messagefoundry-webconsole 0.2.15__py3-none-any.whl

messagefoundry_webconsole/routes/sso.py

@@ -0,0 +1,88 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# Copyright (C) 2026 MessageFoundry Organization and contributors
+"""L5c (ADR 0068 §9): the browser Kerberos SSO challenge route — RFC 4559, Kerberos-only single-leg."""
+
+from __future__ import annotations
+
+import base64
+import binascii
+import logging
+
+from fastapi import FastAPI, Request, Response
+from fastapi.responses import HTMLResponse, RedirectResponse
+
+from messagefoundry.api._ui_seam import UiDeps
+from messagefoundry.api.security import get_auth
+
+from .. import pages
+from .._auth import (
+    set_session_cookie,
+)
+
+_log = logging.getLogger(__name__)
+
+
+def register(app: FastAPI, deps: UiDeps) -> None:
+    """L5c (ADR 0068 §9): the browser Kerberos SSO challenge route — RFC 4559,
+    Kerberos-only SINGLE-LEG, off by default ([auth].kerberos_enabled, experimental)."""
+
+    @app.get("/ui/sso")
+    async def ui_sso(request: Request) -> Response:
+        auth = get_auth(request)
+        if auth is None or not auth.kerberos_available:
+            # Disabled/degraded: redirect WITHOUT auditing (review carve-out, ADR 0068 §9).
+            # There is no rate limiter in front of this branch, so auditing a token-bearing
+            # attempt here would be an unbounded unauthenticated DB-write amplifier — the
+            # exact anti-flood invariant the JSON rate-limit path preserves. The attempt is
+            # a no-op (SSO is off); its visibility is the operator-facing serve-time state.
+            return RedirectResponse("/ui/login?e=sso_unavailable", status_code=303)
+        header = request.headers.get("Authorization", "")
+        if not header.startswith("Negotiate "):
+            # The RFC 4559 challenge leg — deliberately NOT rate-limited: every
+            # unauthenticated SSO navigation produces one 401 before the browser attaches
+            # its token; throttling it would self-lock normal traffic (ADR 0068 §9). The
+            # HTML body keeps a browser without SSO configured from dead-ending.
+            return HTMLResponse(
+                pages.sso_challenge(),
+                status_code=401,
+                headers={"WWW-Authenticate": "Negotiate"},
+            )
+        # Token-bearing leg. The rate limiter runs FIRST (review fix, ADR 0068 §9): it
+        # bounds EVERY downstream audit write to the limiter's rate, so an attacker looping
+        # token requests can't amplify into unbounded audit_log growth. The rate-limit
+        # reject itself is a _log.warning (NOT an audit) — parity with the JSON
+        # _rate_limited path's anti-flood posture — so exhaustion writes zero DB rows.
+        client = request.client.host if request.client else None
+        if not auth.allow_login_attempt(client):
+            _log.warning("SSO rate limit exceeded for %s", client or "<unknown>")
+            return RedirectResponse("/ui/login?e=rate_limited", status_code=303)
+        # Cross-site hygiene — an audited SSO reject (AUTH-K-AUDIT), now behind the limiter
+        # so the audit is bounded: a non-navigation fetch is drive-by ambient-auth probing.
+        # A cross-site TOP-LEVEL navigation is allowed (intranet links keep working; the
+        # residual harm of a forced navigation is self-login only — server-minted token, no
+        # fixation, ADR 0068 §9 threat model).
+        mode = request.headers.get("Sec-Fetch-Mode")
+        if mode is not None and mode != "navigate":
+            await auth.audit_kerberos_reject("non_navigation_fetch")
+            return RedirectResponse("/ui/login?e=sso_failed", status_code=303)
+        try:
+            token_bytes = base64.b64decode(header[len("Negotiate ") :], validate=True)
+        except (binascii.Error, ValueError):
+            await auth.audit_kerberos_reject("malformed_token")
+            return RedirectResponse("/ui/login?e=sso_failed", status_code=303)
+        # seed_reauth=False (ADR 0068 §9): the SSO proof is AMBIENT — the session must not
+        # be born with a free step-up window; the first sensitive action forces the
+        # directory-password step-up at /ui/reauth. ONE session per navigation into this
+        # route (the resync side effect fires here, never per page).
