goosebit 0.2.5__py3-none-any.whl → 0.2.6__py3-none-any.whl

goosebit/auth/__init__.py

@@ -10,8 +10,9 @@ from fastapi.security import OAuth2PasswordBearer, SecurityScopes
 from joserfc import jwt
 from joserfc.errors import BadSignatureError
 
-from goosebit.settings import PWD_CXT, USERS, config
-from goosebit.settings.schema import User
+from goosebit.db.models import User
+from goosebit.settings import PWD_CXT, config
+from goosebit.users import UserManager
 
 logger = logging.getLogger(__name__)
 
@@ -31,25 +32,31 @@ def create_token(username: str) -> str:
     return jwt.encode(header={"alg": "HS256"}, claims={"username": username}, key=config.secret_key)
 
 
-def get_user_from_token(token: str | None) -> User | None:
+async def get_user_from_token(token: str | None) -> User | None:
     if token is None:
         return None
     try:
         token_data = jwt.decode(token, config.secret_key)
         username = token_data.claims["username"]
-        return USERS.get(username)
+        return await UserManager.get_user(username)
     except (BadSignatureError, LookupError, ValueError):
         return None
 
 
-def login_user(username: str, password: str) -> str:
-    user = USERS.get(username)
+async def login_user(username: str, password: str) -> str:
+    user = await UserManager.get_user(username)
     if user is None:
         raise HTTPException(
             status_code=401,
             detail="Invalid username or password",
             headers={"WWW-Authenticate": "Bearer"},
         )
+    if not user.enabled:
+        raise HTTPException(
+            status_code=401,
+            detail="User has been disabled, please contact your administrator",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
     try:
         PWD_CXT.verify(user.hashed_pwd, password)
     except VerifyMismatchError:
@@ -61,12 +68,12 @@ def login_user(username: str, password: str) -> str:
     return create_token(user.username)
 
 
-def get_current_user(
+async def get_current_user(
     session_token: Annotated[str | None, Depends(session_auth)] = None,
     oauth2_token: Annotated[str | None, Depends(oauth2_auth)] = None,
 ) -> User | None:
-    session_user = get_user_from_token(session_token)
-    oauth2_user = get_user_from_token(oauth2_token)
+    session_user = await get_user_from_token(session_token)
+    oauth2_user = await get_user_from_token(oauth2_token)
     user = session_user or oauth2_user
     return user
 
@@ -74,34 +81,63 @@ def get_current_user(
 # using | Request because oauth2_auth.__call__ expects is
 async def get_user_from_request(connection: HTTPConnection | Request) -> User | None:
     token = await session_auth(connection) or await oauth2_auth(connection)
-    return get_user_from_token(token)
+    return await get_user_from_token(token)
 
 
-def redirect_if_unauthenticated(connection: HTTPConnection, user: Annotated[User, Depends(get_current_user)]):
+async def redirect_if_unauthenticated(connection: HTTPConnection, user: Annotated[User, Depends(get_current_user)]):
     if user is None:
         raise HTTPException(
             status_code=302,
             headers={"location": str(connection.url_for("login_get"))},
             detail="Invalid username",
         )
+    if not user.enabled:
+        raise HTTPException(
+            status_code=302,
+            headers={"location": str(connection.url_for("login_get"))},
+            detail="Disabled user",
+        )
 
 
-def redirect_if_authenticated(connection: HTTPConnection, user: Annotated[User, Depends(get_current_user)]):
+async def redirect_if_authenticated(connection: HTTPConnection, user: Annotated[User, Depends(get_current_user)]):
     if user is not None:
+        if not user.enabled:
+            return
         raise HTTPException(
             status_code=302,
             headers={"location": str(connection.url_for("ui_root"))},
             detail="Already logged in",
         )
+    if await User.all().count() == 0:
+        raise HTTPException(
+            status_code=302,
+            headers={"location": str(connection.url_for("setup_get"))},
+            detail="No users set up",
+        )
 
 
-def validate_current_user(user: Annotated[User, Depends(get_current_user)]):
+async def redirect_if_users_exist(connection: HTTPConnection):
+    if await User.all().count() > 0:
+        raise HTTPException(
+            status_code=302,
+            headers={"location": str(connection.url_for("login_get"))},
+            detail="An admin user already exists",
+        )
+
+
+async def validate_current_user(user: Annotated[User, Depends(get_current_user)]):
     if user is None:
         raise HTTPException(
             status_code=401,
             detail="Not authenticated",
             headers={"WWW-Authenticate": "Bearer"},
         )
+    if not user.enabled:
+        raise HTTPException(
+            status_code=401,
+            detail="Disabled user",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
     return user
 
