pyobs-core 2.0.0.dev59__tar.gz → 2.0.0.dev61__tar.gz

{pyobs_core-2.0.0.dev59 → pyobs_core-2.0.0.dev61}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pyobs-core
-Version: 2.0.0.dev59
+Version: 2.0.0.dev61
 Summary: robotic telescope software
 Author-email: Tim-Oliver Husser <thusser@uni-goettingen.de>
 License-Expression: MIT

{pyobs_core-2.0.0.dev59 → pyobs_core-2.0.0.dev61}/pyobs/application.py

@@ -126,9 +126,6 @@ class Application:
         if module_factory is not None and loop_module_class is None:
             raise ValueError("loop_module_class is required when module_factory is given.")
 
-        if iers_offline:
-            _disable_iers_auto_download()
-
         # get config name without path and extension
         self._config = config
         config_base = (
@@ -220,6 +217,12 @@ class Application:
         # (there's no real name yet until the factory resolves the actual module/comm identity)
         module_name.set(Path(self._config).stem.lstrip("_") if self._config is not None else config_base)
 
+        # handlers/module-name context are set up above -- only now can a log.warning() here
+        # actually reach journald tagged with PYOBS_MODULE, instead of falling through to
+        # logging's untagged handler-of-last-resort
+        if iers_offline:
+            _disable_iers_auto_download()
+
         self._module: Module | None = None
         self._module_factory = module_factory
 

{pyobs_core-2.0.0.dev59 → pyobs_core-2.0.0.dev61}/pyobs/modules/utils/httpfilecache.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import hmac
 import logging
 from typing import Any
 
@@ -15,13 +16,22 @@ log = logging.getLogger(__name__)
 class HttpFileCache(Module):
     """A file cache based on a HTTP server."""
 
-    def __init__(self, port: int = 37075, cache_size: int = 25, max_file_size: int = 100, **kwargs: Any):
+    def __init__(
+        self,
+        port: int = 37075,
+        cache_size: int = 25,
+        max_file_size: int = 100,
+        token: str | None = None,
+        **kwargs: Any,
+    ):
         """Initializes file cache.
 
         Args:
             port: Port for HTTP server.
             cache_size: Size of file cache, i.e. number of files to cache.
             max_file_size: Maximum file size in MB.
+            token: Shared secret required in the "Authorization: Bearer <token>" header for
+                download/upload access. If None (default), no auth is enforced.
         """
         Module.__init__(self, **kwargs)
 
@@ -31,6 +41,7 @@ class HttpFileCache(Module):
         self._port = port
         self._cache_size = cache_size
         self._max_file_size = max_file_size * 1024 * 1024
+        self._token = token
 
         # define web server
         self._app = web.Application(client_max_size=self._max_file_size)
@@ -38,6 +49,7 @@ class HttpFileCache(Module):
             [
                 web.get("/ping", self.ping_handler),
                 web.get("/{filename}", self.download_handler),
+                web.options("/{filename}", self.options_handler),
                 web.post("/", self.upload_handler),
             ]
         )
@@ -67,6 +79,19 @@ class HttpFileCache(Module):
         """Whether the server is started."""
         return self._is_listening
 
+    def _check_auth(self, request: web.Request) -> None:
+        """Raises HTTPUnauthorized if a token is configured and the request doesn't carry it.
+
+        Args:
+            request: Request to check.
+        """
+        if self._token is None:
+            return
+        prefix = "Bearer "
+        header = request.headers.get("Authorization", "")
+        if not header.startswith(prefix) or not hmac.compare_digest(header[len(prefix) :], self._token):
+            raise web.HTTPUnauthorized()
+
     async def ping_handler(self, request: web.Request) -> web.Response:
         """Handles GET access to /ping for testing connectivity.
 
