pyobs-core 2.0.0.dev91__tar.gz → 2.0.0.dev93__tar.gz

{pyobs_core-2.0.0.dev91 → pyobs_core-2.0.0.dev93}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pyobs-core
-Version: 2.0.0.dev91
+Version: 2.0.0.dev93
 Summary: robotic telescope software
 Author-email: Tim-Oliver Husser <thusser@uni-goettingen.de>
 License-Expression: MIT

{pyobs_core-2.0.0.dev91 → pyobs_core-2.0.0.dev93}/pyobs/modules/camera/basevideo.py

@@ -1,4 +1,6 @@
 import asyncio
+import hashlib
+import hmac
 import io
 import json
 import logging
@@ -39,6 +41,12 @@ INDEX_HTML = """
 
 """
 
+# session cookie for browser login (see _check_auth); only used when a token is configured
+_COOKIE_NAME = "pyobs_video_session"
+_COOKIE_LIFETIME = 24 * 60 * 60  # 24 h, in seconds
+# delay on a wrong login password, to slow brute force (compare is constant-time either way)
+_LOGIN_FAILURE_SLEEP = 1.0
+
 
 async def calc_expose_timeout(webcam: IExposureTime, *args: Any, **kwargs: Any) -> float:
     """Calculates timeout for grabe_image()."""
@@ -71,7 +79,14 @@ class LastImage(NamedTuple):
 
 
 class BaseVideo(Module, ImageFitsHeaderMixin, IVideo, IImageType, metaclass=ABCMeta):
-    """Base class for all webcam modules."""
+    """Base class for all webcam modules.
+
+    The built-in HTTP server serves the MJPEG live view, the raw frame stream and cached FITS
+    images. Set the ``token`` parameter to protect all of them: machine clients send
+    ``Authorization: Bearer <token>`` (as :class:`pyobs.vfs.HttpFile` does), browsers log in once
+    at ``/login`` and get an HMAC-signed session cookie that rides the same-origin ``<img>``
+    requests. Without a token (the default), no auth is enforced.
+    """
 
     __module__ = "pyobs.modules.camera"
 
@@ -90,6 +105,7 @@ class BaseVideo(Module, ImageFitsHeaderMixin, IVideo, IImageType, metaclass=ABCM
         flip: bool = False,
         sleep_time: int = 60,
         fits_header_timeout: float = 15.0,
+        token: str | None = None,
         **kwargs: Any,
     ):
         """Creates a new BaseWebcam.
@@ -112,6 +128,8 @@ class BaseVideo(Module, ImageFitsHeaderMixin, IVideo, IImageType, metaclass=ABCM
             flip: Whether to flip around Y axis.
             sleep_time: Time in s with inactivity after which the camera should go to sleep.
             fits_header_timeout: Maximum seconds to wait for a peer's FITS headers before skipping them.
+            token: Shared secret required in the "Authorization: Bearer <token>" header (or a
+                login-page cookie) for stream and data access. If None (default), no auth is enforced.
         """
         super().__init__(
             fits_namespaces=fits_namespaces,
@@ -153,12 +171,23 @@ class BaseVideo(Module, ImageFitsHeaderMixin, IVideo, IImageType, metaclass=ABCM
         self._cache = DataCache(cache_size)
 
         # define web server
+        self._token = token
+        # serializes /login attempts so _LOGIN_FAILURE_SLEEP actually caps the guess rate;
+        # without it, concurrent connections each sleep independently and the rate scales
+        # with concurrency instead of being capped
+        self._login_lock = asyncio.Lock()
         self._app = web.Application()
         routes = [web.get("/ping", self.ping_handler), web.get("/{filename}", self.image_handler)]
         if self._video_path is not None:
             routes += [web.get("/", self.web_handler), web.get("/video.mjpg", self.video_handler)]
         if self._raw_path is not None:
             routes.append(web.get("/video.raw", self.raw_handler))
+        if self._token is not None:
+            routes += [
+                web.get("/login", self.login_handler),
+                web.post("/login", self.login_post_handler),
+                web.get("/logout", self.logout_handler),
+            ]
         self._app.add_routes(routes)
         self._runner = web.AppRunner(self._app)
         self._site: web.TCPSite | None = None
@@ -196,6 +225,165 @@ class BaseVideo(Module, ImageFitsHeaderMixin, IVideo, IImageType, metaclass=ABCM
         """Whether the server is started."""
         return self._is_listening
 