 

goosebit/auth/permissions.py

@@ -0,0 +1,80 @@
+from typing import Optional
+
+from pydantic import BaseModel, Field, computed_field
+
+
+class Permission(BaseModel):
+    def model_post_init(self, ctx):
+        if self.sub_permissions is None:
+            return
+        for permission in self.sub_permissions:
+            permission.parent_permission = self
+
+    def __call__(self, *args, **kwargs) -> str:
+        if self.parent_permission is None:
+            return self.name
+        return ".".join([self.parent_permission(), self.name])
+
+    def __getitem__(self, item):
+        return self.sub_permissions_by_name[item]
+
+    @property
+    def sub_permissions_by_name(self) -> dict[str, "Permission"]:
+        if self.sub_permissions is None:
+            return {}
+        return {item.name: item for item in self.sub_permissions}
+
+    @computed_field  # type: ignore[misc]
+    @property
+    def value(self) -> str:
+        return self()
+
+    @computed_field  # type: ignore[misc]
+    @property
+    def parent(self) -> str | None:
+        if self.parent_permission is not None:
+            return self.parent_permission()
+        return None
+
+    name: str
+    description: str
+
+    parent_permission: Optional["Permission"] = Field(exclude=True, default=None)
+    sub_permissions: list["Permission"] | None = None
+
+
+READ_PERMISSION = Permission(name="read", description="Read access")
+WRITE_PERMISSION = Permission(name="write", description="Write access")
+DELETE_PERMISSION = Permission(name="delete", description="Delete access")
+
+DEVICE_PERMISSIONS = Permission(
+    name="device",
+    description="Access to devices",
+    sub_permissions=[READ_PERMISSION.model_copy(), WRITE_PERMISSION.model_copy(), DELETE_PERMISSION.model_copy()],
+)
+SOFTWARE_PERMISSIONS = Permission(
+    name="software",
+    description="Access to software",
+    sub_permissions=[READ_PERMISSION.model_copy(), WRITE_PERMISSION.model_copy(), DELETE_PERMISSION.model_copy()],
+)
+ROLLOUT_PERMISSIONS = Permission(
+    name="rollout",
+    description="Access to rollouts",
+    sub_permissions=[READ_PERMISSION.model_copy(), WRITE_PERMISSION.model_copy(), DELETE_PERMISSION.model_copy()],
+)
+SETTINGS_USERS_PERMISSIONS = Permission(
+    name="users",
+    description="Access to user control",
+    sub_permissions=[READ_PERMISSION.model_copy(), WRITE_PERMISSION.model_copy(), DELETE_PERMISSION.model_copy()],
+)
+SETTING_PERMISSIONS = Permission(
+    name="settings",
+    description="Access to settings",
+    sub_permissions=[SETTINGS_USERS_PERMISSIONS],
+)
+
+GOOSEBIT_PERMISSIONS = Permission(
+    name="goosebit",
+    description="Full access to GooseBit",
+    sub_permissions=[DEVICE_PERMISSIONS, SOFTWARE_PERMISSIONS, ROLLOUT_PERMISSIONS, SETTING_PERMISSIONS],
+)

goosebit/db/config.py

@@ -1,10 +1,66 @@
+import logging
+from urllib.parse import parse_qs, urlparse
+
+from goosebit.db.pg_ssl_context import PostgresSSLContext
 from goosebit.settings import config
 
