qodalis-cli-server-plugin-admin 1.0.0b5__tar.gz → 1.0.0b6__tar.gz

{qodalis_cli_server_plugin_admin-1.0.0b5 → qodalis_cli_server_plugin_admin-1.0.0b6}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: qodalis-cli-server-plugin-admin
-Version: 1.0.0b5
+Version: 1.0.0b6
 Summary: Admin dashboard plugin for Qodalis CLI servers
 Project-URL: Homepage, https://github.com/qodalis-solutions/cli-server-python
 Project-URL: Repository, https://github.com/qodalis-solutions/cli-server-python

{qodalis_cli_server_plugin_admin-1.0.0b5 → qodalis_cli_server_plugin_admin-1.0.0b6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "qodalis-cli-server-plugin-admin"
-version = "1.0.0b5"
+version = "1.0.0b6"
 description = "Admin dashboard plugin for Qodalis CLI servers"
 readme = { text = "", content-type = "text/plain" }
 license = "MIT"

qodalis_cli_server_plugin_admin-1.0.0b6/qodalis_cli_admin/auth/auth_controller.py

@@ -0,0 +1,188 @@
+"""Authentication controller — login and ``/me`` endpoints."""
+
+from __future__ import annotations
+
+import time
+from collections import defaultdict
+from typing import Any
+
+from fastapi import APIRouter, Depends, HTTPException, Request
+from pydantic import BaseModel
+
+from .jwt_service import JwtService
+from ..services.admin_config import AdminConfig
+
+
+class LoginRequest(BaseModel):
+    """Request body for the login endpoint."""
+
+    username: str
+    password: str
+
+
+class LoginResponse(BaseModel):
+    """Response body returned on successful login."""
+
+    token: str
+    expiresIn: int
+    username: str
+
+
+_MAX_ATTEMPTS = 5
+_WINDOW_SECONDS = 60
+
+
+class _RateLimiter:
+    """Simple in-memory per-IP rate limiter for failed login attempts."""
+
+    def __init__(self) -> None:
+        self._attempts: dict[str, list[float]] = defaultdict(list)
+
+    def check(self, ip: str) -> None:
+        """Raise ``HTTPException(429)`` if the IP has exceeded the limit."""
+        now = time.time()
+        cutoff = now - _WINDOW_SECONDS
+        self._attempts[ip] = [t for t in self._attempts[ip] if t > cutoff]
+        if len(self._attempts[ip]) >= _MAX_ATTEMPTS:
+            raise HTTPException(status_code=429, detail="Too many failed login attempts. Try again later.")
+
+    def record_failure(self, ip: str) -> None:
+        """Record a failed login attempt for the given IP."""
+        self._attempts[ip].append(time.time())
+
+
+ADMIN_ACCESS = "admin:access"
+
+
+def trusted_hops(trust_proxy: bool | int | None) -> int:
+    """Number of trusted reverse-proxy hops for a ``trust_proxy`` setting.
+
+    ``False``/``0``/``None`` trust no proxy, ``True`` one hop, an int ``n``
+    ``n`` hops; any other enabled value below 1 (a negative int) counts as
+    one hop.  ``bool`` is checked first (``True == 1`` in Python).
+    """
+    if isinstance(trust_proxy, bool):
+        return 1 if trust_proxy else 0
+    if not trust_proxy:
+        return 0
+    return max(int(trust_proxy), 1)
+
+
+def forwarded_client_ip(headers: Any, trust_proxy: bool | int | None) -> str | None:
+    """Client IP from ``X-Forwarded-For`` behind ``trust_proxy`` trusted hops.
+
+    Every proxy appends the address it saw, so only the rightmost ``n``
+    entries were written by trusted proxies; the ones to their left are
+    client-controlled.  The client IP is the entry at ``len - n`` of the
+    comma-separated, trimmed list (the rightmost entry for one hop), or the
+    leftmost entry when the list has fewer than ``n`` entries.  Returns
+    ``None`` (use the socket peer) when no proxy is trusted, the header is
+    absent/empty, or the selected entry is empty.
+    """
+    hops = trusted_hops(trust_proxy)
+    if hops == 0:
+        return None
+    entries = [
+        entry.strip()
+        for value in headers.getlist("x-forwarded-for")
