keepup-http 0.5.0__tar.gz → 0.6.0__tar.gz

{keepup_http-0.5.0 → keepup_http-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: keepup-http
-Version: 0.5.0
+Version: 0.6.0
 Summary: The way into the application over HTTP: the application, its routes and its middleware.
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown

{keepup_http-0.5.0 → keepup_http-0.6.0}/keepup_http/__init__.py

@@ -10,7 +10,7 @@ route wrapper; they move in one slice at a time, and the base answers their old
 names through the compatibility layer for one release (keepup-122).
 """
 
-__version__ = "0.5.0"
+__version__ = "0.6.0"
 
 __all__ = ["HttpPlugin", "SERVICE_HTTP", "register_api_documentation",
            "register_event_api_routes"]

{keepup_http-0.5.0 → keepup_http-0.6.0}/keepup_http/factory.py

@@ -43,6 +43,7 @@ from keepup_audit.events import init_event_manager
 from keepup_http.events_api import register_event_api_routes
 from keepup.instance import get_instance_id
 from keepup_http.lock_routes import register_lock_routes
+from keepup_http.routes import register_declared_routes, register_declared_sockets
 from keepup_metrics.api import register_metrics_routes
 from keepup_modules.catalogue import register_module_routes
 from keepup.plugins.registry import (
@@ -314,6 +315,19 @@ def _build_lifespan(settings: KeepupSettings):
         if manager is not None:
             await initialize_plugins(app, manager, config_path=settings.plugins_config_path)
 
+        # What the kernel's plugins declared is bound here (keepup-121): an
+        # application that named only `plugins_dir` used to get no route of its
+        # own, because only a PluginManager of the 0.3.0 path ever bound them.
+        # The manager above registered its declarations a moment ago; a route the
+        # application already answers is skipped rather than answered twice.
+        if kernel is not None:
+            mounted = kernel.mount({
+                "routes": lambda items, runtime=None: register_declared_routes(app, items),
+                "sockets": lambda items, runtime=None: register_declared_sockets(app, items),
+            })
+            if mounted:
+                logger.info("Mounted what the plugins declared: %s", mounted)
+
         # The log handlers the running capabilities contribute -- the shipping
         # one, when a collector is named (keepup-118). A deployment that
         # installs none attaches nothing.

{keepup_http-0.5.0 → keepup_http-0.6.0}/keepup_http/routes.py

@@ -40,6 +40,8 @@ from keepup.plugins import route_mask
 __all__ = [
     "accepted_params",
     "raw_request_wrapper",
+    "register_declared_routes",
+    "register_declared_sockets",
     "register_plugin_routes",
 ]
 
@@ -335,10 +337,9 @@ def create_wrapper(handler, path, methods, require_auth: bool = True,
 
     async def call(request: Request, current_user):
         """One call of a plugin route, from the audit's first row to its last."""
-        request_data = {
-            'user_id': current_user.get('id') if current_user else None,
-            'username': current_user.get('username') if current_user else 'anonymous',
-        }
+        # The actor is not part of request_data: that is redacted whole, and a
+        # row that cannot name who called is not an audit (keepup-172).
+        request_data = {}
         if has_path_params:
             request_data['path_params'] = dict(request.path_params)
         request_data['query_params'] = dict(request.query_params)
@@ -353,7 +354,8 @@ def create_wrapper(handler, path, methods, require_auth: bool = True,
                 method=method_name,
                 endpoint=path,
                 host='plugin_api',
-                request_data=request_data
+                request_data=request_data,
+                actor=current_user
         ) as request_id:
             try:
                 response = await invoke(request, current_user)
@@ -413,95 +415,223 @@ async def register_plugin_routes(app, manager):
     logger.info(f"Found {len(routes)} plugin routes to register")
 