+
+def add_models(models_path: str):
+    models.append(models_path)
+
+
+models = ["goosebit.db.models", "aerich.models"]
+
 TORTOISE_CONF = {
     "connections": {"default": config.db_uri},
     "apps": {
         "models": {
-            "models": ["goosebit.db.models", "aerich.models"],
+            "models": models,
         },
     },
 }
+
+if config.db_ssl_crt is not None:
+    # config.db_uri must have the following style:
+    # postgres://<user>:<password>@<host>:<port>/<database>?sslmode=<sslmode>
+    parsed = urlparse(config.db_uri)
+    if parsed.scheme != "postgres":
+        logging.error("database scheme must be postgres!")
+        exit(1)
+
+    # parse parameters
+    params = parse_qs(parsed.query)
+
+    # create ssl context for postgres
+    ssl_context = PostgresSSLContext()
+
+    # set certificate file
+    ssl_context.load_verify_locations(config.db_ssl_crt)
+
+    # parse and set verify-flags
+    if params.get("verifyflags") is not None:
+        ssl_context.parse_verify_flags(params["verifyflags"][0])
+
+    # parse and set ssl verify-mode
+    if params.get("sslmode") is not None:
+        ssl_context.parse_ssl_mode(params["sslmode"][0])
+
+    # update database configuration
+    TORTOISE_CONF = {
+        "connections": {
+            "default": {
+                "engine": "tortoise.backends.asyncpg",
+                "credentials": {
+                    "host": parsed.hostname,
+                    "port": parsed.port,
+                    "user": parsed.username,
+                    "password": parsed.password,
+                    "database": parsed.path.lstrip("/"),
+                    "ssl": ssl_context.context,
+                },
+            },
+        },
+        "apps": {
+            "models": {"models": ["goosebit.db.models", "aerich.models"], "default_connection": "default"},
+        },
+    }

goosebit/db/migrations/models/2_20241121113728_update.py

@@ -0,0 +1,11 @@
+from tortoise import BaseDBAsyncClient
+
+
+async def upgrade(db: BaseDBAsyncClient) -> str:
+    return """
+        CREATE INDEX "idx_rollout_software_3614e1" ON "rollout" ("software_id");"""
+
+
+async def downgrade(db: BaseDBAsyncClient) -> str:
+    return """
+        DROP INDEX "idx_rollout_software_3614e1";"""

goosebit/db/migrations/models/3_20241121140210_update.py

@@ -0,0 +1,11 @@
+from tortoise import BaseDBAsyncClient
+
+
+async def upgrade(db: BaseDBAsyncClient) -> str:
+    return """
+        ALTER TABLE "device" ADD "auth_token" VARCHAR(32);"""
+
+
+async def downgrade(db: BaseDBAsyncClient) -> str:
+    return """
+        ALTER TABLE "device" DROP COLUMN "auth_token";"""

goosebit/db/migrations/models/4_20250324110331_update.py

@@ -0,0 +1,16 @@
+from tortoise import BaseDBAsyncClient
+
+
+async def upgrade(db: BaseDBAsyncClient) -> str:
+    return """
+        CREATE TABLE IF NOT EXISTS "user" (
+    "username" VARCHAR(255) NOT NULL  PRIMARY KEY,
+    "hashed_pwd" VARCHAR(255) NOT NULL,
+    "permissions" JSON NOT NULL,
+    "enabled" INT NOT NULL  DEFAULT 1
+);"""
+
+
+async def downgrade(db: BaseDBAsyncClient) -> str:
+    return """
+        DROP TABLE IF EXISTS "user";"""

goosebit/db/migrations/models/4_20250402085235_rename_uuid_to_id.py

@@ -0,0 +1,11 @@
+from tortoise import BaseDBAsyncClient
+
+
+async def upgrade(db: BaseDBAsyncClient) -> str:
+    return """
+        ALTER TABLE "device" RENAME COLUMN "uuid" TO "id";"""
+
+
+async def downgrade(db: BaseDBAsyncClient) -> str:
+    return """
+        ALTER TABLE "device" RENAME COLUMN "id" TO "uuid";"""

