quantum-framework 0.18.0__py3-none-any.whl

quantum_admin/backend/schemas.py

@@ -0,0 +1,419 @@
+"""
+Pydantic schemas for request/response validation
+"""
+from pydantic import BaseModel, Field
+from typing import Optional, List
+from datetime import datetime
+
+
+# ============================================================================
+# PROJECT SCHEMAS
+# ============================================================================
+
+class ProjectBase(BaseModel):
+    name: str = Field(..., min_length=1, max_length=255)
+    description: Optional[str] = None
+
+
+class ProjectCreate(ProjectBase):
+    source_path: Optional[str] = None
+    git_url: Optional[str] = None
+    git_branch: Optional[str] = "main"
+
+
+class ProjectUpdate(BaseModel):
+    name: Optional[str] = Field(None, min_length=1, max_length=255)
+    description: Optional[str] = None
+    status: Optional[str] = Field(None, pattern="^(active|inactive)$")
+    source_path: Optional[str] = None
+    git_url: Optional[str] = None
+    git_branch: Optional[str] = None
+
+
+class ProjectResponse(ProjectBase):
+    id: int
+    status: str
+    source_path: Optional[str] = None
+    git_url: Optional[str] = None
+    git_branch: Optional[str] = None
+    created_at: datetime
+    updated_at: datetime
+
+    class Config:
+        from_attributes = True  # Enables ORM mode
+
+
+# ============================================================================
+# DATASOURCE SCHEMAS
+# ============================================================================
+
+class DatasourceBase(BaseModel):
+    name: str = Field(..., min_length=1, max_length=255)
+    type: str = Field(..., pattern="^(postgres|mysql|mongodb)$")
+    connection_type: str = Field(..., pattern="^(docker|direct)$")
+
+
+class DatasourceCreate(DatasourceBase):
+    # Docker fields
+    image: Optional[str] = None
+    port: Optional[int] = None
+
+    # Direct connection fields
+    host: Optional[str] = None
+    database_name: Optional[str] = None
+    username: Optional[str] = None
+    password: Optional[str] = None  # Will be encrypted before storage
+
+    auto_start: bool = False
+
+
+class DatasourceUpdate(BaseModel):
+    name: Optional[str] = Field(None, min_length=1, max_length=255)
+    status: Optional[str] = Field(None, pattern="^(running|stopped|error)$")
+    health_status: Optional[str] = Field(None, pattern="^(healthy|unhealthy|unknown)$")
+    auto_start: Optional[bool] = None
+
+    # Dados de conexão. Este schema existia sem estes campos e sem NENHUMA
+    # rota que o usasse: dava para criar e excluir um datasource, nunca
+    # corrigi-lo. Errar o host ou a senha significava excluir e recriar — o
+    # buraco mais visível do núcleo do admin (ADMIN_STATUS.md).
+    host: Optional[str] = None
+    port: Optional[int] = Field(None, ge=1, le=65535)
+    database_name: Optional[str] = None
+    username: Optional[str] = None
+    password: Optional[str] = None      # cifrada antes de gravar
+
+
+class DatasourceResponse(DatasourceBase):
+    id: int
+    project_id: int
+    container_id: Optional[str]
+    image: Optional[str]
+    port: Optional[int]
+    host: Optional[str]
+    database_name: Optional[str]
+    username: Optional[str]
+    status: str
+    health_status: str
+    setup_status: str
+    auto_start: bool
+    created_at: datetime
+    updated_at: datetime
+
+    class Config:
+        from_attributes = True
+
+
+# ============================================================================
+# COMPONENT SCHEMAS
+# ============================================================================
+
+class ComponentResponse(BaseModel):
+    id: int
+    project_id: int
+    name: str
+    file_path: str
+    status: str
+    error_message: Optional[str]
+    last_compiled: Optional[datetime]
+
+    # Metadata counters
+    function_count: int = 0
+    endpoint_count: int = 0
+    query_count: int = 0
+
+    # Test tracking
+    test_count: int = 0
+    tests_passing: int = 0
+    tests_failing: int = 0
+    last_test_run_at: Optional[datetime] = None
+
+    class Config:
+        from_attributes = True
+
+    def get_has_tests(self) -> bool:
+        """Check if component has tests"""
+        return self.test_count > 0
+
+    def get_test_coverage(self) -> int:
+        """Calculate test coverage percentage"""
+        if self.test_count == 0:
+            return 0
+        return int((self.tests_passing / self.test_count) * 100)
+
+
+# ============================================================================
+# COMPONENT TEST SCHEMAS
