feat: memory-only sessions on HTTP, streamed exports, UI refresh
Session - COOKIE_SECURE=false no longer persists the owner key for ten years. services/session.cookie_kwargs() drops max_age in that mode, so the browser holds the key in memory and the session ends with the window. Everything still persists server-side; only the browser link is temporary. base.html shows a warning banner (FR/EN) and an extra paragraph in the onboarding modal, and the README explains the trade-off and the backup-key escape hatch. - Both cookie writers (middleware, POST /session/restore) go through cookie_kwargs() so the policy cannot drift between them. - The CSRF guard on /session/restore compared request.url.scheme against the Origin header. Behind a TLS-terminating proxy uvicorn sees http while the browser sends https, so every legitimate restore was rejected with 403. It now compares hosts only, including X-Forwarded-Host. - /static/*, /favicon.ico and /robots.txt skip the middleware. Each cookieless hit was inserting an Owner row no browser could ever use. Reliability - Malformed printer-form FK fields no longer escape as HTTP 500: a non-numeric client_id/driver_id raised ValueError and an unknown driver_id hit a FOREIGN KEY constraint. Both are now 400/404 HTMX fragments, and the duplicated field checks moved into _validate_fields(). - Package exports stream. build_intunewin() encrypts the inner ZIP in 1 MB chunks against temp files with a streaming HMAC and SHA256, and both endpoints serve the result with FileResponse plus a background cleanup task. A 100 MB driver used to be held in memory three or four times over per concurrent download. The byte layout is unchanged. - FileResponse also escapes the download filename, which was previously interpolated raw into Content-Disposition. - python-multipart >= 0.0.18 (CVE-2024-53981, reachable from /drivers/upload) and Pillow >= 10.3 (CVE-2024-28219, reachable from icon upload). - icons.py reads cfg.ICONS_DIR instead of re-deriving the path from DATA_DIR, matching the .intunewin export. UI - Sidebar/topbar shell, inline SVG icon macros (partials/icons.html), card and data-table components, grouped printer list, and the dedicated /printers/new page replacing partials/printer_form.html. Tests - 194 pass with a bare `pytest tests/`: tests/conftest.py now forces cfg.COOKIE_SECURE = False like the e2e conftest already did, so the Secure cookie is no longer dropped over http://testserver. - New coverage for the malformed-FK guards, the chunk-boundary cases in the encrypt loop (every residue mod _CHUNK plus a multi-megabyte payload), temp-dir cleanup after both exports, and the whole COOKIE_SECURE matrix. - test_printer_edit.py located the Edit button by its translated label, so it only passed on English-locale machines. It now targets the showModal() hook, which also cuts the e2e run from 84s to 15s. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5
@@ -1,41 +1,147 @@
|
||||
{% extends "base.html" %}
|
||||
{% import "partials/icons.html" as ico %}
|
||||
|
||||
{% block head_title %}ImpTune{% endblock %}
|
||||
{% block page_title %}<span x-data x-text="$store.i18n.t('dashboard')">Dashboard</span>{% endblock %}
|
||||
|
||||
{% block page_actions %}
|
||||
<a href="/drivers" class="btn ghost sm">{{ ico.i('upload') }}<span x-text="$store.i18n.t('upload_driver')">Add driver</span></a>
|
||||
<a href="/printers/new" class="btn sm">{{ ico.i('plus') }}<span x-text="$store.i18n.t('add_printer')">Add printer</span></a>
|
||||
{% endblock %}
|
||||
|
||||
{% block content %}
|
||||
<h1 x-data x-text="$store.i18n.t('dashboard')">Dashboard</h1>
|
||||
<p class="page-intro" x-data x-text="$store.i18n.t('dashboard_intro')">Three steps from driver ZIP to deployable package.</p>
|
||||
|
||||
<div class="quick-actions">
|
||||
<a href="/printers" class="btn-action" x-data x-text="$store.i18n.t('new_printer')">New Printer</a>
|
||||
<a href="/drivers" class="btn-action" x-data x-text="$store.i18n.t('upload_driver_btn')">Upload Driver</a>
|
||||
<a href="/packages" class="btn-action" x-data x-text="$store.i18n.t('export_package')">Export Package</a>
|
||||
{#
|
||||
The rail is the spine of the tool: a printer cannot be exported before it has
|
||||
a driver, so the order is real and the state of each stage is worth showing.
