website-agent-server 0.1.0__py3-none-any.whl

website_agent_server/__init__.py

@@ -0,0 +1,3 @@
+"""Website Agent Server package."""
+
+__version__ = "0.1.0"

website_agent_server/__main__.py

@@ -0,0 +1,159 @@
+from __future__ import annotations
+
+import argparse
+import asyncio
+from pathlib import Path
+
+import uvicorn
+
+from .config import settings
+from .url_policy import HostAccessPolicy
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="website-agent-server",
+        description="Run the server-side browser proxy.",
+    )
+    parser.add_argument("--host", default=settings.host, help="Server bind host.")
+    parser.add_argument("--port", type=int, default=settings.port, help="Server port.")
+    parser.add_argument(
+        "--headed",
+        action="store_true",
+        help="Run Chromium with a visible browser window.",
+    )
+    parser.add_argument(
+        "--ignore-https-errors",
+        action="store_true",
+        help="Ignore remote TLS certificate errors.",
+    )
+    parser.add_argument(
+        "--allow-private-hosts",
+        action="store_true",
+        help="Allow private, local, and reserved network targets.",
+    )
+    parser.add_argument(
+        "--session-ttl-seconds",
+        type=int,
+        default=settings.session_ttl_seconds,
+        help="Idle session lifetime in seconds.",
+    )
+    parser.add_argument(
+        "--navigation-timeout-ms",
+        type=int,
+        default=settings.navigation_timeout_ms,
+        help="Navigation timeout in milliseconds.",
+    )
+    parser.add_argument(
+        "--frame-interval-seconds",
+        type=float,
+        default=settings.frame_interval_seconds,
+        help="Screenshot streaming interval in seconds.",
+    )
+    parser.add_argument(
+        "--screenshot-quality",
+        type=int,
+        default=settings.screenshot_quality,
+        help="Screenshot quality from 1 to 100. Values below 100 use JPEG; 100 uses PNG.",
+    )
+    parser.add_argument(
+        "--media-frame-interval-seconds",
+        type=float,
+        default=settings.media_frame_interval_seconds,
+        help="Screenshot streaming interval while remote media is playing.",
+    )
+    parser.add_argument(
+        "--media-screenshot-quality",
+        type=int,
+        default=settings.media_screenshot_quality,
+        help="JPEG screenshot quality while remote media is playing. Ignored when screenshot quality is 100.",
+    )
+    parser.add_argument(
+        "--min-viewport-width",
+        type=int,
+        default=settings.min_viewport_width,
+        help="Minimum remote viewport width.",
+    )
+    parser.add_argument(
+        "--min-viewport-height",
+        type=int,
+        default=settings.min_viewport_height,
+        help="Minimum remote viewport height.",
+    )
+    parser.add_argument(
+        "--max-viewport-width",
+        type=int,
+        default=settings.max_viewport_width,
+        help="Maximum remote viewport width.",
+    )
+    parser.add_argument(
+        "--max-viewport-height",
+        type=int,
+        default=settings.max_viewport_height,
+        help="Maximum remote viewport height.",
+    )
+    parser.add_argument(
+        "--data-dir",
+        type=Path,
+        default=settings.data_dir,
+        help="Runtime downloads and temporary uploads directory.",
+    )
+    parser.add_argument(
+        "--pin",
+        default=None,
+        help="Require this PIN before clients can use the proxy.",
+    )
+    parser.add_argument(
+        "--lock-url",
+        default=None,
+        help="Lock the UI to this initial URL and disable browser option controls.",
+    )
+    return parser
+
+
+async def apply_args(args: argparse.Namespace) -> None:
+    settings.host = args.host
+    settings.port = args.port
+    settings.headless = not args.headed
+    settings.ignore_https_errors = args.ignore_https_errors
+    settings.allow_private_hosts = args.allow_private_hosts
+    settings.session_ttl_seconds = args.session_ttl_seconds
+    settings.navigation_timeout_ms = args.navigation_timeout_ms
+    settings.frame_interval_seconds = args.frame_interval_seconds
+    settings.screenshot_quality = max(1, min(100, args.screenshot_quality))
+    settings.media_frame_interval_seconds = max(0.05, args.media_frame_interval_seconds)
+    settings.media_screenshot_quality = max(1, min(99, args.media_screenshot_quality))
+    settings.min_viewport_width = args.min_viewport_width
+    settings.min_viewport_height = args.min_viewport_height
+    settings.max_viewport_width = args.max_viewport_width
+    settings.max_viewport_height = args.max_viewport_height
+    settings.data_dir = args.data_dir.resolve()
+    settings.pin = args.pin
+    if args.lock_url:
+        lock_url_policy = HostAccessPolicy(settings.allow_private_hosts)
+        settings.lock_url = await lock_url_policy.ensure_navigation_url_allowed(
+            args.lock_url,
+            verify_https=not settings.ignore_https_errors,
+        )
+    else:
+        settings.lock_url = None
+
+
+def main() -> None:
+    parser = build_parser()
+    args = parser.parse_args()
+    try:
+        asyncio.run(apply_args(args))
+    except ValueError as exc:
+        parser.error(str(exc))
+    uvicorn.run(
+        "website_agent_server.main:app",
+        host=settings.host,
+        port=settings.port,
+        reload=False,
+        ws_ping_interval=None,
+    )
+
+
+if __name__ == "__main__":
+    main()

website_agent_server/auth.py

@@ -0,0 +1,67 @@
+from __future__ import annotations
+
+import hmac
+import secrets
+from hashlib import sha256
+
+from fastapi import HTTPException, Request, WebSocket, status
+from starlette.responses import Response
+
+from .config import Settings
+
+
+class PinAuth:
+    def __init__(self, settings: Settings) -> None:
+        self.settings = settings
+        self._secret = secrets.token_urlsafe(32)
+
+    @property
+    def enabled(self) -> bool:
+        return bool(self.settings.pin)
+
+    def verify_pin(self, pin: str) -> bool:
+        expected = self.settings.pin or ""
+        return hmac.compare_digest(pin, expected)
+
+    def token(self) -> str:
+        if not self.settings.pin:
+            return ""
+        digest = hmac.new(
+            self._secret.encode("utf-8"),
+            self.settings.pin.encode("utf-8"),
+            sha256,
+        ).hexdigest()
+        return digest
+
+    def is_request_allowed(self, request: Request) -> bool:
+        if not self.enabled:
+            return True
+        token = request.cookies.get(self.settings.auth_cookie_name, "")
+        return hmac.compare_digest(token, self.token())
+
+    def require_request(self, request: Request) -> None:
+        if not self.is_request_allowed(request):
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="PIN required.",
+            )
+
+    def is_websocket_allowed(self, websocket: WebSocket) -> bool:
+        if not self.enabled:
+            return True
+        token = websocket.cookies.get(self.settings.auth_cookie_name, "")
+        return hmac.compare_digest(token, self.token())
+
+    def set_cookie(self, response: Response) -> None:
+        response.set_cookie(
+            self.settings.auth_cookie_name,
+            self.token(),
+            max_age=self.settings.auth_cookie_max_age,
+            httponly=True,
+            samesite="lax",
+            secure=False,
+            path="/",
+        )
+
+    def clear_cookie(self, response: Response) -> None:
+        response.delete_cookie(self.settings.auth_cookie_name, path="/")