supython 0.1.0__py3-none-any.whl

supython/admin/api/service_auth_users.py

@@ -0,0 +1,346 @@
+import json
+from datetime import datetime, timedelta, timezone
+from typing import Any
+from uuid import UUID
+
+import asyncpg
+
+from ..errors import AdminError
+from ..schemas import (
+    AdminAuditPage,
+    AdminUser,
+    AdminUserDetail,
+    AdminUsersPage,
+    AuditEvent,
+    Identity,
+    RefreshToken,
+    RefreshTokensPage,
+)
+
+DEFAULT_BAN_SECONDS = 24 * 60 * 60
+RECENT_AUDIT_LIMIT = 20
+
+
+def _row_to_admin_user(row: asyncpg.Record) -> AdminUser:
+    return AdminUser(
+        id=row["id"],
+        email=row["email"],
+        created_at=row["created_at"],
+        last_sign_in_at=row["last_sign_in_at"],
+        banned_until=row["banned_until"],
+        email_confirmed_at=row["email_confirmed_at"],
+    )
+
+
+def _row_to_identity(row: asyncpg.Record) -> Identity:
+    raw = row["identity_data"]
+    data = json.loads(raw) if isinstance(raw, str) else (raw or {})
+    return Identity(
+        id=row["id"],
+        user_id=row["user_id"],
+        provider=row["provider"],
+        provider_user_id=row["provider_user_id"],
+        identity_data=data,
+        created_at=row["created_at"],
+    )
+
+
+def _row_to_audit(row: asyncpg.Record) -> AuditEvent:
+    raw = row["payload"]
+    payload = json.loads(raw) if isinstance(raw, str) else (raw or {})
+    return AuditEvent(
+        id=row["id"],
+        user_id=row["user_id"],
+        event=row["event"],
+        ip=str(row["ip"]) if row["ip"] is not None else None,
+        ua=row["ua"],
+        payload=payload,
+        created_at=row["created_at"],
+    )
+
+
+async def search_users(
+    conn: asyncpg.Connection,
+    search: str | None,
+    confirmed: bool | None,
+    banned: bool | None,
+    limit: int,
+    offset: int,
+) -> AdminUsersPage:
+    if limit <= 0 or limit > 200:
+        raise AdminError("invalid_limit", "limit must be between 1 and 200", 422)
+    if offset < 0:
+        raise AdminError("invalid_offset", "offset must be >= 0", 422)
+    pattern = f"%{search}%" if search else None
+    where_sql = """
+        ($1::text is null or email ilike $1)
+        and ($2::bool is null or (email_confirmed_at is not null) = $2)
+        and ($3::bool is null or (banned_until is not null and banned_until > now()) = $3)
+    """
+    rows = await conn.fetch(
+        f"""
+        select id, email, created_at, last_sign_in_at, banned_until, email_confirmed_at
+        from auth.users
+        where {where_sql}
+        order by created_at desc
+        limit $4 offset $5
+        """,
+        pattern,
+        confirmed,
+        banned,
+        limit,
+        offset,
+    )
+    total = await conn.fetchval(
+        f"""
+        select count(*)
+        from auth.users
+        where {where_sql}
+        """,
+        pattern,
+        confirmed,
+        banned,
+    )
+    return AdminUsersPage(
+        rows=[_row_to_admin_user(r) for r in rows],
+        total=total or 0,
+    )
+
+
+async def get_user_detail(conn: asyncpg.Connection, user_id: UUID) -> AdminUserDetail:
+    row = await conn.fetchrow(
+        """
+        select id, email, created_at, last_sign_in_at, banned_until, email_confirmed_at
+        from auth.users
+        where id = $1
+        """,
+        user_id,
+    )
+    if row is None:
+        raise AdminError("not_found", "user not found", 404)
+    identities = await conn.fetch(
+        """
+        select id, user_id, provider, provider_user_id, identity_data, created_at
+        from auth.identities
+        where user_id = $1
+        order by created_at desc
+        """,
+        user_id,
+    )
+    audit = await conn.fetch(
+        """
+        select id, user_id, event, ip, ua, payload, created_at
+        from auth.audit_log
+        where user_id = $1