+# ============================================================================
+
+class ComponentTestCreate(BaseModel):
+    """Schema for creating a component test record"""
+    component_id: int
+    test_file: str = Field(..., min_length=1, max_length=512)
+    test_name: str = Field(..., min_length=1, max_length=255)
+    test_type: str = Field(default="unit", pattern="^(unit|integration|api|e2e)$")
+    generated_by: Optional[str] = Field(default="auto", pattern="^(auto|manual)$")
+
+
+class ComponentTestUpdate(BaseModel):
+    """Schema for updating a component test record"""
+    last_status: Optional[str] = Field(None, pattern="^(passed|failed|skipped|pending|error)$")
+    last_run_at: Optional[datetime] = None
+    last_duration_seconds: Optional[int] = None
+    last_error_message: Optional[str] = None
+
+
+class ComponentTestResponse(BaseModel):
+    """Schema for component test response"""
+    id: int
+    component_id: int
+    test_file: str
+    test_name: str
+    test_type: str
+    generated_at: Optional[datetime]
+    generated_by: Optional[str]
+    last_status: Optional[str]
+    last_run_at: Optional[datetime]
+    last_duration_seconds: Optional[int]
+    last_error_message: Optional[str]
+    created_at: datetime
+    updated_at: datetime
+
+    class Config:
+        from_attributes = True
+
+
+class GenerateTestsRequest(BaseModel):
+    """Schema for test generation request"""
+    test_types: List[str] = Field(default=["unit", "api"], description="Types of tests to generate")
+    output_dir: Optional[str] = Field(default="tests/", description="Output directory for test files")
+
+
+class GenerateTestsResponse(BaseModel):
+    """Schema for test generation response"""
+    component_id: int
+    component_name: str
+    generated: int
+    tests: List[dict]
+
+
+class RunComponentTestsRequest(BaseModel):
+    """Schema for running component tests"""
+    test_types: Optional[List[str]] = Field(default=None, description="Optional filter by test types")
+    verbose: bool = Field(default=False, description="Verbose output")
+
+
+class RunComponentTestsResponse(BaseModel):
+    """Schema for component tests run response"""
+    test_run_id: int
+    component_id: int
+    status: str
+    message: str
+
+
+# ============================================================================
+# ENDPOINT SCHEMAS
+# ============================================================================
+
+class EndpointResponse(BaseModel):
+    id: int
+    project_id: int
+    component_id: Optional[int]
+    method: str
+    path: str
+    function_name: str
+    description: Optional[str]
+
+    class Config:
+        from_attributes = True
+
+
+# ============================================================================
+# DETAILED RESPONSES (with nested data)
+# ============================================================================
+
+class ProjectDetailResponse(ProjectResponse):
+    """Project with all related data"""
+    datasources: List[DatasourceResponse] = []
+    components: List[ComponentResponse] = []
+    endpoints: List[EndpointResponse] = []
+
+    class Config:
+        from_attributes = True
+
+
+# ============================================================================
+# TEST EXECUTION SCHEMAS
+# ============================================================================
+
+class TestRunCreate(BaseModel):
+    """Schema for creating a new test run"""
+    suite_filter: Optional[str] = Field(None, description="Optional suite name to run (e.g., 'phase1', 'phase2')")
+    verbose: bool = Field(False, description="Enable verbose output")
+    stop_on_fail: bool = Field(False, description="Stop execution on first failure")
+    triggered_by: str = Field("manual", description="Who/what triggered the test (manual, ci/cd, schedule)")
+
+
+class TestResultResponse(BaseModel):
+    """Schema for test result response"""
+    id: int
+    test_run_id: int
+    suite_name: str
+    test_file: str
+    status: str
+    duration_seconds: Optional[int]
+    error_message: Optional[str]
+    output: Optional[str]
+
+    class Config:
+        from_attributes = True
+
+
+class TestRunResponse(BaseModel):
+    """Schema for test run response"""
+    id: int
+    project_id: int
+    status: str
+    started_at: datetime
+    completed_at: Optional[datetime]
+    total_tests: int
+    passed_tests: int
+    failed_tests: int
+    duration_seconds: Optional[int]
+    triggered_by: Optional[str]
+    suite_filter: Optional[str]
+    error_message: Optional[str]
+
+    class Config:
+        from_attributes = True
+