+        outcome = await auth.authenticate_kerberos(token_bytes, client=client, seed_reauth=False)
+        if not outcome.ok or outcome.token is None:
+            # authenticate_kerberos audited the reject. NEVER a second 401 — no challenge
+            # loops (Kerberos-only single-leg is a hard line; an NTLM NegTokenInit from an
+            # IP-hosted/SPN-less URL, an expired ticket, or an unknown principal all land
+            # here). The single-leg helper deliberately discards the acceptor's out_token —
+            # no mutual-auth response header (SECURITY.md's "no mutual authentication"; ADR
+            # 0068 §9 records this as the current posture).
+            return RedirectResponse("/ui/login?e=sso_failed", status_code=303)
+        resp = RedirectResponse("/ui", status_code=303)
+        set_session_cookie(resp, outcome.token, request=request)
+        return resp

messagefoundry_webconsole/routes/status.py

@@ -0,0 +1,178 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# Copyright (C) 2026 MessageFoundry Organization and contributors
+"""L1b: read-only engine status page (engine/store metrics, security posture, cluster + DR state).
+
+Also serves ``GET /ui/nav-status`` — the metadata-only health rollup polled by the nav's engine-health
+heart + alerts bell (app.js, every page). Worst issue wins; it never raises (a health probe that crashed
+would blank the nav — a store failure IS the "down" signal).
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import Any
+
+from fastapi import Depends, FastAPI, HTTPException, Request
+from fastapi.responses import HTMLResponse, JSONResponse
+
+from messagefoundry.api._ui_seam import UiDeps
+from messagefoundry.api.models import (
+    ClusterNodeList,
+    ClusterStatus,
+    DrStatus,
+    SystemStatus,
+)
+from messagefoundry.auth import Identity, Permission
+
+from .. import pages
+from .._auth import (
+    require_ui,
+)
+
+_log = logging.getLogger(__name__)
+
+# Free-space thresholds for the engine-health heart (absolute — total disk size isn't exposed, only free
+# bytes). The store's DB grows on this drive, so "DB space" and "local drive space" collapse to one check on
+# the default/embedded backend. Sensible defaults; tune if a deployment wants a different floor.
+_DISK_WARN_BYTES = 5 * 1024**3  # < 5 GiB free → warn (orange)
+_DISK_CRIT_BYTES = 1 * 1024**3  # < 1 GiB free → critical (blinking red)
+
+# ADR 0014 operator-alert severities (store.py: "info|warning|critical"), ranked worst-last for the bell.
+_SEVERITY_RANK = {"info": 1, "warning": 2, "critical": 3}
+
+
+def _worst_severity(severities: list[str]) -> str | None:
+    """The highest-ranked severity among active alerts, or ``None`` for an empty list (drives the bell's
+    color: critical→red, warning→orange, info→accent, none→gray)."""
+    worst: str | None = None
+    rank = 0
+    for s in severities:
+        r = _SEVERITY_RANK.get(s, 0)
+        if r > rank:
+            rank, worst = r, s
+    return worst
+
+
+def _derive_health(
+    sysinfo: SystemStatus | None,
+    dr: DrStatus | None,
+    cluster: ClusterStatus | None,
+    nodes: ClusterNodeList | None,
+) -> tuple[str, str | None]:
+    """Roll infrastructure signals into one engine-health verdict — ``ok`` < ``warn`` < ``down``, worst
+    issue wins — plus a short reason for the worst issue (the heart's tooltip). Pure: takes already-fetched
+    models (``None`` = that probe failed / not applicable), so it's unit-testable without an engine.
+
+    - ``sysinfo is None``  → store unreachable → **down** (the strongest "unhealthy").
+    - disk free (DB drive, and log drive if metered) < 1 GiB → **down**, < 5 GiB → **warn**.
+    - server DB connection pool saturated (``idle == 0``) → **warn**.
+    - running on the DR failover box (``dr.active``) → **warn**; a clustered engine with no leader → **down**.