+        for entry in value.split(",")
+    ]
+    if not entries:
+        return None
+    return entries[max(len(entries) - hops, 0)] or None
+
+
+def client_ip(request: Request, trust_proxy: bool | int | None) -> str:
+    """Client IP; ``X-Forwarded-For`` is only used with ``trust_proxy`` hops."""
+    forwarded = forwarded_client_ip(request.headers, trust_proxy)
+    if forwarded:
+        return forwarded
+    return request.client.host if request.client else "127.0.0.1"
+
+
+def create_auth_router(
+    admin_config: AdminConfig,
+    jwt_service: JwtService,
+    auth_dependency: Any = None,
+    *,
+    trust_proxy: bool | int = False,
+    users_plugin: Any = None,
+) -> APIRouter:
+    """Create a FastAPI router with ``POST /login`` and ``GET /me``.
+
+    With ``users_plugin`` the login goes through the users auth service and
+    requires the ``admin:access`` permission; the returned token is the
+    users session token.  Otherwise the static admin credentials are used.
+    """
+    router = APIRouter()
+    limiter = _RateLimiter()
+
+    @router.post("/login", response_model=LoginResponse)
+    async def login(body: LoginRequest, request: Request) -> Any:
+        ip = client_ip(request, trust_proxy)
+        limiter.check(ip)
+
+        if users_plugin is not None:
+            return await _users_login(body, request, ip)
+
+        if not admin_config.validate_credentials(body.username, body.password):
+            limiter.record_failure(ip)
+            raise HTTPException(status_code=401, detail="Invalid credentials")
+
+        expires_in = JwtService.DEFAULT_EXPIRY_SECONDS
+        token = jwt_service.sign_token(
+            {"username": body.username, "authenticatedAt": int(time.time())},
+            expires_in=expires_in,
+        )
+
+        return LoginResponse(token=token, expiresIn=expires_in, username=body.username)
+
+    async def _users_login(body: LoginRequest, request: Request, ip: str) -> Any:
+        from qodalis_cli_users import SessionMetadata
+
+        auth_service = users_plugin.auth_service
+        await users_plugin.ensure_seeded()
+        try:
+            result = await auth_service.login(
+                body.username, body.password,
+                SessionMetadata(remote_address=ip, user_agent=request.headers.get("user-agent")),
+            )
+        except HTTPException as exc:
+            if exc.status_code == 401:
+                limiter.record_failure(ip)
+            raise
+        allowed = any(_matches(p, ADMIN_ACCESS) for p in result.permissions)
+        if not allowed or result.user.must_change_password:
+            await auth_service.logout(result.token)
+            raise HTTPException(
+                status_code=403,
+                detail="password change required" if allowed else f"missing permission: {ADMIN_ACCESS}",
+            )
+        return LoginResponse(
+            token=result.token,
+            expiresIn=auth_service.session_timeout_ms // 1000,
+            username=result.user.name,
+        )
+
+    if auth_dependency is not None:
+        @router.get("/me")
+        async def me(payload: dict[str, Any] = Depends(auth_dependency)) -> dict[str, Any]:
+            return {
+                "username": payload.get("username", ""),
+                "authenticatedAt": payload.get("authenticatedAt"),
+            }
+
+    return router
+
+
+def _matches(granted: str, required: str) -> bool:
+    g = granted.strip().lower().split(":")
+    r = required.strip().lower().split(":")
+    for i, seg in enumerate(g):
+        # A trailing '*' grants everything below; elsewhere it matches
+        # exactly one segment.
+        if seg == "*" and i == len(g) - 1:
+            return True
+        if i >= len(r) or (seg != "*" and seg != r[i]):
+            return False
+    return len(g) == len(r)