     for route in routes:
-        handler = route['handler']
-        path = route['path']
-        methods = route['methods']
-        require_auth = route.get('require_auth', True)
-        is_upload = route.get('is_upload', False)
-        permission = route.get('permission')
-        audit = route.get('audit', True)
-        response_media_type = route.get('response_media_type')
-        if response_media_type is not None and (
-                not isinstance(response_media_type, str) or not response_media_type.strip()):
-            raise ValueError(
-                f"{path}: response_media_type is a media type, like 'text/plain'")
-        if response_media_type is not None and route.get('raw_request'):
-            raise ValueError(
-                f"{path}: a raw_request route answers with a Response of its own; "
-                "response_media_type would be ignored. Drop one of the two.")
-        if permission is not None:
-            # A right needs somebody to hold it: on a route nobody signs in to,
-            # or one that signs itself in, it would be a check that never runs.
-            if not isinstance(permission, str) or not permission.strip():
-                raise ValueError(f"{path}: permission must be a non-empty string")
-            if route.get('raw_request') or not require_auth:
-                raise ValueError(
-                    f"{path}: a route that declares a permission must be signed in by "
-                    "the framework -- drop require_auth: false or raw_request, or the "
-                    "permission")
-
-        logger.info(
-            f"Registering route {path} - methods: {methods}, auth: {require_auth}, upload: {is_upload}")
-
-        # The kernel parsed and checked the mask when it collected the route,
-        # for every transport there will ever be (keepup-102); a route that
-        # reaches here without one was declared by something else, and is
-        # checked the same way rather than trusted.
-        mask = route.get('_mask')
-        if mask is None:
-            try:
-                mask = route_mask.parse(route.get(route_mask.MASK_FIELD), path)
-                route_mask.check_signature(handler, mask)
-            except route_mask.MaskError as error:
-                # The same loudness as the raw_request check below: a mask naming
-                # a parameter the handler does not take is a typo, and finding it
-                # on a request would mean hearing about it from a user.
-                raise ValueError(f"{path}: {error}")
-
-        if route.get('raw_request'):
-            # A raw route authenticates inside the handler -- it is handed the
-            # Request and nothing else. Declaring require_auth on it therefore
-            # promises a check the framework does not make, and the start-up
-            # line used to print auth=True over an open route (keepup-12).
-            if route.get('require_auth') is True:
-                raise ValueError(
-                    f"{path}: a raw_request route cannot also declare "
-                    "require_auth -- the handler receives the Request and "
-                    "authenticates itself. Drop one of the two.")
-            require_auth = False
-            wrapper = raw_request_wrapper(handler)
-        else:
-            wrapper = create_wrapper(handler, path, methods, require_auth, is_upload, mask,
-                                     permission, audit=audit,
-                                     response_media_type=response_media_type)
-
-        # What the route says about its body: its own limit, or that it reads
-        # the body itself (keepup/body_limit.py).
-        declare_limit(wrapper, route)
-
-        app.add_api_route(
-            path,
-            wrapper,
-            methods=methods,
-            include_in_schema=route.get('include_in_schema', True)
-        )
-
-        logger.info(
-            f"Registered plugin route: {path} - {methods} (auth={require_auth}, upload={is_upload})")
+        _mount_route(app, route)
 
     websocket_routes = manager.get_all_websocket_routes()
     logger.info(f"Found {len(websocket_routes)} WebSocket plugin routes to register")
 
