lockbot 2.0.0__py3-none-any.whl

lockbot/backend/app/admin/router.py

@@ -0,0 +1,224 @@
+"""
+Admin API routes.
+"""
+
+import contextlib
+import os
+import shutil
+import tempfile
+from datetime import datetime
+
+from fastapi import APIRouter, Depends, HTTPException
+from fastapi.responses import FileResponse
+from sqlalchemy.orm import Session
+from starlette.background import BackgroundTask
+
+from lockbot.backend.app.auth.dependencies import can_manage_user, require_admin, require_super_admin
+from lockbot.backend.app.auth.models import User
+from lockbot.backend.app.auth.router import _generate_password, _hash_password
+from lockbot.backend.app.auth.schemas import (
+    AdminCreateUser,
+    AdminEditUser,
+    PasswordResetOut,
+    UserOut,
+)
+from lockbot.backend.app.bots.models import Bot
+from lockbot.backend.app.database import get_db
+
+router = APIRouter(prefix="/api/admin", tags=["admin"])
+
+ADMIN_VISIBLE_ROLES = ("admin", "user")
+SUPER_ADMIN_VISIBLE_ROLES = ("super_admin", "admin", "user")
+ADMIN_CREATABLE_ROLES = ("user",)
+
+
+@router.post("/users", response_model=PasswordResetOut, status_code=201)
+def admin_create_user(
+    body: AdminCreateUser,
+    operator: User = Depends(require_admin),
+    db: Session = Depends(get_db),
+):
+    """Admin creates a user. Super_admin can create admin/user; admin can only create user."""
+    # Non-super_admin can only create regular users
+    if operator.role != "super_admin" and body.role not in ADMIN_CREATABLE_ROLES:
+        raise HTTPException(status_code=403, detail="Cannot create user with this role")
+
+    if body.role not in SUPER_ADMIN_VISIBLE_ROLES:
+        raise HTTPException(status_code=400, detail=f"Invalid role, must be one of {SUPER_ADMIN_VISIBLE_ROLES}")
+
+    exists = db.query(User).filter(User.username == body.username).first()
+    if exists:
+        raise HTTPException(status_code=409, detail="Username already taken")
+    dup_email = db.query(User).filter(User.email == body.email).first()
+    if dup_email:
+        raise HTTPException(status_code=409, detail="Email already taken")
+
+    raw_password = _generate_password()
+    user = User(
+        username=body.username,
+        email=body.email,
+        password_hash=_hash_password(raw_password),
+        role=body.role,
+        max_running_bots=body.max_running_bots,
+        must_change_password=True,
+    )
+    db.add(user)
+    db.commit()
+    db.refresh(user)
+    return PasswordResetOut(id=user.id, username=user.username, new_password=raw_password)
+
+
+@router.get("/users", response_model=list[UserOut])
+def list_users(
+    operator: User = Depends(require_admin),
+    db: Session = Depends(get_db),
+):
+    """List users visible to the operator.
+    Super_admin sees all; admin sees only users (not admins/super_admins)."""
+    if operator.role == "super_admin":
+        return db.query(User).all()
+
+    # admin: see regular users + self
+    return db.query(User).filter((User.role == "user") | (User.id == operator.id)).all()
+
+
+@router.put("/users/{user_id}", response_model=UserOut)
+def admin_edit_user(
+    user_id: int,
+    body: AdminEditUser,
+    operator: User = Depends(require_admin),
+    db: Session = Depends(get_db),
+):
+    """Admin edits user profile."""
+    target = db.get(User, user_id)
+    if not target:
+        raise HTTPException(status_code=404, detail="User not found")
+
+    # Cannot edit users at or above your own level
+    if not can_manage_user(operator, target.role):
+        raise HTTPException(status_code=403, detail="Cannot manage this user")
+
+    if body.username is not None and body.username != target.username:
+        dup = db.query(User).filter(User.username == body.username).first()
+        if dup:
+            raise HTTPException(status_code=409, detail="Username already taken")
+        target.username = body.username
+
+    if body.email is not None and body.email != target.email:
+        dup = db.query(User).filter(User.email == body.email).first()
+        if dup:
+            raise HTTPException(status_code=409, detail="Email already taken")
+        target.email = body.email
+
+    if body.role is not None:
+        if body.role not in SUPER_ADMIN_VISIBLE_ROLES:
+            raise HTTPException(status_code=400, detail="Invalid role")
+        # Only super_admin can promote to admin
+        if body.role in ("admin", "super_admin") and operator.role != "super_admin":
+            raise HTTPException(status_code=403, detail="Only super admin can set this role")
+        target.role = body.role
+
+    if body.max_running_bots is not None:
+        target.max_running_bots = body.max_running_bots
+
+    db.commit()
+    db.refresh(target)
+    return target
+
+
+@router.put("/users/{user_id}/max-bots")
+def set_max_bots(
+    user_id: int,
+    body: dict,
+    operator: User = Depends(require_admin),
+    db: Session = Depends(get_db),
+):
+    user = db.get(User, user_id)
+    if not user:
+        raise HTTPException(status_code=404, detail="User not found")
+    if not can_manage_user(operator, user.role):
+        raise HTTPException(status_code=403, detail="Cannot manage this user")
+    user.max_running_bots = body["max_running_bots"]
+    db.commit()
+    db.refresh(user)
+    return {"id": user.id, "max_running_bots": user.max_running_bots}
+
+
+@router.post("/users/{user_id}/reset-password", response_model=PasswordResetOut)
+def admin_reset_password(
+    user_id: int,
+    operator: User = Depends(require_admin),
+    db: Session = Depends(get_db),
+):
+    """Admin resets a user's password. Returns the new plaintext password."""
+    target = db.get(User, user_id)
+    if not target:
+        raise HTTPException(status_code=404, detail="User not found")
+    if not can_manage_user(operator, target.role):
+        raise HTTPException(status_code=403, detail="Cannot manage this user")
+    raw_password = _generate_password()
+    target.password_hash = _hash_password(raw_password)
+    target.must_change_password = True
+    db.commit()
+    db.refresh(target)
+    return PasswordResetOut(id=target.id, username=target.username, new_password=raw_password)
+
+
+@router.get("/bots")
+def list_all_bots(
+    _admin: User = Depends(require_admin),
+    db: Session = Depends(get_db),
+):
+    rows = db.query(Bot, User.username).join(User, Bot.user_id == User.id).all()
+    return [
+        {c.name: getattr(bot, c.name) for c in bot.__table__.columns} | {"owner": username} for bot, username in rows
+    ]
+
+
+@router.get("/stats")
+def platform_stats(
+    _admin: User = Depends(require_admin),
+    db: Session = Depends(get_db),
+):
+    total_users = db.query(User).count()
+    bots = db.query(Bot).all()
+    return {
+        "totalUsers": total_users,
+        "totalBots": len(bots),
+        "running": sum(1 for b in bots if b.status == "running"),
+        "errors": sum(1 for b in bots if b.status == "error"),
+    }
+
+
+@router.get("/backup")
+def download_backup(
+    _admin: User = Depends(require_super_admin),
+):
+    """Download full SQLite database backup (super_admin only)."""
+    from lockbot.backend.app.config import DATABASE_URL
+
+    db_url = DATABASE_URL
+    if not db_url.startswith("sqlite:///"):
+        raise HTTPException(status_code=400, detail="Backup only supported for SQLite")
+
+    db_path = db_url[len("sqlite:///") :]
+    if not os.path.exists(db_path):
+        raise HTTPException(status_code=404, detail="Database file not found")
+
+    # Copy to temp file to avoid sending a mid-write database
+    fd, tmp_path = tempfile.mkstemp(suffix=".db")
+    os.close(fd)
+    try:
+        shutil.copy2(db_path, tmp_path)
+    except BaseException:
+        with contextlib.suppress(OSError):
+            os.unlink(tmp_path)
+        raise
+
+    filename = f"lockbot_backup_{datetime.now().strftime('%Y%m%d_%H%M%S')}.db"
+    return FileResponse(
+        path=tmp_path,
+        filename=filename,
+        media_type="application/x-sqlite3",
+        background=BackgroundTask(os.unlink, tmp_path),
+    )

