qodalis-cli-server-plugin-admin 1.0.0b5__tar.gz → 1.0.0b7__tar.gz

{qodalis_cli_server_plugin_admin-1.0.0b5 → qodalis_cli_server_plugin_admin-1.0.0b7}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: qodalis-cli-server-plugin-admin
-Version: 1.0.0b5
+Version: 1.0.0b7
 Summary: Admin dashboard plugin for Qodalis CLI servers
 Project-URL: Homepage, https://github.com/qodalis-solutions/cli-server-python
 Project-URL: Repository, https://github.com/qodalis-solutions/cli-server-python

{qodalis_cli_server_plugin_admin-1.0.0b5 → qodalis_cli_server_plugin_admin-1.0.0b7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "qodalis-cli-server-plugin-admin"
-version = "1.0.0b5"
+version = "1.0.0b7"
 description = "Admin dashboard plugin for Qodalis CLI servers"
 readme = { text = "", content-type = "text/plain" }
 license = "MIT"

qodalis_cli_server_plugin_admin-1.0.0b7/qodalis_cli_admin/auth/auth_controller.py

@@ -0,0 +1,188 @@
+"""Authentication controller — login and ``/me`` endpoints."""
+
+from __future__ import annotations
+
+import time
+from collections import defaultdict
+from typing import Any
+
+from fastapi import APIRouter, Depends, HTTPException, Request
+from pydantic import BaseModel
+
+from .jwt_service import JwtService
+from ..services.admin_config import AdminConfig
+
+
+class LoginRequest(BaseModel):
+    """Request body for the login endpoint."""
+
+    username: str
+    password: str
+
+
+class LoginResponse(BaseModel):
+    """Response body returned on successful login."""
+
+    token: str
+    expiresIn: int
+    username: str
+
+
+_MAX_ATTEMPTS = 5
+_WINDOW_SECONDS = 60
+
+
+class _RateLimiter:
+    """Simple in-memory per-IP rate limiter for failed login attempts."""
+
+    def __init__(self) -> None:
+        self._attempts: dict[str, list[float]] = defaultdict(list)
+
+    def check(self, ip: str) -> None:
+        """Raise ``HTTPException(429)`` if the IP has exceeded the limit."""
+        now = time.time()
+        cutoff = now - _WINDOW_SECONDS
+        self._attempts[ip] = [t for t in self._attempts[ip] if t > cutoff]
+        if len(self._attempts[ip]) >= _MAX_ATTEMPTS:
+            raise HTTPException(status_code=429, detail="Too many failed login attempts. Try again later.")
+
+    def record_failure(self, ip: str) -> None:
+        """Record a failed login attempt for the given IP."""
+        self._attempts[ip].append(time.time())
+
+
+ADMIN_ACCESS = "admin:access"
+
+
+def trusted_hops(trust_proxy: bool | int | None) -> int:
+    """Number of trusted reverse-proxy hops for a ``trust_proxy`` setting.
+
+    ``False``/``0``/``None`` trust no proxy, ``True`` one hop, an int ``n``
+    ``n`` hops; any other enabled value below 1 (a negative int) counts as
+    one hop.  ``bool`` is checked first (``True == 1`` in Python).
+    """
+    if isinstance(trust_proxy, bool):
+        return 1 if trust_proxy else 0
+    if not trust_proxy:
+        return 0
+    return max(int(trust_proxy), 1)
+
+
+def forwarded_client_ip(headers: Any, trust_proxy: bool | int | None) -> str | None:
+    """Client IP from ``X-Forwarded-For`` behind ``trust_proxy`` trusted hops.
+
+    Every proxy appends the address it saw, so only the rightmost ``n``
+    entries were written by trusted proxies; the ones to their left are
+    client-controlled.  The client IP is the entry at ``len - n`` of the
+    comma-separated, trimmed list (the rightmost entry for one hop), or the
+    leftmost entry when the list has fewer than ``n`` entries.  Returns
+    ``None`` (use the socket peer) when no proxy is trusted, the header is
+    absent/empty, or the selected entry is empty.
+    """
+    hops = trusted_hops(trust_proxy)
+    if hops == 0:
+        return None
+    entries = [
+        entry.strip()
+        for value in headers.getlist("x-forwarded-for")
+        for entry in value.split(",")
+    ]
+    if not entries:
+        return None
+    return entries[max(len(entries) - hops, 0)] or None
