micrOSDevToolKit 3.2.4__tar.gz → 3.3.0__tar.gz

{microsdevtoolkit-3.2.4/micrOSDevToolKit.egg-info → microsdevtoolkit-3.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: micrOSDevToolKit
-Version: 3.2.4
+Version: 3.3.0
 Summary: Development and deployment environment for micrOS, the diy micropython automation OS (IoT)
 Home-page: https://github.com/BxNxM/micrOS
 Author: Marcell Ban

{microsdevtoolkit-3.2.4 → microsdevtoolkit-3.3.0}/micrOS/release_info/micrOS_ReleaseInfo/system_analysis_sum.json

@@ -1,8 +1,8 @@
 {
     "files": {
         "Auth.py": [
-            9.63,
-            5
+            9.68,
+            6
         ],
         "Time.py": [
             9.38,
@@ -29,7 +29,7 @@
             3
         ],
         "Web.py": [
-            9.32,
+            9.36,
             2
         ],
         "Tasks.py": [
@@ -62,7 +62,7 @@
         ],
         "Common.py": [
             9.86,
-            31
+            32
         ],
         "InterConnect.py": [
             9.7,
@@ -125,7 +125,7 @@
             0
         ],
         "modules/LM_web.py": [
-            9.13,
+            8.14,
             0
         ],
         "modules/LM_genIO.py": [
@@ -303,11 +303,11 @@
     },
     "summary": {
         "core": [
-            5414,
+            5477,
             27
         ],
         "load": [
-            7569,
+            7589,
             48
         ],
         "core_dep": [
@@ -318,8 +318,8 @@
             true,
             5
         ],
-        "core_score": 9.28,
-        "load_score": 8.43,
-        "version": "3.2.4-0"
+        "core_score": 9.29,
+        "load_score": 8.41,
+        "version": "3.3.0-0"
     }
 }

{microsdevtoolkit-3.2.4 → microsdevtoolkit-3.3.0}/micrOS/source/Auth.py

@@ -5,6 +5,22 @@ micrOS Load Module Authentication/Access feature
 from Config import cfgget as __cfgget
 PWD_KEY = "pwd"
 
+
+class AuthRequired(Exception):
+    """
+    Raised by @sudo when the caller did not provide a valid app password.
+    Shell and WebEngine translate this into their own response style.
+    """
+
+
+def check_password(password):
+    """
+    Shared app password check.
+    Username is intentionally not enforced yet: micrOS has only appwd.
+    """
+    return password == __cfgget("appwd")
+
+
 def sudo(_f=None, *, _when_true=None):
     """
     Decorator for password-protected functions.
@@ -42,9 +58,10 @@ def sudo(_f=None, *, _when_true=None):
                     if a[wt_idx]:
                         require = True
 
-            # Password check
-            if require and k.get(PWD_KEY) != __cfgget("appwd"):
-                raise Exception(f"Access denied, wrong password ({PWD_KEY})")
+            # Password check: callers use pwd=.
+            password = k.get(PWD_KEY)
+            if require and not check_password(password):
+                raise AuthRequired(f"Access denied, wrong password ({PWD_KEY})")
             # Remove password before calling function
             k.pop(PWD_KEY, None)
             return f(*a, **k)
@@ -58,5 +75,5 @@ def resolve_secret(commands:str):
     """
     placeholder = f"${PWD_KEY}"
     if placeholder in commands:
-        commands = commands.replace(placeholder, f"'{__cfgget("appwd")}'")
+        commands = commands.replace(placeholder, f"'{__cfgget('appwd')}'")
     return commands

{microsdevtoolkit-3.2.4 → microsdevtoolkit-3.3.0}/micrOS/source/Shell.py

@@ -28,7 +28,7 @@ IMAGE_MODE = 'rel' if 'micrOS' in uname()[-1] else 'dev'
 
 class Shell:
     __slots__ = ['__devfid', '__auth_mode', '__hwuid', '__auth_ok', '__conf_mode']
-    MICROS_VERSION = '3.2.4-0'
+    MICROS_VERSION = '3.3.0-0'
 
     def __init__(self):
         """