+
+class TestRunDetailResponse(TestRunResponse):
+    """Test run with all test results"""
+    test_results: List[TestResultResponse] = []
+
+    class Config:
+        from_attributes = True
+
+
+class TestRunStatusResponse(BaseModel):
+    """Schema for real-time test run status"""
+    id: int
+    status: str
+    total_tests: int
+    passed_tests: int
+    failed_tests: int
+    current_suite: Optional[str]
+    progress_percentage: Optional[float]
+    estimated_time_remaining: Optional[int]
+
+    class Config:
+        from_attributes = True
+
+
+# ============================================================================
+# CONFIGURATION MANAGEMENT SCHEMAS
+# ============================================================================
+
+class EnvironmentVariableCreate(BaseModel):
+    """Schema for creating an environment variable"""
+    key: str = Field(..., min_length=1, max_length=255)
+    value: str = Field(..., description="Plain text value (will be encrypted)")
+    description: Optional[str] = None
+    is_secret: bool = Field(False, description="If true, value is masked in responses")
+
+
+class EnvironmentVariableUpdate(BaseModel):
+    """Schema for updating an environment variable"""
+    value: Optional[str] = Field(None, description="New plain text value (will be encrypted)")
+    description: Optional[str] = None
+    is_secret: Optional[bool] = None
+
+
+class EnvironmentVariableResponse(BaseModel):
+    """Schema for environment variable response"""
+    id: int
+    project_id: int
+    key: str
+    value_masked: str = Field(..., description="Masked value for display (e.g., ****xyz)")
+    description: Optional[str]
+    is_secret: bool
+    created_at: datetime
+    updated_at: datetime
+
+    class Config:
+        from_attributes = True
+
+
+class ConfigurationHistoryResponse(BaseModel):
+    """Schema for configuration history response"""
+    id: int
+    project_id: int
+    version: int
+    changed_at: datetime
+    changed_by: Optional[str]
+    changes_json: Optional[str]
+
+    class Config:
+        from_attributes = True
+
+
+# ============================================================================
+# DEPLOYMENT AUTOMATION SCHEMAS
+# ============================================================================
+
+class DeploymentTargetCreate(BaseModel):
+    """Schema for creating a deployment target"""
+    name: str = Field(..., min_length=1, max_length=255)
+    type: str = Field(..., pattern="^(local|docker|ssh|kubernetes)$")
+    config_json: Optional[str] = Field(None, description="JSON configuration for target")
+    is_active: bool = True
+
+
+class DeploymentTargetResponse(BaseModel):
+    """Schema for deployment target response"""
+    id: int
+    project_id: int
+    name: str
+    type: str
+    config_json: Optional[str]
+    is_active: bool
+    created_at: datetime
+    updated_at: datetime
+
+    class Config:
+        from_attributes = True
+
+
+class DeploymentCreate(BaseModel):
+    """Schema for creating a deployment"""
+    target_id: int
+    version: Optional[str] = Field(None, description="Git commit, tag, or version")
+    triggered_by: str = Field("manual", description="Who/what triggered deployment")
+
+
+class DeploymentResponse(BaseModel):
+    """Schema for deployment response"""
+    id: int
+    project_id: int
+    target_id: int
+    version: Optional[str]
+    status: str
+    started_at: datetime
+    completed_at: Optional[datetime]
+    duration_seconds: Optional[int]
+    triggered_by: Optional[str]
+    error_message: Optional[str]
+
+    class Config:
+        from_attributes = True
+
+
+class DeploymentDetailResponse(DeploymentResponse):
+    """Schema for deployment response with logs"""
+    build_log: Optional[str]
+    deploy_log: Optional[str]
+    rollback_from: Optional[int]
+
+    class Config:
+        from_attributes = True

quantum_admin/backend/secret_manager.py

@@ -0,0 +1,277 @@
+"""
+Secret Manager for Quantum Admin
+Handles encryption and decryption of sensitive data using Fernet symmetric encryption
+"""
+import os
+import base64
+from cryptography.fernet import Fernet
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
+from cryptography.hazmat.backends import default_backend
+import logging
+
+logger = logging.getLogger(__name__)
+
+
+class SecretManager:
+    """
+    Manages encryption and decryption of secrets using Fernet symmetric encryption
+
+    The encryption key is derived from environment variable QUANTUM_ENCRYPTION_KEY.
+    If not set, a default key is generated (NOT secure for production).
