fediflax 1.4.0__py3-none-any.whl

fediflax/__init__.py

@@ -0,0 +1,7 @@
+from flask_alembic import Alembic
+from flask_talisman import Talisman
+
+from fediflax.database import ModelBase
+
+alembic = Alembic(metadatas=ModelBase.metadata)
+talisman = Talisman()

fediflax/admin.py

@@ -0,0 +1,127 @@
+import functools
+
+import click
+from flask import (
+    Blueprint,
+    current_app,
+    flash,
+    g,
+    redirect,
+    render_template,
+    request,
+    session,
+    url_for,
+)
+from sqlalchemy import select
+
+from fediflax import alembic, auth
+from fediflax.database import db
+from fediflax.federation import create_actor
+from fediflax.models import Domain, FediActor, User
+
+bp = Blueprint("admin", __name__, url_prefix="/admin")
+
+
+def add_domain(domainname, owned):
+    # create actor and add it to the database
+    domain = Domain(name=domainname, owned_by_server=owned)
+    db.session.add(domain)
+    db.session.commit()
+
+
+@bp.cli.command("add_domain")
+@click.argument("domainname")
+@click.option("--owned/--no-owned", default=False, prompt=True)
+def add_domain_cli(domainname, owned):
+    add_domain(domainname, owned)
+    print("ok")
+
+
+@bp.get("/setup")
+def setup():
+    current_database_revision = alembic.migration_context.get_current_revision()
+    print(current_app.config.get("ADMIN_USER"))
+    # is_database_current = alembic.needs_upgrade()
+    if current_app.config.get("ADMIN_USER"):
+        pass
+
+    else:
+        pass
+
+    return render_template(
+        "admin/setup.html", current_database_revision=current_database_revision
+    )
+
+
+@bp.post("/upgrade_database")
+def upgrade_database():
+    admin_user = current_app.config.get("ADMIN_USER")
+    if admin_user is None or admin_user == session.get("username"):
+        alembic.upgrade()
+        flash(f"Database updated", "success")
+    else:
+        flash(f"Please login to update database", "warning")
+
+    return redirect(url_for("admin.setup"))
+
+
+@bp.post("/enable_admin")
+def enable_admin():
+    admin_user = current_app.config.get("ADMIN_USER")
+    if admin_user is not None:
+        auth.enable_user(admin_user)
+        flash(f"Admin enabled.", "success")
+    else:
+        flash(f"No admin in config.", "warning")
+
+    return redirect(url_for("admin.setup"))
+
+
+@bp.post("/add_domain")
+def add_domain_post():
+    admin_user = current_app.config.get("ADMIN_USER")
+    if admin_user is not None and admin_user == session.get("username"):
+        add_domain(request.form.get("domain_name"), request.form.get("owned") == "on")
+        flash(f"Domain added.", "success")
+    else:
+        flash(f"Login as admin to add a domain", "warning")
+
+    return redirect(url_for("admin.setup"))
+
+
+@bp.post("/add_actor")
+def add_actor():
+    admin_user = current_app.config.get("ADMIN_USER")
+    if admin_user is not None and admin_user == session.get("username"):
+        subject = (
+            request.form.get("actor_prefix") + "@" + request.form.get("domain_name")
+        )
+        actor: FediActor = db.session.execute(
+            select(FediActor).filter_by(subject=subject)
+        ).scalar()
+        if actor is None:
+            actor = create_actor(
+                request.form.get("actor_prefix"), request.form.get("domain_name")
+            )
+
+        user: User = db.session.execute(
+            select(User).filter_by(username=request.form.get("user"))
+        ).scalar()
+        if user is not None:
+            if request.form.get("user_default") == "on":
+                user.default_actor_uri = actor.uri
+            user.enabled = request.form.get("enable_user") == "on"
+
+        domain: Domain = db.session.execute(
+            select(Domain).filter_by(name=request.form.get("domain_name"))
+        ).scalar()
+        if domain is not None and request.form.get("domain_default") == "on":
+            domain.main_actor_uri = actor.uri
+
+        db.session.commit()
+
+        flash(f"Actor added.", "success")
+    else:
+        flash(f"Login as admin to add a actor", "warning")
+
+    return redirect(url_for("admin.setup"))

