leaf-portal 0.0.0.5__tar.gz

leaf_portal-0.0.0.5/PKG-INFO

@@ -0,0 +1,15 @@
+Metadata-Version: 2.4
+Name: leaf-portal
+Version: 0.0.0.5
+Summary: LEAF Portal
+Requires-Python: >=3.12,<4.0
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Dist: asyncpg (>=0.29.0)
+Requires-Dist: bcrypt (>=4.2.0)
+Requires-Dist: nicegui[testing] (>=3.8.0)
+Requires-Dist: pandas (>=2.0.0)
+Requires-Dist: plotly (>=5.20.0)
+Requires-Dist: python-dotenv (>=1.0.0)

leaf_portal-0.0.0.5/leaf_portal/__main__.py

@@ -0,0 +1,16 @@
+"""Entry point for `leaf-portal` CLI and `python -m leaf_portal`."""
+
+import sys
+import runpy
+from pathlib import Path
+
+
+def main():
+    pkg_dir = Path(__file__).parent
+    if str(pkg_dir) not in sys.path:
+        sys.path.insert(0, str(pkg_dir))
+    runpy.run_path(str(pkg_dir / "main.py"), run_name="__main__")
+
+
+if __name__ == "__main__":
+    main()

leaf_portal-0.0.0.5/leaf_portal/alarm_checker.py

@@ -0,0 +1,223 @@
+import asyncio
+import logging
+from datetime import datetime, timezone
+
+import db
+import mail
+
+logger = logging.getLogger(__name__)
+
+# Base polling interval — how often the loop wakes up to see which rules are due.
+# Individual rules control their own check_interval (stored in alarm_rule.check_interval).
+_BASE_INTERVAL = 60  # seconds
+
+_OPERATORS = {
+    "<": lambda v, t: v < t,
+    ">": lambda v, t: v > t,
+    "<=": lambda v, t: v <= t,
+    ">=": lambda v, t: v >= t,
+    "=": lambda v, t: v == t,
+}
+
+
+def _condition_met(operator: str, value: float, threshold: float) -> bool:
+    fn = _OPERATORS.get(operator)
+    return fn(value, threshold) if fn else False
+
+
+async def _check_rules() -> None:
+    # Only fetch rules whose check_interval has elapsed since last_checked_at
+    rules = await db.fetch(
+        """
+        SELECT id, name, department_id, entity, metric, operator, threshold, check_interval
+        FROM alarm_rule
+        WHERE enabled = TRUE
+          AND (
+              last_checked_at IS NULL
+              OR last_checked_at < NOW() - (check_interval || ' seconds')::INTERVAL
+          )
+        """
+    )
+
+    for rule in rules:
+        rule_id = str(rule["id"])
+        rule_name = rule["name"]
+        department_id = str(rule["department_id"])
+        entity = rule["entity"]
+        metric = rule["metric"]
+        operator = rule["operator"]
+        threshold = rule["threshold"]
+
+        # Stamp last_checked_at immediately so concurrent checker instances don't double-fire
+        await db.execute(
+            "UPDATE alarm_rule SET last_checked_at = NOW() WHERE id = $1::uuid",
+            rule_id,
+        )
+
+        if operator == "no_data":
+            if metric:
+                latest = await db.fetchrow(
+                    """
+                    SELECT MAX(time) AS last_seen
+                    FROM sensor_data
+                    WHERE department_id = $1::uuid
+                      AND entity        = $2
+                      AND metric        = $3
+                    """,
+                    department_id,
+                    entity,
+                    metric,
+                )
+            else:
+                latest = await db.fetchrow(
+                    """
+                    SELECT MAX(time) AS last_seen
+                    FROM sensor_data
+                    WHERE department_id = $1::uuid
+                      AND entity        = $2
+                    """,
+                    department_id,
+                    entity,
+                )
+            if latest is None or latest["last_seen"] is None:
+                breach = True
+                current_value = None
+                occurred_at = None
+            else:
+                minutes_ago = (
+                    datetime.now(timezone.utc) - latest["last_seen"]
+                ).total_seconds() / 60
+                breach = minutes_ago > threshold
+                current_value = round(minutes_ago, 1)
+                occurred_at = latest["last_seen"]
+        else:
+            # Most recent sensor reading for this rule's target
+            latest = await db.fetchrow(
+                """
+                SELECT value, time
+                FROM sensor_data
+                WHERE department_id = $1::uuid
+                  AND entity        = $2