{microsdevtoolkit-3.2.4 → microsdevtoolkit-3.3.0}/micrOS/source/Web.py

@@ -21,6 +21,7 @@ from Config import cfgget
 from Files import OSPath, path_join
 from Buffer import SlidingBuffer, BufferFullError, MemoryPool
 from Debug import console_write, syslog
+from Auth import AuthRequired, PWD_KEY
 
 try:
     from gc import mem_free
@@ -89,7 +90,7 @@ def _parse_rest_cmd(cmd:str) -> list[str]:
             index += 1
         segment = decoded[start:index]
         if segment:
-            segment = segment.replace('/', ' ').strip()
+            segment = segment.replace('/', ' ').replace('-', ' ').strip()
             if segment:
                 tokens.extend(token for token in segment.split() if token)
     return tokens
@@ -98,6 +99,7 @@ def _parse_rest_cmd(cmd:str) -> list[str]:
 class HeaderParsingError(ValueError):
     """Exception for errors occurring while parsing HTTP/MIME headers"""
 
+
 #################################################################
 #                   Pre-allocated Memory Buffer                 #
 #################################################################
@@ -300,6 +302,7 @@ class WebEngine(Buffer):
     VERSION = "n/a"
     RESP_HEADERS = (
         200, b"HTTP/1.1 200 OK",
+        401, b"HTTP/1.1 401 Unauthorized",
         400, b"HTTP/1.1 400 Bad Request",
         404, b"HTTP/1.1 404 Not Found",
         405, b"HTTP/1.1 405 Method Not Allowed",
@@ -353,6 +356,42 @@ class WebEngine(Buffer):
         self.mp_delimiter = None
         self.mp_closing_delimiter = None
 
+    def _auth_execute(self, callback, *args, **kwargs):
+        """Run endpoint callback, retrying @sudo callbacks with custom web auth."""
+        try:
+            return callback(*args, **kwargs)
+        except AuthRequired:
+            auth_header = "x-micros-auth"
+            password = self.headers.get(auth_header)
+            if password is None:
+                raise
+            kwargs[PWD_KEY] = password
+            return callback(*args, **kwargs)
+
+    def _auth_response(self, tx):
+        """Write the custom auth-required HTTP response."""
+        accept = self.headers.get("accept", "")
+        self.response_headers[b"cache-control"] = b"no-store"
+        self.response_headers[b"x-content-type-options"] = b"nosniff"
+        self.response_headers[b"referrer-policy"] = b"no-referrer"
+        wants_html = "text/html" in accept or "application/xhtml+xml" in accept
+        if self.method != self.GET or not wants_html:
+            self.terminate(401, b"application/json")
+            return self._generate_response(tx, {"state": False, "result": "Auth required"})
+        self.response_headers[b"content-security-policy"] = (
+            b"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; "
+            b"object-src 'none'; base-uri 'self'; frame-ancestors 'none'"
+        )
+        self.terminate(401, b"text/html")
+        auth_boot_script = '<script src="/auth.js" data-micros-auth="1"></script>'
+        body = (
+            '<!doctype html><html><head><meta charset="utf-8">'
+            '<meta name="viewport" content="width=device-width,initial-scale=1">'
+            '<title>micrOS Auth</title></head><body>'
+            f'{auth_boot_script}</body></html>'
+        )
+        return self._generate_response(tx, body)
+
     # =========================================
     # Public methods for load modules
     # =========================================
@@ -373,7 +412,6 @@ class WebEngine(Buffer):
             raise ValueError(f"method must be one of {WebEngine.METHODS}")
         WebEngine.ENDPOINTS[endpoint][method] = callback
 