     for ws_route in websocket_routes:
-        path = ws_route['path']
-        handler = ws_route['handler']
-        # Off by default, unlike HTTP routes: sockets of agents and guests carry
-        # tokens of their own and would be refused by the panel's sign-in rule.
-        if ws_route.get('require_auth', False):
-            handler = signed_in_websocket(handler)
-        _register_websocket(app, path, handler)
-        logger.info(f"Registered WebSocket plugin route: {path} "
-                    f"(auth={bool(ws_route.get('require_auth', False))})")
+        _mount_socket(app, ws_route)
+
+
+def register_declared_routes(app, declarations) -> int:
+    """Mount the routes the kernel collected from the plugins (keepup-121).
+
+    The kernel resolves, loads and initialises the plugins, and what they
+    declared is the runtime's, transport-neutral: this is the HTTP half of that
+    seam, the call ``runtime.mount`` hands to a registrar. Until it existed an
+    application that named only ``plugins_dir`` got no route of its own, because
+    only a PluginManager of the 0.3.0 path ever bound them.
+
+    What the application already answers is left alone: the framework's own
+    routes are registered before the kernel starts, and an application that
+    passes a manager has its declarations bound by `register_plugin_routes` --
+    so one declaration never becomes two endpoints.
+
+    Args:
+        app: the FastAPI application.
+        declarations: the route declarations the kernel collected, each tagged
+            with ``_plugin_id`` and, because the collector does it once for every
+            transport, a parsed ``_mask``.
+
+    Returns:
+        How many declarations were mounted.
+    """
+    mounted = 0
+    for declaration in declarations:
+        path = declaration["path"]
+        methods = tuple(declaration.get("methods") or ())
+        if _already_mounted(app, path, methods):
+            logger.info("Route %s %s already answers: the kernel's declaration is "
+                        "not mounted twice", path, list(methods))
+            continue
+        _mount_route(app, declaration)
+        mounted += 1
+    return mounted
+
+
+def register_declared_sockets(app, declarations) -> int:
+    """Mount the sockets the kernel collected from the plugins (keepup-121).
+
+    The same seam as `register_declared_routes`, for the other thing a plugin
+    declares. A socket the application already answers is left alone.
+
+    Args:
+        app: the FastAPI application.
+        declarations: the socket declarations the kernel collected.
+
+    Returns:
+        How many declarations were mounted.
+    """
+    mounted = 0
+    for declaration in declarations:
+        path = declaration["path"]
+        if _already_mounted(app, path):
+            logger.info("Socket %s already answers: the kernel's declaration is not "
+                        "mounted twice", path)
+            continue
+        _mount_socket(app, declaration)
+        mounted += 1
+    return mounted
+
+
+def _mount_route(app, declaration):
+    """Turn one declared route into an endpoint, having checked it first.
+
+    One implementation for every declaration, whatever collected it -- the
+    manager of the 0.3.0 path or the kernel's catalogue (keepup-21, keepup-121).
+    A declaration the route runtime refuses -- a permission on a route nobody
+    signs in to, a mask naming a parameter the handler does not take -- is a
+    mistake found at the start, rather than a route that quietly goes missing
+    (keepup-102).
+
+    Args:
+        app: the FastAPI application.
+        declaration: the route as the plugin declared it. The kernel's collector
+            leaves a parsed ``_mask`` on it; a declaration from anywhere else is
+            checked here instead of trusted.
+
+    Raises:
+        ValueError: when the declaration is one the runtime refuses.
+    """
+    route = declaration
+    handler = route['handler']
+    path = route['path']
+    methods = route['methods']
+    require_auth = route.get('require_auth', True)
+    is_upload = route.get('is_upload', False)
+    permission = route.get('permission')
+    audit = route.get('audit', True)
+    response_media_type = route.get('response_media_type')
+    if response_media_type is not None and (
+            not isinstance(response_media_type, str) or not response_media_type.strip()):
+        raise ValueError(
+            f"{path}: response_media_type is a media type, like 'text/plain'")
+    if response_media_type is not None and route.get('raw_request'):
+        raise ValueError(
+            f"{path}: a raw_request route answers with a Response of its own; "
+            "response_media_type would be ignored. Drop one of the two.")
+    if permission is not None:
+        # A right needs somebody to hold it: on a route nobody signs in to,
+        # or one that signs itself in, it would be a check that never runs.
+        if not isinstance(permission, str) or not permission.strip():
+            raise ValueError(f"{path}: permission must be a non-empty string")
+        if route.get('raw_request') or not require_auth:
+            raise ValueError(
+                f"{path}: a route that declares a permission must be signed in by "
+                "the framework -- drop require_auth: false or raw_request, or the "
+                "permission")
+
+    logger.info(
+        f"Registering route {path} - methods: {methods}, auth: {require_auth}, upload: {is_upload}")
+
+    # The kernel parsed and checked the mask when it collected the route,
+    # for every transport there will ever be (keepup-102); a route that
+    # reaches here without one was declared by something else, and is
+    # checked the same way rather than trusted.
+    mask = route.get('_mask')
+    if mask is None:
+        try:
+            mask = route_mask.parse(route.get(route_mask.MASK_FIELD), path)
+            route_mask.check_signature(handler, mask)
+        except route_mask.MaskError as error:
+            # The same loudness as the raw_request check below: a mask naming
+            # a parameter the handler does not take is a typo, and finding it
+            # on a request would mean hearing about it from a user.
+            raise ValueError(f"{path}: {error}")
+
+    if route.get('raw_request'):
+        # A raw route authenticates inside the handler -- it is handed the
+        # Request and nothing else. Declaring require_auth on it therefore
+        # promises a check the framework does not make, and the start-up
+        # line used to print auth=True over an open route (keepup-12).
+        if route.get('require_auth') is True:
+            raise ValueError(
+                f"{path}: a raw_request route cannot also declare "
+                "require_auth -- the handler receives the Request and "
+                "authenticates itself. Drop one of the two.")
+        require_auth = False
+        wrapper = raw_request_wrapper(handler)
+    else:
+        wrapper = create_wrapper(handler, path, methods, require_auth, is_upload, mask,
+                                 permission, audit=audit,
+                                 response_media_type=response_media_type)
+
+    # What the route says about its body: its own limit, or that it reads
+    # the body itself (keepup/body_limit.py).
+    declare_limit(wrapper, route)
+
+    app.add_api_route(
+        path,
+        wrapper,
+        methods=methods,
+        include_in_schema=route.get('include_in_schema', True)
+    )
+
+    logger.info(
+        f"Registered plugin route: {path} - {methods} (auth={require_auth}, upload={is_upload})")
+
+
+def _mount_socket(app, declaration):
+    """Turn one declared socket into a route on the application.
+
+    The other half of the same seam: the kernel collects what a plugin declared,
+    and this is where HTTP binds it. Kept beside `_mount_route` because one
+    declaration should have one way in, whatever collected it.
+
+    Args:
+        app: the FastAPI application.
+        declaration: the socket as the plugin declared it.
+    """
+    ws_route = declaration
+    path = ws_route['path']
+    handler = ws_route['handler']
+    # Off by default, unlike HTTP routes: sockets of agents and guests carry
+    # tokens of their own and would be refused by the panel's sign-in rule.
+    if ws_route.get('require_auth', False):
+        handler = signed_in_websocket(handler)
+    _register_websocket(app, path, handler)
+    logger.info(f"Registered WebSocket plugin route: {path} "
+                f"(auth={bool(ws_route.get('require_auth', False))})")
+
+
+def _already_mounted(app, path, methods=None) -> bool:
+    """Whether the application already answers this address, and these verbs.
+
+    Asked before a kernel-collected declaration is mounted: the framework's own
+    routes and the ones a PluginManager bound are registered first, and a path
+    registered twice is an application that answers twice. A socket is asked
+    about by path alone -- it has no methods of its own.
+
+    Args:
+        app: the FastAPI application.
+        path: the address.
+        methods: the verbs, or None for a socket.
+
+    Returns:
+        True when the application already has it.
+    """
+    for route in getattr(app, "routes", ()):
+        if getattr(route, "path", None) != path:
+            continue
+        existing = getattr(route, "methods", None)
+        if methods is None:
+            if not existing:
+                return True
+            continue
+        if tuple(sorted(existing or ())) == tuple(sorted(methods)):
+            return True
+    return False
 
