tungsten-security-audit 0.1.0__tar.gz

tungsten_security_audit-0.1.0/.gitignore

@@ -0,0 +1,13 @@
+__pycache__/
+*.py[cod]
+.venv/
+*.egg-info/
+dist/
+build/
+.pytest_cache/
+frontend/node_modules/
+storage/
+*.db
+*.sqlite3
+.DS_Store
+.claude/worktrees/

tungsten_security_audit-0.1.0/PKG-INFO

@@ -0,0 +1,102 @@
+Metadata-Version: 2.5
+Name: tungsten-security-audit
+Version: 0.1.0
+Summary: Tungsten plugin: a security audit with a score and fix tips, plus a login log with lockout.
+Project-URL: Homepage, https://tungsten.prisminfoways.com/
+Project-URL: Documentation, https://tungsten.prisminfoways.com/docs/security-audit.html
+Project-URL: Repository, https://github.com/Prism-Infoways/Tungsten
+Author: Prism Infoways
+License: MIT
+Keywords: admin,audit,fastapi,lockout,login log,security,tungsten,tungsten-admin
+Requires-Python: >=3.10
+Requires-Dist: tungsten-admin>=0.1.4
+Description-Content-Type: text/markdown
+
+# tungsten-security-audit
+
+A security health check for your [Tungsten](https://tungsten.prisminfoways.com/) panel. Press **Run audit** and get a score out of 100, a grade, and a plain tip to fix each problem. It also keeps a **login log** and locks out repeated wrong passwords.
+
+It only checks your own app. It never scans or attacks other sites.
+
+## What it checks
+
+- **Settings**: login required, a strong secret key, debug mode off, HTTPS-only session cookie, `app_url` set, two-factor login, roles, open sign-up, CORS, public API docs, activity log.
+- **Accounts**: how many users have full access, admins with common passwords, old password hashes, admin accounts nobody uses.
+- **Logins**: lockout on, failed logins in the last 24 hours (and from which IPs), logins locked right now.
+- **Website** (your own address): HTTPS, HSTS, Content Security Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, server versions in headers, CORS headers, session cookie flags (Secure, HttpOnly, SameSite), HTTP to HTTPS redirect, certificate expiry.
+- **AI access**: MCP tokens nobody used for a long time (with `tungsten-mcp`).
+- **Packages**: Python version still getting security fixes, and (when you tick it) installed packages with known holes from [osv.dev](https://osv.dev).
+
+Every audit is saved, so **Audit history** shows how your score changes.
+
+## Login log and lockout
+
+Every login try is logged: email, IP, browser, and the result (logged in, wrong password, unknown email, locked out...). After 5 wrong passwords for one email from one IP, that login is locked for 15 minutes. Unlock it early from the **Login log** screen.
+
+## Install
+
+```bash
+pip install tungsten-security-audit
+```
+
+```python
+from tungsten_security_audit import SecurityAuditPlugin
+
+panel = Panel(..., app_url="https://admin.example.com")
+panel.plugin(SecurityAuditPlugin())
+panel.create_tables(engine)
+panel.mount(app)
+```
+
+This adds **Security audit**, **Audit history** and **Login log** under a **Security** group. It needs `tungsten-admin` 0.1.4 or newer.
+
+## Options
+
+```python
+SecurityAuditPlugin(
