messagefoundry 0.1.0__py3-none-any.whl

messagefoundry/console/reauth.py

@@ -0,0 +1,94 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# Copyright (C) 2026 MessageFoundry Organization and contributors
+"""Step-up re-verification dialog (ASVS 7.5.3, WP-L3-16 — console side).
+
+The engine refuses a highly sensitive operation (user admin, replay, purge, config reload) with
+**403 + ``X-Step-Up-Required``** when the session hasn't re-proved its credential within
+``[auth].step_up_max_age_seconds``. :class:`ReauthDialog` collects the password and calls
+``POST /me/reauth`` (local password re-verify, or an AD re-bind); :func:`make_step_up_handler` wires it
+into :class:`~messagefoundry.console.client.EngineClient` so any sensitive action transparently
+prompts-and-retries instead of surfacing a raw 403.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Callable
+
+from PySide6.QtWidgets import (
+    QApplication,
+    QDialog,
+    QFormLayout,
+    QLabel,
+    QLineEdit,
+    QPushButton,
+    QVBoxLayout,
+    QWidget,
+)
+
+from messagefoundry.console.client import ApiError, EngineClient
+from messagefoundry.console.widgets import ERROR_COLOR
+
+
+class ReauthDialog(QDialog):
+    """Collect the caller's current password and call :meth:`EngineClient.reauth` to refresh the
+    step-up window. Accepts on success; surfaces a wrong password (403) inline."""
+
+    def __init__(self, client: EngineClient, *, parent: QWidget | None = None) -> None:
+        super().__init__(parent)
+        self.setWindowTitle("Re-verify — MessageFoundry")
+        self._client = client
+
+        user = client.current_user
+        is_ad = user is not None and user.auth_provider == "ad"
+        prompt = QLabel(
+            "This action needs you to re-verify. Re-enter your "
+            + ("Active Directory password" if is_ad else "password")
+            + " to continue."
+        )
+        prompt.setWordWrap(True)
+
+        self._password = QLineEdit()
+        self._password.setEchoMode(QLineEdit.EchoMode.Password)
+        form = QFormLayout()
+        form.addRow("Password", self._password)
+
+        self._error = QLabel("")
+        self._error.setStyleSheet(f"color: {ERROR_COLOR};")
+        self._error.setWordWrap(True)
+
+        confirm = QPushButton("Re-verify")
+        confirm.setDefault(True)
+        confirm.clicked.connect(self._attempt)
+
+        layout = QVBoxLayout(self)
+        layout.addWidget(prompt)
+        layout.addLayout(form)
+        layout.addWidget(self._error)
+        layout.addWidget(confirm)
+
+        self._password.returnPressed.connect(self._attempt)
+
+    def _attempt(self) -> None:
+        password = self._password.text()
+        if not password:
+            self._error.setText("Enter your password.")
+            return
+        try:
+            self._client.reauth(password)
+        except ApiError as exc:
+            self._error.setText("Password is incorrect." if exc.status == 403 else str(exc))
+            return
+        self._password.clear()  # don't leave plaintext in the field (Qt doesn't zero buffers)
+        self.accept()
+
+
+def make_step_up_handler(client: EngineClient) -> Callable[[], bool]:
+    """A handler for :meth:`EngineClient.set_step_up_handler`: prompt for re-verification on the active
+    window and return ``True`` iff the user re-verified. Runs on the calling thread — the console's
+    sensitive actions run on the Qt main thread, so the modal dialog shows directly."""
+
+    def handler() -> bool:
+        dialog = ReauthDialog(client, parent=QApplication.activeWindow())
+        return dialog.exec() == QDialog.DialogCode.Accepted
+
+    return handler