 
 def _register_websocket(app, path, handler):

{keepup_http-0.5.0 → keepup_http-0.6.0}/keepup_http/static/index_nebula.html

@@ -276,6 +276,8 @@
             </div>
         </div>
     </div>
+    <!-- The second factor, before the shell that uses it (keepup-176). -->
+    <script src="/keepup-static/js/mfa_panel.js"></script>
     <script src="/keepup-static/js/main_new.js"></script>
 </body>
 

{keepup_http-0.5.0 → keepup_http-0.6.0}/keepup_http/static/index_new.html

@@ -269,6 +269,8 @@
             </div>
         </div>
     </div>
+    <!-- The second factor, before the shell that uses it (keepup-176). -->
+    <script src="/keepup-static/js/mfa_panel.js"></script>
     <script src="/keepup-static/js/main_new.js"></script>
 </body>
 

{keepup_http-0.5.0 → keepup_http-0.6.0}/keepup_http/static/js/main_new.js

@@ -77,13 +77,11 @@ const ROLE_CLIENT = 'CLIENT';
 //
 // A user holds a set of roles, and the panel decides by the set: somebody who is
 // both an administrator and a client holds two, and comparing one field with
-// ROLE_ADMIN would have made them choose. `role` is the deprecated mirror of the
-// set and is still the answer for a user an application assembled itself; it
-// goes away in keepup 0.3.0 (keepup-51). Cut out by these markers and executed
-// under node -- see tests/user_roles_tests.py.
+// ROLE_ADMIN would have made them choose. The set is the only answer, in the
+// answers and in the table (keepup-51, keepup-168). Cut out by these markers and
+// executed under node -- see tests/user_roles_tests.py.
 function userRolesOf(user) {
-    if (user && Array.isArray(user.roles) && user.roles.length) return user.roles;
-    return user && user.role ? [user.role] : [];
+    return user && Array.isArray(user.roles) ? user.roles : [];
 }
 
 function userHasRole(user, role) {
@@ -1189,6 +1187,21 @@ function setupAuthForms() {
     // Updated sign-in form handler
     document.getElementById('loginForm').addEventListener('submit', function (e) {
         e.preventDefault();
+        // The password earned a challenge, not a session: the same form now
+        // carries the code (keepup-176).
+        if (window.MfaPanel && MfaPanel.challengeToken()) {
+            const code = document.getElementById('loginCode');
+            MfaPanel.verify(code ? code.value : '').then(function (result) {
+                if (result.ok) {
+                    finishSignIn(result.data);
+                } else {
+                    showAuthMessage(result.data.detail || 'That code is not right', 'error');
+                }
+            }).catch(function (error) {
+                showAuthMessage('Network error: ' + error, 'error');
+            });
+            return;
+        }
         const username = document.getElementById('loginUsername').value;
         const password = document.getElementById('loginPassword').value;
         login(username, password);
@@ -1295,26 +1308,20 @@ async function login(username, password) {
         const data = await response.json();
 