-
     @staticmethod
     def web_mounts(modules:bool=None, data:bool=None, logs:bool=None) -> dict:
         """
@@ -652,38 +690,42 @@ class WebEngine(Buffer):
             resp_schema['result'] = {"micrOS": WebEngine.VERSION,
                                      'node': cfgget('devfid'),
                                      'auth': WebEngine.AUTH}
-            if len(tuple(WebEngine.ENDPOINTS.keys())) > 0:
-                resp_schema['result']['usr_endpoints'] = tuple(
-                    endpoint.decode("ascii") if isinstance(endpoint, (bytes, bytearray)) else endpoint
-                    for endpoint in WebEngine.ENDPOINTS
-                )
+            get_endpoints = tuple(
+                endpoint.decode("ascii") if isinstance(endpoint, (bytes, bytearray)) else endpoint
+                for endpoint, methods in WebEngine.ENDPOINTS.items()
+                if WebEngine.GET in methods
+            )
+            resp_schema['result']['usr_endpoints'] = get_endpoints
             resp_schema['state'] = True
         self.terminate(200, b"text/html")
         return self._generate_response(tx, resp_schema)
 
     def _lm_endpoint_st(self, rx, tx):
         """Process a request by registered load module callbacks"""
-        callback =  WebEngine.ENDPOINTS[self.url][self.method]
-        if "content-length" in self.headers and self.headers["content-length"] > 0:
-            if mp_boundary := WebEngine._is_multipart(self.headers):
-                self.mp_boundary = mp_boundary.encode("ascii")
-                self.engine_state = self._start_multipart_parser_st
-                return
-            if self.headers["content-length"] > rx.size():
-                return
-            if self.headers["content-length"] < rx.size():
-                self.on_client_error(tx, self.CONTENT_LENGTH_ERROR)
-                return
-            self.engine_state = None
-            dtype, data = callback(self.headers, bytes(rx.peek()))
-            dtype = dtype.encode("ascii")
-        else:
-            if not callable(callback):
-                # Handle endpoint callback as a static resource
-                self.engine_state = lambda _rx, _tx: self._send_file_st(_rx, _tx, callback)
-                return
-            dtype, data = callback(self.headers, b"")
-            dtype = dtype.encode("ascii")
+        callback = WebEngine.ENDPOINTS[self.url][self.method]
+        try:
+            if "content-length" in self.headers and self.headers["content-length"] > 0:
+                if mp_boundary := WebEngine._is_multipart(self.headers):
+                    self.mp_boundary = mp_boundary.encode("ascii")
+                    self.engine_state = self._start_multipart_parser_st
+                    return
+                if self.headers["content-length"] > rx.size():
+                    return
+                if self.headers["content-length"] < rx.size():
+                    self.on_client_error(tx, self.CONTENT_LENGTH_ERROR)
+                    return
+                self.engine_state = None
+                dtype, data = self._auth_execute(callback, self.headers, bytes(rx.peek()))
+                dtype = dtype.encode("ascii")
+            else:
+                if not callable(callback):
+                    # Handle endpoint callback as a static resource
+                    self.engine_state = lambda _rx, _tx: self._send_file_st(_rx, _tx, callback)
+                    return
+                dtype, data = self._auth_execute(callback, self.headers, b"")
+                dtype = dtype.encode("ascii")
+        except AuthRequired:
+            return self._auth_response(tx)
         # dtype:
         #   one-shot (simple MIME types): image/jpeg | text/html | text/plain
         #   - data contains the response to include in the body
@@ -760,8 +802,10 @@ class WebEngine(Buffer):
             self.on_missing_resource(tx, b"Mount not found")
             return
         try:
-            self.response_headers[b"content-length"] = str(stat(web_resource)[6]).encode()
-            self.terminate(200, WebEngine._file_type(web_resource))
+            file_size = stat(web_resource)[6]
+            content_type = WebEngine._file_type(web_resource)
+            self.response_headers[b"content-length"] = str(file_size).encode()
+            self.terminate(200, content_type)
             self._write_response_head(tx)
             return open(web_resource, "rb")
         except OSError:
@@ -811,16 +855,21 @@ class WebEngine(Buffer):
             return
         callback = WebEngine.ENDPOINTS[self.url][self.method]
         # Process complete part
-        if not is_final:
-            callback(part_headers, part_body, first=self.mp_first_part, last=False)
-            if rx.peek(len(self.mp_delimiter)) != self.mp_delimiter:
-                self.on_client_error(tx, self.MULTIPART_BOUNDARY_ERROR)
+        try:
+            if not is_final:
+                self._auth_execute(
+                    callback, part_headers, part_body,
+                    first=self.mp_first_part, last=False)
+                if rx.peek(len(self.mp_delimiter)) != self.mp_delimiter:
+                    self.on_client_error(tx, self.MULTIPART_BOUNDARY_ERROR)
+                    return
+                rx.consume(len(self.mp_delimiter))
+                self.content_length_cnt += len(self.mp_delimiter)
+                self.mp_first_part = False
+                self.engine_state = self._parse_boundary_st
                 return
-            rx.consume(len(self.mp_delimiter))
-            self.content_length_cnt += len(self.mp_delimiter)
-            self.mp_first_part = False
-            self.engine_state = self._parse_boundary_st
-            return
+        except AuthRequired:
+            return self._auth_response(tx)
         # Process last part
         rx.consume(len(self.mp_closing_delimiter))
         self.content_length_cnt += len(self.mp_closing_delimiter)
@@ -828,10 +877,14 @@ class WebEngine(Buffer):
         self.content_length_cnt + rx.size() != self.headers["content-length"]:
             self.on_client_error(tx, self.CONTENT_LENGTH_ERROR)
             return
-        dtype, data = callback(
-            part_headers,
-            part_body,
-            first=self.mp_first_part,
-            last=True)
+        try:
+            dtype, data = self._auth_execute(
+                callback,
+                part_headers,
+                part_body,
+                first=self.mp_first_part,
+                last=True)
+        except AuthRequired:
+            return self._auth_response(tx)
         self.terminate(200, dtype.encode("ascii"))
         return self._generate_response(tx, data)

