qodalis-cli-server-plugin-admin 1.0.0b1__tar.gz → 1.0.0b6__tar.gz

{qodalis_cli_server_plugin_admin-1.0.0b1 → qodalis_cli_server_plugin_admin-1.0.0b6}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: qodalis-cli-server-plugin-admin
-Version: 1.0.0b1
+Version: 1.0.0b6
 Summary: Admin dashboard plugin for Qodalis CLI servers
 Project-URL: Homepage, https://github.com/qodalis-solutions/cli-server-python
 Project-URL: Repository, https://github.com/qodalis-solutions/cli-server-python

{qodalis_cli_server_plugin_admin-1.0.0b1 → qodalis_cli_server_plugin_admin-1.0.0b6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "qodalis-cli-server-plugin-admin"
-version = "1.0.0b1"
+version = "1.0.0b6"
 description = "Admin dashboard plugin for Qodalis CLI servers"
 readme = { text = "", content-type = "text/plain" }
 license = "MIT"

qodalis_cli_server_plugin_admin-1.0.0b6/qodalis_cli_admin/auth/auth_controller.py

@@ -0,0 +1,188 @@
+"""Authentication controller — login and ``/me`` endpoints."""
+
+from __future__ import annotations
+
+import time
+from collections import defaultdict
+from typing import Any
+
+from fastapi import APIRouter, Depends, HTTPException, Request
+from pydantic import BaseModel
+
+from .jwt_service import JwtService
+from ..services.admin_config import AdminConfig
+
+
+class LoginRequest(BaseModel):
+    """Request body for the login endpoint."""
+
+    username: str
+    password: str
+
+
+class LoginResponse(BaseModel):
+    """Response body returned on successful login."""
+
+    token: str
+    expiresIn: int
+    username: str
+
+
+_MAX_ATTEMPTS = 5
+_WINDOW_SECONDS = 60
+
+
+class _RateLimiter:
+    """Simple in-memory per-IP rate limiter for failed login attempts."""
+
+    def __init__(self) -> None:
+        self._attempts: dict[str, list[float]] = defaultdict(list)
+
+    def check(self, ip: str) -> None:
+        """Raise ``HTTPException(429)`` if the IP has exceeded the limit."""
+        now = time.time()
+        cutoff = now - _WINDOW_SECONDS
+        self._attempts[ip] = [t for t in self._attempts[ip] if t > cutoff]
+        if len(self._attempts[ip]) >= _MAX_ATTEMPTS:
+            raise HTTPException(status_code=429, detail="Too many failed login attempts. Try again later.")
+
+    def record_failure(self, ip: str) -> None:
+        """Record a failed login attempt for the given IP."""
+        self._attempts[ip].append(time.time())
+
+
+ADMIN_ACCESS = "admin:access"
+
+
+def trusted_hops(trust_proxy: bool | int | None) -> int:
+    """Number of trusted reverse-proxy hops for a ``trust_proxy`` setting.
+
+    ``False``/``0``/``None`` trust no proxy, ``True`` one hop, an int ``n``
+    ``n`` hops; any other enabled value below 1 (a negative int) counts as
+    one hop.  ``bool`` is checked first (``True == 1`` in Python).
+    """
+    if isinstance(trust_proxy, bool):
+        return 1 if trust_proxy else 0
+    if not trust_proxy:
+        return 0
+    return max(int(trust_proxy), 1)
+
+
+def forwarded_client_ip(headers: Any, trust_proxy: bool | int | None) -> str | None:
+    """Client IP from ``X-Forwarded-For`` behind ``trust_proxy`` trusted hops.
+
+    Every proxy appends the address it saw, so only the rightmost ``n``
+    entries were written by trusted proxies; the ones to their left are
+    client-controlled.  The client IP is the entry at ``len - n`` of the
+    comma-separated, trimmed list (the rightmost entry for one hop), or the
+    leftmost entry when the list has fewer than ``n`` entries.  Returns
+    ``None`` (use the socket peer) when no proxy is trusted, the header is
+    absent/empty, or the selected entry is empty.
+    """
+    hops = trusted_hops(trust_proxy)
+    if hops == 0:
+        return None
+    entries = [
+        entry.strip()
+        for value in headers.getlist("x-forwarded-for")
+        for entry in value.split(",")
+    ]
+    if not entries:
+        return None
+    return entries[max(len(entries) - hops, 0)] or None