         if (response.ok) {
-            localStorage.setItem('authToken', SESSION_MARKER);
-            scheduleSessionRefresh(data.expires_in);
-            const userResponse = await fetch('/api/auth/me');
-
-            if (userResponse.ok) {
-                const userData = await userResponse.json();
-                currentUser = userData;
-                updateUIAfterAuth();
-                closeAuthModal();
-                if (!(await ensureAgreements())) {
-                    return;
+            // A confirmed second factor answers here with a challenge, not a
+            // session: no marker, no refresh timer, no /me without a cookie
+            // (keepup-176). Before this, the panel called that a success and
+            // then showed "Failed to get user data".
+            if (data.mfa_required) {
+                if (window.MfaPanel) {
+                    MfaPanel.showChallenge(data.mfa_token);
+                    showAuthMessage('Enter the code from your authenticator app.', 'info');
+                } else {
+                    showAuthMessage('This panel cannot ask for the second factor.', 'error');
                 }
-                await loadModules();
-                refreshEntireUI();
-
-                closeAuthModal();
-                showAuthMessage('Signed in successfully!', 'success');
-            } else {
-                showAuthMessage('Failed to get user data', 'error');
+                return;
             }
+            await finishSignIn(data);
         } else {
             showAuthMessage(data.detail || 'Sign-in failed', 'error');
         }
@@ -1323,6 +1330,35 @@ async function login(username, password) {
     }
 }
 
+async function finishSignIn(data) {
+    // The one place a sign-in becomes a session in this browser, whichever
+    // door it came through: password, or password and a code (keepup-176).
+    if (!data || !data.access_token) {
+        showAuthMessage('Sign-in failed: the server answered without a session.', 'error');
+        return;
+    }
+    localStorage.setItem('authToken', SESSION_MARKER);
+    scheduleSessionRefresh(data.expires_in);
+    const userResponse = await fetch('/api/auth/me');
+
+    if (userResponse.ok) {
+        const userData = await userResponse.json();
+        currentUser = userData;
+        updateUIAfterAuth();
+        closeAuthModal();
+        if (!(await ensureAgreements())) {
+            return;
+        }
+        await loadModules();
+        refreshEntireUI();
+
+        closeAuthModal();
+        showAuthMessage('Signed in successfully!', 'success');
+    } else {
+        showAuthMessage('Failed to get user data', 'error');
+    }
+}
+
 function togglePasswordVisibility(inputId) {
     const passwordInput = document.getElementById(inputId);
     const toggleButton = document.getElementById(inputId + 'Toggle');
@@ -1540,6 +1576,7 @@ async function logout() {
     }
     localStorage.removeItem('authToken');
     localStorage.removeItem('auth_token');
+    if (window.MfaPanel) MfaPanel.clearChallenge();
     currentUser = null;
     headerBadge = null;
     updateUIAfterAuth();
@@ -1812,6 +1849,9 @@ document.head.appendChild(styleSheet);
 
 document.addEventListener('DOMContentLoaded', function() {
     initializeApp();
+    if (window.MfaPanel) {
+        MfaPanel.install();
+    }
     checkAuth();
 });
 