|
||||
#}
|
||||
{% set s1 = 'done' if driver_count else 'next' %}
|
||||
{% set s2 = 'done' if printer_count else ('next' if driver_count else '') %}
|
||||
{% set s3 = 'done' if ready_count else ('next' if printer_count else '') %}
|
||||
<div class="rail">
|
||||
<a class="rail-step {{ s1 }}" href="/drivers">
|
||||
<div class="rail-top">
|
||||
<span class="rail-num">{% if s1 == 'done' %}{{ ico.i('check', 13) }}{% else %}1{% endif %}</span>
|
||||
<span class="rail-title" x-data x-text="$store.i18n.t('step_driver_title')">Add the driver</span>
|
||||
<span class="rail-count">{{ driver_count }}</span>
|
||||
</div>
|
||||
<p class="rail-desc" x-data x-text="$store.i18n.t('step_driver_desc')">A ZIP holding the .inf and its files.</p>
|
||||
<span class="rail-cta" x-data>
|
||||
{% if s1 == 'done' %}<span x-text="$store.i18n.t('drivers')">Drivers</span>{{ ico.i('chevron', 13) }}
|
||||
{% else %}<span x-text="$store.i18n.t('go_upload_driver')">Add a driver</span>{{ ico.i('chevron', 13) }}{% endif %}
|
||||
</span>
|
||||
</a>
|
||||
|
||||
<a class="rail-step {{ s2 }}" href="{% if printer_count %}/printers{% else %}/printers/new{% endif %}">
|
||||
<div class="rail-top">
|
||||
<span class="rail-num">{% if s2 == 'done' %}{{ ico.i('check', 13) }}{% else %}2{% endif %}</span>
|
||||
<span class="rail-title" x-data x-text="$store.i18n.t('step_printer_title')">Configure the printer</span>
|
||||
<span class="rail-count">{{ printer_count }}</span>
|
||||
</div>
|
||||
<p class="rail-desc" x-data x-text="$store.i18n.t('step_printer_desc')">Name, IP address, driver, and defaults.</p>
|
||||
<span class="rail-cta" x-data>
|
||||
{% if s2 == 'done' %}<span x-text="$store.i18n.t('printers')">Printers</span>{{ ico.i('chevron', 13) }}
|
||||
{% else %}<span x-text="$store.i18n.t('go_add_printer')">Add a printer</span>{{ ico.i('chevron', 13) }}{% endif %}
|
||||
</span>
|
||||
</a>
|
||||
|
||||
<a class="rail-step {{ s3 }}" href="/packages">
|
||||
<div class="rail-top">
|
||||
<span class="rail-num">{% if s3 == 'done' %}{{ ico.i('check', 13) }}{% else %}3{% endif %}</span>
|
||||
<span class="rail-title" x-data x-text="$store.i18n.t('step_package_title')">Export the package</span>
|
||||
<span class="rail-count">{{ ready_count }}</span>
|
||||
</div>
|
||||
<p class="rail-desc" x-data x-text="$store.i18n.t('step_package_desc')">.intunewin for Intune, ZIP for NinjaRMM.</p>
|
||||
<span class="rail-cta" x-data>
|
||||
<span x-text="$store.i18n.t('go_export')">View packages</span>{{ ico.i('chevron', 13) }}
|
||||
</span>
|
||||
</a>
|
||||
</div>
|
||||
|
||||
<section class="recent-activity">
|
||||
<h2 x-data x-text="$store.i18n.t('recent_activity')">Recent Activity</h2>
|
||||
<div class="split">
|
||||
<section class="card card-flush">
|
||||
<div class="card-head">
|
||||
<h2 x-data x-text="$store.i18n.t('recent_printers')">Recent printers</h2>
|
||||
{% if recent_printers %}
|
||||
<span class="head-actions">
|
||||
<a href="/printers" class="btn quiet sm" x-data><span x-text="$store.i18n.t('view_all')">View all</span>{{ ico.i('chevron', 13) }}</a>
|
||||
</span>
|
||||
{% endif %}
|
||||
</div>
|
||||
<div class="card-body">
|
||||
{% if recent_printers %}
|
||||
<div class="table-scroll">
|
||||
<table class="data-table">
|
||||
<tbody>
|
||||
{% for printer in recent_printers %}
|
||||
<tr>
|
||||
<td>
|
||||
<a class="cell-name" href="/printers/{{ printer.id }}">{{ printer.name }}</a>
|
||||
<span class="cell-sub">{{ printer.ip_address }}{% if printer.client_id %} · {{ printer.client.name }}{% endif %}</span>
|
||||
</td>
|
||||
<td class="actions">
|
||||
{% if printer.driver_id %}
|
||||
