researchloop 0.1.0__py3-none-any.whl

researchloop/dashboard/app.py

@@ -0,0 +1,15 @@
+"""Dashboard FastAPI application -- used by ``researchloop serve``.
+
+This module provides the ASGI ``app`` object that uvicorn imports.
+It loads the configuration, creates an :class:`Orchestrator`, and
+delegates to :func:`create_app` for route setup.
+"""
+
+from __future__ import annotations
+
+from researchloop.core.config import load_config
+from researchloop.core.orchestrator import Orchestrator, create_app
+
+_config = load_config()
+_orchestrator = Orchestrator(_config)
+app = create_app(_orchestrator)

researchloop/dashboard/auth.py

@@ -0,0 +1,60 @@
+"""Simple password authentication for the dashboard."""
+
+from __future__ import annotations
+
+import hashlib
+import hmac
+import secrets
+
+import bcrypt
+from itsdangerous import URLSafeTimedSerializer
+
+SESSION_COOKIE = "researchloop_session"
+SESSION_MAX_AGE = 86400 * 7  # 7 days
+
+
+def check_password(password: str, password_hash: str) -> bool:
+    """Verify a password against a bcrypt hash."""
+    return bcrypt.checkpw(
+        password.encode("utf-8"),
+        password_hash.encode("utf-8"),
+    )
+
+
+def hash_password(password: str) -> str:
+    """Hash a password with bcrypt."""
+    return bcrypt.hashpw(
+        password.encode("utf-8"),
+        bcrypt.gensalt(),
+    ).decode("utf-8")
+
+
+def generate_csrf_token(session_token: str, secret: str) -> str:
+    """Derive a CSRF token from the session token and signing secret."""
+    return hmac.new(
+        secret.encode(), session_token.encode(), hashlib.sha256
+    ).hexdigest()[:32]
+
+
+def verify_csrf_token(session_token: str, secret: str, token: str) -> bool:
+    """Verify that *token* matches the expected CSRF token."""
+    expected = generate_csrf_token(session_token, secret)
+    return hmac.compare_digest(expected, token)
+
+
+class SessionManager:
+    """Manage signed session cookies."""
+
+    def __init__(self, secret_key: str | None = None) -> None:
+        self.secret_key = secret_key or secrets.token_hex(32)
+        self._serializer = URLSafeTimedSerializer(self.secret_key)
+
+    def create_token(self) -> str:
+        return self._serializer.dumps({"authenticated": True})
+
+    def verify_token(self, token: str) -> bool:
+        try:
+            data = self._serializer.loads(token, max_age=SESSION_MAX_AGE)
+            return data.get("authenticated", False)
+        except Exception:
+            return False