+    """
+    issues: list[tuple[int, str]] = []  # (level, reason); 1 = warn, 2 = down
+    if sysinfo is None:
+        issues.append((2, "store unreachable"))
+    else:
+        frees = [("db", sysinfo.db.disk_free_bytes)]
+        if sysinfo.logs is not None:
+            frees.append(("logs", sysinfo.logs.disk_free_bytes))
+        for label, free in frees:
+            if free < _DISK_CRIT_BYTES:
+                issues.append((2, f"low disk ({label}): {free / 1024**3:.1f} GiB free"))
+            elif free < _DISK_WARN_BYTES:
+                issues.append((1, f"low disk ({label}): {free / 1024**3:.1f} GiB free"))
+        if sysinfo.pool is not None and sysinfo.pool.idle == 0:
+            issues.append((1, "DB connection pool saturated"))
+    if dr is not None and dr.enabled and dr.active:
+        issues.append((1, "running on the DR failover box"))
+    if (
+        cluster is not None
+        and cluster.clustered
+        and nodes is not None
+        and nodes.leader_node_id is None
+    ):
+        issues.append((2, "cluster has no leader"))
+
+    level = max((lvl for lvl, _ in issues), default=0)
+    reason = next((msg for lvl, msg in issues if lvl == level), None)
+    return {0: "ok", 1: "warn", 2: "down"}[level], reason
+
+
+def register(app: FastAPI, deps: UiDeps) -> None:
+    """L1b: read-only engine status page (engine/store metrics, effective security posture,
+    cluster + DR state). Reuses the monitoring:read JSON handlers — no PHI, no step-up."""
+    core = deps.core
+
+    @app.get("/ui/status", response_class=HTMLResponse)
+    async def ui_status(
+        request: Request,
+        engine: Any = Depends(deps.get_engine),
+        identity: Identity = Depends(require_ui(Permission.MONITORING_READ)),
+    ) -> HTMLResponse:
+        sys_status = await core.system_status(request, engine=engine, _user=identity)
+        posture = await core.security_posture(request, engine=engine, identity=identity)
+        cluster = await core.cluster_status(engine=engine, _user=identity)
+        nodes = await core.cluster_nodes(engine=engine, _user=identity)
+        dr = await core.dr_status(engine=engine, _user=identity)
+        svc = await core.service_status(request, _user=identity)
+        return HTMLResponse(pages.status(sys_status, posture, cluster, nodes, dr, svc))
+
+    @app.get("/ui/nav-status")
+    async def ui_nav_status(
+        request: Request,
+        engine: Any = Depends(deps.get_engine),
+        # activity=False (ASVS 14.3.1): a TIMER-driven background poll on every navved page, not user
+        # activity. Refreshing the idle clock here kept an abandoned tab — including every PHI page —
+        # signed in indefinitely, which defeated automatic logoff outright.
+        identity: Identity = Depends(require_ui(Permission.MONITORING_READ, activity=False)),
+    ) -> JSONResponse:
+        # The nav heart + alerts bell poll this ~every 15s from every page. Metadata only — disk/pool/
+        # cluster posture + an alert COUNT (no bodies, no PHI). It must NEVER raise: a crash would blank the
+        # nav, and an unreachable store is itself the "down" verdict, so each probe is guarded and a broad
+        # failure degrades to the worst signal rather than a 500.
+        try:
+            sysinfo: SystemStatus | None = await core.system_status(
+                request, engine=engine, _user=identity
+            )
+        except HTTPException:
+            raise  # a real authz failure — let require_ui-style semantics surface (never seen as "down")
+        except Exception:  # noqa: BLE001 - a store/metrics read failure IS the "down" health signal
+            _log.warning("nav-status: system_status failed; reporting engine down", exc_info=True)
+            sysinfo = None
+
+        dr: DrStatus | None = None
+        cluster: ClusterStatus | None = None
+        nodes: ClusterNodeList | None = None
+        try:
+            dr = await core.dr_status(engine=engine, _user=identity)
+            cluster = await core.cluster_status(engine=engine, _user=identity)
+            if cluster.clustered:
+                nodes = await core.cluster_nodes(engine=engine, _user=identity)
+        except HTTPException:
+            raise
+        except Exception:  # noqa: BLE001 - HA/DR posture is best-effort; absence must not fake a problem
+            _log.warning("nav-status: HA/DR probe failed; skipping failover checks", exc_info=True)
+
+        health, reason = _derive_health(sysinfo, dr, cluster, nodes)
+
+        # Alerts count/severity needs monitoring:diagnose (the ack/resolve tier). The handler is called
+        # DIRECTLY here, which skips its own Depends(require(...)) gate — so gate it explicitly on the
+        # identity (the /ui/alerts page re-asserts at the route level the same way). Without diagnose,
+        # alerts=null so the bell HIDES itself rather than showing a gray "no alerts" the viewer can't trust.