+    def _sign(self, expiry: int) -> str:
+        """HMAC-SHA256 of ``expiry``, keyed with the configured token, as a hex digest.
+
+        Shared by _make_session_value (signs) and _check_cookie (verifies), so the two can't
+        drift apart on hash algo/encoding.
+
+        Args:
+            expiry: Session expiry timestamp being signed.
+
+        Returns:
+            Hex-encoded HMAC signature.
+        """
+        token = self._token
+        if token is None:
+            raise ValueError("Cannot sign a session without a configured token.")
+        return hmac.new(token.encode(), str(expiry).encode(), hashlib.sha256).hexdigest()
+
+    def _make_session_value(self) -> str:
+        """Build the value for the login session cookie.
+
+        Stateless and HMAC-signed -- the cookie does not contain the token itself:
+
+        ``value = "{expiry_ts}.{hex}"`` where ``hex = HMAC-SHA256(key=token, msg=str(expiry_ts))``
+
+        Returns:
+            Cookie value.
+        """
+        expiry = int(time.time()) + _COOKIE_LIFETIME
+        return f"{expiry}.{self._sign(expiry)}"
+
+    def _check_bearer(self, request: web.Request) -> bool:
+        """Whether the request carries the token as "Authorization: Bearer <token>".
+
+        Only called (via _check_auth) once a token is configured.
+
+        Args:
+            request: Request to check.
+
+        Returns:
+            True if the header matches the configured token.
+        """
+        prefix = "Bearer "
+        header = request.headers.get("Authorization", "")
+        if not header.startswith(prefix):
+            return False
+        return hmac.compare_digest(header[len(prefix) :], self._token or "")
+
+    def _check_cookie(self, request: web.Request) -> bool:
+        """Whether the request carries a valid, unexpired session cookie.
+
+        Only called (via _check_auth) once a token is configured.
+
+        Args:
+            request: Request to check.
+
+        Returns:
+            True if the cookie's HMAC signature verifies and it has not expired.
+        """
+        value = request.cookies.get(_COOKIE_NAME)
+        if value is None:
+            return False
+        try:
+            expiry_str, signature = value.rsplit(".", 1)
+            expiry = int(expiry_str)
+        except ValueError:
+            return False
+        if expiry < time.time():
+            return False
+        return hmac.compare_digest(signature, self._sign(expiry))
+
+    def _check_auth(self, request: web.Request) -> None:
+        """Raises HTTPUnauthorized if a token is configured and the request doesn't carry it.
+
+        Accepts either a valid "Authorization: Bearer <token>" header or a valid session cookie.
+        No-op when no token is configured. Same contract as HttpFileCache._check_auth: the
+        exception type is identical regardless of which handler called it.
+
+        Args:
+            request: Request to check.
+        """
+        if self._token is None:
+            return
+        if not (self._check_bearer(request) or self._check_cookie(request)):
+            raise web.HTTPUnauthorized()
+
+    async def login_handler(self, request: web.Request) -> web.Response:
+        """Handles GET access to /login and returns the login form.
+
+        Served unauthenticated: this is the bootstrap a browser needs, since it cannot attach an
+        "Authorization" header to an <img> request. Only registered when a token is configured.
+
+        Args:
+            request: Request to respond to.
+
+        Returns:
+            Response containing the login form.
+        """
+        html = """<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8">
+    <title>Login</title>
+  </head>
+  <body>
+    <form method="post" action="/login">
+      <label>Password: <input type="password" name="token" autofocus></label>
+      <button type="submit">Login</button>
+    </form>
+  </body>
+</html>
+"""
+        return web.Response(text=html, content_type="text/html")
+
+    async def login_post_handler(self, request: web.Request) -> web.Response:
+        """Handles POST access to /login, verifying the password and issuing the session cookie.
+
+        Args:
+            request: Request to respond to.
+
+        Returns:
+            303 redirect to / on success, 401 on wrong password.
+        """
+        token = self._token
+        if token is None:
+            # login routes are only registered when a token is configured -- defensive
+            raise web.HTTPUnauthorized()
+        data = await request.post()
+        password = str(data.get("token", ""))
+        async with self._login_lock:
+            # serialized: caps the guess rate at 1/_LOGIN_FAILURE_SLEEP regardless of how many
+            # connections attempt concurrently
+            if not hmac.compare_digest(password, token):
+                # the compare above is constant-time; this sleep additionally slows brute force
+                await asyncio.sleep(_LOGIN_FAILURE_SLEEP)
+                raise web.HTTPUnauthorized()
+        response = web.HTTPSeeOther("/")
+        response.set_cookie(
+            _COOKIE_NAME,
+            self._make_session_value(),
+            max_age=_COOKIE_LIFETIME,
+            path="/",
+            httponly=True,
+            samesite="Lax",
+        )
+        return response
+
+    async def logout_handler(self, request: web.Request) -> web.Response:
+        """Handles GET access to /logout and clears the session cookie.
+
+        Args:
+            request: Request to respond to.
+
+        Returns:
+            303 redirect to /login.
+        """
+        response = web.HTTPSeeOther("/login")
+        response.del_cookie(_COOKIE_NAME, path="/")
+        return response
+
     async def web_handler(self, request: web.Request) -> web.Response:
         """Handles access to / and returns HTML page.
 