+
+
+def client_ip(request: Request, trust_proxy: bool | int | None) -> str:
+    """Client IP; ``X-Forwarded-For`` is only used with ``trust_proxy`` hops."""
+    forwarded = forwarded_client_ip(request.headers, trust_proxy)
+    if forwarded:
+        return forwarded
+    return request.client.host if request.client else "127.0.0.1"
+
+
+def create_auth_router(
+    admin_config: AdminConfig,
+    jwt_service: JwtService,
+    auth_dependency: Any = None,
+    *,
+    trust_proxy: bool | int = False,
+    users_plugin: Any = None,
+) -> APIRouter:
+    """Create a FastAPI router with ``POST /login`` and ``GET /me``.
+
+    With ``users_plugin`` the login goes through the users auth service and
+    requires the ``admin:access`` permission; the returned token is the
+    users session token.  Otherwise the static admin credentials are used.
+    """
+    router = APIRouter()
+    limiter = _RateLimiter()
+
+    @router.post("/login", response_model=LoginResponse)
+    async def login(body: LoginRequest, request: Request) -> Any:
+        ip = client_ip(request, trust_proxy)
+        limiter.check(ip)
+
+        if users_plugin is not None:
+            return await _users_login(body, request, ip)
+
+        if not admin_config.validate_credentials(body.username, body.password):
+            limiter.record_failure(ip)
+            raise HTTPException(status_code=401, detail="Invalid credentials")
+
+        expires_in = JwtService.DEFAULT_EXPIRY_SECONDS
+        token = jwt_service.sign_token(
+            {"username": body.username, "authenticatedAt": int(time.time())},
+            expires_in=expires_in,
+        )
+
+        return LoginResponse(token=token, expiresIn=expires_in, username=body.username)
+
+    async def _users_login(body: LoginRequest, request: Request, ip: str) -> Any:
+        from qodalis_cli_users import SessionMetadata
+
+        auth_service = users_plugin.auth_service
+        await users_plugin.ensure_seeded()
+        try:
+            result = await auth_service.login(
+                body.username, body.password,
+                SessionMetadata(remote_address=ip, user_agent=request.headers.get("user-agent")),
+            )
+        except HTTPException as exc:
+            if exc.status_code == 401:
+                limiter.record_failure(ip)
+            raise
+        allowed = any(_matches(p, ADMIN_ACCESS) for p in result.permissions)
+        if not allowed or result.user.must_change_password:
+            await auth_service.logout(result.token)
+            raise HTTPException(
+                status_code=403,
+                detail="password change required" if allowed else f"missing permission: {ADMIN_ACCESS}",
+            )
+        return LoginResponse(
+            token=result.token,
+            expiresIn=auth_service.session_timeout_ms // 1000,
+            username=result.user.name,
+        )
+
+    if auth_dependency is not None:
+        @router.get("/me")
+        async def me(payload: dict[str, Any] = Depends(auth_dependency)) -> dict[str, Any]:
+            return {
+                "username": payload.get("username", ""),
+                "authenticatedAt": payload.get("authenticatedAt"),
+            }
+
+    return router
+
+
+def _matches(granted: str, required: str) -> bool:
+    g = granted.strip().lower().split(":")
+    r = required.strip().lower().split(":")
+    for i, seg in enumerate(g):
+        # A trailing '*' grants everything below; elsewhere it matches
+        # exactly one segment.
+        if seg == "*" and i == len(g) - 1:
+            return True
+        if i >= len(r) or (seg != "*" and seg != r[i]):
+            return False
+    return len(g) == len(r)

{qodalis_cli_server_plugin_admin-1.0.0b5 → qodalis_cli_server_plugin_admin-1.0.0b7}/qodalis_cli_admin/auth/auth_middleware.py

@@ -10,6 +10,28 @@ from fastapi import Request, HTTPException
 from .jwt_service import JwtService
 