{microsdevtoolkit-3.2.4 → microsdevtoolkit-3.3.0}/micrOS/source/modules/LM_web.py

@@ -10,17 +10,15 @@ from Common import web_endpoint, web_mounts
 from Config import cfgget, cfgput
 from Auth import sudo
 
-_CFG_HIDE = ("hwuid", "guimeta", "socport", "version", "auth", "soctout")
-
-
-def load(dashboard=True, fileserver:bool=False, fs_explore:bool=False):
+def load(dashboard=True, fileserver:bool=False, fs_explore:bool=False, config=True):
     """
     Centralized Web Backend Services Loader
     - Dynamic application dashboard
     - Fileserver
     :param dashboard:  bool - enable*/disable application dashboard
     :param fileserver: bool - enable/disable* fileserver
-    :param fs_explore: bool - enable all shared web mounts: modules, data
+    :param fs_explore: bool - enable/disable* all shared web mounts: modules, data
+    :param config:     bool - enable*/disable micrOS web config with auth
     """
     endpoints = []
     if dashboard:
@@ -30,10 +28,13 @@ def load(dashboard=True, fileserver:bool=False, fs_explore:bool=False):
         import LM_fileserver
         endpoints.append(LM_fileserver.load())
         endpoints.append(web_mounts(fs_explore, fs_explore, fs_explore))
+    if config:
+        endpoints.append(enable_config())
     return endpoints
 
+######################## System Config ######################
+_CFG_HIDE = ("hwuid", "guimeta", "socport", "version", "auth", "soctout")
 
-@sudo
 def enable_config():
     """
     Enable web configuration option
@@ -41,13 +42,15 @@ def enable_config():
     web_endpoint("config", _cfg_get_clb)
     web_endpoint("config", _cfg_set_clb, "POST")
     web_endpoint("config/ui", 'config.html')
-    return "Endpoints: /config and /config/ui"
+    web_endpoint("config/reboot", _reboot_clb, "POST")
+    return "Config endpoints: config/ui GET, /config GET|POST (protected), /config/reboot POST (protected)"
 
 
 def _cfg_json(data):
     return "application/json", dumps(data)
 
 
+@sudo
 def _cfg_get_clb(*_):
     """
     Get system config
@@ -55,6 +58,7 @@ def _cfg_get_clb(*_):
     return _cfg_json({k: v for k, v in cfgget().items() if k not in _CFG_HIDE})
 
