monitor-app 2.1.0__tar.gz → 2.3.1__tar.gz

{monitor_app-2.1.0 → monitor_app-2.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: monitor-app
-Version: 2.1.0
+Version: 2.3.1
 Summary: Drop in a CSV, write one config file, and get a live-updating Web UI + REST API. FastAPI-based data monitoring for shop floors and small teams.
 License-Expression: MIT
 License-File: LICENSE
@@ -25,16 +25,17 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Provides-Extra: xlsx
 Requires-Dist: click (>=8.1,<8.2)
-Requires-Dist: fastapi (>=0.115,<1.0)
+Requires-Dist: fastapi (>=0.133,<1.0)
 Requires-Dist: jinja2 (>=3.1,<4.0)
 Requires-Dist: openpyxl (>=3.1,<4.0) ; extra == "xlsx"
-Requires-Dist: pg8000 (>=1.30,<2.0)
+Requires-Dist: pg8000 (>=1.31.5,<2.0)
 Requires-Dist: pydantic (>=2.7,<3.0)
 Requires-Dist: pydantic-settings (>=2.3,<3.0)
 Requires-Dist: pymysql (>=1.1,<2.0)
-Requires-Dist: python-multipart (>=0.0.9)
+Requires-Dist: python-multipart (>=0.0.31)
 Requires-Dist: sqlalchemy (>=2.0,<3.0)
 Requires-Dist: sse-starlette (>=2.1,<3.0)
+Requires-Dist: starlette (>=1.3.1,<2.0)
 Requires-Dist: typer (>=0.12,<1.0)
 Requires-Dist: uvicorn[standard] (>=0.30,<1.0)
 Project-URL: Changelog, https://github.com/mikawa-bushi/monitor-app/blob/main/CHANGELOG.md
@@ -72,9 +73,12 @@ Monitor App is a FastAPI-based data monitoring tool designed for shop floors, la
 | Feature | What it does | How to enable |
 |---|---|---|
 | Auto data ingest | Watches `csv/` for changes; `POST /api/ingest/{table}` for sensors/PLC/MES | `MONITOR_INGEST_WATCH` / always on |
-| Threshold alerts | On-screen banner + beep, Webhook (Slack/Teams), LINE, e-mail; edge-triggered | `alerts=[AlertRule(...)]` |
+| Threshold alerts | On-screen banner + browser notification, Webhook (Slack/Teams), e-mail; edge-triggered | `alerts=[AlertRule(...)]` |
 | Andon wallboard | Full-screen rotating views with a green/amber/red status light at `/kiosk` | `kiosk=KioskConfig(...)` |
 | Trend / SPC charts | Line & bar charts with UCL/LCL/target lines, out-of-control points highlighted | `ViewDef(chart=ChartDef(...))` |
+| Dashboard | Home page shows mini-chart grid (columns=1–4) for chart-enabled views; non-chart views listed below | `dashboard=DashboardConfig(columns=2)` |
+| Group navigation | Sidebar and view list support named groups; `ViewDef(group="...")` | `ViewDef(group=...)` |
+| Dark theme | Toggle between light and dark; persisted in `localStorage["monitor-theme"]`; `<html data-theme="dark">` | theme-toggle button (☀️/🌙) |
 | KPI cards | Scalar SQL (counts, rates, OEE) as color-coded cards on the home page | `kpis={...}` |
 | Operator entry forms | Touch-friendly forms generated from your table schema at `/form/{table}` | `TableDef(form=FormDef(...))` |
 | Audit log | Who changed what and when, for every write | `MONITOR_AUDIT_ENABLED` |
@@ -172,7 +176,7 @@ MONITOR_WEBHOOK_URL=https://hooks.slack.com/services/...
 
