 'django_cfg':
+        return 'safe'
+
+    if app_name.startswith('django.'):
+        safe_commands = {'check', 'diffsettings', 'showmigrations'}
+        if command_name in safe_commands:
+            return 'safe'
+        return 'caution'
+
+    return 'caution'