+        order by created_at desc
+        limit $2
+        """,
+        user_id,
+        RECENT_AUDIT_LIMIT,
+    )
+    return AdminUserDetail(
+        user=_row_to_admin_user(row),
+        identities=[_row_to_identity(r) for r in identities],
+        recent_audit=[_row_to_audit(r) for r in audit],
+    )
+
+
+async def ban_user(
+    conn: asyncpg.Connection, user_id: UUID, duration_seconds: int | None
+) -> datetime:
+    seconds = duration_seconds if duration_seconds is not None else DEFAULT_BAN_SECONDS
+    if seconds <= 0:
+        raise AdminError("invalid_duration", "duration_seconds must be > 0", 422)
+    banned_until = datetime.now(tz=timezone.utc) + timedelta(seconds=seconds)
+    updated = await conn.fetchval(
+        """
+        update auth.users
+        set banned_until = $2, updated_at = now()
+        where id = $1
+        returning banned_until
+        """,
+        user_id,
+        banned_until,
+    )
+    if updated is None:
+        raise AdminError("not_found", "user not found", 404)
+    return updated
+
+
+async def unban_user(conn: asyncpg.Connection, user_id: UUID) -> None:
+    updated = await conn.fetchval(
+        """
+        update auth.users
+        set banned_until = null, updated_at = now()
+        where id = $1
+        returning id
+        """,
+        user_id,
+    )
+    if updated is None:
+        raise AdminError("not_found", "user not found", 404)
+
+
+async def force_logout(conn: asyncpg.Connection, user_id: UUID) -> int:
+    exists = await conn.fetchval(
+        "select 1 from auth.users where id = $1",
+        user_id,
+    )
+    if exists is None:
+        raise AdminError("not_found", "user not found", 404)
+    revoked = await conn.fetch(
+        """
+        update auth.refresh_tokens
+        set revoked = true
+        where user_id = $1 and revoked = false
+        returning id
+        """,
+        user_id,
+    )
+    return len(revoked)
+
+
+async def write_user_audit(
+    conn: asyncpg.Connection,
+    *,
+    user_id: UUID,
+    event: str,
+    payload: dict[str, Any],
+    ip: str | None,
+    ua: str | None,
+) -> None:
+    await conn.execute(
+        """
+        insert into auth.audit_log (user_id, event, ip, ua, payload)
+        values ($1, $2, $3::inet, $4, $5::jsonb)
+        """,
+        user_id,
+        event,
+        ip,
+        ua,
+        json.dumps(payload),
+    )
+
+
+def _row_to_refresh_token(row: asyncpg.Record) -> RefreshToken:
+    return RefreshToken(
+        id=row["id"],
+        user_id=row["user_id"],
+        token=row["token"],
+        parent=row["parent"],
+        revoked=row["revoked"],
+        created_at=row["created_at"],
+    )
+
+
+async def list_refresh_tokens(
+    conn: asyncpg.Connection,
+    user_id: UUID | None,
+    limit: int,
+    offset: int,
+) -> RefreshTokensPage:
+    if limit <= 0 or limit > 200:
+        raise AdminError("invalid_limit", "limit must be between 1 and 200", 422)
+    if offset < 0:
+        raise AdminError("invalid_offset", "offset must be >= 0", 422)
+
+    rows = await conn.fetch(
+        """
+        select id, user_id, token, parent, revoked, created_at
+        from auth.refresh_tokens
+        where ($1::uuid is null or user_id = $1)
+        order by created_at desc
+        limit $2 offset $3
+        """,
+        user_id,
+        limit,
+        offset,
+    )
+    total = await conn.fetchval(
+        """
+        select count(*)
+        from auth.refresh_tokens
+        where ($1::uuid is null or user_id = $1)
+        """,
+        user_id,
+    )
+    return RefreshTokensPage(
+        rows=[_row_to_refresh_token(r) for r in rows],
+        total=total or 0,
+    )
+
+
+async def revoke_refresh_token(conn: asyncpg.Connection, token_id: int) -> UUID:
+    """Revoke a single refresh token. Returns the owning user_id for audit."""