+
+
+def client_ip(request: Request, trust_proxy: bool | int | None) -> str:
+    """Client IP; ``X-Forwarded-For`` is only used with ``trust_proxy`` hops."""
+    forwarded = forwarded_client_ip(request.headers, trust_proxy)
+    if forwarded:
+        return forwarded
+    return request.client.host if request.client else "127.0.0.1"
+
+
+def create_auth_router(
+    admin_config: AdminConfig,
+    jwt_service: JwtService,
+    auth_dependency: Any = None,
+    *,
+    trust_proxy: bool | int = False,
+    users_plugin: Any = None,
+) -> APIRouter:
+    """Create a FastAPI router with ``POST /login`` and ``GET /me``.
+
+    With ``users_plugin`` the login goes through the users auth service and
+    requires the ``admin:access`` permission; the returned token is the
+    users session token.  Otherwise the static admin credentials are used.
+    """
+    router = APIRouter()
+    limiter = _RateLimiter()
+
+    @router.post("/login", response_model=LoginResponse)
+    async def login(body: LoginRequest, request: Request) -> Any:
+        ip = client_ip(request, trust_proxy)
+        limiter.check(ip)
+
+        if users_plugin is not None:
+            return await _users_login(body, request, ip)
+
+        if not admin_config.validate_credentials(body.username, body.password):
+            limiter.record_failure(ip)
+            raise HTTPException(status_code=401, detail="Invalid credentials")
+
+        expires_in = JwtService.DEFAULT_EXPIRY_SECONDS
+        token = jwt_service.sign_token(
+            {"username": body.username, "authenticatedAt": int(time.time())},
+            expires_in=expires_in,
+        )
+
+        return LoginResponse(token=token, expiresIn=expires_in, username=body.username)
+
+    async def _users_login(body: LoginRequest, request: Request, ip: str) -> Any:
+        from qodalis_cli_users import SessionMetadata
+
+        auth_service = users_plugin.auth_service
+        await users_plugin.ensure_seeded()
+        try:
+            result = await auth_service.login(
+                body.username, body.password,
+                SessionMetadata(remote_address=ip, user_agent=request.headers.get("user-agent")),
+            )
+        except HTTPException as exc:
+            if exc.status_code == 401:
+                limiter.record_failure(ip)
+            raise
+        allowed = any(_matches(p, ADMIN_ACCESS) for p in result.permissions)
+        if not allowed or result.user.must_change_password:
+            await auth_service.logout(result.token)
+            raise HTTPException(
+                status_code=403,
+                detail="password change required" if allowed else f"missing permission: {ADMIN_ACCESS}",
+            )
+        return LoginResponse(
+            token=result.token,
+            expiresIn=auth_service.session_timeout_ms // 1000,
+            username=result.user.name,
+        )
+
+    if auth_dependency is not None:
+        @router.get("/me")
+        async def me(payload: dict[str, Any] = Depends(auth_dependency)) -> dict[str, Any]:
+            return {
+                "username": payload.get("username", ""),
+                "authenticatedAt": payload.get("authenticatedAt"),
+            }
+
+    return router
+
+
+def _matches(granted: str, required: str) -> bool:
+    g = granted.strip().lower().split(":")
+    r = required.strip().lower().split(":")
+    for i, seg in enumerate(g):
+        # A trailing '*' grants everything below; elsewhere it matches
+        # exactly one segment.
+        if seg == "*" and i == len(g) - 1:
+            return True
+        if i >= len(r) or (seg != "*" and seg != r[i]):
+            return False
+    return len(g) == len(r)

{qodalis_cli_server_plugin_admin-1.0.0b1 → qodalis_cli_server_plugin_admin-1.0.0b6}/qodalis_cli_admin/auth/auth_middleware.py

@@ -10,6 +10,28 @@ from fastapi import Request, HTTPException
 from .jwt_service import JwtService
 
