kawaandClaude Opus 5
b397d3dc3d
Session - COOKIE_SECURE=false no longer persists the owner key for ten years. services/session.cookie_kwargs() drops max_age in that mode, so the browser holds the key in memory and the session ends with the window. Everything still persists server-side; only the browser link is temporary. base.html shows a warning banner (FR/EN) and an extra paragraph in the onboarding modal, and the README explains the trade-off and the backup-key escape hatch. - Both cookie writers (middleware, POST /session/restore) go through cookie_kwargs() so the policy cannot drift between them. - The CSRF guard on /session/restore compared request.url.scheme against the Origin header. Behind a TLS-terminating proxy uvicorn sees http while the browser sends https, so every legitimate restore was rejected with 403. It now compares hosts only, including X-Forwarded-Host. - /static/*, /favicon.ico and /robots.txt skip the middleware. Each cookieless hit was inserting an Owner row no browser could ever use. Reliability - Malformed printer-form FK fields no longer escape as HTTP 500: a non-numeric client_id/driver_id raised ValueError and an unknown driver_id hit a FOREIGN KEY constraint. Both are now 400/404 HTMX fragments, and the duplicated field checks moved into _validate_fields(). - Package exports stream. build_intunewin() encrypts the inner ZIP in 1 MB chunks against temp files with a streaming HMAC and SHA256, and both endpoints serve the result with FileResponse plus a background cleanup task. A 100 MB driver used to be held in memory three or four times over per concurrent download. The byte layout is unchanged. - FileResponse also escapes the download filename, which was previously interpolated raw into Content-Disposition. - python-multipart >= 0.0.18 (CVE-2024-53981, reachable from /drivers/upload) and Pillow >= 10.3 (CVE-2024-28219, reachable from icon upload). - icons.py reads cfg.ICONS_DIR instead of re-deriving the path from DATA_DIR, matching the .intunewin export. UI - Sidebar/topbar shell, inline SVG icon macros (partials/icons.html), card and data-table components, grouped printer list, and the dedicated /printers/new page replacing partials/printer_form.html. Tests - 194 pass with a bare `pytest tests/`: tests/conftest.py now forces cfg.COOKIE_SECURE = False like the e2e conftest already did, so the Secure cookie is no longer dropped over http://testserver. - New coverage for the malformed-FK guards, the chunk-boundary cases in the encrypt loop (every residue mod _CHUNK plus a multi-megabyte payload), temp-dir cleanup after both exports, and the whole COOKIE_SECURE matrix. - test_printer_edit.py located the Edit button by its translated label, so it only passed on English-locale machines. It now targets the showModal() hook, which also cuts the e2e run from 84s to 15s. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
94 lines
3.2 KiB
Markdown
94 lines
3.2 KiB
Markdown
# ImpTune
|
|
|
|
Build printer deploy packages (`.intunewin` for Intune, `.zip` for NinjaRMM) from Windows driver ZIPs via a web UI.
|
|
|
|
## Run
|
|
|
|
### Local development
|
|
|
|
```bash
|
|
docker compose up
|
|
```
|
|
|
|
`docker-compose.override.yml` is merged automatically: it mounts your working
|
|
copy into the container and runs uvicorn with `--reload`, so code edits are
|
|
picked up live. The override is gitignored (personal / per-machine).
|
|
|
|
### Run the published image
|
|
|
|
To run the image from the registry instead of building locally, skip the
|
|
override:
|
|
|
|
```bash
|
|
docker compose -f docker-compose.yml pull
|
|
docker compose -f docker-compose.yml up
|
|
```
|
|
|
|
Then open http://localhost:8000
|
|
|
|
## Publishing
|
|
|
|
`scripts/publish.ps1` builds the image and pushes it to the Gitea container
|
|
registry at `git.azuze.fr/kawa/imptune`.
|
|
|
|
```powershell
|
|
# build + push :<short-git-sha> and :latest (prompts for a Gitea token)
|
|
./scripts/publish.ps1
|
|
|
|
# tag an explicit version
|
|
./scripts/publish.ps1 -Tag v1.2.0
|
|
```
|
|
|
|
Use a Gitea access token (Settings → Applications, with package read/write
|
|
scope) as the password. For non-interactive runs set `GITEA_USER` /
|
|
`GITEA_TOKEN` env vars. Run `Get-Help ./scripts/publish.ps1 -Detailed` for all
|
|
parameters (`-Registry`, `-Owner`, `-Image`, `-NoBuild`, `-SkipLogin`, …).
|
|
|
|
## Environment variables
|
|
|
|
Set these under `environment:` in `docker-compose.yml`.
|
|
|
|
| Variable | Default | Purpose |
|
|
|------------------|---------|--------------------------------------------------|
|
|
| `DATA_DIR` | `/data` | Storage root for the SQLite DB, drivers and icons. Should map to the `imptune_data` volume. |
|
|
| `PORT` | `8000` | Port the server listens on inside the container. |
|
|
| `COOKIE_SECURE` | `true` | `Secure` flag on the session cookie. Set to `false` when the app is reached over plain HTTP — see below. |
|
|
|
|
### `COOKIE_SECURE` and HTTPS
|
|
|
|
Printers, print defaults and clients belong to a session identified by an opaque
|
|
key in a cookie (there are no accounts). That cookie is `Secure` by default, so
|
|
it only travels over HTTPS.
|
|
|
|
**Behind a TLS-terminating proxy** (nginx, Traefik, Caddy — the normal setup):
|
|
leave the default. The session cookie lasts ten years, so a browser keeps its
|
|
printers indefinitely.
|
|
|
|
**Reached directly over plain HTTP** (`http://host:8000`): set
|
|
`COOKIE_SECURE=false`, otherwise the browser refuses the cookie and every
|
|
request starts a brand-new empty session — no printer you save is ever visible
|
|
again.
|
|
|
|
In that mode the app is fully usable and keeps remembering everything, but the
|
|
cookie becomes **memory-only**: the session ends when the browser closes, and
|
|
every page shows a warning saying so. This is deliberate — over plain HTTP the
|
|
key is readable on the wire, so it is not written to disk for ten years. Use
|
|
**Download my backup key** to save the key to a file; `/session/restore` takes
|
|
it back on the next browser start, or on another machine.
|
|
|
|
```yaml
|
|
services:
|
|
imptune:
|
|
environment:
|
|
- DATA_DIR=/data
|
|
- COOKIE_SECURE=false # only when serving plain HTTP
|
|
```
|
|
|
|
For local development the same applies:
|
|
|
|
```bash
|
|
export DATA_DIR=/tmp/imptune_data
|
|
export COOKIE_SECURE=false
|
|
uvicorn imptune.main:app --reload --port 8000
|
|
```
|