+                  AND metric        = $3
+                ORDER BY time DESC
+                LIMIT 1
+                """,
+                department_id,
+                entity,
+                metric,
+            )
+
+            if latest is None:
+                continue
+
+            current_value = latest["value"]
+            occurred_at = latest["time"]
+            breach = _condition_met(operator, current_value, threshold)
+
+        await db.execute(
+            "UPDATE alarm_rule SET last_checked_value = $1 WHERE id = $2::uuid",
+            current_value,
+            rule_id,
+        )
+
+        # Last alarm event for this rule (determines current state)
+        last_event = await db.fetchrow(
+            """
+            SELECT status
+            FROM alarm_event
+            WHERE rule_id = $1::uuid
+            ORDER BY occurred_at DESC
+            LIMIT 1
+            """,
+            rule_id,
+        )
+
+        last_status = last_event["status"] if last_event else None
+
+        if breach and last_status != "triggered":
+            await db.execute(
+                "INSERT INTO alarm_event (rule_id, status, value) VALUES ($1::uuid, 'triggered', $2)",
+                rule_id,
+                current_value,
+            )
+
+            recipients = await db.fetch(
+                """
+                SELECT ua.email, ua.name
+                FROM alarm_recipient ar
+                JOIN user_account ua ON ua.id = ar.user_id
+                WHERE ar.rule_id = $1::uuid
+                """,
+                rule_id,
+            )
+
+            subject = f"LEAF Alarm: {rule_name}"
+            if operator == "no_data":
+                metric_line = f"Metric    : {metric}\n" if metric else ""
+                body = (
+                    f'Alarm "{rule_name}" has been triggered.\n\n'
+                    f"Entity    : {entity}\n"
+                    + metric_line
+                    + f"Condition : no data for > {threshold:.0f} minutes\n"
+                ) + (
+                    f"Silent for: {current_value} minutes\n"
+                    f"Last seen : {occurred_at.strftime('%Y-%m-%d %H:%M:%S UTC')}\n"
+                    if occurred_at
+                    else "Last seen : never\n"
+                )
+            else:
+                body = (
+                    f'Alarm "{rule_name}" has been triggered.\n\n'
+                    f"Entity    : {entity}\n"
+                    f"Metric    : {metric}\n"
+                    f"Condition : {metric} {operator} {threshold}\n"
+                    f"Value     : {current_value}\n"
+                    f"Time      : {occurred_at.strftime('%Y-%m-%d %H:%M:%S UTC')}\n"
+                )
+
+            for recipient in recipients:
+                try:
+                    await mail.send_email(
+                        to=recipient["email"], subject=subject, body=body
+                    )
+                except Exception:
+                    logger.exception(
+                        "Failed to send alarm email to %s for rule %s",
+                        recipient["email"],
+                        rule_id,
+                    )
+
+            logger.info(
+                "Alarm triggered: rule=%s entity=%s metric=%s operator=%s",
+                rule_id,
+                entity,
+                metric,
+                operator,
+            )
+
+        elif not breach and last_status == "triggered":
+            await db.execute(
+                "INSERT INTO alarm_event (rule_id, status, value) VALUES ($1::uuid, 'resolved', $2)",
+                rule_id,
+                current_value,
+            )
+            logger.info(
+                "Alarm resolved: rule=%s entity=%s metric=%s operator=%s",
+                rule_id,
+                entity,
+                metric,
+                operator,
+            )
+
+
+async def alarm_checker_loop() -> None:
+    logger.info("Alarm checker waiting for schema...")
+    while not await db.schema_applied():
+        await asyncio.sleep(5)
+    logger.info("Alarm checker started (base interval=%ds)", _BASE_INTERVAL)
+    while True:
+        try:
+            await _check_rules()
+        except Exception:
+            logger.exception("Alarm checker error")
+        await asyncio.sleep(_BASE_INTERVAL)