messagefoundry/console/search.py

@@ -0,0 +1,57 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# Copyright (C) 2026 MessageFoundry Organization and contributors
+"""Log Search page: search options on top, the message list below, and the single-message
+detail (parse tree / raw / deliveries / audit) at the bottom. Composes the existing
+``MessagesPanel`` and ``MessageDetailPanel``, stacked vertically.
+"""
+
+from __future__ import annotations
+
+from PySide6.QtCore import Qt, Signal
+from PySide6.QtWidgets import QSplitter, QVBoxLayout, QWidget
+
+from messagefoundry.console.client import EngineClient
+from messagefoundry.console.widgets import MessageDetailPanel, MessagesPanel
+
+
+class LogSearchPage(QWidget):
+    """Message browser + detail, the relocated home of the old console's lower half."""
+
+    error = Signal(str)
+
+    def __init__(self, client: EngineClient, *, poll_client: EngineClient | None = None) -> None:
+        super().__init__()
+        self.messages = MessagesPanel(client, poll_client=poll_client)
+        self.detail = MessageDetailPanel(client, poll_client=poll_client)
+
+        self.messages.message_selected.connect(self.detail.load)
+        self.messages.selection_cleared.connect(self.detail.clear)
+        self.detail.changed.connect(self.messages.refresh)
+        self.messages.error.connect(self.error.emit)
+        self.detail.error.connect(self.error.emit)
+
+        split = QSplitter(Qt.Orientation.Vertical)
+        split.addWidget(self.messages)
+        split.addWidget(self.detail)
+        split.setStretchFactor(0, 1)
+        split.setStretchFactor(1, 2)
+
+        layout = QVBoxLayout(self)
+        layout.addWidget(split)
+
+    def refresh(self) -> None:
+        """Silent refresh — used by the auto-refresh timer (no PHI audit)."""
+        self.messages.refresh()
+
+    def reload(self) -> None:
+        """User-initiated load (opening the page) — audits summary display."""
+        self.messages.refresh(audit=True)
+
+    def set_channel(self, channel_id: str) -> None:
+        """Filter the list to one channel (used by the Connections 'Logs' link)."""
+        self.messages.set_channel_filter(channel_id)
+
+    def stop(self) -> None:
+        """Stop the message-list + detail background runners (call on window close)."""
+        self.messages.stop()
+        self.detail.stop()