 
+def create_users_auth_dependency(users_plugin: Any):
+    """Admin auth through the users plugin: a valid users session holding
+    ``admin:access`` (admin ``*`` has it)."""
+
+    async def require_auth(request: Request) -> dict[str, Any]:
+        auth_header = request.headers.get("Authorization", "")
+        if not auth_header.startswith("Bearer "):
+            raise HTTPException(status_code=401, detail="Missing or invalid Authorization header")
+        await users_plugin.ensure_seeded()
+        ctx = await users_plugin.auth_service.authenticate_token(auth_header[7:].strip())
+        if ctx.must_change_password:
+            raise HTTPException(status_code=403, detail="password change required")
+        if not ctx.can("admin:access"):
+            raise HTTPException(status_code=403, detail="missing permission: admin:access")
+        return {
+            "username": ctx.user.name,
+            "authenticatedAt": (ctx.session.created_at // 1000) if ctx.session else None,
+        }
+
+    return require_auth
+
+
 def create_auth_dependency(jwt_service: JwtService):
     """Return a FastAPI ``Depends`` callable that validates Bearer tokens."""
 
@@ -36,8 +58,6 @@ def create_auth_dependency(jwt_service: JwtService):
     return require_auth
 
 
-# Convenience alias — requires a JwtService instance to be set externally.
-# Prefer ``create_auth_dependency(jwt_service)`` for production use.
 async def require_auth(request: Request) -> dict[str, Any]:  # noqa: F811
-    """Placeholder — use :func:`create_auth_dependency` to create a real dependency."""
+    """No-op fallback; use ``create_auth_dependency`` to create a real dependency."""
     raise HTTPException(status_code=401, detail="Auth not configured")

{qodalis_cli_server_plugin_admin-1.0.0b1 → qodalis_cli_server_plugin_admin-1.0.0b6}/qodalis_cli_admin/auth/jwt_service.py

@@ -33,12 +33,9 @@ class JwtService:
     ) -> str:
         """Create a signed JWT token.
 
-        Parameters
-        ----------
-        payload:
-            Claims to embed in the token.
-        expires_in:
-            Lifetime in seconds.  Defaults to 24 hours.
+        Args:
+            payload: Claims to embed in the token.
+            expires_in: Lifetime in seconds. Defaults to 24 hours.
         """
         exp = int(time.time()) + (self.DEFAULT_EXPIRY_SECONDS if expires_in is None else expires_in)
         data = {**payload, "exp": exp, "iat": int(time.time())}
@@ -47,9 +44,7 @@ class JwtService:
     def verify_token(self, token: str) -> dict[str, Any]:
         """Decode and verify a JWT token.
 
-        Raises
-        ------
-        jwt.InvalidTokenError
-            If the token is invalid or expired.
+        Raises:
+            jwt.InvalidTokenError: If the token is invalid or expired.
         """
         return jwt.decode(token, self._secret, algorithms=["HS256"])

{qodalis_cli_server_plugin_admin-1.0.0b1 → qodalis_cli_server_plugin_admin-1.0.0b6}/qodalis_cli_admin/cli_admin_builder.py

@@ -11,7 +11,7 @@ from fastapi import APIRouter
 from .spa_static_files import SPAStaticFiles
 
 from .auth.jwt_service import JwtService
-from .auth.auth_middleware import create_auth_dependency
+from .auth.auth_middleware import create_auth_dependency, create_users_auth_dependency
 from .auth.auth_controller import create_auth_router
 from .controllers.status_controller import create_status_router
 from .controllers.plugins_controller import create_plugins_router
@@ -36,16 +36,22 @@ class AdminBuildDeps:
     builder: Any  # CliBuilder
     broadcast_fn: BroadcastFn | None = None
     enabled_features: list[str] | None = None
+    #: When set, the dashboard authenticates through the users plugin
+    #: (``admin:access`` permission); static credentials are not used.
+    users_plugin: Any = None
 
 
 @dataclass
 class CliAdminPlugin:
     """Result of building the admin plugin."""
 