 | Path | Description |
 |---|---|
-| `/` | Home: KPI cards + view list |
+| `/` | Home: dashboard with mini-charts, KPI cards, and view list |
 | `/table/{view}` | Live table / chart page |
 | `/kiosk` | Andon wallboard (full screen, auto-rotating) |
 | `/form/{table}` | Operator entry form |
@@ -182,6 +186,24 @@ MONITOR_WEBHOOK_URL=https://hooks.slack.com/services/...
 | `/api/views/{view}` | View data (+ `/stream` for SSE, `/export` for CSV/Excel) |
 | `/api/kpis`, `/api/alerts`, `/api/audit`, `/api/schema`, `/api/health` | KPIs, active alerts, audit log, schema, health |
 
+## 🔌 External tool integrations (v2.2)
+
+Connect procdiag, netdiag, and network-checker to Monitor App with a few lines — no changes to the external tools required (read-only, pull-based).
+
+```python
+from monitor_app.integrations import procdiag, netdiag, network_checker
+
+config = procdiag.attach(config, db_path="/opt/procdiag/data/procdiag.db")
+config = netdiag.attach(config)
+config = network_checker.attach(config, hosts=["plc-01", "gateway"])
+```
+
+Each `attach()` call merges tables, views, KPIs, and alert rules into your existing config. Run `monitor-app sync-sources` to ingest on demand, or set `MONITOR_INGEST_WATCH=1` for continuous polling.
+
+Full reference: [docs/integrations_v2_2.md](https://github.com/mikawa-bushi/monitor-app/blob/main/docs/integrations_v2_2.md)
+
+---
+
 ## 🔄 Migrating from v0.x
 
 v2 was rebuilt on FastAPI + Pydantic. The legacy dict-style `config.py`
@@ -193,7 +215,9 @@ compatibility shim, but new projects should use `MonitorConfig`. Key changes:
 - API paths: `/api/<table>` → `/api/tables/{table}`, `/api/view/<v>` → `/api/views/{view}`
 
 Details: [redesign notes](https://github.com/mikawa-bushi/monitor-app/blob/main/docs/redesign_v2.md) ·
-[v2.1 feature design](https://github.com/mikawa-bushi/monitor-app/blob/main/docs/feature_expansion_v2.1.md)
+[v2.1 feature design](https://github.com/mikawa-bushi/monitor-app/blob/main/docs/feature_expansion_v2.1.md) ·
+[v2.2 integrations](https://github.com/mikawa-bushi/monitor-app/blob/main/docs/integrations_v2_2.md) ·
+[v2.3 UI redesign](https://github.com/mikawa-bushi/monitor-app/blob/main/docs/ui_redesign_v2_3.md)
 