fediflax/auth.py

@@ -0,0 +1,292 @@
+import functools
+import logging
+import secrets
+from datetime import datetime, timedelta
+
+import click
+from authlib.integrations.flask_oauth2 import (
+    AuthorizationServer,
+    ResourceProtector,
+    current_token,
+)
+from authlib.integrations.sqla_oauth2 import OAuth2ClientMixin
+from authlib.oauth2 import OAuth2Request
+from authlib.oauth2.rfc6749 import grants
+from authlib.oauth2.rfc6750 import BearerTokenValidator
+from flask import (
+    Blueprint,
+    current_app,
+    flash,
+    g,
+    redirect,
+    render_template,
+    request,
+    session,
+    url_for,
+)
+from sqlalchemy import func, select
+from sqlalchemy.exc import IntegrityError
+from werkzeug.security import check_password_hash, generate_password_hash
+
+from fediflax.database import db
+from fediflax.models import Client, FediActor, Grant, Token, User
+
+bp = Blueprint("auth", __name__, url_prefix="/auth")
+oauth_server = AuthorizationServer()
+require_oauth = ResourceProtector()
+
+
+class AuthorizationCodeGrant(grants.AuthorizationCodeGrant):
+    def save_authorization_code(self, code, request):
+        print("save authorization code")
+        expires = datetime.utcnow() + timedelta(seconds=100)
+        grant = Grant(
+            client_id=request.client.client_id,
+            code=code,
+            user_name=request.user.get_user_id(),
+            redirect_uri=request.redirect_uri,
+            _scopes=request.client._default_scopes,
+        )
+        db.session.add(grant)
+        db.session.commit()
+        return grant
+
+    def query_authorization_code(self, code, client):
+        print("query authorization code")
+        grant = db.session.execute(
+            select(Grant).filter_by(client_id=client.client_id, code=code)
+        ).scalar_one()
+        return grant
+
+    def delete_authorization_code(self, authorization_code):
+        db.session.delete(authorization_code)
+        db.session.commit()
+
+    def authenticate_user(self, authorization_code):
+        return authorization_code.user
+
+    def create_token_response(self):
+        (status_code, body, headers) = super().create_token_response()
+        if self.client.default_actor_uri:
+            body["me"] = self.client.default_actor_uri
+        return status_code, body, headers
+
+
+class MyBearerTokenValidator(BearerTokenValidator):
+    def authenticate_token(self, token_string):
+        token = db.session.execute(
+            select(Token).filter_by(access_token=token_string)
+        ).scalar_one()
+        return token
+
+
+def init_oauth(app):
+
+    def get_client(client_id):
+        print("get client")
+        client = db.session.execute(
+            select(Client).filter_by(client_id=client_id)
+        ).scalar_one()
+        return client
+
+    def save_token(token_data, request):
+
+        expires = datetime.utcnow() + timedelta(seconds=token_data.get("expires_in"))
+
+        tok = Token(
+            access_token=token_data["access_token"],
+            refresh_token=token_data.get("refresh_token"),
+            token_type=token_data["token_type"],
+            _scopes=token_data["scope"],
+            client_id=request.client.client_id,
+            user_name=request.user.username,
+            expires=expires,
+        )
+        db.session.add(tok)
+        db.session.commit()
+        return tok
+
+    oauth_server.init_app(app, query_client=get_client, save_token=save_token)
+    oauth_server.register_grant(AuthorizationCodeGrant)
+    require_oauth.register_token_validator(MyBearerTokenValidator())
+
+
+@bp.before_app_request
+def load_logged_in_user():
+    username = session.get("username")
+
+    if username is None:
+        g.user = None
+    else:
+        try:
+            g.user = db.session.execute(
+                select(User).filter_by(username=username)
+            ).scalar_one()
+        except Exception as e:
+            g.user = None
+
+
+def enable_user(username):
+    user = db.session.execute(select(User).filter_by(username=username)).scalar_one()
+    user.enabled = True
+    db.session.commit()
+
+
+@bp.cli.command("enable_user")
+@click.argument("username")
+def enable_user_cli(username):
+    enable_user(username)
+
+
+@bp.route("/login", methods=("GET", "POST"))
+def login():
+    if request.method == "POST":
+        user = db.session.execute(
+            select(User).filter_by(username=request.form["username"])
+        ).scalar()
+        if user is None:
+            flash(f"Login failed.", "warning")
+            return render_template("auth/login.html")
+        password_okay = check_password_hash(user.password, request.form["password"])