goosebit/db/migrations/models/5_20250619090242_null_feed.py

@@ -0,0 +1,83 @@
+from tortoise import BaseDBAsyncClient
+
+
+async def upgrade(db: BaseDBAsyncClient) -> str:
+    dialect = db.schema_generator.DIALECT
+
+    if dialect == "postgres":
+        return """
+            ALTER TABLE "device" ALTER COLUMN "feed" DROP NOT NULL;"""
+
+    return """PRAGMA foreign_keys=off;
+
+    CREATE TABLE "device_new" (
+        "id" CHAR(255) NOT NULL PRIMARY KEY,
+        "name" CHAR(255),
+        "assigned_software_id" INT,
+        "force_update" INT NOT NULL DEFAULT 0,
+        "sw_version" CHAR(255),
+        "hardware_id" INT NOT NULL,
+        "feed" CHAR(255) DEFAULT 'default',  -- NULL allowed here
+        "update_mode" INT NOT NULL DEFAULT 0,
+        "last_state" INT NOT NULL DEFAULT 0,
+        "progress" INT,
+        "last_log" TEXT,
+        "last_seen" BIGINT,
+        "last_ip" CHAR(15),
+        "last_ipv6" CHAR(40),
+        "auth_token" CHAR(32)
+    );
+
+    INSERT INTO "device_new" SELECT
+        id, name, assigned_software_id, force_update, sw_version,
+        hardware_id, feed, update_mode, last_state, progress,
+        last_log, last_seen, last_ip, last_ipv6, auth_token
+    FROM "device";
+
+    DROP TABLE "device";
+
+    ALTER TABLE "device_new" RENAME TO "device";
+
+    PRAGMA foreign_keys=on;
+    """
+
+
+async def downgrade(db: BaseDBAsyncClient) -> str:
+    dialect = db.schema_generator.DIALECT
+
+    if dialect == "postgres":
+        return """
+            ALTER TABLE "device" ALTER COLUMN "feed" SET NOT NULL;"""
+
+    return """PRAGMA foreign_keys=off;
+
+    CREATE TABLE "device_old" (
+        "id" CHAR(255) NOT NULL PRIMARY KEY,
+        "name" CHAR(255),
+        "assigned_software_id" INT,
+        "force_update" INT NOT NULL DEFAULT 0,
+        "sw_version" CHAR(255),
+        "hardware_id" INT NOT NULL,
+        "feed" CHAR(255) NOT NULL DEFAULT 'default',  -- NOT NULL again
+        "update_mode" INT NOT NULL DEFAULT 0,
+        "last_state" INT NOT NULL DEFAULT 0,
+        "progress" INT,
+        "last_log" TEXT,
+        "last_seen" BIGINT,
+        "last_ip" CHAR(15),
+        "last_ipv6" CHAR(40),
+        "auth_token" CHAR(32)
+    );
+
+    INSERT INTO "device_old" SELECT
+        id, name, assigned_software_id, force_update, sw_version,
+        hardware_id, feed, update_mode, last_state, progress,
+        last_log, last_seen, last_ip, last_ipv6, auth_token
+    FROM "device";
+
+    DROP TABLE "device";
+
+    ALTER TABLE "device_old" RENAME TO "device";
+
+    PRAGMA foreign_keys=on;
+    """

goosebit/db/models.py

@@ -5,13 +5,12 @@ from typing import Self
 from urllib.parse import unquote, urlparse
 from urllib.request import url2pathname
 
-import semver
 from anyio import Path
-from semver import Version
 from tortoise import Model, fields
 from tortoise.exceptions import ValidationError
 
 from goosebit.api.telemetry.metrics import devices_count
+from goosebit.util.version import Version
 
 
 class UpdateModeEnum(IntEnum):
@@ -57,7 +56,7 @@ class Tag(Model):
 
 
 class Device(Model):
-    uuid = fields.CharField(max_length=255, primary_key=True)
+    id = fields.CharField(max_length=255, primary_key=True)
     name = fields.CharField(max_length=255, null=True)
     assigned_software = fields.ForeignKeyField(
         "models.Software", related_name="assigned_devices", null=True, on_delete=fields.SET_NULL
@@ -65,7 +64,7 @@ class Device(Model):
     force_update = fields.BooleanField(default=False)
     sw_version = fields.CharField(max_length=255, null=True)
     hardware = fields.ForeignKeyField("models.Hardware", related_name="devices")
-    feed = fields.CharField(max_length=255, default="default")
+    feed = fields.CharField(max_length=255, default="default", null=True)
     update_mode = fields.IntEnumField(UpdateModeEnum, default=UpdateModeEnum.ROLLOUT)
     last_state = fields.IntEnumField(UpdateStateEnum, default=UpdateStateEnum.UNKNOWN)
     progress = fields.IntField(null=True)
@@ -73,9 +72,14 @@ class Device(Model):
     last_seen = fields.BigIntField(null=True)
     last_ip = fields.CharField(max_length=15, null=True)
     last_ipv6 = fields.CharField(max_length=40, null=True)
+    auth_token = fields.CharField(max_length=32, null=True)
     tags = fields.ManyToManyField("models.Tag", related_name="devices", through="device_tags")
 