+    row = await conn.fetchrow(
+        """
+        update auth.refresh_tokens
+        set revoked = true
+        where id = $1
+        returning id, user_id
+        """,
+        token_id,
+    )
+    if row is None:
+        raise AdminError("not_found", "refresh token not found", 404)
+    return row["user_id"]
+
+
+async def list_audit_log(
+    conn: asyncpg.Connection,
+    event: str | None,
+    ip: str | None,
+    from_date: str | None,
+    to_date: str | None,
+    limit: int,
+    offset: int,
+) -> AdminAuditPage:
+    if limit <= 0 or limit > 200:
+        raise AdminError("invalid_limit", "limit must be between 1 and 200", 422)
+    if offset < 0:
+        raise AdminError("invalid_offset", "offset must be >= 0", 422)
+
+    try:
+        from_date_d = datetime.strptime(from_date, "%Y-%m-%d").date() if from_date else None
+        to_date_d = datetime.strptime(to_date, "%Y-%m-%d").date() if to_date else None
+    except ValueError as exc:
+        raise AdminError("invalid_date", "dates must be YYYY-MM-DD", 422) from exc
+
+    ip_pattern = f"%{ip}%" if ip else None
+
+    rows = await conn.fetch(
+        """
+        select id, user_id, event, ip, ua, payload, created_at
+        from auth.audit_log
+        where ($1::text is null or event = $1)
+          and ($2::text is null or ip::text ilike $2)
+          and ($3::date is null or created_at::date >= $3)
+          and ($4::date is null or created_at::date <= $4)
+        order by created_at desc
+        limit $5 offset $6
+        """,
+        event,
+        ip_pattern,
+        from_date_d,
+        to_date_d,
+        limit,
+        offset,
+    )
+    total = await conn.fetchval(
+        """
+        select count(*)
+        from auth.audit_log
+        where ($1::text is null or event = $1)
+          and ($2::text is null or ip::text ilike $2)
+          and ($3::date is null or created_at::date >= $3)
+          and ($4::date is null or created_at::date <= $4)
+        """,
+        event,
+        ip_pattern,
+        from_date_d,
+        to_date_d,
+    )
+    return AdminAuditPage(
+        rows=[_row_to_audit(r) for r in rows],
+        total=total or 0,
+    )

supython/admin/api/service_db.py

@@ -0,0 +1,214 @@
+import re
+from typing import Any, Literal
+from uuid import UUID, uuid4
+
+import asyncpg
+
+from ..errors import AdminError
+from ..schemas import (
+    DryRunResponse,
+    MigrationRecord,
+    RlsPolicy,
+    RowsPage,
+    SchemaInfo,
+    SqlExecRequest,
+    SqlExecResponse,
+    TableInfo,
+)
+
+_IDENT_RE = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*$")
+_DDL_ALLOWED = re.compile(r"^\s*(create|drop|alter)\s+policy\b", re.IGNORECASE | re.DOTALL)
+
+
+def _safe_value(v: Any) -> Any:
+    """Ensure values are JSON-serializable (bytes → hex, else identity)."""
+    if isinstance(v, bytes):
+        return r"\x" + v.hex()
+    return v
+
+
+def _check_ident(kind: str, value: str) -> None:
+    if not _IDENT_RE.match(value):
+        raise AdminError(f"invalid_{kind}", f"invalid {kind} name: {value}", 400)
+
+
+def _qident(schema: str, table: str) -> str:
+    _check_ident("schema", schema)
+    _check_ident("table", table)
+    return f'"{schema}"."{table}"'
+
+
+async def list_schemas(conn: asyncpg.Connection) -> list[SchemaInfo]:
+    rows = await conn.fetch(
+        """
+        select n.nspname as name,
+               pg_catalog.pg_get_userbyid(n.nspowner) as owner,
+               n.nspname not in ('pg_catalog', 'information_schema') as is_user
+        from pg_catalog.pg_namespace n
+        where n.nspname not like 'pg_%'
+        order by n.nspname
+        """,
+    )
+    return [SchemaInfo(**dict(r)) for r in rows]
+
+
+async def list_tables(conn: asyncpg.Connection, schema: str) -> list[TableInfo]:
+    _check_ident("schema", schema)
+    rows = await conn.fetch(
+        """
+        select c.relname as name,
+               c.relrowsecurity as rls_enabled
+        from pg_catalog.pg_class c
+        join pg_catalog.pg_namespace n on n.oid = c.relnamespace
+        where n.nspname = $1
+          and c.relkind = 'r'
+        order by c.relname
+        """,
+        schema,
+    )
+    return [TableInfo(**dict(r)) for r in rows]
+
+
+async def read_rows(
+    conn: asyncpg.Connection,
+    schema: str,
+    table: str,
+    limit: int,
+    offset: int,
+    order: str | None,
+) -> RowsPage:
+    qident = _qident(schema, table)
+    order_sql = ""
+    if order:
+        if not all(c.isalnum() or c in "_," for c in order):
+            raise AdminError("invalid_order", f"invalid order clause: {order}", 400)