+    prefix: str
+    dashboard_prefix: str
     router: APIRouter
     auth_dependency: Any
     log_buffer: LogRingBuffer
     dashboard_app: Any  # ASGI app (SPA fallback) or None
+    module_registry: ModuleRegistry | None = None
 
 
 class CliAdminBuilder:
@@ -56,6 +62,8 @@ class CliAdminBuilder:
         self._password: str = ""
         self._jwt_secret: str = ""
         self._dashboard_path: str | None = None
+        self._trust_proxy = False
+        self._users_plugin: Any = None
 
     def set_credentials(self, username: str, password: str) -> CliAdminBuilder:
         """Set admin login credentials (overrides env vars)."""
@@ -73,30 +81,52 @@ class CliAdminBuilder:
         self._dashboard_path = path
         return self
 
+    def set_trust_proxy(self, trust: bool | int = True) -> CliAdminBuilder:
+        """Trust ``X-Forwarded-For`` for login rate limiting (behind a proxy only).
+
+        ``False``/``0`` uses the socket peer, ``True`` = 1 trusted hop, an int
+        ``n`` = ``n`` hops: the client is the entry at ``len - n`` (the
+        rightmost for one proxy), the leftmost if there are fewer entries.
+        """
+        self._trust_proxy = trust
+        return self
+
+    def set_users_plugin(self, users_plugin: Any) -> CliAdminBuilder:
+        """Authenticate the dashboard through the users plugin."""
+        self._users_plugin = users_plugin
+        return self
+
     def build(self, deps: AdminBuildDeps) -> CliAdminPlugin:
         """Build the plugin, returning the router, auth dependency, and log buffer."""
         start_time = time.time()
 
-        # Services
+        users_plugin = self._users_plugin or deps.users_plugin
         config = AdminConfig(
             username=self._username,
             password=self._password,
             jwt_secret=self._jwt_secret,
+            warn_default=users_plugin is None,
         )
         jwt_service = JwtService(secret=config.jwt_secret)
         log_buffer = LogRingBuffer(broadcast_fn=deps.broadcast_fn)
         log_buffer.install_handler()
         module_registry = ModuleRegistry(deps.builder)
-        auth_dep = create_auth_dependency(jwt_service)
+        if users_plugin is not None:
+            auth_dep = create_users_auth_dependency(users_plugin)
+            allow = getattr(users_plugin, "allow_anonymous", None)
+            if callable(allow):
+                allow("/api/v1/qcli/auth/login", ["POST"])
+        else:
+            auth_dep = create_auth_dependency(jwt_service)
 
-        # Build the top-level router
         router = APIRouter()
 
-        # Auth routes (login is public, /me is protected)
-        auth_router = create_auth_router(config, jwt_service, auth_dependency=auth_dep)
+        auth_router = create_auth_router(
+            config, jwt_service, auth_dependency=auth_dep,
+            trust_proxy=self._trust_proxy, users_plugin=users_plugin,
+        )
         router.include_router(auth_router, prefix="/auth")
 
-        # Detect enabled features
         enabled_features: list[str] = list(deps.enabled_features or [])
 
         if "filesystem" not in enabled_features and (
@@ -112,7 +142,6 @@ class CliAdminBuilder:
                     enabled_features.append("jobs")
                     break
 
-        # Protected routes
         status_router = create_status_router(
             start_time, deps.event_socket_manager, auth_dep, enabled_features,
             registry=deps.registry,
@@ -131,7 +160,6 @@ class CliAdminBuilder:
         ws_clients_router = create_ws_clients_router(deps.event_socket_manager, auth_dep)
         router.include_router(ws_clients_router)
 
-        # Resolve dashboard SPA
         dashboard_dir = resolve_dashboard_dir(self._dashboard_path)
         dashboard_app = None
 
@@ -139,8 +167,11 @@ class CliAdminBuilder:
             dashboard_app = SPAStaticFiles(directory=dashboard_dir, html=True)
 
         return CliAdminPlugin(
+            prefix="/api/v1/qcli",
+            dashboard_prefix="/qcli/admin",
             router=router,
             auth_dependency=auth_dep,
             log_buffer=log_buffer,
             dashboard_app=dashboard_app,
+            module_registry=module_registry,
         )

{qodalis_cli_server_plugin_admin-1.0.0b1 → qodalis_cli_server_plugin_admin-1.0.0b6}/qodalis_cli_admin/controllers/config_controller.py

@@ -11,6 +11,8 @@ from ..services.admin_config import AdminConfig
 
 
 class UpdateConfigRequest(BaseModel):
+    """Request body for updating admin configuration settings."""
+
     settings: dict[str, Any]
 
 

{qodalis_cli_server_plugin_admin-1.0.0b1 → qodalis_cli_server_plugin_admin-1.0.0b6}/qodalis_cli_admin/dashboard_resolver.py