+        if user.enabled and password_okay:
+            session["username"] = user.username
+            actor = db.session.execute(
+                select(FediActor).filter_by(object_uri=user.default_actor_uri)
+            ).scalar()
+            if actor is not None:
+                session["actor"] = actor.subject
+            flash(f"User {user.username} successful logged in.", "success")
+            current_app.logger.log(logging.INFO, user.username + "logged in.")
+            if session.get("login_redirect"):
+                return redirect(session["login_redirect"])
+            else:
+                return redirect(url_for("web.home"))
+        else:
+            flash(f"Login failed.", "warning")
+    return render_template("auth/login.html")
+
+
+@bp.route("/register", methods=("GET", "POST"))
+def register():
+    if request.method == "POST":
+        error = None
+        try:
+            username = request.form["username"]
+            user = User(
+                id=username,
+                username=username,
+                remarks=request.form["remarks"],
+                email=request.form["email"],
+                password=generate_password_hash(request.form["password"]),
+            )
+            db.session.add(user)
+            db.session.commit()
+        except IntegrityError:
+            flash(f"User {username} already exists", "warning")
+        else:
+            flash(f"User {username} successful created.", "success")
+            return redirect(url_for("auth.login"))
+    return render_template("auth/register.html")
+
+
+@bp.route("/logout", methods=("GET", "POST"))
+def logout():
+    session.clear()
+    return redirect(url_for("auth.login"))
+
+
+@bp.post("client_registration")
+def client_registration():
+    client_id = secrets.token_hex(16)
+    client_secret = secrets.token_urlsafe(32)
+
+    data = request.json
+
+    description = (
+        "Created on "
+        + datetime.today().strftime("%Y-%m-%d %H:%M:%S")
+        + "\n"
+        + request.user_agent.string
+    )
+    if data.get("client_uri"):
+        description = description + "\n" + data["client_uri"]
+
+    client = Client(
+        name="",
+        description=description,
+        id=client_id,
+        client_id=client_id,
+        client_secret=generate_password_hash(client_secret),
+        is_confidential=True,
+        _redirect_uris=" ".join(data["redirect_uris"]),
+    )
+    if data.get("client_name"):
+        client.name = data["client_name"]
+    if data.get("token_endpoint_auth_method") == "none":
+        client.is_confidential = False
+    if data.get("scope"):
+        client._default_scopes = data["scope"]
+
+    db.session.add(client)
+    db.session.commit()
+
+    return {
+        "client_id": client_id,
+        "client_secret": client_secret,
+        "client_secret_expires_at": 0,
+        "scope": data["scope"],
+    }
+
+
+@bp.route("/authorization", methods=("GET", "POST"))
+def authorize(*args, **kwargs):
+    if not g.user:
+        session["login_redirect"] = request.url
+        return redirect(url_for("auth.login"))
+
+    client = db.session.execute(
+        select(Client).filter_by(client_id=request.args.get("client_id"))
+    ).scalar_one()
+    if client.owner and client.default_actor_uri:
+        return oauth_server.create_authorization_response(grant_user=client.owner)
+
+    if request.method == "GET":
+        return render_template("auth/authorization.html")
+
+    if request.method == "POST":
+        confirm = request.form.get("confirm", "no")
+        if confirm == "yes":
+            client.enabled = True
+            client.owner_id = g.user.username
+            actor = db.session.execute(
+                select(FediActor).filter_by(subject=request.form.get("actor"))
+            ).scalar_one()
+            client.default_actor_uri = actor.object_uri
+            db.session.commit()
+            return oauth_server.create_authorization_response(grant_user=g.user)
+        else:
+            return oauth_server.create_authorization_response(grant_user=None)
+
+
+@bp.route("/token", methods=["POST"])
+def issue_token():
+    return oauth_server.create_token_response()
+
+
+@bp.route("/hello")
+@require_oauth("read")
+def hello():
+    return {"text": "Hello World!"}
+
+
+def require_permission():
+    def permission_decorator(view):
+        @functools.wraps(view)
+        def wrapper(*args, **kwargs):
+            if g.user is None:
+                return redirect(url_for("auth.login"))
+            return view(*args, **kwargs)
+
+        return wrapper
+
+    return permission_decorator