{qodalis_cli_server_plugin_admin-1.0.0b5 → qodalis_cli_server_plugin_admin-1.0.0b6}/qodalis_cli_admin/auth/auth_middleware.py

@@ -10,6 +10,28 @@ from fastapi import Request, HTTPException
 from .jwt_service import JwtService
 
 
+def create_users_auth_dependency(users_plugin: Any):
+    """Admin auth through the users plugin: a valid users session holding
+    ``admin:access`` (admin ``*`` has it)."""
+
+    async def require_auth(request: Request) -> dict[str, Any]:
+        auth_header = request.headers.get("Authorization", "")
+        if not auth_header.startswith("Bearer "):
+            raise HTTPException(status_code=401, detail="Missing or invalid Authorization header")
+        await users_plugin.ensure_seeded()
+        ctx = await users_plugin.auth_service.authenticate_token(auth_header[7:].strip())
+        if ctx.must_change_password:
+            raise HTTPException(status_code=403, detail="password change required")
+        if not ctx.can("admin:access"):
+            raise HTTPException(status_code=403, detail="missing permission: admin:access")
+        return {
+            "username": ctx.user.name,
+            "authenticatedAt": (ctx.session.created_at // 1000) if ctx.session else None,
+        }
+
+    return require_auth
+
+
 def create_auth_dependency(jwt_service: JwtService):
     """Return a FastAPI ``Depends`` callable that validates Bearer tokens."""
 

{qodalis_cli_server_plugin_admin-1.0.0b5 → qodalis_cli_server_plugin_admin-1.0.0b6}/qodalis_cli_admin/cli_admin_builder.py

@@ -11,7 +11,7 @@ from fastapi import APIRouter
 from .spa_static_files import SPAStaticFiles
 
 from .auth.jwt_service import JwtService
-from .auth.auth_middleware import create_auth_dependency
+from .auth.auth_middleware import create_auth_dependency, create_users_auth_dependency
 from .auth.auth_controller import create_auth_router
 from .controllers.status_controller import create_status_router
 from .controllers.plugins_controller import create_plugins_router
@@ -36,6 +36,9 @@ class AdminBuildDeps:
     builder: Any  # CliBuilder
     broadcast_fn: BroadcastFn | None = None
     enabled_features: list[str] | None = None
+    #: When set, the dashboard authenticates through the users plugin
+    #: (``admin:access`` permission); static credentials are not used.
+    users_plugin: Any = None
 
 
 @dataclass
@@ -59,6 +62,8 @@ class CliAdminBuilder:
         self._password: str = ""
         self._jwt_secret: str = ""
         self._dashboard_path: str | None = None
+        self._trust_proxy = False
+        self._users_plugin: Any = None
 
     def set_credentials(self, username: str, password: str) -> CliAdminBuilder:
         """Set admin login credentials (overrides env vars)."""
@@ -76,24 +81,50 @@ class CliAdminBuilder:
         self._dashboard_path = path
         return self
 
+    def set_trust_proxy(self, trust: bool | int = True) -> CliAdminBuilder:
+        """Trust ``X-Forwarded-For`` for login rate limiting (behind a proxy only).
+
+        ``False``/``0`` uses the socket peer, ``True`` = 1 trusted hop, an int
+        ``n`` = ``n`` hops: the client is the entry at ``len - n`` (the
+        rightmost for one proxy), the leftmost if there are fewer entries.
+        """
+        self._trust_proxy = trust
+        return self
+
+    def set_users_plugin(self, users_plugin: Any) -> CliAdminBuilder:
+        """Authenticate the dashboard through the users plugin."""
+        self._users_plugin = users_plugin
+        return self
+
     def build(self, deps: AdminBuildDeps) -> CliAdminPlugin:
         """Build the plugin, returning the router, auth dependency, and log buffer."""
         start_time = time.time()
 