@@ -5,23 +5,22 @@ from pathlib import Path
 
 
 def resolve_dashboard_dir(explicit_path: str | None = None) -> str | None:
+    """Resolve the dashboard dist directory.
+
+    Searches in order: explicit path, bundled directory, npm package
+    (``node_modules/@qodalis/cli-server-dashboard/dist``), and relative
+    development paths.
+
+    Returns:
+        The absolute path to the dashboard directory, or ``None``.
     """
-    Resolve the dashboard dist directory. Looks for:
-    1. Explicitly configured path
-    2. Bundled dashboard directory (embedded in this package)
-    3. node_modules/@qodalis/cli-server-dashboard/dist (npm package)
-    4. Relative development paths (sibling repo)
-    """
-    # 1. Explicit override
     if explicit_path and os.path.isdir(explicit_path):
         return os.path.abspath(explicit_path)
 
-    # 2. Bundled dashboard directory (embedded in this package)
     bundled = os.path.join(os.path.dirname(os.path.abspath(__file__)), 'dashboard')
     if os.path.isdir(bundled):
         return bundled
 
-    # 3. npm package — search upwards from cwd for node_modules
     current = os.getcwd()
     while current != os.path.dirname(current):
         candidate = os.path.join(
@@ -31,7 +30,6 @@ def resolve_dashboard_dir(explicit_path: str | None = None) -> str | None:
             return os.path.abspath(candidate)
         current = os.path.dirname(current)
 
-    # 4. Relative development paths
     this_dir = os.path.dirname(os.path.abspath(__file__))
     dev_paths = [
         os.path.join(this_dir, "..", "..", "..", "..", "cli-server-dashboard", "dist"),

{qodalis_cli_server_plugin_admin-1.0.0b1 → qodalis_cli_server_plugin_admin-1.0.0b6}/qodalis_cli_admin/services/admin_config.py

@@ -22,6 +22,7 @@ class AdminConfig:
     username: str = ""
     password: str = ""
     jwt_secret: str = ""
+    warn_default: bool = True
 
     # Mutable runtime settings
     _mutable_settings: dict[str, Any] = field(default_factory=dict)
@@ -38,7 +39,7 @@ class AdminConfig:
         if not self.jwt_secret:
             self.jwt_secret = os.environ.get("QCLI_ADMIN_JWT_SECRET", "")
 
-        if self.username == "admin" and self.password == "admin":
+        if self.warn_default and self.username == "admin" and self.password == "admin":
             logger.warning(
                 "Using default admin credentials. Set QCLI_ADMIN_USERNAME"
                 " and QCLI_ADMIN_PASSWORD environment variables."
@@ -46,8 +47,13 @@ class AdminConfig:
 
     def validate_credentials(self, username: str, password: str) -> bool:
         """Return *True* if the supplied credentials match."""
-        username_ok = hmac.compare_digest(username, self.username)
-        password_ok = hmac.compare_digest(password, self.password)
+        # surrogatepass: a lone surrogate in the input must not raise (500)
+        username_ok = hmac.compare_digest(
+            username.encode("utf-8", "surrogatepass"), self.username.encode("utf-8", "surrogatepass"),
+        )
+        password_ok = hmac.compare_digest(
+            password.encode("utf-8", "surrogatepass"), self.password.encode("utf-8", "surrogatepass"),
+        )
         return username_ok and password_ok
 
     def get_config_sections(self) -> list[dict[str, Any]]:
@@ -105,6 +111,7 @@ class AdminConfig:
 
 
 def _infer_type(val: Any) -> str:
+    """Infer a JSON-schema-style type string from a Python value."""
     if isinstance(val, bool):
         return "boolean"
     if isinstance(val, (int, float)):

{qodalis_cli_server_plugin_admin-1.0.0b1 → qodalis_cli_server_plugin_admin-1.0.0b6}/qodalis_cli_admin/services/log_ring_buffer.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import logging
+import re
 from collections import deque
 from dataclasses import dataclass, field
 from datetime import datetime, timezone
@@ -21,6 +22,20 @@ class LogEntry:
 
 BroadcastFn = Callable[[str], Awaitable[None]]
 