+    lockout=True,            # lock a login after too many wrong passwords
+    max_failures=5,          # wrong passwords before the lock
+    lockout_minutes=15,      # how long the lock lasts
+    keep_login_days=90,      # delete login log rows older than this (0 keeps them)
+    trust_proxy=False,       # read the IP from X-Forwarded-For (only behind your own proxy)
+    max_superusers=3,        # warn when more users have full access
+    idle_days=90,            # warn about admins and AI tokens unused this long
+    check_passwords=True,    # try common passwords against admin password hashes
+    allowed_hosts=[],        # more host names the website check may open
+    checks=[],               # your own checks
+)
+```
+
+With roles on, only users with the **Open Security audit** permission see the audit, and **See the login log** for the log. Super admins see both.
+
+## Your own checks
+
+```python
+from tungsten_security_audit import Result
+
+def check_backups(audit):
+    ok = Path("/backups/latest.sql.gz").exists()
+    return Result("backups", "Settings", "Database backups exist", "pass" if ok else "fail", "high",
+                  "Found today's backup." if ok else "No backup found.",
+                  "" if ok else "Set up a daily backup job.")
+
+panel.plugin(SecurityAuditPlugin(checks=[check_backups]))
+```
+
+## License
+
+MIT
+
+## More Tungsten plugins
+
+| Package | What it adds | Docs |
+| --- | --- | --- |
+| [`tungsten-leads`](https://pypi.org/project/tungsten-leads/) | Leads list, stages, timeline and your own lead form fields | [README](https://github.com/Prism-Infoways/Tungsten/tree/claude/tungsten-admin-panel/plugins/leads) |
+| [`tungsten-meta-leads`](https://pypi.org/project/tungsten-meta-leads/) | Facebook and Instagram lead form leads, with one-click setup | [Guide](https://tungsten.prisminfoways.com/docs/facebook-leads.html) |
+| [`tungsten-whatsapp`](https://pypi.org/project/tungsten-whatsapp/) | WhatsApp for leads: click-to-chat, Cloud API or WhatsApp Web | [Guide](https://tungsten.prisminfoways.com/docs/whatsapp.html) |
+| [`tungsten-mcp`](https://pypi.org/project/tungsten-mcp/) | MCP server, so AI assistants like Claude can read and change your data | [Guide](https://tungsten.prisminfoways.com/docs/mcp.html) |
+| [`tungsten-tickets`](https://pypi.org/project/tungsten-tickets/) | Help desk: tickets, replies, notes, SLA and a customer support page | [Guide](https://tungsten.prisminfoways.com/docs/tickets.html) |
+| [`tungsten-blog`](https://pypi.org/project/tungsten-blog/) | Blog built for SEO, GEO and AEO, with a live score, sitemap and llms.txt | [Guide](https://tungsten.prisminfoways.com/docs/blog.html) |
+| [`tungsten-seo-audit`](https://pypi.org/project/tungsten-seo-audit/) | SEO audit of your website: score, fix tips, AI search checks, history | [Guide](https://tungsten.prisminfoways.com/docs/seo-audit.html) |
+
+Core package: [`tungsten-admin`](https://pypi.org/project/tungsten-admin/). Website and docs: https://tungsten.prisminfoways.com/

