feat: memory-only sessions on HTTP, streamed exports, UI refresh
Session - COOKIE_SECURE=false no longer persists the owner key for ten years. services/session.cookie_kwargs() drops max_age in that mode, so the browser holds the key in memory and the session ends with the window. Everything still persists server-side; only the browser link is temporary. base.html shows a warning banner (FR/EN) and an extra paragraph in the onboarding modal, and the README explains the trade-off and the backup-key escape hatch. - Both cookie writers (middleware, POST /session/restore) go through cookie_kwargs() so the policy cannot drift between them. - The CSRF guard on /session/restore compared request.url.scheme against the Origin header. Behind a TLS-terminating proxy uvicorn sees http while the browser sends https, so every legitimate restore was rejected with 403. It now compares hosts only, including X-Forwarded-Host. - /static/*, /favicon.ico and /robots.txt skip the middleware. Each cookieless hit was inserting an Owner row no browser could ever use. Reliability - Malformed printer-form FK fields no longer escape as HTTP 500: a non-numeric client_id/driver_id raised ValueError and an unknown driver_id hit a FOREIGN KEY constraint. Both are now 400/404 HTMX fragments, and the duplicated field checks moved into _validate_fields(). - Package exports stream. build_intunewin() encrypts the inner ZIP in 1 MB chunks against temp files with a streaming HMAC and SHA256, and both endpoints serve the result with FileResponse plus a background cleanup task. A 100 MB driver used to be held in memory three or four times over per concurrent download. The byte layout is unchanged. - FileResponse also escapes the download filename, which was previously interpolated raw into Content-Disposition. - python-multipart >= 0.0.18 (CVE-2024-53981, reachable from /drivers/upload) and Pillow >= 10.3 (CVE-2024-28219, reachable from icon upload). - icons.py reads cfg.ICONS_DIR instead of re-deriving the path from DATA_DIR, matching the .intunewin export. UI - Sidebar/topbar shell, inline SVG icon macros (partials/icons.html), card and data-table components, grouped printer list, and the dedicated /printers/new page replacing partials/printer_form.html. Tests - 194 pass with a bare `pytest tests/`: tests/conftest.py now forces cfg.COOKIE_SECURE = False like the e2e conftest already did, so the Secure cookie is no longer dropped over http://testserver. - New coverage for the malformed-FK guards, the chunk-boundary cases in the encrypt loop (every residue mod _CHUNK plus a multi-megabyte payload), temp-dir cleanup after both exports, and the whole COOKIE_SECURE matrix. - test_printer_edit.py located the Edit button by its translated label, so it only passed on English-locale machines. It now targets the showModal() hook, which also cuts the e2e run from 84s to 15s. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5
@@ -1,50 +1,95 @@
|
||||
{% import "partials/icons.html" as ico %}
|
||||
{% set usage = usage | default({}, true) %}
|
||||
{% set new_driver_id = new_driver_id | default(None, true) %}
|
||||
<div id="driver-list">
|
||||
{% if parsed is defined and parsed.unused_files %}
|
||||
<p class="notice">
|
||||
{{ parsed.unused_files | length }} file(s) may be unused (not referenced by the INF):
|
||||
<div class="notice">
|
||||
<p>
|
||||
{{ parsed.unused_files | length }}
|
||||
<span x-data x-text="$store.i18n.t('unused_files')">file(s) in the ZIP are unused — the .inf never references them.</span>
|
||||
</p>
|
||||
<details>
|
||||
<summary>Show unused files</summary>
|
||||
<summary x-data x-text="$store.i18n.t('show_unused')">Show unused files</summary>
|
||||
<ul>
|
||||
{% for f in parsed.unused_files %}
|
||||
<li>{{ f }}</li>
|
||||
{% endfor %}
|
||||
</ul>
|
||||
</details>
|
||||
</p>
|
||||
</div>
|
||||
{% endif %}
|
||||
|
||||
{% if driver_data %}
|
||||
<table>
|
||||
<thead>
|
||||
<tr>
|
||||
<th x-data x-text="$store.i18n.t('driver_filename')">Filename</th>
|
||||
<th x-data x-text="$store.i18n.t('driver_names_col')">Driver Name(s)</th>
|
||||