lockbot/backend/app/auth/dependencies.py

@@ -0,0 +1,72 @@
+"""
+JWT authentication dependencies.
+
+NOTE: This is a local auth implementation (JWT + local user table).
+To integrate with company SSO / OAuth, replace get_current_user()
+with your SSO token validation logic. All routes use
+Depends(get_current_user), so no other changes are needed.
+"""
+
+from datetime import datetime, timedelta, timezone
+
+import jwt
+from fastapi import Depends, HTTPException, status
+from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
+from sqlalchemy.orm import Session
+
+from lockbot.backend.app.auth.models import User
+from lockbot.backend.app.config import JWT_ALGORITHM, JWT_EXPIRE_MINUTES, JWT_SECRET
+from lockbot.backend.app.database import get_db
+
+_security = HTTPBearer(auto_error=False)
+
+_ROLE_LEVELS = {"super_admin": 0, "admin": 1, "user": 2}
+
+
+def create_access_token(user_id: int, must_change_password: bool = False) -> str:
+    payload = {
+        "sub": str(user_id),
+        "exp": datetime.now(timezone.utc) + timedelta(minutes=JWT_EXPIRE_MINUTES),
+        "mcp": must_change_password,
+    }
+    return jwt.encode(payload, JWT_SECRET, algorithm=JWT_ALGORITHM)
+
+
+def get_current_user(
+    credentials: HTTPAuthorizationCredentials | None = Depends(_security),
+    db: Session = Depends(get_db),
+) -> User:
+    if credentials is None:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Not authenticated")
+    token = credentials.credentials
+    try:
+        payload = jwt.decode(token, JWT_SECRET, algorithms=[JWT_ALGORITHM])
+        user_id = int(payload["sub"])
+    except (jwt.PyJWTError, KeyError, ValueError):
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid token") from None
+
+    user = db.get(User, user_id)
+    if user is None:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="User not found")
+    return user
+
+
+def require_admin(user: User = Depends(get_current_user)) -> User:
+    """Require admin or super_admin."""
+    if user.role not in ("admin", "super_admin"):
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Admin required")
+    return user
+
+
+def require_super_admin(user: User = Depends(get_current_user)) -> User:
+    """Require super_admin only."""
+    if user.role != "super_admin":
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Super admin required")
+    return user
+
+
+def can_manage_user(operator: User, target_role: str) -> bool:
+    """Check if operator can manage a user with the given role."""
+    op_level = _ROLE_LEVELS.get(operator.role, 3)
+    tgt_level = _ROLE_LEVELS.get(target_role, 3)
+    return op_level < tgt_level

lockbot/backend/app/auth/models.py

@@ -0,0 +1,24 @@
+"""
+User model
+"""
+
+from datetime import datetime
+
+from sqlalchemy import Boolean, DateTime, Integer, String, func
+from sqlalchemy.orm import Mapped, mapped_column
+
+from lockbot.backend.app.database import Base
+
+
+class User(Base):
+    __tablename__ = "users"
+
+    id: Mapped[int] = mapped_column(Integer, primary_key=True)
+    username: Mapped[str] = mapped_column(String(64), unique=True, nullable=False)
+    email: Mapped[str] = mapped_column(String(128), unique=True, nullable=False)
+    password_hash: Mapped[str] = mapped_column(String(256), nullable=False)
+    role: Mapped[str] = mapped_column(String(16), nullable=False, default="user")
+    max_running_bots: Mapped[int] = mapped_column(Integer, default=10)
+    must_change_password: Mapped[bool] = mapped_column(Boolean, nullable=False, default=False)
+    created_at: Mapped[datetime] = mapped_column(DateTime, server_default=func.now())
+    updated_at: Mapped[datetime] = mapped_column(DateTime, server_default=func.now(), onupdate=func.now())