messagefoundry/console/service_control.py

@@ -0,0 +1,137 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# Copyright (C) 2026 MessageFoundry Organization and contributors
+"""Windows service control for the Engine Status page.
+
+The engine can't control its *own* hosting service through the API (stopping it kills the API;
+once stopped there's no API to start it), and service control needs admin rights — so this is
+done locally via the Windows SCM: ``sc query`` for state (no elevation) and an elevated
+``net start/stop`` for actions (one UAC prompt each). Same-machine, Windows-only; on other
+platforms / when ``sc`` is absent, state is ``"unavailable"`` and actions are no-ops.
+
+Elevated actions are fire-and-forget (the elevated process is detached, so output isn't
+captured) — poll :func:`service_state` to observe the result.
+"""
+
+from __future__ import annotations
+
+import ctypes
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+import messagefoundry
+
+__all__ = [
+    "service_state",
+    "control_service",
+    "parse_service_state",
+    "install_script_path",
+    "install_service",
+    "is_safe_environment",
+]
+
+_ACTIONS = {
+    "start": '{0} start "{1}"',
+    "stop": '{0} stop "{1}"',
+    "restart": '{0} stop "{1}" & {0} start "{1}"',
+}
+
+# The restart action chains two `net` calls with `&`, so control_service can't avoid cmd.exe — and
+# that line runs ELEVATED. A service name with a quote/`&`/`|` could break out of its quoted argument
+# and run arbitrary commands as admin. Windows service names need none of those, so allow only a
+# conservative set and reject the rest (review low-16).
+_SAFE_SERVICE_NAME = re.compile(r"^[A-Za-z0-9 ._-]+$")
+
+
+def _is_safe_service_name(name: str) -> bool:
+    return bool(_SAFE_SERVICE_NAME.match(name))
+
+
+# The active-environment name is passed to install-service.ps1 as `-Environment <name>`, interpolated
+# into an ELEVATED PowerShell command line (ShellExecuteW "runas"). It also becomes a filename segment
+# (environments/<name>.toml), so constrain it to the same token charset the engine validates
+# ([ai].environment) and reject anything else — an unsafe value could break out of the quoted arg and
+# run as admin (cf. the service-name guard above).
+_SAFE_ENV_NAME = re.compile(r"^[A-Za-z0-9._-]+$")
+
+
+def is_safe_environment(name: str) -> bool:
+    """True if ``name`` is a valid active-environment name (letters, digits, ``.``, ``_``, ``-``)."""
+    return bool(_SAFE_ENV_NAME.match(name))
+
+
+def parse_service_state(sc_output: str) -> str:
+    """Map ``sc query`` output to ``running`` / ``stopped`` / ``unknown``."""
+    text = sc_output.upper()
+    if "RUNNING" in text:
+        return "running"
+    if "STOP" in text:  # STOPPED or STOP_PENDING
+        return "stopped"
+    return "unknown"
+
+
+def service_state(name: str) -> str:
+    """``running`` | ``stopped`` | ``not installed`` | ``unavailable`` (non-Windows / no ``sc``)."""
+    if sys.platform != "win32":
+        return "unavailable"
+    if not _is_safe_service_name(name):
+        return "unavailable"  # never let an unsafe name enable the (elevated) control buttons
+    try:
+        # nosec: fixed system tool (sc), no shell; `name` is validated above (low-16).
+        proc = subprocess.run(["sc", "query", name], capture_output=True, text=True, timeout=5)  # nosec B603 B607
+    except (OSError, subprocess.SubprocessError):
+        return "unavailable"
+    if proc.returncode != 0:
+        return "not installed"  # e.g. error 1060: service does not exist
+    return parse_service_state(proc.stdout)
+
+
+def control_service(action: str, name: str) -> bool:
+    """Start/stop/restart ``name`` with a one-time UAC elevation. Returns False off Windows.
+
+    Uses ``net`` (synchronous) under an elevated, hidden ``cmd``. Output isn't captured;
+    call :func:`service_state` afterwards to see the new state.
+
+    Raises :class:`ValueError` for a service name with shell metacharacters — it would be
+    interpolated into an elevated cmd.exe line (review low-16)."""
+    if not _is_safe_service_name(name):
+        raise ValueError(f"unsafe service name {name!r}")
+    if sys.platform != "win32":
+        return False
+    command = _ACTIONS[action].format("net", name)
+    # ShellExecuteW with the "runas" verb raises the UAC prompt; SW_HIDE (0) hides the console.
+    ctypes.windll.shell32.ShellExecuteW(None, "runas", "cmd.exe", f"/c {command}", None, 0)
+    return True
+
+
+def install_script_path() -> Path | None:
+    """Locate ``scripts/service/install-service.ps1`` in the (editable-installed) repo."""
+    pkg = messagefoundry.__file__
+    if pkg is None:
+        return None
+    script = Path(pkg).resolve().parents[1] / "scripts" / "service" / "install-service.ps1"
+    return script if script.exists() else None
+
+
+def _install_params(script_path: str, environment: str) -> str:
+    """Build the argument string for the elevated installer launch.
+
+    ``environment`` is the active environment the service will run as (``serve --env``); it is
+    interpolated into an elevated command line, so reject anything that isn't a plain environment
+    name (raises :class:`ValueError`). Validation runs on every platform so it is unit-testable."""
+    if not is_safe_environment(environment):
+        raise ValueError(f"unsafe environment name {environment!r}")
+    return f'-NoExit -ExecutionPolicy Bypass -File "{script_path}" -Environment "{environment}"'
+
+
+def install_service(script_path: str, environment: str) -> bool:
+    """Run the install script elevated in a *visible* PowerShell window (one-time setup, so the
+    operator can read the output / 'next steps' and any errors). ``environment`` is the active
+    environment the service runs as (ADR 0017 — install-service.ps1 requires it). Returns False off
+    Windows. Raises :class:`ValueError` for an unsafe environment name (it runs elevated)."""
+    params = _install_params(script_path, environment)  # validates env on every platform
+    if sys.platform != "win32":
+        return False
+    ctypes.windll.shell32.ShellExecuteW(None, "runas", "powershell.exe", params, None, 1)
+    return True