keepup_http-0.6.0/keepup_http/static/js/mfa_panel.js

@@ -0,0 +1,342 @@
+// The second factor, seen by a person (keepup-176).
+//
+// The server has answered the API since keepup-174: a confirmed account gets
+// `mfa_required` and a five-minute challenge instead of a session, and the MFA
+// endpoints enrol, confirm and disable the factor. This file is the other half:
+// the code field the sign-in form grows after the password, and the screen that
+// puts a secret into an authenticator app and reads it back.
+//
+// It builds its elements rather than shipping markup in a page: the same script
+// is loaded by every theme, and a theme that replaces the sign-in form still
+// gets the second factor. Text is written with textContent, never spliced into
+// markup.
+(function () {
+    'use strict';
+
+    const state = {challenge: null, busy: false};
+
+    function node(tag, className, text) {
+        const element = document.createElement(tag);
+        if (className) element.className = className;
+        if (text !== undefined) element.textContent = text;
+        return element;
+    }
+
+    function payloadFor(value) {
+        const code = String(value || '').trim();
+        if (!code) return null;
+        // A recovery code is the only thing people type with a dash. The
+        // server accepts both fields and checks the value; this only names the
+        // one the person meant.
+        return /^[A-Za-z0-9]{4}-[A-Za-z0-9]{4}$/.test(code)
+            ? {recovery_code: code}
+            : {code: code};
+    }
+
+    async function request(path, body) {
+        const answer = await fetch(path, {
+            method: body === undefined ? 'GET' : 'POST',
+            headers: {'Content-Type': 'application/json'},
+            body: body === undefined ? undefined : JSON.stringify(body)
+        });
+        let data = {};
+        try {
+            data = await answer.json();
+        } catch (error) {
+            data = {detail: answer.statusText || 'The server did not answer'};
+        }
+        return {ok: answer.ok, status: answer.status, data: data};
+    }
+
+    // --- the code field on the sign-in form ---------------------------------
+
+    function challengeElements() {
+        return {
+            form: document.getElementById('loginForm'),
+            block: document.getElementById('mfaStep'),
+            input: document.getElementById('loginCode'),
+            username: document.getElementById('loginUsername'),
+            password: document.getElementById('loginPassword')
+        };
+    }
+
+    function installChallenge() {
+        const found = challengeElements();
+        if (!found.form || found.block || !found.password) return null;
+
+        const block = node('div', 'mb-6 hidden');
+        block.id = 'mfaStep';
+        block.appendChild(node('p', 'text-sm text-gray-600 mb-2',
+            'Enter the six-digit code from your authenticator app.'));
+        const input = node('input', 'w-full border border-gray-300 rounded-lg px-4 py-3 focus:outline-none focus:ring-2 focus:ring-blue-500');
+        input.id = 'loginCode';
+        input.type = 'text';
+        input.inputMode = 'numeric';
+        input.autocomplete = 'one-time-code';
+        input.placeholder = '000000';
+        block.appendChild(input);
+        block.appendChild(node('p', 'mt-2 text-xs text-gray-500',
+            'Lost the device? Enter one of your recovery codes instead.'));
+        const back = node('button', 'mt-3 text-sm text-blue-600 hover:underline', 'Back to the password');
+        back.type = 'button';
+        back.addEventListener('click', function () {
+            clearChallenge();
+            if (found.username) found.username.focus();
+        });
+        block.appendChild(back);
+
+        (found.password.closest('.mb-6') || found.password.parentElement)
+            .insertAdjacentElement('afterend', block);
+        return block;
+    }
+
+    function setSubmitLabel(text) {
+        const {form} = challengeElements();
+        const submit = form && form.querySelector('button[type="submit"]');
+        if (submit) submit.textContent = text;
+    }
+
+    function showChallenge(token) {
+        state.challenge = token || null;
+        installChallenge();
+        const {block, input, username, password} = challengeElements();
+        if (username) (username.closest('.mb-4') || username.parentElement).classList.add('hidden');
+        if (password) (password.closest('.mb-6') || password.parentElement).classList.add('hidden');
+        if (block) block.classList.remove('hidden');
+        setSubmitLabel('Verify');
+        if (input) {
+            input.value = '';
+            input.focus();
+        }
+    }
+
+    function clearChallenge() {
+        state.challenge = null;
+        const {block, input, username, password} = challengeElements();
+        if (username) (username.closest('.mb-4') || username.parentElement).classList.remove('hidden');
+        if (password) (password.closest('.mb-6') || password.parentElement).classList.remove('hidden');
+        if (block) block.classList.add('hidden');
+        if (input) input.value = '';
+        setSubmitLabel('Sign in');
+    }
+
+    async function verify(value) {