lockbot/backend/app/auth/router.py

@@ -0,0 +1,140 @@
+"""
+Auth routes: register / login / current user
+"""
+
+import secrets
+import string
+
+import bcrypt as _bcrypt
+from fastapi import APIRouter, Depends, HTTPException, status
+from sqlalchemy import or_
+from sqlalchemy.orm import Session
+
+import lockbot.backend.app.config as _config
+from lockbot.backend.app.auth.dependencies import create_access_token, get_current_user
+from lockbot.backend.app.auth.models import User
+from lockbot.backend.app.auth.schemas import (
+    ChangeEmail,
+    ChangePassword,
+    ForceChangePassword,
+    TokenOut,
+    UserLogin,
+    UserOut,
+    UserRegister,
+)
+from lockbot.backend.app.database import get_db
+
+router = APIRouter(prefix="/api/auth", tags=["auth"])
+
+
+def _hash_password(password: str) -> str:
+    return _bcrypt.hashpw(password.encode(), _bcrypt.gensalt()).decode()
+
+
+def _verify_password(password: str, hashed: str) -> bool:
+    return _bcrypt.checkpw(password.encode(), hashed.encode())
+
+
+def _generate_password(length: int = 12) -> str:
+    """Generate a random password with mixed character types."""
+    alphabet = string.ascii_letters + string.digits + "!@#$%&*"
+    password = [
+        secrets.choice(string.ascii_lowercase),
+        secrets.choice(string.ascii_uppercase),
+        secrets.choice(string.digits),
+        secrets.choice("!@#$%&*"),
+    ]
+    password += [secrets.choice(alphabet) for _ in range(length - 4)]
+    secrets.SystemRandom().shuffle(password)
+    return "".join(password)
+
+
+@router.post("/register", response_model=UserOut, status_code=status.HTTP_201_CREATED)
+def register(body: UserRegister, db: Session = Depends(get_db)):
+    if not _config.ALLOW_REGISTER:
+        raise HTTPException(status_code=403, detail="Registration is disabled. Contact admin.")
+
+    exists = db.query(User).filter(or_(User.username == body.username, User.email == body.email)).first()
+    if exists:
+        raise HTTPException(status_code=409, detail="Username or email already taken")
+
+    user = User(
+        username=body.username,
+        email=body.email,
+        password_hash=_hash_password(body.password),
+    )
+    db.add(user)
+    db.commit()
+    db.refresh(user)
+    return user
+
+
+@router.post("/login", response_model=TokenOut)
+def login(body: UserLogin, db: Session = Depends(get_db)):
+    user = db.query(User).filter(User.username == body.username).first()
+    if not user or not _verify_password(body.password, user.password_hash):
+        raise HTTPException(status_code=401, detail="Invalid credentials")
+    return TokenOut(
+        access_token=create_access_token(user.id, user.must_change_password),
+        must_change_password=user.must_change_password,
+    )
+
+
+@router.get("/me", response_model=UserOut)
+def me(user: User = Depends(get_current_user)):
+    return user
+
+
+@router.put("/change-password", response_model=TokenOut)
+def change_password(
+    body: ChangePassword,
+    user: User = Depends(get_current_user),
+    db: Session = Depends(get_db),
+):
+    if not _verify_password(body.current_password, user.password_hash):
+        raise HTTPException(status_code=400, detail="Current password is incorrect")
+    if len(body.new_password) < 6:
+        raise HTTPException(status_code=400, detail="Password must be at least 6 characters")
+    user.password_hash = _hash_password(body.new_password)
+    user.must_change_password = False
+    db.commit()
+    return TokenOut(
+        access_token=create_access_token(user.id, False),
+        must_change_password=False,
+    )
+
+
+@router.put("/force-change-password", response_model=TokenOut)
+def force_change_password(
+    body: ForceChangePassword,
+    user: User = Depends(get_current_user),
+    db: Session = Depends(get_db),
+):
+    if not user.must_change_password:
+        raise HTTPException(status_code=400, detail="No password change required")
+    if body.new_password != body.confirm_password:
+        raise HTTPException(status_code=400, detail="Passwords do not match")
+    if len(body.new_password) < 6:
+        raise HTTPException(status_code=400, detail="Password must be at least 6 characters")
+    user.password_hash = _hash_password(body.new_password)
+    user.must_change_password = False
+    db.commit()
+    return TokenOut(
+        access_token=create_access_token(user.id, False),
+        must_change_password=False,
+    )
+
+
+@router.put("/change-email", response_model=UserOut)
+def change_email(
+    body: ChangeEmail,
+    user: User = Depends(get_current_user),
+    db: Session = Depends(get_db),
+):
+    exists = db.query(User).filter(User.email == body.new_email).filter(User.id != user.id).first()
+    if exists:
+        raise HTTPException(status_code=409, detail="Email already taken")
+    user.email = body.new_email
+    db.commit()
+    db.refresh(user)
+    return user