 
+def create_users_auth_dependency(users_plugin: Any):
+    """Admin auth through the users plugin: a valid users session holding
+    ``admin:access`` (admin ``*`` has it)."""
+
+    async def require_auth(request: Request) -> dict[str, Any]:
+        auth_header = request.headers.get("Authorization", "")
+        if not auth_header.startswith("Bearer "):
+            raise HTTPException(status_code=401, detail="Missing or invalid Authorization header")
+        await users_plugin.ensure_seeded()
+        ctx = await users_plugin.auth_service.authenticate_token(auth_header[7:].strip())
+        if ctx.must_change_password:
+            raise HTTPException(status_code=403, detail="password change required")
+        if not ctx.can("admin:access"):
+            raise HTTPException(status_code=403, detail="missing permission: admin:access")
+        return {
+            "username": ctx.user.name,
+            "authenticatedAt": (ctx.session.created_at // 1000) if ctx.session else None,
+        }
+
+    return require_auth
+
+
 def create_auth_dependency(jwt_service: JwtService):
     """Return a FastAPI ``Depends`` callable that validates Bearer tokens."""
 

{qodalis_cli_server_plugin_admin-1.0.0b5 → qodalis_cli_server_plugin_admin-1.0.0b7}/qodalis_cli_admin/cli_admin_builder.py

@@ -11,7 +11,7 @@ from fastapi import APIRouter
 from .spa_static_files import SPAStaticFiles
 
 from .auth.jwt_service import JwtService
-from .auth.auth_middleware import create_auth_dependency
+from .auth.auth_middleware import create_auth_dependency, create_users_auth_dependency
 from .auth.auth_controller import create_auth_router
 from .controllers.status_controller import create_status_router
 from .controllers.plugins_controller import create_plugins_router
@@ -36,6 +36,9 @@ class AdminBuildDeps:
     builder: Any  # CliBuilder
     broadcast_fn: BroadcastFn | None = None
     enabled_features: list[str] | None = None
+    #: When set, the dashboard authenticates through the users plugin
+    #: (``admin:access`` permission); static credentials are not used.
+    users_plugin: Any = None
 
 
 @dataclass
@@ -59,6 +62,8 @@ class CliAdminBuilder:
         self._password: str = ""
         self._jwt_secret: str = ""
         self._dashboard_path: str | None = None
+        self._trust_proxy = False
+        self._users_plugin: Any = None
 
     def set_credentials(self, username: str, password: str) -> CliAdminBuilder:
         """Set admin login credentials (overrides env vars)."""
@@ -76,24 +81,50 @@ class CliAdminBuilder:
         self._dashboard_path = path
         return self
 
+    def set_trust_proxy(self, trust: bool | int = True) -> CliAdminBuilder:
+        """Trust ``X-Forwarded-For`` for login rate limiting (behind a proxy only).
+
+        ``False``/``0`` uses the socket peer, ``True`` = 1 trusted hop, an int
+        ``n`` = ``n`` hops: the client is the entry at ``len - n`` (the
+        rightmost for one proxy), the leftmost if there are fewer entries.
+        """
+        self._trust_proxy = trust
+        return self
+
+    def set_users_plugin(self, users_plugin: Any) -> CliAdminBuilder:
+        """Authenticate the dashboard through the users plugin."""
+        self._users_plugin = users_plugin
+        return self
+
     def build(self, deps: AdminBuildDeps) -> CliAdminPlugin:
         """Build the plugin, returning the router, auth dependency, and log buffer."""
         start_time = time.time()
 
+        users_plugin = self._users_plugin or deps.users_plugin
         config = AdminConfig(
             username=self._username,
             password=self._password,
             jwt_secret=self._jwt_secret,
+            warn_default=users_plugin is None,
         )
         jwt_service = JwtService(secret=config.jwt_secret)
         log_buffer = LogRingBuffer(broadcast_fn=deps.broadcast_fn)
         log_buffer.install_handler()
         module_registry = ModuleRegistry(deps.builder)
-        auth_dep = create_auth_dependency(jwt_service)
+        if users_plugin is not None:
+            auth_dep = create_users_auth_dependency(users_plugin)
+            allow = getattr(users_plugin, "allow_anonymous", None)
+            if callable(allow):
+                allow("/api/v1/qcli/auth/login", ["POST"])
+        else:
+            auth_dep = create_auth_dependency(jwt_service)
 
         router = APIRouter()
 
-        auth_router = create_auth_router(config, jwt_service, auth_dependency=auth_dep)
+        auth_router = create_auth_router(
+            config, jwt_service, auth_dependency=auth_dep,
+            trust_proxy=self._trust_proxy, users_plugin=users_plugin,
+        )
         router.include_router(auth_router, prefix="/auth")
 
         enabled_features: list[str] = list(deps.enabled_features or [])