 ## 🐳 Docker
 
@@ -211,6 +235,30 @@ poetry install
 poetry run pytest
 ```
 
+### Pre-push security & quality checks
+
+A [pre-commit](https://pre-commit.com/) config scans for **secrets** and enforces
+formatting locally, before code leaves your machine. Enable it once per clone:
+
+```sh
+poetry run pre-commit install          # installs the commit + pre-push hooks
+poetry run pre-commit run --all-files  # optional: run across the repo now
+```
+
+- **gitleaks** — blocks hard-coded secrets (PyPI/AWS/GCP tokens, GitHub PATs, private keys)
+- **detect-private-key / check-added-large-files / check-merge-conflict**, plus **black / ruff** (pinned to the CI versions)
+- **check-commit-identity** (pre-push) — rejects commits whose author/committer e-mail is off the allowlist, keeping work/other identities out of history (`scripts/check_commit_identity.py`; extend via the `MONITOR_ALLOWED_EMAILS` env var)
+- **check-ai-traces** (commit + pre-push) — flags traces of AI-agent tools (config dirs, file content, commit metadata) so they don't leak into the repo. Tool patterns are data-driven in `scripts/check_ai_traces.py` (extend the `TOOLS` list or `MONITOR_AI_TRACE_EXTRA`; ignore paths via `.ai-trace-ignore`)
+
+Audit the **whole working tree and full git history** on demand:
+
+```sh
+python3 scripts/check_ai_traces.py --all   # exit 0 = no traces found
+```
+
+> ⚠️ Local hooks can be skipped with `git commit/push --no-verify`. For an
+> unbypassable gate, also make `gitleaks` a required GitHub Actions check.
+
 Contributions are welcome — see [CONTRIBUTING.md](https://github.com/mikawa-bushi/monitor-app/blob/main/CONTRIBUTING.md).
 
 ## 📜 License

{monitor_app-2.1.0 → monitor_app-2.3.1}/README.md

@@ -27,9 +27,12 @@ Monitor App is a FastAPI-based data monitoring tool designed for shop floors, la
 | Feature | What it does | How to enable |
 |---|---|---|
 | Auto data ingest | Watches `csv/` for changes; `POST /api/ingest/{table}` for sensors/PLC/MES | `MONITOR_INGEST_WATCH` / always on |
-| Threshold alerts | On-screen banner + beep, Webhook (Slack/Teams), LINE, e-mail; edge-triggered | `alerts=[AlertRule(...)]` |
+| Threshold alerts | On-screen banner + browser notification, Webhook (Slack/Teams), e-mail; edge-triggered | `alerts=[AlertRule(...)]` |
 | Andon wallboard | Full-screen rotating views with a green/amber/red status light at `/kiosk` | `kiosk=KioskConfig(...)` |
 | Trend / SPC charts | Line & bar charts with UCL/LCL/target lines, out-of-control points highlighted | `ViewDef(chart=ChartDef(...))` |
+| Dashboard | Home page shows mini-chart grid (columns=1–4) for chart-enabled views; non-chart views listed below | `dashboard=DashboardConfig(columns=2)` |
+| Group navigation | Sidebar and view list support named groups; `ViewDef(group="...")` | `ViewDef(group=...)` |
+| Dark theme | Toggle between light and dark; persisted in `localStorage["monitor-theme"]`; `<html data-theme="dark">` | theme-toggle button (☀️/🌙) |
 | KPI cards | Scalar SQL (counts, rates, OEE) as color-coded cards on the home page | `kpis={...}` |
 | Operator entry forms | Touch-friendly forms generated from your table schema at `/form/{table}` | `TableDef(form=FormDef(...))` |
 | Audit log | Who changed what and when, for every write | `MONITOR_AUDIT_ENABLED` |
@@ -127,7 +130,7 @@ MONITOR_WEBHOOK_URL=https://hooks.slack.com/services/...
 
 | Path | Description |
 |---|---|
-| `/` | Home: KPI cards + view list |
+| `/` | Home: dashboard with mini-charts, KPI cards, and view list |
 | `/table/{view}` | Live table / chart page |
 | `/kiosk` | Andon wallboard (full screen, auto-rotating) |
 | `/form/{table}` | Operator entry form |
@@ -137,6 +140,24 @@ MONITOR_WEBHOOK_URL=https://hooks.slack.com/services/...
 | `/api/views/{view}` | View data (+ `/stream` for SSE, `/export` for CSV/Excel) |
 | `/api/kpis`, `/api/alerts`, `/api/audit`, `/api/schema`, `/api/health` | KPIs, active alerts, audit log, schema, health |
 
+## 🔌 External tool integrations (v2.2)
+
+Connect procdiag, netdiag, and network-checker to Monitor App with a few lines — no changes to the external tools required (read-only, pull-based).
+
+```python
+from monitor_app.integrations import procdiag, netdiag, network_checker
+
+config = procdiag.attach(config, db_path="/opt/procdiag/data/procdiag.db")
+config = netdiag.attach(config)
+config = network_checker.attach(config, hosts=["plc-01", "gateway"])
+```
+
+Each `attach()` call merges tables, views, KPIs, and alert rules into your existing config. Run `monitor-app sync-sources` to ingest on demand, or set `MONITOR_INGEST_WATCH=1` for continuous polling.
+
+Full reference: [docs/integrations_v2_2.md](https://github.com/mikawa-bushi/monitor-app/blob/main/docs/integrations_v2_2.md)
+
+---
+
 ## 🔄 Migrating from v0.x
 
 v2 was rebuilt on FastAPI + Pydantic. The legacy dict-style `config.py`
@@ -148,7 +169,9 @@ compatibility shim, but new projects should use `MonitorConfig`. Key changes:
 - API paths: `/api/<table>` → `/api/tables/{table}`, `/api/view/<v>` → `/api/views/{view}`
 
 Details: [redesign notes](https://github.com/mikawa-bushi/monitor-app/blob/main/docs/redesign_v2.md) ·
-[v2.1 feature design](https://github.com/mikawa-bushi/monitor-app/blob/main/docs/feature_expansion_v2.1.md)
+[v2.1 feature design](https://github.com/mikawa-bushi/monitor-app/blob/main/docs/feature_expansion_v2.1.md) ·
+[v2.2 integrations](https://github.com/mikawa-bushi/monitor-app/blob/main/docs/integrations_v2_2.md) ·
+[v2.3 UI redesign](https://github.com/mikawa-bushi/monitor-app/blob/main/docs/ui_redesign_v2_3.md)
 
 ## 🐳 Docker
 
@@ -166,6 +189,30 @@ poetry install
 poetry run pytest
 ```
 