+        users_plugin = self._users_plugin or deps.users_plugin
         config = AdminConfig(
             username=self._username,
             password=self._password,
             jwt_secret=self._jwt_secret,
+            warn_default=users_plugin is None,
         )
         jwt_service = JwtService(secret=config.jwt_secret)
         log_buffer = LogRingBuffer(broadcast_fn=deps.broadcast_fn)
         log_buffer.install_handler()
         module_registry = ModuleRegistry(deps.builder)
-        auth_dep = create_auth_dependency(jwt_service)
+        if users_plugin is not None:
+            auth_dep = create_users_auth_dependency(users_plugin)
+            allow = getattr(users_plugin, "allow_anonymous", None)
+            if callable(allow):
+                allow("/api/v1/qcli/auth/login", ["POST"])
+        else:
+            auth_dep = create_auth_dependency(jwt_service)
 
         router = APIRouter()
 
-        auth_router = create_auth_router(config, jwt_service, auth_dependency=auth_dep)
+        auth_router = create_auth_router(
+            config, jwt_service, auth_dependency=auth_dep,
+            trust_proxy=self._trust_proxy, users_plugin=users_plugin,
+        )
         router.include_router(auth_router, prefix="/auth")
 
         enabled_features: list[str] = list(deps.enabled_features or [])

{qodalis_cli_server_plugin_admin-1.0.0b5 → qodalis_cli_server_plugin_admin-1.0.0b6}/qodalis_cli_admin/services/admin_config.py

@@ -22,6 +22,7 @@ class AdminConfig:
     username: str = ""
     password: str = ""
     jwt_secret: str = ""
+    warn_default: bool = True
 
     # Mutable runtime settings
     _mutable_settings: dict[str, Any] = field(default_factory=dict)
@@ -38,7 +39,7 @@ class AdminConfig:
         if not self.jwt_secret:
             self.jwt_secret = os.environ.get("QCLI_ADMIN_JWT_SECRET", "")
 
-        if self.username == "admin" and self.password == "admin":
+        if self.warn_default and self.username == "admin" and self.password == "admin":
             logger.warning(
                 "Using default admin credentials. Set QCLI_ADMIN_USERNAME"
                 " and QCLI_ADMIN_PASSWORD environment variables."
@@ -46,8 +47,13 @@ class AdminConfig:
 
     def validate_credentials(self, username: str, password: str) -> bool:
         """Return *True* if the supplied credentials match."""
-        username_ok = hmac.compare_digest(username, self.username)
-        password_ok = hmac.compare_digest(password, self.password)
+        # surrogatepass: a lone surrogate in the input must not raise (500)
+        username_ok = hmac.compare_digest(
+            username.encode("utf-8", "surrogatepass"), self.username.encode("utf-8", "surrogatepass"),
+        )
+        password_ok = hmac.compare_digest(
+            password.encode("utf-8", "surrogatepass"), self.password.encode("utf-8", "surrogatepass"),
+        )
         return username_ok and password_ok
 
     def get_config_sections(self) -> list[dict[str, Any]]:

{qodalis_cli_server_plugin_admin-1.0.0b5 → qodalis_cli_server_plugin_admin-1.0.0b6}/qodalis_cli_admin/services/log_ring_buffer.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import logging
+import re
 from collections import deque
 from dataclasses import dataclass, field
 from datetime import datetime, timezone
@@ -21,6 +22,20 @@ class LogEntry:
 
 BroadcastFn = Callable[[str], Awaitable[None]]
 
+_REDACTIONS = [
+    # Also the URL-encoded ``Bearer%20<token>`` form (``_header_Authorization`` query).
+    (re.compile(r"(?i)(bearer(?:\s+|%20))[A-Za-z0-9._~+/=%-]+"), r"\1[redacted]"),
+    (re.compile(r"(?i)\b(token|ticket|password|secret|cmd)=([^&\s]+)"), r"\1=[redacted]"),
+    (re.compile(r'(?i)"(token|ticket|password|currentPassword|newPassword)"\s*:\s*"[^"]*"'), r'"\1": "[redacted]"'),
+]
+
+
+def redact(message: str) -> str:
+    """Mask bearer tokens, tickets and passwords in a log message."""
+    for pattern, repl in _REDACTIONS:
+        message = pattern.sub(repl, message)
+    return message
+
 _LEVEL_MAP = {
     "WARNING": "WARN",
 }
@@ -114,11 +129,16 @@ class _RingBufferHandler(logging.Handler):
         self._ring = ring
 