@@ -205,6 +393,11 @@ class BaseVideo(Module, ImageFitsHeaderMixin, IVideo, IImageType, metaclass=ABCM
         Returns:
             Response containing web page.
         """
+        # a browser landing on / should be taken to the login form, not shown a bare 401
+        try:
+            self._check_auth(request)
+        except web.HTTPUnauthorized:
+            raise web.HTTPSeeOther("/login")
         return web.Response(text=INDEX_HTML, content_type="text/html")
 
     async def ping_handler(self, request: web.Request) -> web.Response:
@@ -227,6 +420,7 @@ class BaseVideo(Module, ImageFitsHeaderMixin, IVideo, IImageType, metaclass=ABCM
         Returns:
             Response containing video stream.
         """
+        self._check_auth(request)
 
         # create response
         response = web.StreamResponse()
@@ -273,6 +467,8 @@ class BaseVideo(Module, ImageFitsHeaderMixin, IVideo, IImageType, metaclass=ABCM
         Returns:
             Response containing raw frame stream.
         """
+        # auth first: an unauthenticated request must not wake the camera
+        self._check_auth(request)
 
         # activate camera
         await self.activate_camera()
@@ -368,6 +564,7 @@ class BaseVideo(Module, ImageFitsHeaderMixin, IVideo, IImageType, metaclass=ABCM
         Returns:
             Response containing image.
         """
+        self._check_auth(request)
 
         # get filename
         filename = request.match_info["filename"]

{pyobs_core-2.0.0.dev91 → pyobs_core-2.0.0.dev93}/pyobs/modules/image/imagewatcher.py

@@ -176,7 +176,7 @@ class ImageWatcher(Module):
                 try:
                     with warnings.catch_warnings():
                         warnings.simplefilter("ignore", fits.verify.VerifyWarning)
-                        fits_file = fits.HDUList.fromstring(data)
+                        fits_file = await asyncio.to_thread(fits.HDUList.fromstring, data)
                 except Exception:
                     fits_file = None
 
@@ -234,6 +234,10 @@ class ImageWatcher(Module):
         """Can be overwritten by derived classes to do extra processing on files.
         All information are stored in self.current_file and can be checked against the given filename.
 
+        Note:
+            This hook runs on the module's event loop and must not block: no CPU-heavy or
+            synchronous I/O here. Offload such work to a thread, e.g. with ``asyncio.to_thread``.
+
         Args:
             filename: Input name of original file.
 
@@ -246,6 +250,10 @@ class ImageWatcher(Module):
         """Can be overwritten by derived classes to do clean up after successful copying.
         All information are stored in self.current_file and can be checked against the given filename.
 