@@ -76,7 +101,24 @@ class HttpFileCache(Module):
         Returns:
             Response with a JSON status.
         """
-        return web.json_response({"status": "ok"})
+        return web.json_response({"status": "ok"}, headers={"Access-Control-Allow-Origin": "*"})
+
+    async def options_handler(self, request: web.Request) -> web.Response:
+        """Handles OPTIONS access to /{filename} for CORS preflight requests.
+
+        Args:
+            request: Request to respond to.
+
+        Returns:
+            Empty response with CORS headers.
+        """
+        return web.Response(
+            headers={
+                "Access-Control-Allow-Origin": "*",
+                "Access-Control-Allow-Methods": "GET",
+                "Access-Control-Allow-Headers": "Authorization",
+            }
+        )
 
     async def download_handler(self, request: web.Request) -> web.Response:
         """Handles GET access to /{filename} and returns image.
@@ -87,6 +129,7 @@ class HttpFileCache(Module):
         Returns:
             Response containing image.
         """
+        self._check_auth(request)
 
         # get filename
         filename = request.match_info["filename"]
@@ -98,7 +141,7 @@ class HttpFileCache(Module):
 
         # send it
         log.info("Serving file %s.", filename)
-        return web.Response(body=data)
+        return web.Response(body=data, headers={"Access-Control-Allow-Origin": "*"})
 
     async def upload_handler(self, request: web.Request) -> web.Response:
         """Handles PUSH access to /, stores image and returns filename.
@@ -109,6 +152,7 @@ class HttpFileCache(Module):
         Returns:
             Response containing filename.
         """
+        self._check_auth(request)
 
         # read multipart data
         reader = await request.multipart()

{pyobs_core-2.0.0.dev59 → pyobs_core-2.0.0.dev61}/pyobs/vfs/httpfile.py

@@ -23,8 +23,7 @@ class HttpFile(BufferedFile):
         mode: str = "r",
         download: str | None = None,
         upload: str | None = None,
-        username: str | None = None,
-        password: str | None = None,
+        token: str | None = None,
         verify_tls: bool = False,
         timeout: int = 30,
         **kwargs: Any,
@@ -36,8 +35,7 @@ class HttpFile(BufferedFile):
             mode: Open mode (r/w).
             download: Base URL for downloading files. If None, no read access possible.
             upload: Base URL for uploading files. If None, no write access possible.
-            username: Username for accessing the HTTP server.
-            password: Password for accessing the HTTP server.
+            token: Shared secret sent as "Authorization: Bearer <token>" to the HTTP server.
             verify_tls: Whether to verify TLS certificates.
             timeout: Timeout in seconds for uploading/downloading files.
         """
@@ -49,9 +47,7 @@ class HttpFile(BufferedFile):
         self._timeout = aiohttp.ClientTimeout(total=timeout)
 
         # auth
-        self._auth = None
-        if username is not None and password is not None:
-            self._auth = aiohttp.BasicAuth(username, password)
+        self._headers = {"Authorization": f"Bearer {token}"} if token is not None else {}
 
         # filename is not allowed to start with a / or contain ..
         if name.startswith("/") or ".." in name:
@@ -91,7 +87,7 @@ class HttpFile(BufferedFile):
 
         # do request
         async with aiohttp.ClientSession() as session:
-            async with session.get(self.url, auth=self._auth, timeout=self._timeout) as response:
+            async with session.get(self.url, headers=self._headers, timeout=self._timeout) as response:
                 # check response
                 if response.status == 200:
                     # get data and return it
@@ -165,7 +161,9 @@ class HttpFile(BufferedFile):
         async with aiohttp.ClientSession() as session:
             data = aiohttp.FormData()
             data.add_field("file", self._buffer(filename), filename=filename)
-            async with session.post(self._upload_path, auth=self._auth, data=data, timeout=self._timeout) as response:
+            async with session.post(
+                self._upload_path, headers=self._headers, data=data, timeout=self._timeout
+            ) as response:
                 if response.status == 401:
                     log.error("Wrong credentials for uploading file.")
                     raise FileNotFoundError

{pyobs_core-2.0.0.dev59 → pyobs_core-2.0.0.dev61}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pyobs-core"
-version = "2.0.0.dev59"
+version = "2.0.0.dev61"
 description = "robotic telescope software"
 authors = [{ name = "Tim-Oliver Husser", email = "thusser@uni-goettingen.de" }]
 requires-python = ">=3.11"