tungsten_security_audit-0.1.0/README.md

@@ -0,0 +1,88 @@
+# tungsten-security-audit
+
+A security health check for your [Tungsten](https://tungsten.prisminfoways.com/) panel. Press **Run audit** and get a score out of 100, a grade, and a plain tip to fix each problem. It also keeps a **login log** and locks out repeated wrong passwords.
+
+It only checks your own app. It never scans or attacks other sites.
+
+## What it checks
+
+- **Settings**: login required, a strong secret key, debug mode off, HTTPS-only session cookie, `app_url` set, two-factor login, roles, open sign-up, CORS, public API docs, activity log.
+- **Accounts**: how many users have full access, admins with common passwords, old password hashes, admin accounts nobody uses.
+- **Logins**: lockout on, failed logins in the last 24 hours (and from which IPs), logins locked right now.
+- **Website** (your own address): HTTPS, HSTS, Content Security Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, server versions in headers, CORS headers, session cookie flags (Secure, HttpOnly, SameSite), HTTP to HTTPS redirect, certificate expiry.
+- **AI access**: MCP tokens nobody used for a long time (with `tungsten-mcp`).
+- **Packages**: Python version still getting security fixes, and (when you tick it) installed packages with known holes from [osv.dev](https://osv.dev).
+
+Every audit is saved, so **Audit history** shows how your score changes.
+
+## Login log and lockout
+
+Every login try is logged: email, IP, browser, and the result (logged in, wrong password, unknown email, locked out...). After 5 wrong passwords for one email from one IP, that login is locked for 15 minutes. Unlock it early from the **Login log** screen.
+
+## Install
+
+```bash
+pip install tungsten-security-audit
+```
+
+```python
+from tungsten_security_audit import SecurityAuditPlugin
+
+panel = Panel(..., app_url="https://admin.example.com")
+panel.plugin(SecurityAuditPlugin())
+panel.create_tables(engine)
+panel.mount(app)
+```
+
+This adds **Security audit**, **Audit history** and **Login log** under a **Security** group. It needs `tungsten-admin` 0.1.4 or newer.
+
+## Options
+
+```python
+SecurityAuditPlugin(
+    lockout=True,            # lock a login after too many wrong passwords
+    max_failures=5,          # wrong passwords before the lock
+    lockout_minutes=15,      # how long the lock lasts
+    keep_login_days=90,      # delete login log rows older than this (0 keeps them)
+    trust_proxy=False,       # read the IP from X-Forwarded-For (only behind your own proxy)
+    max_superusers=3,        # warn when more users have full access
+    idle_days=90,            # warn about admins and AI tokens unused this long
+    check_passwords=True,    # try common passwords against admin password hashes
+    allowed_hosts=[],        # more host names the website check may open
+    checks=[],               # your own checks
+)
+```
+
+With roles on, only users with the **Open Security audit** permission see the audit, and **See the login log** for the log. Super admins see both.
+
+## Your own checks
+
+```python
+from tungsten_security_audit import Result
+
+def check_backups(audit):
+    ok = Path("/backups/latest.sql.gz").exists()
+    return Result("backups", "Settings", "Database backups exist", "pass" if ok else "fail", "high",
+                  "Found today's backup." if ok else "No backup found.",
+                  "" if ok else "Set up a daily backup job.")
+
+panel.plugin(SecurityAuditPlugin(checks=[check_backups]))
+```
+
+## License
+
+MIT
+
+## More Tungsten plugins
+
+| Package | What it adds | Docs |
+| --- | --- | --- |
+| [`tungsten-leads`](https://pypi.org/project/tungsten-leads/) | Leads list, stages, timeline and your own lead form fields | [README](https://github.com/Prism-Infoways/Tungsten/tree/claude/tungsten-admin-panel/plugins/leads) |
+| [`tungsten-meta-leads`](https://pypi.org/project/tungsten-meta-leads/) | Facebook and Instagram lead form leads, with one-click setup | [Guide](https://tungsten.prisminfoways.com/docs/facebook-leads.html) |
+| [`tungsten-whatsapp`](https://pypi.org/project/tungsten-whatsapp/) | WhatsApp for leads: click-to-chat, Cloud API or WhatsApp Web | [Guide](https://tungsten.prisminfoways.com/docs/whatsapp.html) |
+| [`tungsten-mcp`](https://pypi.org/project/tungsten-mcp/) | MCP server, so AI assistants like Claude can read and change your data | [Guide](https://tungsten.prisminfoways.com/docs/mcp.html) |
+| [`tungsten-tickets`](https://pypi.org/project/tungsten-tickets/) | Help desk: tickets, replies, notes, SLA and a customer support page | [Guide](https://tungsten.prisminfoways.com/docs/tickets.html) |
+| [`tungsten-blog`](https://pypi.org/project/tungsten-blog/) | Blog built for SEO, GEO and AEO, with a live score, sitemap and llms.txt | [Guide](https://tungsten.prisminfoways.com/docs/blog.html) |
+| [`tungsten-seo-audit`](https://pypi.org/project/tungsten-seo-audit/) | SEO audit of your website: score, fix tips, AI search checks, history | [Guide](https://tungsten.prisminfoways.com/docs/seo-audit.html) |
+
+Core package: [`tungsten-admin`](https://pypi.org/project/tungsten-admin/). Website and docs: https://tungsten.prisminfoways.com/

tungsten_security_audit-0.1.0/pyproject.toml

@@ -0,0 +1,22 @@
+[build-system]
+requires = ["hatchling>=1.24"]
+build-backend = "hatchling.build"
+
+[project]
+name = "tungsten-security-audit"
+version = "0.1.0"
+description = "Tungsten plugin: a security audit with a score and fix tips, plus a login log with lockout."
+readme = "README.md"
+requires-python = ">=3.10"
+license = { text = "MIT" }
+authors = [{ name = "Prism Infoways" }]
+keywords = ["tungsten", "tungsten-admin", "security", "audit", "login log", "lockout", "fastapi", "admin"]
+dependencies = ["tungsten-admin>=0.1.4"]
+
+[project.urls]
+Homepage = "https://tungsten.prisminfoways.com/"
+Documentation = "https://tungsten.prisminfoways.com/docs/security-audit.html"
+Repository = "https://github.com/Prism-Infoways/Tungsten"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/tungsten_security_audit"]

