feat: memory-only sessions on HTTP, streamed exports, UI refresh
Session - COOKIE_SECURE=false no longer persists the owner key for ten years. services/session.cookie_kwargs() drops max_age in that mode, so the browser holds the key in memory and the session ends with the window. Everything still persists server-side; only the browser link is temporary. base.html shows a warning banner (FR/EN) and an extra paragraph in the onboarding modal, and the README explains the trade-off and the backup-key escape hatch. - Both cookie writers (middleware, POST /session/restore) go through cookie_kwargs() so the policy cannot drift between them. - The CSRF guard on /session/restore compared request.url.scheme against the Origin header. Behind a TLS-terminating proxy uvicorn sees http while the browser sends https, so every legitimate restore was rejected with 403. It now compares hosts only, including X-Forwarded-Host. - /static/*, /favicon.ico and /robots.txt skip the middleware. Each cookieless hit was inserting an Owner row no browser could ever use. Reliability - Malformed printer-form FK fields no longer escape as HTTP 500: a non-numeric client_id/driver_id raised ValueError and an unknown driver_id hit a FOREIGN KEY constraint. Both are now 400/404 HTMX fragments, and the duplicated field checks moved into _validate_fields(). - Package exports stream. build_intunewin() encrypts the inner ZIP in 1 MB chunks against temp files with a streaming HMAC and SHA256, and both endpoints serve the result with FileResponse plus a background cleanup task. A 100 MB driver used to be held in memory three or four times over per concurrent download. The byte layout is unchanged. - FileResponse also escapes the download filename, which was previously interpolated raw into Content-Disposition. - python-multipart >= 0.0.18 (CVE-2024-53981, reachable from /drivers/upload) and Pillow >= 10.3 (CVE-2024-28219, reachable from icon upload). - icons.py reads cfg.ICONS_DIR instead of re-deriving the path from DATA_DIR, matching the .intunewin export. UI - Sidebar/topbar shell, inline SVG icon macros (partials/icons.html), card and data-table components, grouped printer list, and the dedicated /printers/new page replacing partials/printer_form.html. Tests - 194 pass with a bare `pytest tests/`: tests/conftest.py now forces cfg.COOKIE_SECURE = False like the e2e conftest already did, so the Secure cookie is no longer dropped over http://testserver. - New coverage for the malformed-FK guards, the chunk-boundary cases in the encrypt loop (every residue mod _CHUNK plus a multi-megabyte payload), temp-dir cleanup after both exports, and the whole COOKIE_SECURE matrix. - test_printer_edit.py located the Edit button by its translated label, so it only passed on English-locale machines. It now targets the showModal() hook, which also cuts the e2e run from 84s to 15s. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5
@@ -1,57 +1,98 @@
|
||||
{% import "partials/icons.html" as ico %}
|
||||
<div id="printer-list">
|
||||
{% if not grouped %}
|
||||
<p x-data x-text="$store.i18n.t('no_printers')">No printers configured yet.</p>
|
||||
<div class="card">
|
||||
<div class="empty">
|
||||
<span class="empty-ico">{{ ico.i('printer', 18) }}</span>
|
||||
<strong x-data x-text="$store.i18n.t('no_printers')">No printers configured yet.</strong>
|
||||
<p x-data x-text="$store.i18n.t('step_printer_desc')">Name, IP address, driver, and the defaults the workstation gets.</p>
|
||||
<a href="/printers/new" class="btn sm" x-data>{{ ico.i('plus', 14) }}<span x-text="$store.i18n.t('add_printer')">Add printer</span></a>
|
||||
</div>
|
||||
</div>
|
||||
{% else %}
|
||||
{% for client_name, printers in grouped.items() %}
|
||||
<section>
|
||||
{% set group_client_id = printers[0].client_id if printers else None %}
|
||||
{% if group_client_id %}
|
||||
<h3><a href="/clients/{{ group_client_id }}">{{ client_name }}</a></h3>
|
||||
{% else %}
|
||||
<h3>{{ client_name }}</h3>
|
||||
{% endif %}
|
||||
<table>
|
||||
<thead>
|
||||
<tr>
|
||||
<th x-data x-text="$store.i18n.t('th_name')">Name</th>
|
||||
<th x-data x-text="$store.i18n.t('th_ip')">IP Address</th>
|
||||
<th x-data x-text="$store.i18n.t('th_port')">Port</th>
|
||||
<th x-data x-text="$store.i18n.t('th_driver')">Driver</th>
|
||||
<th x-data x-text="$store.i18n.t('th_duplex')">Duplex</th>
|
||||
<th x-data x-text="$store.i18n.t('th_color')">Color</th>
|
||||
<th x-data x-text="$store.i18n.t('th_paper')">Paper</th>
|
||||
<th x-data x-text="$store.i18n.t('th_collate')">Collate</th>
|
||||
<th x-data x-text="$store.i18n.t('th_actions')">Actions</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
{% for p in printers %}
|
||||
<tr>
|
||||
<td><a href="/printers/{{ p.id }}">{{ p.name }}</a></td>
|
||||
<td>{{ p.ip_address }}</td>
|
||||
<td>{{ p.port_name }}</td>
|
||||
<td>{{ p.driver.original_filename if p.driver_id else '—' }}</td>
|
||||
<td>{{ p.duplex_mode }}</td>
|
||||
<td x-data="{ val: {{ 'true' if p.color_mode else 'false' }} }"
|
||||
x-text="val ? $store.i18n.t('yes') : $store.i18n.t('no')">{{ 'Yes' if p.color_mode else 'No' }}</td>
|
||||
<td>{{ p.paper_size }}</td>
|
||||
<td x-data="{ val: {{ 'true' if p.collate else 'false' }} }"
|
||||
x-text="val ? $store.i18n.t('yes') : $store.i18n.t('no')">{{ 'Yes' if p.collate else 'No' }}</td>
|
||||
<td>
|
||||
{% include "partials/printer_edit_modal.html" %}
|
||||
<button
|
||||
hx-delete="/printers/{{ p.id }}"
|
||||
hx-target="#printer-list"
|
||||
hx-swap="outerHTML"
|
||||
hx-confirm="Delete '{{ p.name }}'?"