+        alerts: dict[str, object] | None = None
+        if identity.has(Permission.MONITORING_DIAGNOSE):
+            try:
+                instances = await core.list_active_alerts(
+                    engine=engine, identity=identity, limit=200
+                )
+                active = instances.alerts
+                alerts = {
+                    "count": len(active),
+                    "severity": _worst_severity([a.severity for a in active]),
+                }
+            except HTTPException:
+                raise
+            except Exception:  # noqa: BLE001 - a best-effort count; a query failure must not crash the probe
+                _log.warning("nav-status: list_active_alerts failed; omitting count", exc_info=True)
+                alerts = None
+
+        return JSONResponse({"health": health, "reason": reason, "alerts": alerts})

messagefoundry_webconsole/routes/uploaded_logs.py

@@ -0,0 +1,181 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# Copyright (C) 2026 MessageFoundry Organization and contributors
+"""Offline uploaded-logs /ui routes (BACKLOG #125/#126, ADR 0134).
+
+Upload / list / browse / resend / delete over the engine's uploaded-logs CoreHandlers (seam v7). The
+console never touches the filesystem or the store directly — it calls the audited JSON handlers by
+reference and re-asserts the equivalent permission/step-up via ``require_ui*``. The browse GET (which
+decrypts PHI) is step-up-gated + registered as an UNLOCK action (like content search); delete is a
+step-up, body-less, auto-retryable POST behind a confirm step; upload is a same-origin multipart POST
+(no step-up — a body-carrying POST can't survive the re-auth redirect, and browsing PHI is the gated
+surface). Resend is a same-origin POST on top of the already-stepped-up browse page.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from fastapi import Depends, FastAPI, HTTPException, Query, Request
+from fastapi.responses import HTMLResponse, RedirectResponse, Response
+
+from messagefoundry.api._ui_seam import UiDeps
+from messagefoundry.api.models import UploadResendRequest
+from messagefoundry.auth import Identity, Permission
+
+from .. import pages
+from .._auth import (
+    assert_same_origin,
+    register_ui_action,
+    require_ui,
+    require_ui_step_up,
+)
+from ._common import _form_pairs
+
+# The browse GET decrypts PHI (step-up), so register it as an UNLOCK form — a stale step-up 303s to
+# /ui/reauth and GET-redirects back to the browse page (the PHI-shaped filter is a GET query, so it is
+# deliberately NOT carried across the redirect). The delete POST is body-less + step-up, so it may be
+# auto-retried after re-auth. Upload/resend are same-origin require_ui POSTs (not registered).
+register_ui_action(
+    r"^/ui/uploaded-logs/file/[^/?#]+$", Permission.FILES_BROWSE, auto_retry=False, unlock=True
+)
+register_ui_action(r"^/ui/uploaded-logs/file/[^/?#]+/delete$", Permission.FILES_DELETE)
+
+
+def register(app: FastAPI, deps: UiDeps) -> None:
+    core = deps.core
+
+    @app.get("/ui/uploaded-logs", response_class=HTMLResponse)
+    async def ui_uploaded_logs(
+        request: Request,
+        engine: Any = Depends(deps.get_engine),
+        identity: Identity = Depends(require_ui(Permission.FILES_BROWSE)),
+    ) -> HTMLResponse:
+        data = await core.list_uploaded_files(request, engine=engine, identity=identity)
+        return HTMLResponse(pages.uploaded_logs(data))
+
+    @app.get("/ui/uploaded-logs/upload", response_class=HTMLResponse)
+    async def ui_uploaded_logs_upload_form(
+        request: Request,
+        _identity: Identity = Depends(require_ui(Permission.FILES_UPLOAD)),
+    ) -> HTMLResponse:
+        return HTMLResponse(pages.uploaded_logs_upload())
+
+    @app.post("/ui/uploaded-logs/upload")
+    async def ui_uploaded_logs_upload(
+        request: Request,
+        engine: Any = Depends(deps.get_engine),
+        identity: Identity = Depends(require_ui(Permission.FILES_UPLOAD)),
+    ) -> Response:
+        # Same-origin CSRF defense-in-depth on top of the SameSite cookie. No step-up: a multipart body
+        # POST can't survive the re-auth redirect (browsing the PHI is the step-up-gated surface).