tungsten_security_audit-0.1.0/src/tungsten_security_audit/__init__.py

@@ -0,0 +1,119 @@
+"""A security health check for your Tungsten panel, plus a login log with lockout.
+
+    from tungsten_security_audit import SecurityAuditPlugin
+
+    panel.plugin(SecurityAuditPlugin())
+    panel.create_tables(engine)
+    panel.mount(app)
+
+Open "Security audit" in the panel and press Run audit. It checks your own app only (settings,
+admin accounts, logins, your site's HTTPS and headers, and optionally your packages against
+osv.dev) and gives a score with a tip to fix each problem. Every login try is logged, and
+repeated wrong passwords lock that login for a while.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Iterable
+from pathlib import Path
+from typing import Any
+from collections.abc import Callable
+
+from tungsten import Plugin
+
+from .checks import DEFAULT_CHECKS, Audit, Result, grade_of, run_checks, score_of
+from .logins import LoginGuard, client_ip
+from .models import LoginAttempt, SecurityAudit, SecurityBase
+from .net import Net
+from .resources import (
+    AUDIT_PERMISSION,
+    LOGINS_PERMISSION,
+    LoginAttemptResource,
+    SecurityAuditPage,
+    SecurityAuditResource,
+    run_audit,
+)
+
+__version__ = "0.1.0"
+
+
+class SecurityAuditPlugin(Plugin):
+    """``SecurityAuditPlugin(lockout=True, max_failures=5, lockout_minutes=15, ...)``.
+
+    - ``lockout``: after ``max_failures`` wrong passwords for one email from one IP, that login is
+      locked for ``lockout_minutes``. Admins can unlock it on the Login log screen.
+    - ``log_logins``: keep a log of every login try. ``keep_login_days``: how long (0 keeps them all).
+    - ``trust_proxy``: read the visitor's IP from ``X-Forwarded-For``. Only behind a proxy you run.
+    - ``max_superusers``: more users with full access than this gives a warning.
+    - ``idle_days``: admin accounts and AI tokens unused this long give a warning.
+    - ``check_passwords``: try a short list of common passwords against each admin's password hash.
+    - ``public_url``: your site's address for the website check. Default: the panel's ``app_url``.
+    - ``allowed_hosts``: more host names the website check may open (e.g. your main site).
+    - ``checks``: extra checks of your own, ``fn(audit) -> Result | list[Result] | None``.
+    """
+
+    id = "security-audit"
+    metadata = SecurityBase.metadata
+    templates = Path(__file__).with_name("templates")
+
+    def __init__(self, *, lockout: bool = True, max_failures: int = 5, lockout_minutes: int = 15,
+                 log_logins: bool = True, keep_login_days: int = 90, trust_proxy: bool = False,
+                 max_superusers: int = 3, idle_days: int = 90, check_passwords: bool = True,
+                 public_url: str | None = None, allowed_hosts: Iterable[str] = (),
+                 checks: Iterable[Callable[[Audit], Any]] = (), net: Net | None = None) -> None:
+        self.lockout = lockout
+        self.max_failures = max(1, max_failures)
+        self.lockout_minutes = max(1, lockout_minutes)
+        self.log_logins = log_logins or lockout  # the lockout counts the logged failures
+        self.keep_login_days = keep_login_days
+        self.trust_proxy = trust_proxy
+        self.max_superusers = max_superusers
+        self.idle_days = idle_days
+        self.check_passwords = check_passwords
+        self.public_url = public_url.rstrip("/") if public_url else None
+        self.allowed_hosts = [h.lower() for h in allowed_hosts]
+        self.checks = list(DEFAULT_CHECKS) + list(checks)
+        self.net = net or Net()
+        self.guard = LoginGuard(self)
+        self.panel: Any = None
+        #: your main app, seen by ``panel.mount(app)``, for the debug, CORS and API docs checks
+        self.app: Any = None
+
+    def register(self, panel: Any) -> None:
+        self.panel = panel
+        panel.pages([SecurityAuditPage])
+        panel.resources([SecurityAuditResource])
+        if panel.auth.enabled:
+            panel.resources([LoginAttemptResource])
+            if self.log_logins:
+                self.guard.install(panel.auth)
+
+    def mount(self, app: Any, panel: Any) -> None:
+        self.app = app
+
+    def permissions(self) -> list[tuple[str, str]]:
+        return [(LOGINS_PERMISSION, "See the login log")]  # the audit page lists its own
+
+
+__all__ = [
+    "AUDIT_PERMISSION",
+    "DEFAULT_CHECKS",
+    "LOGINS_PERMISSION",
+    "Audit",
+    "LoginAttempt",
+    "LoginAttemptResource",
+    "LoginGuard",
+    "Net",
+    "Result",
+    "SecurityAudit",
+    "SecurityAuditPage",
+    "SecurityAuditPlugin",
+    "SecurityAuditResource",
+    "SecurityBase",
+    "__version__",
+    "client_ip",
+    "grade_of",
+    "run_audit",
+    "run_checks",
+    "score_of",
+]