+    """
+
+    _instance = None
+    _cipher = None
+
+    def __new__(cls):
+        """Singleton pattern to ensure only one instance exists"""
+        if cls._instance is None:
+            cls._instance = super(SecretManager, cls).__new__(cls)
+            cls._instance._initialize_cipher()
+        return cls._instance
+
+    def _initialize_cipher(self):
+        """Initialize Fernet cipher with encryption key from environment"""
+        encryption_key = os.getenv('QUANTUM_ENCRYPTION_KEY')
+
+        # Fail-closed em producao. A chave padrao abaixo e DERIVADA DE LITERAIS
+        # NO FONTE (senha fixa + salt fixo, PBKDF2 100k): qualquer um com o
+        # codigo reconstroi a chave e decifra tudo que foi cifrado com ela. E
+        # o admin grava esses valores cifrados em quantum_admin/settings/*.yaml,
+        # que ja foi versionado — ou seja, o default re-arma o vazamento a
+        # cada save. Em producao isso nao pode ser um aviso que ninguem le;
+        # o servico se recusa a subir, espelhando auth_service._load_config.
+        if not encryption_key:
+            estrito = os.environ.get('QUANTUM_ADMIN_ENV', '').lower() in (
+                'production', 'prod')
+            if estrito:
+                raise RuntimeError(
+                    "QUANTUM_ADMIN_ENV=production requires QUANTUM_ENCRYPTION_KEY. "
+                    "The built-in default key is derived from source literals and "
+                    "provides no confidentiality; refusing to start. Generate one "
+                    "with: python -m quantum_admin.backend.secret_manager"
+                )
+
+        try:
+            if encryption_key:
+                # Use provided key
+                key = encryption_key.encode()
+                logger.info("✅ Using encryption key from QUANTUM_ENCRYPTION_KEY environment variable")
+            else:
+                # Generate default key (NOT secure for production!)
+                logger.warning("⚠️  QUANTUM_ENCRYPTION_KEY not set! Using default key (NOT SECURE FOR PRODUCTION!)")
+                logger.warning("⚠️  Set QUANTUM_ENCRYPTION_KEY environment variable for production use")
+
+                # Use a deterministic default key derived from a fixed password
+                # This allows decryption after restart but is NOT secure
+                password = b"quantum-admin-default-key-change-me-in-production"
+                salt = b"quantum-salt"  # Fixed salt for deterministic key
+                kdf = PBKDF2HMAC(
+                    algorithm=hashes.SHA256(),
+                    length=32,
+                    salt=salt,
+                    iterations=100000,
+                    backend=default_backend()
+                )
+                key = base64.urlsafe_b64encode(kdf.derive(password))
+
+            self._cipher = Fernet(key)
+            logger.info("🔐 Secret manager initialized successfully")
+
+        except Exception as e:
+            logger.error(f"❌ Failed to initialize secret manager: {e}")
+            raise RuntimeError(f"Secret manager initialization failed: {e}")
+
+    def encrypt(self, plain_text: str) -> str:
+        """
+        Encrypt a plain text string
+
+        Args:
+            plain_text: The plain text to encrypt
+
+        Returns:
+            str: Base64-encoded encrypted string
+
+        Raises:
+            ValueError: If encryption fails
+        """
+        if not plain_text:
+            raise ValueError("Cannot encrypt empty string")
+
+        try:
+            encrypted_bytes = self._cipher.encrypt(plain_text.encode('utf-8'))
+            return encrypted_bytes.decode('utf-8')
+        except Exception as e:
+            logger.error(f"❌ Encryption failed: {e}")
+            raise ValueError(f"Encryption failed: {e}")
+
+    def decrypt(self, encrypted_text: str) -> str:
+        """
+        Decrypt an encrypted string
+
+        Args:
+            encrypted_text: The encrypted text (base64-encoded)
+
+        Returns:
+            str: Decrypted plain text
+
+        Raises:
+            ValueError: If decryption fails
+        """
+        if not encrypted_text:
+            raise ValueError("Cannot decrypt empty string")
+
+        try:
+            decrypted_bytes = self._cipher.decrypt(encrypted_text.encode('utf-8'))
+            return decrypted_bytes.decode('utf-8')
+        except Exception as e:
+            logger.error(f"❌ Decryption failed: {e}")
+            raise ValueError(f"Decryption failed: {e}")
+
+    def mask_value(self, value: str, show_chars: int = 4) -> str:
+        """
+        Mask a sensitive value for display purposes
+
+        Args:
+            value: The value to mask
+            show_chars: Number of characters to show at the end
+
+        Returns:
+            str: Masked value (e.g., "****xyz")
+
+        Example:
+            >>> manager = SecretManager()
+            >>> manager.mask_value("my-secret-password")
+            '****word'
+        """
+        if not value:
+            return ""
+
+        if len(value) <= show_chars:
+            return "*" * len(value)
+
+        masked_length = len(value) - show_chars
+        return ("*" * min(masked_length, 8)) + value[-show_chars:]
+
+    @staticmethod
+    def generate_key() -> str:
+        """
+        Generate a new Fernet encryption key
+
+        Returns:
+            str: Base64-encoded encryption key
+
+        Example:
+            >>> key = SecretManager.generate_key()
+            >>> print(f"Set this as environment variable:")
+            >>> print(f"export QUANTUM_ENCRYPTION_KEY={key}")
+        """
+        return Fernet.generate_key().decode('utf-8')
+
+
+# Singleton instance
+secret_manager = SecretManager()
+
+
+# Convenience functions
+def encrypt_value(plain_text: str) -> str:
+    """Encrypt a value using the global secret manager"""
+    return secret_manager.encrypt(plain_text)
+
+
+def decrypt_value(encrypted_text: str) -> str:
+    """Decrypt a value using the global secret manager"""
+    return secret_manager.decrypt(encrypted_text)
+
+
+def mask_value(value: str, show_chars: int = 4) -> str:
+    """Mask a value for display using the global secret manager"""
+    return secret_manager.mask_value(value, show_chars)
+
+
+def _looks_like_fernet_token(stored: str) -> bool:
+    """Is this a Fernet token — regardless of whether OUR key opens it?