     def emit(self, record: logging.LogRecord) -> None:
-        """Convert a log record to a LogEntry and append it to the ring buffer."""
+        """Convert a log record to a LogEntry and append it to the ring buffer.
+
+        Records flagged ``qcli_sensitive`` are skipped and tokens/passwords
+        are redacted."""
+        if getattr(record, "qcli_sensitive", False):
+            return
         entry = LogEntry(
             timestamp=datetime.now(timezone.utc).isoformat(),
             level=record.levelname,
-            message=self.format(record),
+            message=redact(self.format(record)),
             logger_name=record.name,
         )
         self._ring.add(entry)

{qodalis_cli_server_plugin_admin-1.0.0b5 → qodalis_cli_server_plugin_admin-1.0.0b6}/qodalis_cli_admin/services/module_registry.py

@@ -34,7 +34,7 @@ class ModuleRegistry(ICliProcessorFilter):
         """(Re-)build the processor-to-module-id mapping."""
         self._processor_to_module.clear()
         for idx, module in enumerate(self._builder.modules):
-            module_id = str(idx)
+            module_id = self._module_id(idx, module)
             for processor in module.processors:
                 self._processor_to_module[id(processor)] = module_id
 
@@ -52,42 +52,62 @@ class ModuleRegistry(ICliProcessorFilter):
 
     def list(self) -> list[dict[str, Any]]:
         """Return a list of all modules with their enabled/disabled state."""
-        result: list[dict[str, Any]] = []
-        for idx, module in enumerate(self._builder.modules):
-            module_id = str(idx)
-            name = getattr(module, "name", type(module).__name__)
-            result.append(
-                {
-                    "id": module_id,
-                    "name": name,
-                    "processorCount": len(module.processors),
-                    "processors": [p.command for p in module.processors],
-                    "enabled": module_id not in self._disabled,
-                }
-            )
-        return result
+        return [
+            self._describe(idx, module, self._module_id(idx, module) not in self._disabled)
+            for idx, module in enumerate(self._builder.modules)
+        ]
 
     def toggle(self, module_id: str) -> dict[str, Any]:
-        """Toggle a module's enabled state and return the updated record."""
+        """Toggle a module's enabled state and return the updated record.
+
+        ``module_id`` is the module name (as listed); the legacy numeric index
+        is still accepted.
+        """
         modules = self._builder.modules
-        idx = int(module_id)
-        if idx < 0 or idx >= len(modules):
+        idx = self._find(module_id)
+        if idx is None:
             raise KeyError(f"Module not found: {module_id}")
 
-        if module_id in self._disabled:
-            self._disabled.discard(module_id)
+        module_key = self._module_id(idx, modules[idx])
+        if module_key in self._disabled:
+            self._disabled.discard(module_key)
             enabled = True
         else:
-            self._disabled.add(module_id)
+            self._disabled.add(module_key)
             enabled = False
+        return self._describe(idx, modules[idx], enabled)
+
+    # -- helpers ------------------------------------------------------------
+
+    def _module_id(self, idx: int, module: Any) -> str:
+        """Stable id: the module name (same as the node and .NET servers);
+        the index only when the name is missing or used twice."""
+        name = getattr(module, "name", None)
+        names = [getattr(m, "name", None) for m in self._builder.modules]
+        if isinstance(name, str) and name and names.count(name) == 1:
+            return name
+        return str(idx)
 