leaf_portal-0.0.0.5/leaf_portal/auth.py

@@ -0,0 +1,158 @@
+import bcrypt
+import secrets
+from datetime import datetime, timedelta, timezone
+from nicegui import app
+from typing import Optional
+import db
+
+
+async def verify_login(email: str, password: str) -> Optional[dict]:
+    """Return user dict if credentials are valid, else None."""
+    row = await db.fetchrow(
+        """
+        SELECT id, email, name, is_superadmin, password_hash
+        FROM user_account
+        WHERE email = $1
+        """,
+        email.lower().strip(),
+    )
+    if not row or not row["password_hash"]:
+        return None
+    if bcrypt.checkpw(password.encode(), row["password_hash"].encode()):
+        await db.execute(
+            "UPDATE user_account SET last_login_at = now() WHERE id = $1",
+            row["id"],
+        )
+        return {**dict(row), "id": str(row["id"])}
+    return None
+
+
+async def hash_password(password: str) -> str:
+    return bcrypt.hashpw(password.encode(), bcrypt.gensalt()).decode()
+
+
+async def set_password(user_id: str, password: str) -> None:
+    hashed = await hash_password(password)
+    await db.execute(
+        "UPDATE user_account SET password_hash = $1 WHERE id = $2",
+        hashed,
+        user_id,
+    )
+
+
+def current_user() -> Optional[dict]:
+    return app.storage.user.get("user")
+
+
+async def sync_session() -> None:
+    """Re-fetch the current user from the DB and update the session cache."""
+    if not db.is_connected():
+        return
+    user = current_user()
+    if not user:
+        return
+    fresh = await db.fetchrow(
+        "SELECT id, email, name, is_superadmin FROM user_account WHERE id = $1",
+        user["id"],
+    )
+    if fresh:
+        dept_admin_row = await db.fetchrow(
+            "SELECT 1 FROM user_department WHERE user_id = $1::uuid AND role = 'admin' LIMIT 1",
+            str(fresh["id"]),
+        )
+        app.storage.user["user"] = {
+            **dict(fresh),
+            "id": str(fresh["id"]),
+            "is_dept_admin": dept_admin_row is not None,
+        }
+    else:
+        # User was deleted — clear session
+        app.storage.user.clear()
+
+
+def is_authenticated() -> bool:
+    if not db.is_connected():
+        return False
+    return current_user() is not None
+
+
+def is_superadmin() -> bool:
+    user = current_user()
+    return bool(user and user.get("is_superadmin"))
+
+
+def is_dept_admin() -> bool:
+    user = current_user()
+    return bool(user and user.get("is_dept_admin"))
+
+
+async def get_admin_department_ids(user_id: str) -> list:
+    """Return department IDs where the user has role='admin'."""
+    rows = await db.fetch(
+        "SELECT department_id FROM user_department WHERE user_id = $1::uuid AND role = 'admin'",
+        user_id,
+    )
+    return [str(r["department_id"]) for r in rows]
+
+
+async def create_reset_token(email: str) -> Optional[str]:
+    """Generate a password reset token for the given email. Returns token or None if not found."""
+    row = await db.fetchrow(
+        "SELECT id FROM user_account WHERE email = $1",
+        email.lower().strip(),
+    )
+    if not row:
+        return None
+    token = secrets.token_urlsafe(32)
+    expires_at = datetime.now(timezone.utc) + timedelta(hours=1)
+    await db.execute(
+        "INSERT INTO password_reset_token (user_id, token, expires_at) VALUES ($1, $2, $3)",
+        row["id"],
+        token,
+        expires_at,
+    )
+    return token
+
+
+async def verify_reset_token(token: str) -> Optional[dict]:
+    """Return user + token info if the token is valid, unused, and not expired."""
+    row = await db.fetchrow(
+        """
+        SELECT ua.id, ua.email, ua.name, prt.id AS token_id
+        FROM   password_reset_token prt
+        JOIN   user_account ua ON ua.id = prt.user_id
+        WHERE  prt.token      = $1
+          AND  prt.used_at    IS NULL
+          AND  prt.expires_at > now()
+        """,
+        token,
+    )
+    return dict(row) if row else None
+
+
+async def consume_reset_token(token_id: str, user_id: str, new_password: str) -> None:
+    """Mark the token as used and update the user's password atomically."""
+    hashed = await hash_password(new_password)
+    await db.execute(
+        "UPDATE password_reset_token SET used_at = now() WHERE id = $1",
+        token_id,
+    )
+    await db.execute(
+        "UPDATE user_account SET password_hash = $1 WHERE id = $2",
+        hashed,
+        user_id,
+    )
+
+
+async def get_user_organisations(user_id: str) -> list:
+    """Return organisations the user is a member of (with role)."""
+    return await db.fetch(
+        """
+        SELECT i.id, i.name, ui.role
+        FROM user_organisation ui
+        JOIN organisation i ON i.id = ui.organisation_id
+        WHERE ui.user_id = $1
+        ORDER BY i.name
+        """,
+        user_id,
+    )