+
+    A Fernet token is urlsafe-base64 over `0x80 | 8-byte timestamp | 16-byte
+    IV | ciphertext | 32-byte HMAC`, so the shortest possible one is 57
+    bytes and every one of them starts with the version byte 0x80. Plain
+    text that happens to be valid base64 (`user:pass`, a JSON blob) does
+    not.
+    """
+    try:
+        raw = base64.urlsafe_b64decode(stored.encode('ascii'))
+    except Exception:
+        return False
+    return len(raw) >= 57 and raw[0] == 0x80
+
+
+class DecryptionKeyMismatch(ValueError):
+    """The stored value IS encrypted and the current key does not open it."""
+
+
+def decrypt_or_legacy(stored: str) -> str:
+    """Decrypt a value, tolerating one written before it was encrypted.
+
+    Cloud integration credentials were saved as plain JSON into a column
+    named credentials_encrypted, with a `# TODO: encrypt properly` beside it.
+    Rows written back then are still plain text, and refusing to read them
+    would lose configuration people already have.
+
+    So: decrypt when it decrypts, and when it does not, hand back what is
+    stored and say why. The next write encrypts it.
+
+    MAS so quando o guardado nao e um token cifrado.
+
+    O `except Exception: return stored` valia para os dois motivos de falha,
+    e o segundo e desastroso. Se QUANTUM_ENCRYPTION_KEY mudar — trocada,
+    perdida, ou simplesmente ausente num deploy novo, quando o modulo cai na
+    chave padrao — a decifragem falha com InvalidToken e o texto CIFRADO era
+    devolvido como se fosse a senha. Dai:
+
+      * a conexao com o banco tentava autenticar com o token base64 como
+        senha, e o erro que aparecia era "senha invalida", apontando para o
+        lugar errado;
+      * pior, o proximo save re-cifrava esse token com a chave NOVA. A senha
+        de verdade, que so a chave antiga abria, ia embora de vez — e nada
+        no caminho dizia que algo tinha se perdido.
+
+    Um segredo que nao abre e um erro, nao um valor. So texto que nunca foi
+    cifrado passa pelo caminho legado.
+    """
+    if not stored:
+        return stored
+    try:
+        return secret_manager.decrypt(stored)
+    except Exception as exc:
+        if _looks_like_fernet_token(stored):
+            logger.error(
+                "a stored secret is encrypted but the current "
+                "QUANTUM_ENCRYPTION_KEY does not decrypt it — the key has "
+                "changed or is missing. Restore the original key; saving "
+                "over this value would destroy the secret permanently."
+            )
+            raise DecryptionKeyMismatch(
+                "cannot decrypt a stored secret with the current "
+                "QUANTUM_ENCRYPTION_KEY (the key changed or is not set). "
+                "Restore the key that encrypted it — re-saving this record "
+                "would overwrite the secret irrecoverably."
+            ) from exc
+        logger.warning(
+            "reading a credential that was stored unencrypted (written "
+            "before encryption was wired up); it will be encrypted on the "
+            "next save"
+        )
+        return stored
+
+
+if __name__ == "__main__":
+    # Generate a new encryption key
+    print("="*70)
+    print("QUANTUM ADMIN - ENCRYPTION KEY GENERATOR")
+    print("="*70)
+    print("\nGenerate a new encryption key for production use:\n")
+    key = SecretManager.generate_key()
+    print(f"export QUANTUM_ENCRYPTION_KEY='{key}'")
+    print("\nAdd this to your environment variables or .env file")
+    print("="*70)