     async def save(self, *args, **kwargs):
+        # ensure if using rollout that feed is set
+        if self.update_mode == UpdateModeEnum.ROLLOUT:
+            if self.feed is None:
+                raise ValidationError("Feed must be set in order to use rollout.")
         # Check if the software is compatible with the hardware before saving
         if self.assigned_software and self.hardware:
             # Check if the assigned software is compatible with the hardware
@@ -107,7 +111,7 @@ class Rollout(Model):
     created_at = fields.DatetimeField(auto_now_add=True)
     name = fields.CharField(max_length=255, null=True)
     feed = fields.CharField(max_length=255, default="default")
-    software = fields.ForeignKeyField("models.Software", related_name="rollouts")
+    software = fields.ForeignKeyField("models.Software", related_name="rollouts", db_index=True)
     paused = fields.BooleanField(default=False)
     success_count = fields.IntField(default=0)
     failure_count = fields.IntField(default=0)
@@ -133,12 +137,12 @@ class Software(Model):
 
     @classmethod
     async def latest(cls, device: Device) -> Self | None:
-        updates = await cls.filter(compatibility__devices__uuid=device.uuid)
+        updates = await cls.filter(compatibility__devices__id=device.id)
         if len(updates) == 0:
             return None
         return sorted(
             updates,
-            key=lambda x: semver.Version.parse(x.version, optional_minor_and_patch=True),
+            key=lambda x: Version.parse(x.version),
             reverse=True,
         )[0]
 
@@ -159,4 +163,11 @@ class Software(Model):
 
     @property
     def parsed_version(self) -> Version:
-        return semver.Version.parse(self.version, optional_minor_and_patch=True)
+        return Version.parse(self.version)
+
+
+class User(Model):
+    username = fields.CharField(max_length=255, primary_key=True, null=False)
+    hashed_pwd = fields.CharField(max_length=255, null=False)
+    permissions: fields.JSONField[list[str]] = fields.JSONField(default=[])
+    enabled = fields.BooleanField(default=True)

goosebit/db/pg_ssl_context.py

@@ -0,0 +1,51 @@
+import logging
+import ssl
+
+
+class PostgresSSLContext:
+    context: ssl.SSLContext
+
+    def __init__(self):
+        # create ssl context in server-auth mode: this sets verify_mode = required and check_hostname = True
+        self.context = ssl.create_default_context(purpose=ssl.Purpose.SERVER_AUTH)
+
+    def parse_ssl_mode(self, sslmode: str):
+        match sslmode:
+            case "none":
+                self.context.check_hostname = False
+                self.context.verify_mode = ssl.CERT_NONE
+            case "optional":
+                self.context.verify_mode = ssl.CERT_OPTIONAL
+            case "require":
+                self.context.verify_mode = ssl.CERT_REQUIRED
+            case _:
+                logging.error("sslmode must be either: none, optional or required!")
+                exit(1)
+
+    # parse and set verify-flags according to postgres string attributes
+    # default as defined in python3.13 lib/ssl.py: https://github.com/python/cpython/blob/3.13/Lib/ssl.py#L713)
+    # is the following: (ssl.VERIFY_X509_PARTIAL_CHAIN | ssl.VERIFY_X509_STRICT)
+    def parse_verify_flags(self, verifyflags: str):
+        self.context.verify_flags = ssl.VerifyFlags(0)
+        for f in verifyflags.split("|"):
+            match f:
+                case "default":
+                    self.context.verify_flags |= ssl.VerifyFlags.VERIFY_DEFAULT
+                case "crl_check_leaf":
+                    self.context.verify_flags |= ssl.VerifyFlags.VERIFY_CRL_CHECK_LEAF
+                case "crl_check_chain":
+                    self.context.verify_flags |= ssl.VerifyFlags.VERIFY_CRL_CHECK_CHAIN
+                case "x509_strict":
+                    self.context.verify_flags |= ssl.VerifyFlags.VERIFY_X509_STRICT
+                case "allow_proxy_certs":
+                    self.context.verify_flags |= ssl.VerifyFlags.VERIFY_ALLOW_PROXY_CERTS
+                case "x509_trusted_first":
+                    self.context.verify_flags |= ssl.VerifyFlags.VERIFY_X509_TRUSTED_FIRST
+                case "x509_partial_chain":
+                    self.context.verify_flags |= ssl.VerifyFlags.VERIFY_X509_PARTIAL_CHAIN
+                case _:
+                    logging.error(f"verify-flag is undefined: {f}")
+                    exit(1)
+
+    def load_verify_locations(self, file):
+        self.context.load_verify_locations(file)