+_REDACTIONS = [
+    # Also the URL-encoded ``Bearer%20<token>`` form (``_header_Authorization`` query).
+    (re.compile(r"(?i)(bearer(?:\s+|%20))[A-Za-z0-9._~+/=%-]+"), r"\1[redacted]"),
+    (re.compile(r"(?i)\b(token|ticket|password|secret|cmd)=([^&\s]+)"), r"\1=[redacted]"),
+    (re.compile(r'(?i)"(token|ticket|password|currentPassword|newPassword)"\s*:\s*"[^"]*"'), r'"\1": "[redacted]"'),
+]
+
+
+def redact(message: str) -> str:
+    """Mask bearer tokens, tickets and passwords in a log message."""
+    for pattern, repl in _REDACTIONS:
+        message = pattern.sub(repl, message)
+    return message
+
 _LEVEL_MAP = {
     "WARNING": "WARN",
 }
@@ -47,8 +62,6 @@ class LogRingBuffer:
         self._broadcast_fn = broadcast_fn
         self._handler: _RingBufferHandler | None = None
 
-    # -- public API -----------------------------------------------------------
-
     def add(self, entry: LogEntry) -> None:
         """Append a log entry to the buffer."""
         entry.level = (entry.level or "INFO").upper()
@@ -93,8 +106,6 @@ class LogRingBuffer:
             total,
         )
 
-    # -- logging integration --------------------------------------------------
-
     def install_handler(self, logger_name: str = "") -> None:
         """Install a :class:`logging.Handler` that feeds into this buffer."""
         if self._handler is not None:
@@ -118,10 +129,16 @@ class _RingBufferHandler(logging.Handler):
         self._ring = ring
 
     def emit(self, record: logging.LogRecord) -> None:
+        """Convert a log record to a LogEntry and append it to the ring buffer.
+
+        Records flagged ``qcli_sensitive`` are skipped and tokens/passwords
+        are redacted."""
+        if getattr(record, "qcli_sensitive", False):
+            return
         entry = LogEntry(
             timestamp=datetime.now(timezone.utc).isoformat(),
             level=record.levelname,
-            message=self.format(record),
+            message=redact(self.format(record)),
             logger_name=record.name,
         )
         self._ring.add(entry)

qodalis_cli_server_plugin_admin-1.0.0b6/qodalis_cli_admin/services/module_registry.py

@@ -0,0 +1,113 @@
+"""Module registry — reads modules from CliBuilder and tracks enabled state.
+
+Implements :class:`ICliProcessorFilter` so that processors belonging to
+disabled modules are blocked at execution time.
+"""
+
+from __future__ import annotations
+
+from typing import Any, TYPE_CHECKING
+
+from qodalis_cli_server_abstractions import ICliProcessorFilter
+
+if TYPE_CHECKING:
+    from qodalis_cli_server_abstractions import ICliCommandProcessor
+    from qodalis_cli.extensions.cli_builder import CliBuilder
+
+
+class ModuleRegistry(ICliProcessorFilter):
+    """Provides a read/toggle view over modules registered in :class:`CliBuilder`.
+
+    Also acts as a processor filter: processors that belong to a disabled
+    module are reported as *not allowed*, causing the executor to reject
+    the command with a user-friendly error.
+    """
+
+    def __init__(self, builder: CliBuilder) -> None:
+        self._builder = builder
+        self._disabled: set[str] = set()
+        # Map each processor instance to its module id for fast lookup.
+        self._processor_to_module: dict[int, str] = {}
+        self._rebuild_processor_map()
+
+    def _rebuild_processor_map(self) -> None:
+        """(Re-)build the processor-to-module-id mapping."""
+        self._processor_to_module.clear()