 
+@sudo
 def _cfg_set_clb(_, body):
     """
     Set system config delta
@@ -65,9 +69,11 @@ def _cfg_set_clb(_, body):
         failed_keys = []
         for k, v in incoming_data.items():
             try:
-                if k == 'devfid' and not str(v).strip():
-                    raise Exception("Device name cannot be empty")
-                state = cfgput(k, v)
+                if isinstance(v, str) and not v.strip():
+                    if k == 'devfid':
+                        raise Exception("Device name cannot be empty")
+                    v = 'n/a'
+                state = cfgput(k, v, type_check=True)
             except Exception as e:
                 state = False
                 k = f"{k}: {e}"
@@ -84,6 +90,25 @@ def _cfg_set_clb(_, body):
         return _cfg_json({"state": False, "result": str(e)})
 
 
+@sudo
+def _reboot_clb(*_):
+    """
+    Hard reboot system from web endpoint
+    """
+    from Common import micro_task
+    from machine import reset
+
+    @micro_task("web.reboot", _wrap=True)
+    async def _hard_reboot(tag):
+        with micro_task(tag) as my_task:
+            await my_task.feed(1000)
+            reset()
+
+    return _cfg_json({"state": bool(_hard_reboot()), "result": "Hard reboot scheduled"})
+
+#############################################################
+
+
 def help(widgets=False):
     """
     [i] micrOS LM naming convention - built-in help message
@@ -91,6 +116,6 @@ def help(widgets=False):
         (widgets=False) list of functions implemented by this application
         (widgets=True) list of widget json for UI generation
     """
-    return ('load dashboard=True fileserver=False fs_explore=False',
+    return ('load dashboard=True fileserver=False fs_explore=False config=True',
             'enable_config',
             'help')