<th x-data x-text="$store.i18n.t('architecture')">Architecture</th>
|
||||
<th x-data x-text="$store.i18n.t('uploaded_at')">Uploaded</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
{% for item in driver_data %}
|
||||
<tr>
|
||||
<td>{{ item.driver.original_filename }}</td>
|
||||
<td>
|
||||
{% if item.names %}
|
||||
<select aria-label="Driver names">
|
||||
{% for name in item.names %}
|
||||
<option>{{ name }}</option>
|
||||
{% endfor %}
|
||||
</select>
|
||||
{% else %}
|
||||
<em x-data x-text="$store.i18n.t('unknown')">Unknown</em>
|
||||
{% endif %}
|
||||
</td>
|
||||
<td>{% if item.driver.architecture %}{{ item.driver.architecture }}{% else %}<span x-data x-text="$store.i18n.t('unknown')">Unknown</span>{% endif %}</td>
|
||||
<td>{{ item.driver.uploaded_at }}</td>
|
||||
</tr>
|
||||
{% endfor %}
|
||||
</tbody>
|
||||
</table>
|
||||
<div class="card card-flush">
|
||||
<div class="table-scroll">
|
||||
<table class="data-table">
|
||||
<thead>
|
||||
<tr>
|
||||
<th x-data x-text="$store.i18n.t('driver_filename')">File</th>
|
||||
<th x-data x-text="$store.i18n.t('driver_names_col')">Driver name(s)</th>
|
||||
<th class="col-arch" x-data x-text="$store.i18n.t('architecture')">Architecture</th>
|
||||
<th class="col-used" x-data x-text="$store.i18n.t('th_used_by')">Used by</th>
|
||||
<th class="col-added" x-data x-text="$store.i18n.t('uploaded_at')">Added</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
{% for item in driver_data %}
|
||||
<tr>
|
||||
<td>
|
||||
<span class="cell-name mono">{{ item.driver.original_filename }}</span>
|
||||
<span class="cell-sub">
|
||||
{% if item.driver.size_bytes >= 1048576 %}{{ (item.driver.size_bytes / 1048576) | round(1) }} MB{% elif item.driver.size_bytes >= 1024 %}{{ (item.driver.size_bytes / 1024) | round(0) | int }} KB{% else %}{{ item.driver.size_bytes }} B{% endif %}
|
||||
{% if item.driver.inf_filename %} · {{ item.driver.inf_filename }}{% endif %}
|
||||
</span>
|
||||
</td>
|
||||
<td>
|
||||
{% if item.names %}
|
||||
{# Multi-model INFs can carry a dozen names — show three, fold the rest. #}
|
||||
<span class="pill-row">
|
||||
{% for name in item.names[:3] %}<span class="pill">{{ name }}</span>{% endfor %}
|
||||
{% if item.names | length > 3 %}
|
||||
<details class="more-pills">
|
||||
<summary class="pill">+{{ item.names | length - 3 }}</summary>
|
||||
<span class="pill-row">
|
||||
{% for name in item.names[3:] %}<span class="pill">{{ name }}</span>{% endfor %}
|
||||
</span>
|
||||
</details>
|
||||
{% endif %}
|
||||
</span>
|
||||
{% else %}
|
||||
<span class="faint" x-data x-text="$store.i18n.t('unknown')">Unknown</span>
|
||||
{% endif %}
|
||||
</td>
|
||||
<td class="col-arch">
|
||||
{% if item.driver.architecture %}
|
||||
<span class="badge">{{ item.driver.architecture }}</span>
|
||||
{% else %}
|
||||
<span class="faint" x-data x-text="$store.i18n.t('unknown')">Unknown</span>
|
||||
{% endif %}
|
||||
</td>
|
||||
<td class="num col-used">
|
||||
{% set n = usage.get(item.driver.id, 0) %}
|
||||
{% if n %}<a href="/printers">{{ n }}</a>{% else %}<span class="faint">0</span>{% endif %}
|
||||
</td>
|
||||
<td class="num col-added">
|
||||
{{ item.driver.uploaded_at.strftime('%Y-%m-%d %H:%M') if item.driver.uploaded_at is not string else item.driver.uploaded_at }}
|
||||
{% if new_driver_id and item.driver.id == new_driver_id %}
|
||||
<span class="badge ok">{{ ico.i('check', 12) }}new</span>
|
||||
{% endif %}
|
||||
</td>
|
||||
</tr>
|
||||
{% endfor %}
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
</div>
|
||||
{% else %}
|
||||
<p x-data x-text="$store.i18n.t('no_drivers')">No drivers uploaded yet.</p>
|
||||
<div class="card">
|
||||
<div class="empty">
|
||||
<span class="empty-ico">{{ ico.i('driver', 18) }}</span>
|
||||
<strong x-data x-text="$store.i18n.t('no_drivers')">No drivers uploaded yet.</strong>
|
||||
<p x-data x-text="$store.i18n.t('hint_driver_zip')">The ZIP must contain the .inf file and every file it references.</p>
|
||||
</div>
|
||||
</div>
|
||||
{% endif %}
|
||||
</div>
|
||||
|
||||
Reference in New Issue
Block a user