+        assert_same_origin(request)
+        try:
+            await core.upload_file(request, engine=engine, identity=identity)
+        except HTTPException as exc:
+            return HTMLResponse(
+                pages.uploaded_logs_upload(error=str(exc.detail)), status_code=exc.status_code
+            )
+        return RedirectResponse("/ui/uploaded-logs", status_code=303)
+
+    @app.get("/ui/uploaded-logs/file/{file_id}", response_class=HTMLResponse)
+    async def ui_uploaded_log_browse(
+        file_id: str,
+        request: Request,
+        engine: Any = Depends(deps.get_engine),
+        identity: Identity = Depends(require_ui_step_up(Permission.FILES_BROWSE)),
+        content: str | None = Query(None, max_length=512),
+        field_path: str | None = Query(None, max_length=32),
+        field_value: str | None = Query(None, max_length=512),
+        message_type: str | None = Query(None, max_length=64),
+        control_id: str | None = Query(None, max_length=256),
+        limit: int = Query(200, ge=1, le=500),
+    ) -> Response:
+        shared = dict(  # noqa: C408
+            content=content or "",
+            field_path=field_path or "",
+            field_value=field_value or "",
+            message_type=message_type or "",
+            control_id=control_id or "",
+        )
+
+        async def _browse(c: str | None, fp: str | None, fv: str | None) -> Any:
+            return await core.browse_uploaded_file(
+                request,
+                file_id=file_id,
+                engine=engine,
+                identity=identity,
+                content=c,
+                field_path=fp,
+                field_value=fv,
+                target="both",
+                message_type=message_type,
+                control_id=control_id,
+                limit=limit,
+                offset=0,
+            )
+
+        try:
+            result = await _browse(content, field_path, field_value)
+        except HTTPException as exc:
+            if exc.status_code == 404:  # bad/absent id (incl. path-traversal) → back to the list
+                return RedirectResponse("/ui/uploaded-logs", status_code=303)
+            if exc.status_code == 400:  # bad content criteria → re-render metadata-only + the error
+                result = await _browse(None, None, None)
+                return HTMLResponse(
+                    pages.uploaded_log_detail(result, error=str(exc.detail), **shared),
+                    status_code=400,
+                )
+            raise
+        return HTMLResponse(pages.uploaded_log_detail(result, **shared))
+
+    @app.post("/ui/uploaded-logs/file/{file_id}/resend")
+    async def ui_uploaded_log_resend(
+        file_id: str,
+        request: Request,
+        engine: Any = Depends(deps.get_engine),
+        identity: Identity = Depends(require_ui(Permission.FILES_BROWSE)),
+    ) -> Response:
+        # Same-origin; the browse page it posts from is already step-up-gated, so the operator is fresh.
+        assert_same_origin(request)
+        form = dict(await _form_pairs(request))
+        try:
+            body = UploadResendRequest(index=int(form.get("index", "")), to=form.get("to", ""))
+        except (ValueError, TypeError):
+            raise HTTPException(400, "index and to are required") from None
+        await core.resend_uploaded_message(
+            request, file_id=file_id, body=body, engine=engine, identity=identity
+        )
+        return RedirectResponse(f"/ui/uploaded-logs/file/{file_id}", status_code=303)
+
+    @app.get("/ui/uploaded-logs/file/{file_id}/delete-confirm", response_class=HTMLResponse)
+    async def ui_uploaded_log_delete_confirm(
+        file_id: str,
+        request: Request,
+        engine: Any = Depends(deps.get_engine),
+        identity: Identity = Depends(require_ui(Permission.FILES_DELETE)),
+    ) -> Response:
+        # The confirm step (BACKLOG #126). Show the filename so the operator confirms the right file; a
+        # bad/absent id (path-traversal) 404s at the browse handler, so read metadata via list here.
+        data = await core.list_uploaded_files(request, engine=engine, identity=identity)
+        match = next((f for f in data.files if f.file_id == file_id), None)
+        if match is None:
+            return RedirectResponse("/ui/uploaded-logs", status_code=303)
+        return HTMLResponse(pages.uploaded_log_delete_confirm(file_id, match.filename))
+
+    @app.post("/ui/uploaded-logs/file/{file_id}/delete")
+    async def ui_uploaded_log_delete(
+        file_id: str,
+        request: Request,
+        engine: Any = Depends(deps.get_engine),
+        identity: Identity = Depends(require_ui_step_up(Permission.FILES_DELETE)),
+    ) -> Response:
+        assert_same_origin(request)
+        try:
+            await core.delete_uploaded_file(
+                request, file_id=file_id, engine=engine, identity=identity
+            )
+        except HTTPException as exc:
+            if exc.status_code == 404:
+                return RedirectResponse("/ui/uploaded-logs", status_code=303)
+            raise
+        return RedirectResponse("/ui/uploaded-logs", status_code=303)