leaf_portal-0.0.0.5/leaf_portal/db.py

@@ -0,0 +1,117 @@
+import importlib.resources
+import os
+import asyncpg
+from typing import Optional
+
+_pool: Optional[asyncpg.Pool] = None
+
+
+async def init_pool() -> None:
+    global _pool
+    _pool = await asyncpg.create_pool(
+        host=os.environ.get("PGHOST", "timescaledb"),
+        port=int(os.environ.get("PGPORT", 5432)),
+        database=os.environ.get("PGDATABASE", "leaf"),
+        user=os.environ.get("PGUSER", "postgres"),
+        password=os.environ.get("PGPASSWORD", ""),
+        min_size=2,
+        max_size=10,
+    )
+
+
+def is_connected() -> bool:
+    return _pool is not None
+
+
+async def schema_applied() -> bool:
+    """Return True if our schema tables exist (no exceptions raised)."""
+    if _pool is None:
+        return False
+    result = await fetchval(
+        "SELECT EXISTS (SELECT 1 FROM information_schema.tables"
+        " WHERE table_schema = 'public' AND table_name = 'user_account')"
+    )
+    return bool(result)
+
+
+async def connect(
+    host: str, port: int, user: str, password: str, database: str
+) -> None:
+    global _pool
+    _pool = await asyncpg.create_pool(
+        host=host,
+        port=port,
+        database=database,
+        user=user,
+        password=password,
+        min_size=2,
+        max_size=10,
+    )
+
+
+async def apply_schema() -> None:
+    sql = importlib.resources.files("leaf_portal").joinpath("deploy.sql").read_text()
+    async with _pool.acquire() as conn:
+        await conn.execute(sql)
+
+
+async def close_pool() -> None:
+    if _pool:
+        await _pool.close()
+
+
+async def fetch(sql: str, *args) -> list:
+    async with _pool.acquire() as conn:
+        return await conn.fetch(sql, *args)
+
+
+async def fetchrow(sql: str, *args) -> Optional[asyncpg.Record]:
+    async with _pool.acquire() as conn:
+        return await conn.fetchrow(sql, *args)
+
+
+async def fetchval(sql: str, *args):
+    async with _pool.acquire() as conn:
+        return await conn.fetchval(sql, *args)
+
+
+async def execute(sql: str, *args) -> str:
+    async with _pool.acquire() as conn:
+        return await conn.execute(sql, *args)
+
+
+async def get_setting(key: str, namespace: str = "general") -> str | None:
+    if _pool is None:
+        return None
+    return await fetchval(
+        "SELECT value FROM setting WHERE namespace = $1 AND key = $2",
+        namespace,
+        key,
+    )
+
+
+async def set_setting(key: str, value: str, namespace: str = "general") -> None:
+    await execute(
+        """
+        INSERT INTO setting (namespace, key, value)
+        VALUES ($1, $2, $3)
+        ON CONFLICT (namespace, key) DO UPDATE SET value = EXCLUDED.value, updated_at = now()
+        """,
+        namespace,
+        key,
+        value,
+    )
+
+
+async def fetch_as_user(email: str, sql: str, *args) -> list:
+    """
+    Execute a query with RLS scoped to the given user email.
+    Uses SET LOCAL inside a transaction so the setting is connection-safe.
+    Requires a non-superuser DB account; superusers bypass RLS.
+    """
+    async with _pool.acquire() as conn:
+        async with conn.transaction():
+            await conn.execute(
+                "SELECT set_config('app.current_user_email', $1, true)", email
+            )
+            return await conn.fetch(sql, *args)