lockbot/backend/app/auth/schemas.py

@@ -0,0 +1,70 @@
+"""
+User Pydantic schemas
+"""
+
+from datetime import datetime
+
+from pydantic import BaseModel
+
+
+class UserRegister(BaseModel):
+    username: str
+    email: str
+    password: str
+
+
+class UserLogin(BaseModel):
+    username: str
+    password: str
+
+
+class UserOut(BaseModel):
+    id: int
+    username: str
+    email: str
+    role: str
+    max_running_bots: int
+    created_at: datetime
+    must_change_password: bool = False
+
+    model_config = {"from_attributes": True}
+
+
+class TokenOut(BaseModel):
+    access_token: str
+    token_type: str = "bearer"
+    must_change_password: bool = False
+
+
+class AdminCreateUser(BaseModel):
+    username: str
+    email: str
+    role: str = "user"
+    max_running_bots: int = 10
+
+
+class AdminEditUser(BaseModel):
+    username: str | None = None
+    email: str | None = None
+    role: str | None = None
+    max_running_bots: int | None = None
+
+
+class ChangePassword(BaseModel):
+    current_password: str
+    new_password: str
+
+
+class ForceChangePassword(BaseModel):
+    new_password: str
+    confirm_password: str
+
+
+class ChangeEmail(BaseModel):
+    new_email: str
+
+
+class PasswordResetOut(BaseModel):
+    id: int
+    username: str
+    new_password: str

lockbot/backend/app/bots/encryption.py

@@ -0,0 +1,57 @@
+"""
+Sensitive data encryption utilities.
+"""
+
+import logging
+
+from cryptography.fernet import Fernet
+
+from lockbot.backend.app.config import BASE_DIR, ENCRYPTION_KEY
+
+logger = logging.getLogger(__name__)
+
+_fernet = None
+
+# Persistent key file for dev mode (when ENCRYPTION_KEY env var is not set)
+_KEY_FILE = BASE_DIR / "data" / ".encryption_key"
+
+
+def _get_fernet() -> Fernet:
+    global _fernet
+    if _fernet is None:
+        key = ENCRYPTION_KEY
+        if not key:
+            # Try to load from persistent file first
+            if _KEY_FILE.exists():
+                key = _KEY_FILE.read_text().strip()
+                logger.info("Loaded encryption key from %s", _KEY_FILE)
+            else:
+                # Auto-generate and persist for dev
+                key = Fernet.generate_key().decode()
+                _KEY_FILE.parent.mkdir(parents=True, exist_ok=True)
+                _KEY_FILE.write_text(key)
+                logger.warning(
+                    "Generated new encryption key and saved to %s. Set ENCRYPTION_KEY env var in production.",
+                    _KEY_FILE,
+                )
+        _fernet = Fernet(key.encode() if isinstance(key, str) else key)
+    return _fernet
+
+
+def encrypt(plaintext: str) -> str:
+    if not plaintext:
+        return ""
+    return _get_fernet().encrypt(plaintext.encode()).decode()
+
+
+def decrypt(ciphertext: str) -> str:
+    if not ciphertext:
+        return ""
+    return _get_fernet().decrypt(ciphertext.encode()).decode()
+
+
+def mask(value: str, show_last: int = 4) -> str:
+    """Mask display: ***xxxx"""
+    if not value or len(value) <= show_last:
+        return "***"
+    return "***" + value[-show_last:]