<span class="badge ok">{{ ico.i('check', 12) }}<span x-data x-text="$store.i18n.t('ready_to_export')">Ready</span></span>
|
||||
{% else %}
|
||||
<span class="badge warn">{{ ico.i('alert', 12) }}<span x-data x-text="$store.i18n.t('needs_driver')">Driver needed</span></span>
|
||||
{% endif %}
|
||||
</td>
|
||||
</tr>
|
||||
{% endfor %}
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
{% else %}
|
||||
<div class="empty">
|
||||
<span class="empty-ico">{{ ico.i('printer', 18) }}</span>
|
||||
<strong x-data x-text="$store.i18n.t('no_printers')">No printers configured yet.</strong>
|
||||
<p x-data x-text="$store.i18n.t('step_printer_desc')">Name, IP address, driver, and defaults.</p>
|
||||
<a href="/printers/new" class="btn sm" x-data>{{ ico.i('plus', 14) }}<span x-text="$store.i18n.t('add_printer')">Add printer</span></a>
|
||||
</div>
|
||||
{% endif %}
|
||||
</div>
|
||||
</section>
|
||||
|
||||
<div class="activity-section">
|
||||
<h3 x-data x-text="$store.i18n.t('recent_printers')">Recent Printers</h3>
|
||||
{% if recent_printers %}
|
||||
<ul>
|
||||
{% for printer in recent_printers %}
|
||||
<li><a href="/printers/{{ printer.id }}">{{ printer.name }}</a> — {{ printer.ip_address }}</li>
|
||||
{% endfor %}
|
||||
</ul>
|
||||
{% else %}
|
||||
<p class="empty-state" x-data x-text="$store.i18n.t('no_printers')">No printers configured yet.</p>
|
||||
{% endif %}
|
||||
</div>
|
||||
|
||||
<div class="activity-section">
|
||||
<h3 x-data x-text="$store.i18n.t('recent_packages')">Recent Packages</h3>
|
||||
{% if recent_packages %}
|
||||
<ul>
|
||||
{% for package in recent_packages %}
|
||||
<li><a href="/printers/{{ package.id }}">{{ package.name }}</a>{% if package.client_id %} — {{ package.client.name }}{% endif %}</li>
|
||||
{% endfor %}
|
||||
</ul>
|
||||
{% else %}
|
||||
<p class="empty-state" x-data x-text="$store.i18n.t('no_packages')">No packages exported yet.</p>
|
||||
{% endif %}
|
||||
</div>
|
||||
</section>
|
||||
<section class="card card-flush">
|
||||
<div class="card-head">
|
||||
<h2 x-data x-text="$store.i18n.t('recent_packages')">Ready to export</h2>
|
||||
{% if recent_packages %}
|
||||
<span class="head-actions">
|
||||
<a href="/packages" class="btn quiet sm" x-data><span x-text="$store.i18n.t('view_all')">View all</span>{{ ico.i('chevron', 13) }}</a>
|
||||
</span>
|
||||
{% endif %}
|
||||
</div>
|
||||
<div class="card-body">
|
||||
{% if recent_packages %}
|
||||
<div class="table-scroll">
|
||||
<table class="data-table">
|
||||
<tbody>
|
||||
{% for package in recent_packages %}
|
||||
<tr>
|
||||
<td>
|
||||
<a class="cell-name" href="/printers/{{ package.id }}">{{ package.name }}</a>
|
||||
<span class="cell-sub">{% if package.client_id %}{{ package.client.name }}{% else %}—{% endif %}</span>
|
||||
</td>
|
||||
<td class="actions">
|
||||
<span class="btn-row">
|
||||
<a class="btn quiet sm" href="/printers/{{ package.id }}/packages/intunewin">{{ ico.i('download', 13) }}<span class="mono">.intunewin</span></a>
|
||||
<a class="btn quiet sm" href="/printers/{{ package.id }}/packages/ninja">{{ ico.i('download', 13) }}<span class="mono">.zip</span></a>
|
||||
</span>
|
||||
</td>
|
||||
</tr>
|
||||
{% endfor %}
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
{% else %}
|
||||
<div class="empty">
|
||||
<span class="empty-ico">{{ ico.i('package', 18) }}</span>
|
||||
<strong x-data x-text="$store.i18n.t('no_packages')">No printers are ready to export yet.</strong>
|
||||
<p x-data x-text="$store.i18n.t('no_packages_ready')">No printer is ready yet. Assign a driver to enable export.</p>
|
||||
</div>
|
||||
{% endif %}
|
||||
</div>
|
||||
</section>
|
||||
</div>
|
||||
{% endblock %}
|
||||
|
||||
Reference in New Issue
Block a user