+        for idx, module in enumerate(self._builder.modules):
+            module_id = self._module_id(idx, module)
+            for processor in module.processors:
+                self._processor_to_module[id(processor)] = module_id
+
+    # -- ICliProcessorFilter ------------------------------------------------
+
+    def is_allowed(self, processor: ICliCommandProcessor) -> bool:
+        """Return ``False`` if the processor belongs to a disabled module."""
+        module_id = self._processor_to_module.get(id(processor))
+        if module_id is None:
+            # Processor not registered via a module — always allowed.
+            return True
+        return module_id not in self._disabled
+
+    # -- Public API ---------------------------------------------------------
+
+    def list(self) -> list[dict[str, Any]]:
+        """Return a list of all modules with their enabled/disabled state."""
+        return [
+            self._describe(idx, module, self._module_id(idx, module) not in self._disabled)
+            for idx, module in enumerate(self._builder.modules)
+        ]
+
+    def toggle(self, module_id: str) -> dict[str, Any]:
+        """Toggle a module's enabled state and return the updated record.
+
+        ``module_id`` is the module name (as listed); the legacy numeric index
+        is still accepted.
+        """
+        modules = self._builder.modules
+        idx = self._find(module_id)
+        if idx is None:
+            raise KeyError(f"Module not found: {module_id}")
+
+        module_key = self._module_id(idx, modules[idx])
+        if module_key in self._disabled:
+            self._disabled.discard(module_key)
+            enabled = True
+        else:
+            self._disabled.add(module_key)
+            enabled = False
+        return self._describe(idx, modules[idx], enabled)
+
+    # -- helpers ------------------------------------------------------------
+
+    def _module_id(self, idx: int, module: Any) -> str:
+        """Stable id: the module name (same as the node and .NET servers);
+        the index only when the name is missing or used twice."""
+        name = getattr(module, "name", None)
+        names = [getattr(m, "name", None) for m in self._builder.modules]
+        if isinstance(name, str) and name and names.count(name) == 1:
+            return name
+        return str(idx)
+
+    def _find(self, module_id: str) -> int | None:
+        modules = self._builder.modules
+        for idx, module in enumerate(modules):
+            if self._module_id(idx, module) == module_id:
+                return idx
+        if module_id.isdigit() and int(module_id) < len(modules):
+            return int(module_id)
+        return None
+
+    def _describe(self, idx: int, module: Any, enabled: bool) -> dict[str, Any]:
+        record: dict[str, Any] = {
+            "id": self._module_id(idx, module),
+            "name": getattr(module, "name", type(module).__name__),
+            "version": getattr(module, "version", None) or "",
+            "description": getattr(module, "description", None) or "",
+            "enabled": enabled,
+            "processorCount": len(module.processors),
+            "processors": [p.command for p in module.processors],
+        }
+        author = getattr(module, "author", None)
+        if author is not None:
+            record["author"] = getattr(author, "name", author) if not isinstance(author, str) else author
+        return record