+        order_sql = f" order by {order}"
+    try:
+        rows = await conn.fetch(
+            f"select * from {qident}{order_sql} limit $1 offset $2",
+            limit,
+            offset,
+        )
+        total = await conn.fetchval(f"select count(*) from {qident}")
+    except asyncpg.UndefinedTableError as exc:
+        raise AdminError("not_found", str(exc), 404) from exc
+    except asyncpg.PostgresError as exc:
+        raise AdminError("sql_error", str(exc), 400) from exc
+    cols = list(rows[0].keys()) if rows else []
+    return RowsPage(
+        columns=cols,
+        rows=[[_safe_value(r[c]) for c in cols] for r in rows],
+        total=total or 0,
+    )
+
+
+def preview_claims(role: Literal["authenticated", "anon"], sub: UUID | None) -> dict[str, Any]:
+    if role == "authenticated" and sub is None:
+        raise AdminError(
+            "preview_sub_required",
+            "authenticated preview needs impersonate_sub",
+            422,
+        )
+    return {
+        "role": role,
+        "sub": str(sub) if sub else str(uuid4()),
+        "aud": "authenticated" if role == "authenticated" else "anon",
+    }
+
+
+async def execute_sql(conn: asyncpg.Connection, payload: SqlExecRequest) -> SqlExecResponse:
+    async with conn.transaction():
+        if payload.read_only:
+            await conn.execute("set local transaction read only")
+        try:
+            rows = await conn.fetch(payload.statement)
+        except asyncpg.PostgresError as exc:
+            raise AdminError("sql_error", str(exc), 400) from exc
+    cols = list(rows[0].keys()) if rows else []
+    return SqlExecResponse(
+        columns=cols,
+        rows=[[_safe_value(r[c]) for c in cols] for r in rows],
+        row_count=len(rows),
+    )
+
+
+async def list_policies(conn: asyncpg.Connection, schema: str, table: str) -> list[RlsPolicy]:
+    _qident(schema, table)
+    try:
+        rows = await conn.fetch(
+            """
+            select schemaname, tablename, policyname, permissive,
+                   roles, cmd, qual, with_check
+            from pg_policies
+            where schemaname = $1 and tablename = $2
+            order by policyname
+            """,
+            schema,
+            table,
+        )
+    except asyncpg.PostgresError as exc:
+        raise AdminError("sql_error", str(exc), 400) from exc
+    return [RlsPolicy(**dict(r)) for r in rows]
+
+
+async def dry_run_policy(conn: asyncpg.Connection, ddl: str, sample_query: str) -> DryRunResponse:
+    if not _DDL_ALLOWED.match(ddl):
+        raise AdminError(
+            "invalid_ddl",
+            "dry-run only accepts (create|drop|alter) policy statements",
+            422,
+        )
+    if len(ddl) > 8192:
+        raise AdminError("invalid_ddl", "ddl too long", 422)
+
+    class _Rollback(Exception):
+        def __init__(self, rows: list[asyncpg.Record]) -> None:
+            self.rows = rows
+
+    try:
+        async with conn.transaction():
+            await conn.execute(ddl)
+            rows = await conn.fetch(sample_query)
+            raise _Rollback(rows)
+    except _Rollback as rb:
+        cols = list(rb.rows[0].keys()) if rb.rows else []
+        return DryRunResponse(
+            columns=cols,
+            rows=[[_safe_value(r[c]) for c in cols] for r in rb.rows],
+        )
+    except asyncpg.PostgresError as exc:
+        raise AdminError("sql_error", str(exc), 400) from exc
+
+
+async def list_migrations(conn: asyncpg.Connection) -> list[MigrationRecord]:
+    out: list[MigrationRecord] = []
+    try:
+        supython_rows = await conn.fetch(
+            """
+            select name as version, applied_at
+            from supython.migrations
+            order by name
+            """
+        )
+    except asyncpg.PostgresError as exc:
+        raise AdminError("sql_error", str(exc), 400) from exc
+    out.extend(
+        MigrationRecord(version=r["version"], applied_at=r["applied_at"], source="supython")
+        for r in supython_rows
+    )
+
+    try:
+        has_dbmate = await conn.fetchval(
+            "select to_regclass('public.schema_migrations') is not null"
+        )
+        if has_dbmate:
+            dbmate_rows = await conn.fetch(
+                "select version from public.schema_migrations order by version"
+            )
+            out.extend(
+                MigrationRecord(version=r["version"], applied_at=None, source="dbmate")
+                for r in dbmate_rows
+            )
+    except asyncpg.PostgresError as exc:
+        raise AdminError("sql_error", str(exc), 400) from exc
+    return out