+        Note:
+            This hook runs on the module's event loop and must not block: no CPU-heavy or
+            synchronous I/O here. Offload such work to a thread, e.g. with ``asyncio.to_thread``.
+
         Args:
             filename: Input name of original file.
         """

{pyobs_core-2.0.0.dev91 → pyobs_core-2.0.0.dev93}/pyobs/modules/telescope/basetelescope.py

@@ -35,6 +35,27 @@ from pyobs.utils.time import Time
 
 log = logging.getLogger(__name__)
 
+
+def _format_ra(ra_deg: float) -> str:
+    """Format an RA in degrees as sexagesimal HH:MM:SS.sss.
+
+    Deliberately avoids astropy's Angle.to_string(): its vectorized do_format ufunc path emits a
+    RuntimeWarning on numpy 2.x, which application.py promotes to an error -- see pyobs-gui commit
+    04d39d6 for the same issue and fix.
+    """
+    h, rem = divmod(ra_deg / 15.0, 1)
+    m, rem = divmod(rem * 60, 1)
+    return f"{int(h):02d}:{int(m):02d}:{rem * 60:06.3f}"
+
+
+def _format_dec(dec_deg: float) -> str:
+    """Format a Dec in degrees as sexagesimal +DD:MM:SS.sss. See _format_ra for why to_string() is avoided."""
+    sign = "+" if dec_deg >= 0 else "-"
+    d, rem = divmod(abs(dec_deg), 1)
+    m, rem = divmod(rem * 60, 1)
+    return f"{sign}{int(d):02d}:{int(m):02d}:{rem * 60:06.3f}"
+
+
 # Gaussian gravitational constant, rad/day, for AU/day/solar-mass units -- encodes the Sun's
 # GM for heliocentric two-body elements, so no per-body mass lookup is needed.
 _GAUSSIAN_GRAVITATIONAL_CONSTANT = 0.01720209895
@@ -325,6 +346,12 @@ class BaseTelescope(
         if not isinstance(self, IPointingRaDec):
             raise exc.NotSupportedError("This telescope does not support RA/Dec pointing.")
 
+        # reject non-finite coordinates outright -- otherwise NaN/inf silently passes the
+        # altitude check below (NaN comparisons are always False) and only surfaces later as an
+        # opaque RuntimeWarning-turned-error out of the sexagesimal formatting
+        if not (math.isfinite(ra) and math.isfinite(dec)):
+            raise exc.InvalidArgumentError(f"RA/Dec must be finite, got ra={ra}, dec={dec}.")
+
         # do nothing, if initializing, parking or parked
         if self.motion_status() in [MotionStatus.INITIALIZING, MotionStatus.PARKING, MotionStatus.PARKED]:
             return
@@ -354,9 +381,9 @@ class BaseTelescope(
             await self._change_motion_status(MotionStatus.SLEWING)
             log.info(
                 "Moving telescope to RA=%s (%.5f°), Dec=%s (%.5f°)...",
-                ra_dec.ra.to_string(sep=":", unit=u.hour, pad=True),
+                _format_ra(ra),
                 ra,
-                ra_dec.dec.to_string(sep=":", unit=u.deg, pad=True),
+                _format_dec(dec),
                 dec,
             )
             await self.comm.send_event(MoveRaDecEvent(ra=ra, dec=dec))
@@ -418,6 +445,10 @@ class BaseTelescope(
         if not isinstance(self, IPointingAltAz):
             raise exc.NotSupportedError("This telescope does not support Alt/Az pointing.")
 