-        module = modules[idx]
-        result: dict[str, Any] = {
-            "id": module_id,
+    def _find(self, module_id: str) -> int | None:
+        modules = self._builder.modules
+        for idx, module in enumerate(modules):
+            if self._module_id(idx, module) == module_id:
+                return idx
+        if module_id.isdigit() and int(module_id) < len(modules):
+            return int(module_id)
+        return None
+
+    def _describe(self, idx: int, module: Any, enabled: bool) -> dict[str, Any]:
+        record: dict[str, Any] = {
+            "id": self._module_id(idx, module),
             "name": getattr(module, "name", type(module).__name__),
+            "version": getattr(module, "version", None) or "",
+            "description": getattr(module, "description", None) or "",
+            "enabled": enabled,
             "processorCount": len(module.processors),
             "processors": [p.command for p in module.processors],
-            "enabled": enabled,
         }
-
-        return result
+        author = getattr(module, "author", None)
+        if author is not None:
+            record["author"] = getattr(author, "name", author) if not isinstance(author, str) else author
+        return record

qodalis_cli_server_plugin_admin-1.0.0b5/qodalis_cli_admin/auth/auth_controller.py

@@ -1,92 +0,0 @@
-"""Authentication controller — login and ``/me`` endpoints."""
-
-from __future__ import annotations
-
-import time
-from collections import defaultdict
-from typing import Any
-
-from fastapi import APIRouter, Depends, HTTPException, Request
-from pydantic import BaseModel
-
-from .jwt_service import JwtService
-from ..services.admin_config import AdminConfig
-
-
-class LoginRequest(BaseModel):
-    """Request body for the login endpoint."""
-
-    username: str
-    password: str
-
-
-class LoginResponse(BaseModel):
-    """Response body returned on successful login."""
-
-    token: str
-    expiresIn: int
-    username: str
-
-
-_MAX_ATTEMPTS = 5
-_WINDOW_SECONDS = 60
-
-
-class _RateLimiter:
-    """Simple in-memory per-IP rate limiter for failed login attempts."""
-
-    def __init__(self) -> None:
-        self._attempts: dict[str, list[float]] = defaultdict(list)
-
-    def check(self, ip: str) -> None:
-        """Raise ``HTTPException(429)`` if the IP has exceeded the limit."""
-        now = time.time()
-        cutoff = now - _WINDOW_SECONDS
-        self._attempts[ip] = [t for t in self._attempts[ip] if t > cutoff]
-        if len(self._attempts[ip]) >= _MAX_ATTEMPTS:
-            raise HTTPException(status_code=429, detail="Too many failed login attempts. Try again later.")
-
-    def record_failure(self, ip: str) -> None:
-        """Record a failed login attempt for the given IP."""
-        self._attempts[ip].append(time.time())
-
-
-def create_auth_router(
-    admin_config: AdminConfig,
-    jwt_service: JwtService,
-    auth_dependency: Any = None,
-) -> APIRouter:
-    """Create a FastAPI router with ``POST /login`` and ``GET /me``."""
-    router = APIRouter()
-    limiter = _RateLimiter()
-
-    @router.post("/login", response_model=LoginResponse)
-    async def login(body: LoginRequest, request: Request) -> Any:
-        forwarded_for = request.headers.get("x-forwarded-for")
-        if forwarded_for:
-            client_ip = forwarded_for.split(",")[0].strip()
-        else:
-            client_ip = request.client.host if request.client else "127.0.0.1"
-        limiter.check(client_ip)
-
-        if not admin_config.validate_credentials(body.username, body.password):
-            limiter.record_failure(client_ip)
-            raise HTTPException(status_code=401, detail="Invalid credentials")
-
-        expires_in = JwtService.DEFAULT_EXPIRY_SECONDS
-        token = jwt_service.sign_token(
-            {"username": body.username, "authenticatedAt": int(time.time())},
-            expires_in=expires_in,
-        )
-
-        return LoginResponse(token=token, expiresIn=expires_in, username=body.username)
-
-    if auth_dependency is not None:
-        @router.get("/me")
-        async def me(payload: dict[str, Any] = Depends(auth_dependency)) -> dict[str, Any]:
-            return {
-                "username": payload.get("username", ""),
-                "authenticatedAt": payload.get("authenticatedAt"),
-            }
-
-    return router