+### Pre-push security & quality checks
+
+A [pre-commit](https://pre-commit.com/) config scans for **secrets** and enforces
+formatting locally, before code leaves your machine. Enable it once per clone:
+
+```sh
+poetry run pre-commit install          # installs the commit + pre-push hooks
+poetry run pre-commit run --all-files  # optional: run across the repo now
+```
+
+- **gitleaks** — blocks hard-coded secrets (PyPI/AWS/GCP tokens, GitHub PATs, private keys)
+- **detect-private-key / check-added-large-files / check-merge-conflict**, plus **black / ruff** (pinned to the CI versions)
+- **check-commit-identity** (pre-push) — rejects commits whose author/committer e-mail is off the allowlist, keeping work/other identities out of history (`scripts/check_commit_identity.py`; extend via the `MONITOR_ALLOWED_EMAILS` env var)
+- **check-ai-traces** (commit + pre-push) — flags traces of AI-agent tools (config dirs, file content, commit metadata) so they don't leak into the repo. Tool patterns are data-driven in `scripts/check_ai_traces.py` (extend the `TOOLS` list or `MONITOR_AI_TRACE_EXTRA`; ignore paths via `.ai-trace-ignore`)
+
+Audit the **whole working tree and full git history** on demand:
+
+```sh
+python3 scripts/check_ai_traces.py --all   # exit 0 = no traces found
+```
+
+> ⚠️ Local hooks can be skipped with `git commit/push --no-verify`. For an
+> unbypassable gate, also make `gitleaks` a required GitHub Actions check.
+
 Contributions are welcome — see [CONTRIBUTING.md](https://github.com/mikawa-bushi/monitor-app/blob/main/CONTRIBUTING.md).
 