+        const payload = payloadFor(value);
+        if (!state.challenge || !payload) {
+            return {ok: false, status: 400, data: {detail: 'Enter a code first'}};
+        }
+        return request('/api/auth/mfa/verify', {mfa_token: state.challenge, ...payload});
+    }
+
+    // --- the account screen -------------------------------------------------
+
+    let modal = null;
+
+    function buildModal() {
+        if (modal) return modal;
+
+        const overlay = node('div', 'modal-overlay hidden');
+        overlay.id = 'mfaModal';
+        const content = node('div', 'modal-content');
+        const header = node('div', 'modal-header');
+        header.appendChild(node('h2', 'modal-title', 'Two-factor authentication'));
+        const close = node('button', 'close-btn');
+        close.type = 'button';
+        close.setAttribute('aria-label', 'Close');
+        const icon = node('i');
+        icon.setAttribute('data-feather', 'x');
+        close.appendChild(icon);
+        close.addEventListener('click', closeModal);
+        header.appendChild(close);
+        content.appendChild(header);
+
+        const body = node('div', 'modal-body');
+
+        const status = node('p', 'text-sm text-gray-600 mb-4');
+        status.id = 'mfaStatus';
+        body.appendChild(status);
+
+        const enabled = node('div', 'hidden');
+        enabled.id = 'mfaEnabled';
+        enabled.appendChild(node('p', 'text-sm text-gray-600 mb-3',
+            'A code from your authenticator is required when you sign in.'));
+        const disableCode = codeInput('mfaDisableCode', 'Code from the app');
+        enabled.appendChild(disableCode);
+        const disable = node('button', 'mt-3 px-4 py-2 bg-red-600 text-white rounded-lg hover:bg-red-700', 'Disable');
+        disable.type = 'button';
+        disable.addEventListener('click', disableFactor);
+        enabled.appendChild(disable);
+        body.appendChild(enabled);
+
+        const disabled = node('div', 'hidden');
+        disabled.id = 'mfaDisabled';
+        disabled.appendChild(node('p', 'text-sm text-gray-600 mb-3',
+            'Add a second step to your sign-in. You will need an authenticator app.'));
+        const start = node('button', 'px-4 py-2 bg-blue-600 text-white rounded-lg hover:bg-blue-700', 'Set up');
+        start.type = 'button';
+        start.addEventListener('click', startFactor);
+        disabled.appendChild(start);
+        body.appendChild(disabled);
+
+        const setup = node('div', 'hidden');
+        setup.id = 'mfaSetup';
+        setup.appendChild(node('p', 'text-sm text-gray-600 mb-2',
+            'Type this secret into your authenticator app, or open the address in it.'));
+        const secret = node('code', 'block break-all bg-gray-100 rounded p-3 mb-2');
+        secret.id = 'mfaSecret';
+        setup.appendChild(secret);
+        const uri = node('code', 'block break-all text-xs bg-gray-100 rounded p-3 mb-3');
+        uri.id = 'mfaUri';
+        setup.appendChild(uri);
+        setup.appendChild(codeInput('mfaConfirmCode', 'Code from the app'));
+        const confirm = node('button', 'mt-3 px-4 py-2 bg-blue-600 text-white rounded-lg hover:bg-blue-700', 'Confirm');
+        confirm.type = 'button';
+        confirm.addEventListener('click', confirmFactor);
+        setup.appendChild(confirm);
+        body.appendChild(setup);
+
+        const recovery = node('div', 'hidden mt-4');
+        recovery.id = 'mfaRecovery';
+        recovery.appendChild(node('h3', 'font-medium text-gray-800 mb-2', 'Recovery codes'));
+        recovery.appendChild(node('p', 'text-sm text-gray-600 mb-2',
+            'Keep these somewhere safe. Each works once, and they will not be shown again.'));
+        const list = node('ul', 'font-mono text-sm bg-gray-100 rounded p-3 space-y-1');
+        list.id = 'mfaRecoveryList';
+        recovery.appendChild(list);
+        body.appendChild(recovery);
+
+        const message = node('p', 'mt-4 text-sm');
+        message.id = 'mfaMessage';
+        body.appendChild(message);
+        content.appendChild(body);
+        overlay.appendChild(content);
+        overlay.addEventListener('click', function (event) {
+            if (event.target === overlay) closeModal();
+        });
+        document.body.appendChild(overlay);
+        modal = overlay;
+        return overlay;
+    }
+
+    function codeInput(id, placeholder) {
+        const input = node('input', 'w-full border border-gray-300 rounded-lg px-4 py-3 focus:outline-none focus:ring-2 focus:ring-blue-500');
+        input.id = id;
+        input.type = 'text';
+        input.autocomplete = 'one-time-code';
+        input.placeholder = placeholder || '000000';
+        return input;
+    }
+
+    function say(text, tone) {
+        const message = document.getElementById('mfaMessage');
+        if (!message) return;
+        message.textContent = text || '';
+        message.className = 'mt-4 text-sm ' + (tone === 'error' ? 'text-red-600' : 'text-green-700');
+    }
+
+    function show(id, visible) {
+        const element = document.getElementById(id);
+        if (element) element.classList.toggle('hidden', !visible);
+    }
+
+    function openModal() {
+        buildModal();
+        modal.classList.remove('hidden');