microsdevtoolkit-3.3.0/micrOS/source/web/auth.js

@@ -0,0 +1,142 @@
+(function () {
+  var ID = 'micrOSAuth', rf = window.fetch && window.fetch.bind(window);
+  var user = 'admin', pass = '';
+  try {
+    sessionStorage.removeItem(ID);
+    sessionStorage.removeItem('micros.config.auth');
+  } catch (_) {}
+
+  function rm(e) { if (e && e.parentNode) e.parentNode.removeChild(e); }
+  function load() { return {user: user, pass: pass}; }
+  function save(d) {
+    user = d.user || 'admin';
+    pass = d.pass || '';
+    return load();
+  }
+  function clear() { pass = ''; }
+  function url(i) {
+    return typeof i === 'string' ? i :
+      i && typeof i.href === 'string' ? i.href :
+      i && typeof i.url === 'string' ? i.url : '';
+  }
+  function same(i) {
+    try {
+      var a = document.createElement('a'), u = url(i);
+      if (!u) return false;
+      a.href = u;
+      return a.protocol === location.protocol && a.host === location.host;
+    } catch (_) { return false; }
+  }
+  function hdr(d) {
+    d = d || load();
+    return d.pass ? {'x-micros-auth': d.pass} : {};
+  }
+  function ext(a, b) {
+    var o = {}, k;
+    a = a || {};
+    for (k in a) o[k] = a[k];
+    for (k in b) o[k] = b[k];
+    return o;
+  }
+  function mh(a, b) {
+    var k, o = {};
+    if (window.Headers) {
+      try {
+        o = new Headers(a || {});
+        for (k in b) o.set(k, b[k]);
+        return o;
+      } catch (_) {}
+    }
+    a = a || {};
+    for (k in a) o[k] = a[k];
+    for (k in b) o[k] = b[k];
+    return o;
+  }
+  function af(u, o, d) {
+    o = o || {};
+    if (!rf) return Promise.reject(Error('Fetch unsupported'));
+    return rf(u, ext(o, {headers: mh(o.headers || (u && u.headers), same(u) && d ? hdr(d) : {})}));
+  }
+  function gf(u, o) {
+    o = o || {};
+    return af(u, o).then(function (r) {
+      if (r.status !== 401 || o.micrOSAuth === false || !same(u)) return r;
+      var d = load();
+      if (d.pass) {
+        return af(u, o, d).then(function (rr) {
+          if (rr.status !== 401) return rr;
+          clear();
+          return prompt({target: u, request: o, message: 'Auth required', ok: function (pr) { return pr; }});
+        });
+      }
+      return prompt({target: u, request: o, message: 'Auth required', ok: function (rr) { return rr; }});
+    });
+  }
+  function css() {
+    if (document.getElementById(ID + 'Style')) return;
+    var s = document.createElement('style');
+    s.id = ID + 'Style';
+    s.textContent = '#' + ID + '{position:fixed;top:0;right:0;bottom:0;left:0;z-index:9999;display:flex;align-items:center;justify-content:center;background:#0009;font:14px sans-serif;color:#fff}#' + ID + ' form{display:flex;flex-direction:column;width:240px;max-width:90%;padding:14px;border:1px solid #555;border-radius:6px;background:#161022}#' + ID + ' input,#' + ID + ' button{display:block;width:100%;min-width:0;max-width:none;flex:none;height:32px;min-height:32px;margin:8px 0 0;border-radius:4px;border:1px solid #555;padding:0 9px;box-sizing:border-box;font:14px sans-serif}#' + ID + ' input{background:#241a36;color:#fff}#' + ID + ' button{background:#17823a;color:#fff;font-weight:bold}#' + ID + ' span{min-height:18px;margin-top:6px;color:#ff9a9a}#' + ID + ' pre{white-space:pre-wrap;word-break:break-word}';
+    (document.head || document.getElementsByTagName('head')[0]).appendChild(s);
+  }
+  function prompt(o) {
+    o = o || {};
+    css();
+    rm(document.getElementById(ID));
+    var d = load(), p = document.createElement('div'), f, e, m, t;
+    p.id = ID;
+    p.innerHTML = '<form><strong>micrOS Auth</strong><input name="user" autocomplete="username" placeholder="Username"><input name="pass" type="password" autocomplete="current-password" placeholder="Password"><button>Unlock</button><span></span></form>';
+    f = p.getElementsByTagName('form')[0];
+    e = f.elements;
+    m = p.getElementsByTagName('span')[0];
+    t = o.target || location.pathname;
+    e.user.value = d.user || 'admin';
+    m.textContent = o.message || '';
+    return new Promise(function (resolve, reject) {
+      f.onsubmit = function (ev) {
+        ev.preventDefault();
+        var n = {user: e.user.value || 'admin', pass: e.pass.value || ''};
+        af(t, o.request || {}, n).then(function (r) {
+          if (r.status === 401) {
+            m.textContent = 'Access denied';
+            return;
+          }
+          save(n);
+          if (o.ok) {
+            rm(p);
+            resolve(o.ok(r, n));
+            return;
+          }
+          r.text().then(function (body) {
+            if ((r.headers.get('content-type') || '').indexOf('text/html') >= 0) {
+              document.open();
+              document.write(body);
+              document.close();
+            } else {
+              p.removeAttribute('id');
+              p.innerHTML = '<pre></pre>';
+              p.getElementsByTagName('pre')[0].textContent = body;
+            }
+            resolve(r);
+          });
+        }).catch(function (err) {
+          m.textContent = 'Request failed';
+          reject(err);
+        });
+      };
+      document.body.appendChild(p);
+      e.pass.focus();
+    });
+  }
+  function ready(fn) {
+    if (document.body) fn();
+    else document.addEventListener('DOMContentLoaded', fn);
+  }
+
+  var ss = document.getElementsByTagName('script');
+  var me = document.currentScript || ss[ss.length - 1];
+  var boot = me && me.getAttribute('data-micros-auth');
+  window.micrOSAuth = {load: load, save: save, clear: clear, headers: hdr, fetch: gf, prompt: prompt};
+  if (rf) window.fetch = gf;
+  if (boot) ready(function () { prompt({target: boot === '1' ? location.pathname : boot}); });
+})();