+        # reject non-finite coordinates outright -- see move_radec for why
+        if not (math.isfinite(alt) and math.isfinite(az)):
+            raise exc.InvalidArgumentError(f"Alt/Az must be finite, got alt={alt}, az={az}.")
+
         # do nothing, if initializing, parking or parked
         if self.motion_status() in [MotionStatus.INITIALIZING, MotionStatus.PARKING, MotionStatus.PARKED]:
             return
@@ -760,14 +791,16 @@ class BaseTelescope(
             )
             hdr["AIRMASS"] = FitsHeaderEntry(float(coords_alt_az.secz.value), "Airmass of observation start")
 
-        # convert to sexagesimal
-        if coords_ra_dec is not None:
-            hdr["RA"] = FitsHeaderEntry(
-                str(coords_ra_dec.ra.to_string(sep=":", unit=u.hour, pad=True)), "Right ascension of object"
-            )
-            hdr["DEC"] = FitsHeaderEntry(
-                str(coords_ra_dec.dec.to_string(sep=":", unit=u.deg, pad=True)), "Declination of object"
-            )
+        # convert to sexagesimal -- _position_radec can be NaN for an uninitialized telescope, and
+        # unlike to_string() the manual formatters below raise on a non-finite value rather than
+        # just warning, so skip them instead of emitting bogus headers
+        if (
+            coords_ra_dec is not None
+            and math.isfinite(coords_ra_dec.ra.degree)
+            and math.isfinite(coords_ra_dec.dec.degree)
+        ):
+            hdr["RA"] = FitsHeaderEntry(_format_ra(float(coords_ra_dec.ra.degree)), "Right ascension of object")
+            hdr["DEC"] = FitsHeaderEntry(_format_dec(float(coords_ra_dec.dec.degree)), "Declination of object")
 
         # site location
         if self._observer is not None:

{pyobs_core-2.0.0.dev91 → pyobs_core-2.0.0.dev93}/pyobs/vfs/httpfile.py

@@ -78,6 +78,14 @@ class HttpFile(BufferedFile):
             raise ValueError("No download URL given.")
         return urljoin(self._download_path, self.filename)
 
+    @property
+    def headers(self) -> dict[str, str]:
+        """Headers sent with GET/POST requests, e.g. "Authorization: Bearer <token>".
+
+        Returns a copy; mutating it does not affect this instance's headers.
+        """
+        return dict(self._headers)
+
     async def _download(self) -> None:
         """For read access, download the file into a local buffer.
 

{pyobs_core-2.0.0.dev91 → pyobs_core-2.0.0.dev93}/pyobs/vfs/localfile.py

@@ -7,13 +7,55 @@ from typing import IO, Any
 from .file import VFSFile
 
 
+def _open_sync(full_path: str, mode: str, mkdir: bool) -> IO[Any]:
+    """Open a local file, creating parent directories first if needed.
+
+    Runs on an executor thread off the event loop. Raises ``ValueError`` when ``mkdir`` is
+    disabled and the parent directory does not exist.
+    """
+    path = os.path.dirname(full_path)
+    if not os.path.exists(path):
+        if mkdir:
+            # exist_ok: this runs on an executor thread, so concurrent opens into the same new
+            # sibling directory can race between the exists() check and makedirs() here.
+            os.makedirs(path, exist_ok=True)
+        else:
+            raise ValueError("Cannot write into sub-directory with disabled mkdir option.")
+    return open(full_path, mode)
+
+
+def _find_sync(full_path: str, pattern: str) -> list[str]:
+    """Walk ``full_path`` and return the paths of files matching ``pattern``, relative to it."""
+    files = []
+    for cur, dirnames, filenames in os.walk(full_path):
+        for filename in fnmatch.filter(filenames, pattern):
+            files += [os.path.relpath(os.path.join(cur, filename), full_path)]
+    return files
+
+
+def _remove_sync(full_path: str) -> bool:
+    """Remove the file at ``full_path``; return False if it does not exist or is a directory."""
+    try:
+        os.remove(full_path)
+        return True
+    except (FileNotFoundError, IsADirectoryError):
+        return False
+
+
 class LocalFile(VFSFile):
-    """Wraps a local file with the virtual file system."""
+    """Wraps a local file with the virtual file system.
+
+    All potentially blocking I/O (open/read/write/close/remove/find/exists) runs on the default
+    executor, keeping the event loop responsive even on slow (e.g. network-mounted) paths.
+    """
 
     __module__ = "pyobs.vfs"
 
     def __init__(self, name: str, mode: str = "r", root: str | None = None, mkdir: bool = True, **kwargs: Any):
-        """Open a local file.
+        """Create a new local file.
+
+        Only validates the path here; the file itself is opened in ``__aenter__`` off the event
+        loop, so construction stays cheap and never blocks.
 