 ## 📜 License

monitor_app-2.3.1/monitor_app/api/deps.py

@@ -0,0 +1,140 @@
+"""FastAPI 依存。アプリ状態(app.state)へのアクセスと API キー / セッション検証。
+
+認証(#11): 書き込み系は ``api_key`` 設定時に必須、読み取り系は ``protect_reads``
+有効時に必須。クライアントは **X-API-Key ヘッダ** か **セッション Cookie** の
+どちらかで認証できる。Cookie は同梱 Web UI がブラウザから認証するための経路で、
+``/api/login`` がキー検証後に発行する(値はキーの HMAC で、生キーは保存しない)。
+"""
+
+from __future__ import annotations
+
+import hashlib
+import hmac
+import secrets
+
+from fastapi import Depends, HTTPException, Request, Security
+from fastapi.security import APIKeyHeader
+
+from ..services.crud_service import CrudService
+from ..services.view_service import ViewService
+from ..settings.declarative import MonitorConfig
+from ..settings.runtime import AppSettings
+
+_api_key_header = APIKeyHeader(name="X-API-Key", auto_error=False)
+
+#: セッション Cookie 名(#11)。
+SESSION_COOKIE = "monitor_session"
+
+
+def session_token(api_key: str) -> str:
+    """API キーから導出する署名付きセッショントークン。
+
+    生キーを Cookie に置かないための HMAC。ステートレスなので再起動・多ワーカーでも
+    一貫して検証できる。"""
+    return hmac.new(
+        api_key.encode("utf-8"), b"monitor-session", hashlib.sha256
+    ).hexdigest()
+
+
+def get_settings(request: Request) -> AppSettings:
+    return request.app.state.settings
+
+
+def get_config(request: Request) -> MonitorConfig:
+    return request.app.state.config
+
+
+def get_crud_service(request: Request) -> CrudService:
+    return request.app.state.crud_service
+
+
+def get_view_service(request: Request) -> ViewService:
+    return request.app.state.view_service
+
+
+def get_alert_engine(request: Request):
+    """AlertEngine を返す(フェーズ1・A)。"""
+    return request.app.state.alert_engine
+
+
+def get_kpi_service(request: Request):
+    """KpiService を返す(フェーズ2・E)。"""
+    return request.app.state.kpi_service
+
+
+def get_audit_service(request: Request):
+    """AuditService を返す(フェーズ4・G)。"""
+    return request.app.state.audit_service
+
+
+def _is_authed(settings: AppSettings, request: Request, provided: str | None) -> bool:
+    """ヘッダ or セッション Cookie で認証済みか。api_key 未設定なら常に True。"""
+    if settings.api_key is None:
+        return True
+    if provided and secrets.compare_digest(provided, settings.api_key):
+        return True
+    cookie = request.cookies.get(SESSION_COOKIE)
+    if cookie and secrets.compare_digest(cookie, session_token(settings.api_key)):
+        return True
+    return False
+
+
+def get_actor(
+    request: Request,
+    provided: str | None = Security(_api_key_header),
+) -> str:
+    """監査用の実行主体を表す文字列(フェーズ4・G)。
+
+    ヘッダ認証なら "api"、Cookie セッションなら "ui"、いずれも無ければ "anon"。
+    クライアント IP を添える。
+    """
+    client = request.client.host if request.client else "unknown"
+    if provided:
+        who = "api"
+    elif request.cookies.get(SESSION_COOKIE):
+        who = "ui"
+    else:
+        who = "anon"
+    return f"{who}@{client}"
+
+
+def _check_auth(settings: AppSettings, request: Request, provided: str | None) -> None:
+    if not _is_authed(settings, request, provided):
+        raise HTTPException(
+            status_code=401,
+            detail={"code": "UNAUTHORIZED", "message": "API キーが無効です"},
+        )
+
+
+def require_write_auth(
+    request: Request,
+    settings: AppSettings = Depends(get_settings),
+    provided: str | None = Security(_api_key_header),
+) -> None:
+    """書き込み系(POST/PUT/DELETE)で必須。api_key 未設定なら素通り。"""
+    _check_auth(settings, request, provided)
+
+
+def require_read_auth(
+    request: Request,
+    settings: AppSettings = Depends(get_settings),
+    provided: str | None = Security(_api_key_header),
+) -> None:
+    """読み取り系。protect_reads=True かつ api_key 設定時のみ検証。"""
+    if settings.protect_reads:
+        _check_auth(settings, request, provided)
+
+
+class RedirectToLogin(Exception):
+    """HTML ページが未認証のとき送出。/login へのリダイレクトに変換される(#11)。"""
+
+
+def page_auth_guard(
+    request: Request,
+    settings: AppSettings = Depends(get_settings),
+    provided: str | None = Security(_api_key_header),
+) -> None:
+    """HTML ページ用ガード。protect_reads+api_key 有効かつ未認証なら /login へ。"""
+    if settings.protect_reads and settings.api_key:
+        if not _is_authed(settings, request, provided):
+            raise RedirectToLogin()

{monitor_app-2.1.0 → monitor_app-2.3.1}/monitor_app/api/errors.py

@@ -6,9 +6,10 @@ import logging
 import uuid
 
 from fastapi import FastAPI, Request
-from fastapi.responses import JSONResponse
+from fastapi.responses import JSONResponse, RedirectResponse
 
 from ..exceptions import MonitorAppError
+from .deps import RedirectToLogin
 
 logger = logging.getLogger("monitor_app.api")
 
