Remove data-theme attribute when mode="auto" instead of setting it to
"auto". Pico's OS-dark selector is :root:not([data-theme]), so any
value (even "auto") prevents dark-mode Pico styles. Add Pico form
element background vars and color-scheme: light to match active
theme.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Driver rename and icons: `Driver.display_name` plus a `DriverIcon` table, both
global/shared like the `Driver` row they hang off, so a rename or an icon is
what every Owner sees. The rename/icon dialog keeps its forms as siblings
(nested forms are invalid HTML) and the icon routes return an `hx-swap-oob`
thumbnail refresh rather than re-rendering the table, which would tear the open
`<dialog>` out of the DOM.
Web image picker: `GET /web/images` renders a pickable grid for a printer or a
driver icon, with the search term prefilled from the entity name and editable.
Picking one downloads it server-side and normalizes it.
Driver download search: `GET /web/drivers` searches for a vendor-wide driver
(the term is rewritten into the vendor's real product name for 15 brands) or for
the exact model as typed. Links only — nothing is downloaded, and the fragment
says the results are unvetted.
Icon uploads no longer reject off-size or non-PNG files: `normalize_icon()`
letterboxes any decodable raster into a 256x256 PNG. An already-exact 256x256
PNG is returned byte-identical, because icon storage is content-addressed and
re-encoding would move the file on every save.
`fetch_image()` makes the request from the server, so `assert_fetchable()`
refuses any URL resolving to a private, loopback, or link-local address, and
re-runs on every redirect. ImpTune sits on the same LAN as the printers it
configures; an unguarded fetcher would be a port scanner for anyone who can
reach the UI.
DuckDuckGo is scraped, not called through an API — no key needed, but fragile,
so both search functions swallow parse failures and return [] instead of 500ing
a page. `WEB_SEARCH=false` disables every outbound request and hides the
controls, for air-gapped installs.
Also: one shared `Jinja2Templates` in `templating.py` instead of five per-router
instances, so a template global is declared once; `_add_missing_columns()` in
`database.py` adds new nullable columns to a pre-existing table, which
`create_tables(safe=True)` skips; `db_env` in test_db.py now closes its
connection on teardown, or the next test's ORM writes land in the previous
test's DB file.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Session
- COOKIE_SECURE=false no longer persists the owner key for ten years.
services/session.cookie_kwargs() drops max_age in that mode, so the
browser holds the key in memory and the session ends with the window.
Everything still persists server-side; only the browser link is
temporary. base.html shows a warning banner (FR/EN) and an extra
paragraph in the onboarding modal, and the README explains the
trade-off and the backup-key escape hatch.
- Both cookie writers (middleware, POST /session/restore) go through
cookie_kwargs() so the policy cannot drift between them.
- The CSRF guard on /session/restore compared request.url.scheme against
the Origin header. Behind a TLS-terminating proxy uvicorn sees http
while the browser sends https, so every legitimate restore was
rejected with 403. It now compares hosts only, including
X-Forwarded-Host.
- /static/*, /favicon.ico and /robots.txt skip the middleware. Each
cookieless hit was inserting an Owner row no browser could ever use.
Reliability
- Malformed printer-form FK fields no longer escape as HTTP 500:
a non-numeric client_id/driver_id raised ValueError and an unknown
driver_id hit a FOREIGN KEY constraint. Both are now 400/404 HTMX
fragments, and the duplicated field checks moved into
_validate_fields().
- Package exports stream. build_intunewin() encrypts the inner ZIP in
1 MB chunks against temp files with a streaming HMAC and SHA256, and
both endpoints serve the result with FileResponse plus a background
cleanup task. A 100 MB driver used to be held in memory three or four
times over per concurrent download. The byte layout is unchanged.
- FileResponse also escapes the download filename, which was previously
interpolated raw into Content-Disposition.
- python-multipart >= 0.0.18 (CVE-2024-53981, reachable from
/drivers/upload) and Pillow >= 10.3 (CVE-2024-28219, reachable from
icon upload).
- icons.py reads cfg.ICONS_DIR instead of re-deriving the path from
DATA_DIR, matching the .intunewin export.
UI
- Sidebar/topbar shell, inline SVG icon macros (partials/icons.html),
card and data-table components, grouped printer list, and the
dedicated /printers/new page replacing partials/printer_form.html.
Tests
- 194 pass with a bare `pytest tests/`: tests/conftest.py now forces
cfg.COOKIE_SECURE = False like the e2e conftest already did, so the
Secure cookie is no longer dropped over http://testserver.
- New coverage for the malformed-FK guards, the chunk-boundary cases in
the encrypt loop (every residue mod _CHUNK plus a multi-megabyte
payload), temp-dir cleanup after both exports, and the whole
COOKIE_SECURE matrix.
- test_printer_edit.py located the Edit button by its translated label,
so it only passed on English-locale machines. It now targets the
showModal() hook, which also cuts the e2e run from 84s to 15s.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Printers and groups (Client) are now scoped to an Owner identified by an opaque
bearer key (secrets.token_urlsafe(32)) stored in an httponly cookie, defaulting
to temporary. First-visit modal offers backup-key download (marks permanent) or
temporary-only choice. /session/restore re-attaches a fresh browser to a saved
key. Every printer-facing route enforces ownership (404 on mismatch, not just
filtering) since printer IDs are sequential ints. Drivers stay global/shared.
On upgrade, pre-existing printer/client rows backfill to a synthetic legacy Owner;
its key is written to {DATA_DIR}/legacy_owner_key.txt for manual restore.
SECURITY: Added Origin/Referer same-origin check on POST /session/restore to
block login-CSRF/session-fixation attacks (cross-site form POST can't re-point
victim's cookie at attacker's Owner without hitting that check first).
Tests: 140 pass (2 deselected: pre-existing locale-flaky, unrelated to this change).
Verified live: modal on first visit, isolation between browsers, backup-key
download and restore flow work end-to-end.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
HTMX outerHTML swap target was hidden — upload confirmation (driver name + table)
was invisible to technician despite server returning correct fragment. Single-line
removal on line 98; no other files modified.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
kawaandClaude Haiku 4.5