|
||||
x-data x-text="$store.i18n.t('delete')">
|
||||
Delete
|
||||
</button>
|
||||
</td>
|
||||
</tr>
|
||||
{% endfor %}
|
||||
</tbody>
|
||||
</table>
|
||||
{% set group_client_id = printers[0].client_id if printers else None %}
|
||||
{# Group search text must cover everything its rows match on, or a row can
|
||||
match while its group stays hidden. #}
|
||||
{% set gsearch = (printers | map(attribute='name') | join(' ')) ~ ' '
|
||||
~ (printers | map(attribute='ip_address') | join(' ')) ~ ' '
|
||||
~ (printers | map(attribute='port_name') | join(' ')) ~ ' '
|
||||
~ (printers | selectattr('driver_id') | map(attribute='driver.original_filename') | join(' ')) ~ ' '
|
||||
~ client_name %}
|
||||
<section class="card card-flush"
|
||||
data-search="{{ gsearch | lower }}"
|
||||
x-data
|
||||
x-show="!$store.filter.q.trim() || $el.dataset.search.includes($store.filter.q.trim().toLowerCase())">
|
||||
<div class="group-head">
|
||||
{{ ico.i('group') }}
|
||||
{% if group_client_id %}
|
||||
<h3><a href="/clients/{{ group_client_id }}">{{ client_name }}</a></h3>
|
||||
{% else %}
|
||||
<h3 x-data x-text="$store.i18n.t('unassigned')">{{ client_name }}</h3>
|
||||
{% endif %}
|
||||
<span class="count">{{ printers | length }}</span>
|
||||
</div>
|
||||
<div class="table-scroll">
|
||||
<table class="data-table">
|
||||
<thead>
|
||||
<tr>
|
||||
<th x-data x-text="$store.i18n.t('th_name')">Name</th>
|
||||
<th x-data x-text="$store.i18n.t('th_status')">Status</th>
|
||||
<th class="col-defaults" x-data x-text="$store.i18n.t('th_config')">Defaults</th>
|
||||
<th x-data x-text="$store.i18n.t('th_actions')">Actions</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
{% for p in printers %}
|
||||
<tr data-search="{{ (p.name ~ ' ' ~ p.ip_address ~ ' ' ~ p.port_name ~ ' ' ~ client_name ~ ' ' ~ (p.driver.original_filename if p.driver_id else '')) | lower }}"
|
||||
x-data
|
||||
x-show="!$store.filter.q.trim() || $el.dataset.search.includes($store.filter.q.trim().toLowerCase())">
|
||||
<td>
|
||||
<a class="cell-name" href="/printers/{{ p.id }}">{{ p.name }}</a>
|
||||
<span class="cell-sub">{{ p.ip_address }} · {{ p.port_name }}</span>
|
||||
</td>
|
||||
<td>
|
||||
{% if p.driver_id %}
|
||||
<span class="badge ok">{{ ico.i('check', 12) }}<span x-data x-text="$store.i18n.t('ready_to_export')">Ready</span></span>
|
||||
<span class="cell-sub">{{ p.driver.original_filename }}</span>
|
||||
{% else %}
|
||||
<span class="badge warn">{{ ico.i('alert', 12) }}<span x-data x-text="$store.i18n.t('needs_driver')">Driver needed</span></span>
|
||||
{% endif %}
|
||||
</td>
|
||||
<td class="col-defaults">
|
||||
<span class="pill-row">
|
||||
<span class="pill" x-data
|
||||
x-text="$store.i18n.t('{{ 'one_sided' if p.duplex_mode == 'OneSided' else ('long_edge' if p.duplex_mode == 'LongEdge' else 'short_edge') }}')">{{ p.duplex_mode }}</span>
|
||||
<span class="pill" x-data
|
||||
x-text="$store.i18n.t('{{ 'color_value' if p.color_mode else 'grayscale_value' }}')">{{ 'Color' if p.color_mode else 'Grayscale' }}</span>
|
||||
<span class="pill">{{ p.paper_size }}</span>
|
||||
{% if p.collate %}
|
||||
<span class="pill" x-data x-text="$store.i18n.t('collate')">Collate</span>
|
||||
{% endif %}
|
||||
</span>
|
||||
</td>
|
||||
<td class="actions">
|
||||
<span class="btn-row">
|
||||
{% if p.driver_id %}
|
||||
<a class="btn quiet sm" href="/printers/{{ p.id }}/packages/intunewin"
|
||||
title=".intunewin">{{ ico.i('download', 14) }}</a>
|
||||
{% endif %}
|
||||
{% include "partials/printer_edit_modal.html" %}
|
||||
<button class="btn danger sm"
|
||||
hx-delete="/printers/{{ p.id }}"
|
||||
hx-target="#printer-list"
|
||||
hx-swap="outerHTML"
|
||||
hx-confirm="Delete '{{ p.name }}'?"
|
||||
x-data :title="$store.i18n.t('delete')">
|
||||
{{ ico.i('trash', 14) }}
|
||||
</button>
|
||||
</span>
|
||||
</td>
|
||||
</tr>
|
||||
{% endfor %}
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
</section>
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
Reference in New Issue
Block a user