messagefoundry/console/sessions.py

@@ -0,0 +1,122 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# Copyright (C) 2026 MessageFoundry Organization and contributors
+"""Self-service active-session inventory dialog (the WP-10 console view).
+
+Lists the signed-in user's active sessions (``GET /me/sessions``) and lets them revoke an individual
+session or sign out everywhere else. The **current** session is flagged and cannot be revoked here —
+that is what "Sign out" does — so this dialog never logs the user out. Calls are synchronous like the
+other console dialogs (localhost, modal; see :mod:`messagefoundry.console.client`).
+"""
+
+from __future__ import annotations
+
+from PySide6.QtWidgets import (
+    QDialog,
+    QHBoxLayout,
+    QHeaderView,
+    QLabel,
+    QMessageBox,
+    QPushButton,
+    QTableWidget,
+    QTableWidgetItem,
+    QVBoxLayout,
+    QWidget,
+)
+
+from messagefoundry.api.auth_models import SessionInfo
+from messagefoundry.console.client import ApiError, EngineClient
+from messagefoundry.console.widgets import ERROR_COLOR, fmt_ts
+
+
+class SessionsDialog(QDialog):
+    """The user's active sessions with per-row revoke + "sign out everywhere else"."""
+
+    def __init__(self, client: EngineClient, *, parent: QWidget | None = None) -> None:
+        super().__init__(parent)
+        self.setWindowTitle("Active sessions — MessageFoundry")
+        self._client = client
+        self._sessions: list[SessionInfo] = []
+
+        self._table = QTableWidget(0, 5)
+        self._table.setHorizontalHeaderLabels(["Client", "Created", "Last used", "Expires", ""])
+        header = self._table.horizontalHeader()
+        if header is not None:
+            header.setSectionResizeMode(QHeaderView.ResizeMode.Stretch)
+        self._table.setEditTriggers(QTableWidget.EditTrigger.NoEditTriggers)
+        self._table.setSelectionBehavior(QTableWidget.SelectionBehavior.SelectRows)
+
+        self._error = QLabel("")
+        self._error.setStyleSheet(f"color: {ERROR_COLOR};")
+        self._error.setWordWrap(True)
+
+        self._others_btn = QPushButton("Sign out everywhere else")
+        self._others_btn.clicked.connect(self._sign_out_others)
+        refresh_btn = QPushButton("Refresh")
+        refresh_btn.clicked.connect(self._reload)
+        close_btn = QPushButton("Close")
+        close_btn.clicked.connect(self.accept)
+
+        buttons = QHBoxLayout()
+        buttons.addWidget(self._others_btn)
+        buttons.addStretch(1)
+        buttons.addWidget(refresh_btn)
+        buttons.addWidget(close_btn)
+
+        layout = QVBoxLayout(self)
+        layout.addWidget(self._table)
+        layout.addWidget(self._error)
+        layout.addLayout(buttons)
+
+        self._reload()
+
+    def _reload(self) -> None:
+        self._error.clear()
+        try:
+            self._sessions = self._client.list_sessions()
+        except ApiError as exc:
+            self._error.setText(str(exc))
+            return
+        self._table.setRowCount(len(self._sessions))
+        for row, session in enumerate(self._sessions):
+            label = (session.client or "unknown") + ("  (this device)" if session.current else "")
+            cells = [
+                label,
+                fmt_ts(session.created_at),
+                fmt_ts(session.last_used_at),
+                fmt_ts(session.expires_at),
+            ]
+            for col, text in enumerate(cells):
+                self._table.setItem(row, col, QTableWidgetItem(text))
+            # The current session is revoked via "Sign out", not here, so it gets a label not a button.
+            if session.current:
+                self._table.setCellWidget(row, 4, QLabel("current"))
+            else:
+                revoke = QPushButton("Revoke")
+                revoke.clicked.connect(lambda _=False, sid=session.id: self._revoke(sid))
+                self._table.setCellWidget(row, 4, revoke)
+        # Nothing else to sign out when only this session exists.
+        self._others_btn.setEnabled(any(not s.current for s in self._sessions))
+
+    def _revoke(self, session_id: str) -> None:
+        try:
+            self._client.revoke_session(session_id)
+        except ApiError as exc:
+            self._error.setText(str(exc))
+            return
+        self._reload()
+
+    def _sign_out_others(self) -> None:
+        confirm = QMessageBox.question(
+            self,
+            "Sign out other sessions",
+            "Revoke every other active session (all devices except this one)?",
+        )
+        if confirm != QMessageBox.StandardButton.Yes:
+            return
+        try:
+            detail = self._client.revoke_other_sessions()
+        except ApiError as exc:
+            self._error.setText(str(exc))
+            return
+        self._reload()
+        QMessageBox.information(self, "Sessions revoked", detail)