@@ -31,3 +32,8 @@ def register_exception_handlers(app: FastAPI) -> None:
         return JSONResponse(
             status_code=exc.status_code, content=_body(exc.code, exc.message)
         )
+
+    @app.exception_handler(RedirectToLogin)
+    async def _handle_login_redirect(_request: Request, _exc: RedirectToLogin):
+        # 未認証の HTML ページアクセスはログインページへ誘導する(#11)。
+        return RedirectResponse(url="/login", status_code=303)

monitor_app-2.3.1/monitor_app/api/routers/auth.py

@@ -0,0 +1,51 @@
+"""UI 向けセッション認証エンドポイント(#11)。
+
+``protect_reads``/``api_key`` 有効時に、ブラウザからキーを渡して同梱 UI を使える
+ようにする。検証成功で HttpOnly な署名付き Cookie を発行し、以後の同一オリジン
+fetch が自動的に認証される。
+"""
+
+from __future__ import annotations
+
+import secrets
+
+from fastapi import APIRouter, Depends, Form, Request
+from fastapi.responses import RedirectResponse
+
+from ...settings.runtime import AppSettings
+from ..deps import SESSION_COOKIE, get_settings, session_token
+
+router = APIRouter(prefix="/api", tags=["Auth"])
+
+
+@router.post("/login")
+def login(
+    request: Request,
+    key: str = Form(...),
+    settings: AppSettings = Depends(get_settings),
+):
+    """キーを検証し、成功なら HttpOnly セッション Cookie を発行して / へ。"""
+    if settings.api_key is not None and not secrets.compare_digest(
+        key, settings.api_key
+    ):
+        return RedirectResponse(url="/login?error=1", status_code=303)
+
+    resp = RedirectResponse(url="/", status_code=303)
+    if settings.api_key is not None:
+        resp.set_cookie(
+            SESSION_COOKIE,
+            session_token(settings.api_key),
+            httponly=True,
+            samesite="lax",
+            secure=request.url.scheme == "https",
+            max_age=60 * 60 * 12,  # 12 時間
+        )
+    return resp
+
+
+@router.post("/logout")
+def logout():
+    """セッション Cookie を失効させ、ログインページへ。"""
+    resp = RedirectResponse(url="/login", status_code=303)
+    resp.delete_cookie(SESSION_COOKIE)
+    return resp

{monitor_app-2.1.0 → monitor_app-2.3.1}/monitor_app/api/routers/crud.py

@@ -2,10 +2,11 @@
 
 from __future__ import annotations
 
-from typing import Any, Dict
+from typing import Any, Dict, Optional
 
-from fastapi import APIRouter, Body, Depends
+from fastapi import APIRouter, Body, Depends, Query
 
+from ...services.crud_service import CrudService
 from ..deps import (
     get_actor,
     get_crud_service,
@@ -13,7 +14,6 @@ from ..deps import (
     require_write_auth,
 )
 from ..schemas import MessageResponse, RecordResponse, TableDataResponse
-from ...services.crud_service import CrudService
 
 router = APIRouter(prefix="/api/tables", tags=["CRUD"])
 
@@ -21,11 +21,13 @@ router = APIRouter(prefix="/api/tables", tags=["CRUD"])
 @router.get("/{table_name}", response_model=TableDataResponse)
 def list_records(
     table_name: str,
+    limit: Optional[int] = Query(None, ge=1, description="返す最大行数(#17)"),
+    offset: int = Query(0, ge=0, description="先頭からのスキップ行数(#17)"),
     service: CrudService = Depends(get_crud_service),
     _: None = Depends(require_read_auth),
 ):
-    """テーブルの全レコードを取得する。"""
-    rows = service.list_records(table_name)
+    """テーブルのレコードを取得する。``limit``/``offset`` 省略時は全件。"""
+    rows = service.list_records(table_name, limit=limit, offset=offset)
     columns = service.config.tables[table_name].column_names
     return TableDataResponse(
         table_name=table_name, columns=columns, data=rows, count=len(rows)