+        say('', 'ok');
+        refreshStatus();
+        if (window.feather && window.feather.replace) window.feather.replace();
+    }
+
+    function closeModal() {
+        if (modal) modal.classList.add('hidden');
+    }
+
+    async function refreshStatus() {
+        const answer = await request('/api/auth/mfa');
+        const status = document.getElementById('mfaStatus');
+        const enabled = answer.ok && answer.data.enabled;
+        if (status) status.textContent = enabled
+            ? 'Two-factor authentication is on.'
+            : 'Two-factor authentication is off.';
+        show('mfaEnabled', enabled);
+        show('mfaDisabled', !enabled);
+        if (!enabled) show('mfaSetup', false);
+    }
+
+    async function startFactor() {
+        const answer = await request('/api/auth/mfa/totp/start', {});
+        if (!answer.ok) return say(answer.data.detail || 'Could not start setup', 'error');
+        document.getElementById('mfaSecret').textContent = answer.data.secret || '';
+        document.getElementById('mfaUri').textContent = answer.data.otpauth_uri || '';
+        show('mfaSetup', true);
+        show('mfaDisabled', false);
+        show('mfaRecovery', false);
+        say('Scan the address, then enter the code it shows.', 'ok');
+    }
+
+    async function confirmFactor() {
+        const code = document.getElementById('mfaConfirmCode');
+        const answer = await request('/api/auth/mfa/totp/confirm', {code: code ? code.value : ''});
+        if (!answer.ok) return say(answer.data.detail || 'That code is not right', 'error');
+        const list = document.getElementById('mfaRecoveryList');
+        list.replaceChildren(...(answer.data.recovery_codes || []).map(value => {
+            const item = node('li', '', value);
+            return item;
+        }));
+        show('mfaSetup', false);
+        show('mfaRecovery', true);
+        show('mfaEnabled', true);
+        show('mfaDisabled', false);
+        const status = document.getElementById('mfaStatus');
+        if (status) status.textContent = 'Two-factor authentication is on.';
+        say('Two-factor authentication is on. Save the recovery codes now.', 'ok');
+    }
+
+    async function disableFactor() {
+        const code = document.getElementById('mfaDisableCode');
+        const answer = await request('/api/auth/mfa/totp/disable', {code: code ? code.value : ''});
+        if (!answer.ok) return say(answer.data.detail || 'That code is not right', 'error');
+        show('mfaRecovery', false);
+        say('Two-factor authentication is off.', 'ok');
+        refreshStatus();
+    }
+
+    function installAccountButton() {
+        const logout = document.querySelector('[data-action="shell.logout"]');
+        if (!logout || document.getElementById('mfaOpen')) return;
+        const button = node('button', 'ml-2 p-2 text-gray-600 rounded-full hover:bg-gray-100 hover:text-blue-600 transition-colors duration-150');
+        button.id = 'mfaOpen';
+        button.type = 'button';
+        button.title = 'Two-factor authentication';
+        button.setAttribute('aria-label', 'Two-factor authentication');
+        const icon = node('i');
+        icon.setAttribute('data-feather', 'shield');
+        button.appendChild(icon);
+        button.addEventListener('click', openModal);
+        logout.parentElement.insertBefore(button, logout);
+        if (window.feather && window.feather.replace) window.feather.replace();
+    }
+
+    function install() {
+        installChallenge();
+        installAccountButton();
+        document.addEventListener('keydown', function (event) {
+            if (event.key === 'Escape' && modal && !modal.classList.contains('hidden')) closeModal();
+        });
+    }
+
+    window.MfaPanel = {
+        install: install,
+        payloadFor: payloadFor,
+        verify: verify,
+        showChallenge: showChallenge,
+        clearChallenge: clearChallenge,
+        challengeToken: () => state.challenge,
+        open: openModal,
+        close: closeModal
+    };
+
+    // The shell calls install() once the page is ready: both pages that load
+    // this file also load main_new.js, and a second listener would install the
+    // second factor twice (keepup-176).
+})();

{keepup_http-0.5.0 → keepup_http-0.6.0}/keepup_http.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: keepup-http
-Version: 0.5.0
+Version: 0.6.0
 Summary: The way into the application over HTTP: the application, its routes and its middleware.
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown

{keepup_http-0.5.0 → keepup_http-0.6.0}/keepup_http.egg-info/SOURCES.txt

@@ -25,6 +25,7 @@ keepup_http/static/js/aos.js
 keepup_http/static/js/feather-icons.js
 keepup_http/static/js/layout_bootstrap.js
 keepup_http/static/js/main_new.js
+keepup_http/static/js/mfa_panel.js
 keepup_http/static/js/tailwind.js
 keepup_http/static/modules/css/background_tasks.css
 keepup_http/static/modules/css/cluster.css

{keepup_http-0.5.0 → keepup_http-0.6.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "keepup-http"
-version = "0.5.0"
+version = "0.6.0"
 description = "The way into the application over HTTP: the application, its routes and its middleware."
 readme = "README.md"
 requires-python = ">=3.11"