         Args:
             name: Name of file.
@@ -32,35 +74,36 @@ class LocalFile(VFSFile):
 
         # build filename
         self.filename = name
-        full_path = os.path.join(root, name)
+        self._full_path = os.path.join(root, name)
+        self._mode = mode
+        self._mkdir = mkdir
+        self.fd: IO[Any] | None = None
 
-        # need to create directory?
-        path = os.path.dirname(full_path)
-        if not os.path.exists(path):
-            if mkdir:
-                os.makedirs(path)
-            else:
-                raise ValueError("Cannot write into sub-directory with disabled mkdir option.")
-
-        # file object
-        self.fd: IO[Any] = open(full_path, mode)
+    async def __aenter__(self) -> "LocalFile":
+        """Open the file on an executor thread, keeping the event loop responsive."""
+        loop = asyncio.get_running_loop()
+        self.fd = await loop.run_in_executor(None, _open_sync, self._full_path, self._mode, self._mkdir)
+        return self
 
     async def close(self) -> None:
         if self.fd:
-            self.fd.close()
+            loop = asyncio.get_running_loop()
+            await loop.run_in_executor(None, self.fd.close)
 
     async def read(self, n: int = -1) -> str | bytes:
         if self.fd is None:
-            raise OSError
-        buf = self.fd.read(n)
+            raise OSError("LocalFile is not open; use 'async with' to open it before reading.")
+        loop = asyncio.get_running_loop()
+        buf = await loop.run_in_executor(None, self.fd.read, n)
         if not isinstance(buf, str) and not isinstance(buf, bytes):
             raise OSError
         return buf
 
     async def write(self, s: str | bytes) -> None:
         if self.fd is None:
-            raise OSError
-        self.fd.write(s)
+            raise OSError("LocalFile is not open; use 'async with' to open it before writing.")
+        loop = asyncio.get_running_loop()
+        await loop.run_in_executor(None, self.fd.write, s)
 
     @staticmethod
     async def local_path(path: str, **kwargs: Any) -> str:
@@ -120,12 +163,9 @@ class LocalFile(VFSFile):
         # build full path
         full_path = os.path.join(root, path)
 
-        # loop directories
-        files = []
-        for cur, dirnames, filenames in os.walk(full_path):
-            for filename in fnmatch.filter(filenames, pattern):
-                files += [os.path.relpath(os.path.join(cur, filename), full_path)]
-        return files
+        # walk directories off the event loop
+        loop = asyncio.get_running_loop()
+        return await loop.run_in_executor(None, _find_sync, full_path, pattern)
 
     @staticmethod
     async def remove(path: str, *args: Any, **kwargs: Any) -> bool:
@@ -141,13 +181,10 @@ class LocalFile(VFSFile):
         # get root from kwargs
         root = kwargs["root"]
 
-        # build full path and remove
+        # build full path and remove off the event loop
         full_path = os.path.join(root, path)
-        try:
-            os.remove(full_path)
-            return True
-        except (FileNotFoundError, IsADirectoryError):
-            return False
+        loop = asyncio.get_running_loop()
+        return await loop.run_in_executor(None, _remove_sync, full_path)
 
     @classmethod
     async def exists(cls, path: str, root: str = "", *args: Any, **kwargs: Any) -> bool:
@@ -164,8 +201,9 @@ class LocalFile(VFSFile):
         # build full path
         full_path = os.path.join(root, path)
 
-        # check
-        return os.path.exists(full_path)
+        # check off the event loop
+        loop = asyncio.get_running_loop()
+        return await loop.run_in_executor(None, os.path.exists, full_path)
 
 
 __all__ = ["LocalFile"]

{pyobs_core-2.0.0.dev91 → pyobs_core-2.0.0.dev93}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pyobs-core"
-version = "2.0.0.dev91"
+version = "2.0.0.dev93"
 description = "robotic telescope software"
 authors = [{ name = "Tim-Oliver Husser", email = "thusser@uni-goettingen.de" }]
 requires-python = ">=3.11"