{qodalis_cli_server_plugin_admin-1.0.0b1 → qodalis_cli_server_plugin_admin-1.0.0b6}/qodalis_cli_admin/spa_static_files.py

@@ -24,12 +24,12 @@ class SPAStaticFiles(StaticFiles):
     """
 
     async def get_response(self, path: str, scope: Scope) -> Response:
+        """Return the static file or fall back to ``index.html`` for SPA routes."""
         try:
             return await super().get_response(path, scope)
         except StarletteHTTPException as exc:
             if exc.status_code != 404:
                 raise
-            # File not found — serve index.html for SPA client-side routing
             index = os.path.join(self.directory, "index.html")  # type: ignore[arg-type]
             if os.path.isfile(index):
                 return FileResponse(index, media_type="text/html")

qodalis_cli_server_plugin_admin-1.0.0b1/qodalis_cli_admin/auth/auth_controller.py

@@ -1,103 +0,0 @@
-"""Authentication controller — login and ``/me`` endpoints."""
-
-from __future__ import annotations
-
-import time
-from collections import defaultdict
-from typing import Any
-
-from fastapi import APIRouter, Depends, HTTPException, Request
-from pydantic import BaseModel
-
-from .jwt_service import JwtService
-from ..services.admin_config import AdminConfig
-
-
-# ---------------------------------------------------------------------------
-# Request / Response models
-# ---------------------------------------------------------------------------
-
-
-class LoginRequest(BaseModel):
-    username: str
-    password: str
-
-
-class LoginResponse(BaseModel):
-    token: str
-    expiresIn: int
-    username: str
-
-
-# ---------------------------------------------------------------------------
-# Rate limiting helpers
-# ---------------------------------------------------------------------------
-
-_MAX_ATTEMPTS = 5
-_WINDOW_SECONDS = 60
-
-
-class _RateLimiter:
-    """Simple in-memory per-IP rate limiter for failed login attempts."""
-
-    def __init__(self) -> None:
-        self._attempts: dict[str, list[float]] = defaultdict(list)
-
-    def check(self, ip: str) -> None:
-        """Raise ``HTTPException(429)`` if the IP has exceeded the limit."""
-        now = time.time()
-        cutoff = now - _WINDOW_SECONDS
-        # Clean old entries
-        self._attempts[ip] = [t for t in self._attempts[ip] if t > cutoff]
-        if len(self._attempts[ip]) >= _MAX_ATTEMPTS:
-            raise HTTPException(status_code=429, detail="Too many failed login attempts. Try again later.")
-
-    def record_failure(self, ip: str) -> None:
-        self._attempts[ip].append(time.time())
-
-
-# ---------------------------------------------------------------------------
-# Router factory
-# ---------------------------------------------------------------------------
-
-
-def create_auth_router(
-    admin_config: AdminConfig,
-    jwt_service: JwtService,
-    auth_dependency: Any = None,
-) -> APIRouter:
-    """Create a FastAPI router with ``POST /login`` and ``GET /me``."""
-    router = APIRouter()
-    limiter = _RateLimiter()
-
-    @router.post("/login", response_model=LoginResponse)
-    async def login(body: LoginRequest, request: Request) -> Any:
-        # Check X-Forwarded-For header for real client IP behind proxy
-        forwarded_for = request.headers.get("x-forwarded-for")
-        if forwarded_for:
-            client_ip = forwarded_for.split(",")[0].strip()
-        else:
-            client_ip = request.client.host if request.client else "127.0.0.1"
-        limiter.check(client_ip)
-
-        if not admin_config.validate_credentials(body.username, body.password):
-            limiter.record_failure(client_ip)
-            raise HTTPException(status_code=401, detail="Invalid credentials")
-
-        expires_in = JwtService.DEFAULT_EXPIRY_SECONDS
-        token = jwt_service.sign_token(
-            {"username": body.username, "authenticatedAt": int(time.time())},
-            expires_in=expires_in,
-        )
-
-        return LoginResponse(token=token, expiresIn=expires_in, username=body.username)
-
-    if auth_dependency is not None:
-        @router.get("/me")
-        async def me(payload: dict[str, Any] = Depends(auth_dependency)) -> dict[str, Any]:
-            return {
-                "username": payload.get("username", ""),
-                "authenticatedAt": payload.get("authenticatedAt"),
-            }
-
-    return router

qodalis_cli_server_plugin_admin-1.0.0b1/qodalis_cli_admin/services/module_registry.py

@@ -1,64 +0,0 @@
-"""Module registry — reads modules from CliBuilder and tracks enabled state."""
-
-from __future__ import annotations
-
-from typing import Any, TYPE_CHECKING
-
-if TYPE_CHECKING:
-    from qodalis_cli.extensions.cli_builder import CliBuilder
-
-
-class ModuleRegistry:
-    """Provides a read/toggle view over modules registered in :class:`CliBuilder`."""
-
-    def __init__(self, builder: CliBuilder) -> None:
-        self._builder = builder
-        self._disabled: set[str] = set()
-
-    def list(self) -> list[dict[str, Any]]:
-        """Return a list of all modules with their enabled/disabled state."""
-        result: list[dict[str, Any]] = []
-        for idx, module in enumerate(self._builder.modules):
-            module_id = str(idx)
-            name = getattr(module, "name", type(module).__name__)
-            result.append(
-                {
-                    "id": module_id,
-                    "name": name,
-                    "processorCount": len(module.processors),
-                    "processors": [p.command for p in module.processors],
-                    "enabled": module_id not in self._disabled,
-                }
-            )
-        return result
-
-    def toggle(self, module_id: str) -> dict[str, Any]:
-        """Toggle a module's enabled state and return the updated record."""
-        modules = self._builder.modules
-        idx = int(module_id)
-        if idx < 0 or idx >= len(modules):
-            raise KeyError(f"Module not found: {module_id}")
-
-        if module_id in self._disabled:
-            self._disabled.discard(module_id)
-            enabled = True
-        else:
-            self._disabled.add(module_id)
-            enabled = False
-
-        module = modules[idx]
-        result: dict[str, Any] = {
-            "id": module_id,
-            "name": getattr(module, "name", type(module).__name__),
-            "processorCount": len(module.processors),
-            "processors": [p.command for p in module.processors],
-            "enabled": enabled,
-        }
-
-        if not enabled:
-            result["warning"] = (
-                "Module state tracked but command unregistration is not yet"
-                " supported. Processors remain active."
-            )
-
-        return result