fediflax/core/__init__.py

@@ -0,0 +1 @@
+"""This folder contains the Fediflax modules required for core functionality."""

fediflax/core/instance.py

@@ -0,0 +1,104 @@
+from os import PathLike
+from typing import override
+
+import yaml
+from flask import Flask
+from flask_sqlalchemy_lite import SQLAlchemy
+
+from fediflax import alembic, talisman
+from fediflax.database import db
+
+from ..types import Core, Extension, PageType
+from .web import WebManager
+
+
+class FediflaxInstance(Core):
+    """ """
+
+    def __init__(self, config_file: str | PathLike[str]):
+        self.extensions: list[Extension] = []
+        self.config_file: str | PathLike[str] = config_file
+        self.web: WebManager = WebManager()
+        self._db: SQLAlchemy = db
+
+    @property
+    @override
+    def database(self):
+        return self._db
+
+    @override
+    def register_page_type(self, page_type: PageType):
+        self.web.register_page_type(page_type)
+
+    def add_extension(self, extension: Extension):
+        self.extensions.append(extension)
+        extension.init_core(self)
+
+    def add_default_extensions(self, custom_pages: bool = True, documents: bool = True):
+        if custom_pages:
+            from ..extensions.custom_pages import CustomPageExtension
+
+            self.add_extension(CustomPageExtension())
+        if documents:
+            from ..extensions.documents import DocumentPageExtension
+
+            self.add_extension(DocumentPageExtension())
+
+    def init_app(self, app: Flask):
+        self._init_config(app)
+        db.init_app(app)
+        alembic.init_app(app)
+        self._init_talisman(app)
+        self._register_core(app)
+        for extension in self.extensions:
+            extension.init_app(app, self)
+
+    def _init_config(self, app: Flask):
+        app.config.from_mapping(
+            SECRET_KEY="dev",
+            SQLALCHEMY_ENGINES={"default": "sqlite:///default.sqlite"},
+            INSTANCE_NAME="Instanz-Infos",
+        )
+        app.config.from_file(self.config_file, load=yaml.safe_load, text=False)
+
+    def _init_talisman(self, app: Flask):
+        csp = {
+            "default-src": "'self'",
+            "script-src": ["'strict-dynamic'", "'unsafe-eval'"],
+            "img-src": ["'self'", "data:"],
+        }
+
+        talisman.init_app(
+            app,
+            content_security_policy=csp,
+            content_security_policy_nonce_in=["script-src"],
+        )
+        pass
+
+    def _register_core(self, app: Flask):
+
+        self.web.init_app(app, self)
+
+        from ..legacy import templates as legacy_templates
+
+        legacy_templates.init_app(app)
+
+        from .. import (
+            admin,
+            auth,
+            federation,
+            media,
+            settings,
+            well_known,
+        )
+
+        app.register_blueprint(admin.bp)
+        app.register_blueprint(auth.bp)
+        auth.init_oauth(app)
+        app.register_blueprint(federation.bp)
+        federation.register_hooks()
+        app.register_blueprint(media.bp)
+        app.register_blueprint(settings.bp)
+        # app.register_blueprint(web.bp)
+        app.register_blueprint(well_known.bp)
+        app.add_url_rule("/", endpoint="web.home")

fediflax/core/web/__init__.py

@@ -0,0 +1,4 @@
+"""This folder provides the functionality for the content management system."""
+
+from .utils import url_for_page as url_for_page
+from .web_manager import WebManager as WebManager

fediflax/core/web/templates/web/create_page.html

@@ -0,0 +1,51 @@
+{% extends 'base.html' %}
+
+{% block header %}
+<h1>{% block title %}Create Page{% endblock %}</h1>
+{% endblock %}
+
+{% block content %}
+<form method="post">
+
+    <label>Actor
+        <input type="text" name="actor" id="nav_actor" value="{{actor}}" required readonly>
+    </label>
+
+    <label>Navigation Menu
+
+        <select name="nav_section" required>
+            <option value="home">Home</option>
+            <option value="main">Main</option>
+            <option value="profile_page">Profile Page</option>
+            <option value="domain_footer">Domain Footer</option>
+            <option value="instance_footer">Instance Footer</option>
+
+        </select>
+    </label>
+
+    <label>Name
+        <input type="text" name="nav_name" id="nav_name" required />
+    </label>
+
+    <label>Order hint
+        <input type="text" name="nav_order" id="nav_order" />
+    </label>
+
+    <label>Path
+        <input type="text" name="nav_path" id="nav_path" required />
+    </label>
+
+    <label>Page Type
+        <select name="page_type" required>
+            <option value="document">Markdown Document</option>
+            <option value="custom_page">Angepasste Seite</option>
+        </select>
+    </label>
+
+    <!-- <label> Draft
+        <input type="checkbox" name="draft" checked />
+    </label> -->
+
+    <button type="submit" name="action" class="button" value="create">Create page</button>
+</form>
+{% endblock %}

fediflax/core/web/templates/web/delete_page.html

@@ -0,0 +1,28 @@
+{% extends 'base.html' %}
+
+{% block header %}
+<h1>{% block title %}Delete Page{% endblock %}</h1>
+{% endblock %}
+
+{% block content %}
+Do you want to delete the following page?
+<form method="post">
+
+    <input type="hidden" name="csrf-check" value="{{csrf_check}}" required/>
+
+    <label>ID
+        <input type="text" name="id" id="page_id" value="{{page.id}}" required readonly />
+    </label>
+
+    <label>Actor
+        <input type="text" name="actor" id="nav_actor" value="{{page.actor}}" readonly />
+    </label>
+
+    <label>Path
+        <input type="text" name="nav_path" id="nav_path" value="{{page.subpath}}"" readonly />
+    </label>
+
+
+    <button type="submit" name="action" value="delete" class="button">Delete Page</button>
+</form>
+{% endblock %}

fediflax/core/web/utils.py

@@ -0,0 +1,16 @@
+from flask import (
+    request,
+    url_for,
+)
+
+from fediflax.models import WebPage
+
+
+def url_for_page(page: WebPage) -> str:
+    actor, domain = page.actor.split("@")
+    return (
+        request.scheme
+        + "://"
+        + domain
+        + url_for("web.show_page", actor=actor, subpath=page.subpath)
+    )