Files
ImpTune/imptune/templates/partials/printer_edit_modal.html
T
kawaandClaude Opus 5 b397d3dc3d feat: memory-only sessions on HTTP, streamed exports, UI refresh
Session

- COOKIE_SECURE=false no longer persists the owner key for ten years.
  services/session.cookie_kwargs() drops max_age in that mode, so the
  browser holds the key in memory and the session ends with the window.
  Everything still persists server-side; only the browser link is
  temporary. base.html shows a warning banner (FR/EN) and an extra
  paragraph in the onboarding modal, and the README explains the
  trade-off and the backup-key escape hatch.
- Both cookie writers (middleware, POST /session/restore) go through
  cookie_kwargs() so the policy cannot drift between them.
- The CSRF guard on /session/restore compared request.url.scheme against
  the Origin header. Behind a TLS-terminating proxy uvicorn sees http
  while the browser sends https, so every legitimate restore was
  rejected with 403. It now compares hosts only, including
  X-Forwarded-Host.
- /static/*, /favicon.ico and /robots.txt skip the middleware. Each
  cookieless hit was inserting an Owner row no browser could ever use.

Reliability

- Malformed printer-form FK fields no longer escape as HTTP 500:
  a non-numeric client_id/driver_id raised ValueError and an unknown
  driver_id hit a FOREIGN KEY constraint. Both are now 400/404 HTMX
  fragments, and the duplicated field checks moved into
  _validate_fields().
- Package exports stream. build_intunewin() encrypts the inner ZIP in
  1 MB chunks against temp files with a streaming HMAC and SHA256, and
  both endpoints serve the result with FileResponse plus a background
  cleanup task. A 100 MB driver used to be held in memory three or four
  times over per concurrent download. The byte layout is unchanged.
- FileResponse also escapes the download filename, which was previously
  interpolated raw into Content-Disposition.
- python-multipart >= 0.0.18 (CVE-2024-53981, reachable from
  /drivers/upload) and Pillow >= 10.3 (CVE-2024-28219, reachable from
  icon upload).
- icons.py reads cfg.ICONS_DIR instead of re-deriving the path from
  DATA_DIR, matching the .intunewin export.

UI

- Sidebar/topbar shell, inline SVG icon macros (partials/icons.html),
  card and data-table components, grouped printer list, and the
  dedicated /printers/new page replacing partials/printer_form.html.

Tests

- 194 pass with a bare `pytest tests/`: tests/conftest.py now forces
  cfg.COOKIE_SECURE = False like the e2e conftest already did, so the
  Secure cookie is no longer dropped over http://testserver.
- New coverage for the malformed-FK guards, the chunk-boundary cases in
  the encrypt loop (every residue mod _CHUNK plus a multi-megabyte
  payload), temp-dir cleanup after both exports, and the whole
  COOKIE_SECURE matrix.
- test_printer_edit.py located the Edit button by its translated label,
  so it only passed on English-locale machines. It now targets the
  showModal() hook, which also cuts the e2e run from 84s to 15s.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-04 17:58:49 +02:00

124 lines
6.0 KiB
HTML

{% import "partials/icons.html" as ico %}
<!-- Edit trigger — sits in the row's Actions cell -->
<button class="btn ghost sm"
onclick="document.getElementById('edit-modal-{{ p.id }}').showModal()"
x-data>
{{ ico.i('pencil', 14) }}<span x-text="$store.i18n.t('edit')">Edit</span>
</button>
<!-- Edit dialog — native <dialog>, no extra library -->
<dialog id="edit-modal-{{ p.id }}">
<article>
<div x-data="{ ip: '{{ p.ip_address }}', port: '{{ p.port_name }}', portEdited: true }">
<form hx-patch="/printers/{{ p.id }}"
hx-target="#printer-list"
hx-swap="outerHTML"
hx-on::after-request="document.getElementById('edit-modal-{{ p.id }}').close()">
<div class="dialog-head">
<h3 x-text="$store.i18n.t('edit_printer_title')">Edit printer</h3>
{# No aria-label="Close": Pico hooks that attribute to draw its own
floated X icon, which fights this button's glyph and placement. #}
<button type="button" class="icon-btn close"
:aria-label="$store.i18n.t('cancel')"
onclick="document.getElementById('edit-modal-{{ p.id }}').close()">&times;</button>
</div>
<div class="dialog-body">
<fieldset class="form-section">
<legend x-text="$store.i18n.t('section_identity')">Identity</legend>
<label>
<span class="label-text" x-text="$store.i18n.t('printer_name')">Printer name</span>
<input type="text" name="name" value="{{ p.name }}" required>
</label>
<label>
<span class="label-text" x-text="$store.i18n.t('client')">Client</span>
<select name="client_id">
<option value="" x-text="$store.i18n.t('unassigned_option')">Unassigned</option>
{% for c in clients %}
<option value="{{ c.id }}" {% if p.client_id == c.id %}selected{% endif %}>{{ c.name }}</option>
{% endfor %}
</select>
</label>
</fieldset>
<fieldset class="form-section">
<legend x-text="$store.i18n.t('section_connection')">Network connection</legend>
<div class="form-row">
<label>
<span class="label-text" x-text="$store.i18n.t('ip_address')">IP address</span>
<input type="text" name="ip_address" class="mono"
x-model="ip"
@input="if (!portEdited) port = 'IP_' + ip.replaceAll('.', '_')"
required>
</label>
<label>
<span class="label-text" x-text="$store.i18n.t('port_name')">Port name</span>
<input type="text" name="port_name" class="mono"
x-model="port"
@change="portEdited = true"
@keydown="portEdited = true">
</label>
</div>
</fieldset>
<fieldset class="form-section">
<legend x-text="$store.i18n.t('section_driver')">Driver</legend>
<label>
<select name="driver_id">
<option value="" x-text="$store.i18n.t('no_driver_option')">No driver</option>
{% for item in driver_data %}
<option value="{{ item.driver.id }}"
{% if p.driver_id == item.driver.id %}selected{% endif %}>
{{ item.driver.original_filename }}{% if item.names %} — {{ item.names | join(', ') }}{% endif %}
</option>
{% endfor %}
</select>
<span class="hint" x-text="$store.i18n.t('hint_driver')">Without a driver the printer is saved, but export stays locked.</span>
</label>
</fieldset>
<fieldset class="form-section">
<legend x-text="$store.i18n.t('section_defaults')">Print defaults</legend>
<div class="form-row">
<label>
<span class="label-text" x-text="$store.i18n.t('duplex_mode')">Duplex mode</span>
<select name="duplex_mode">
<option value="OneSided" {% if p.duplex_mode == 'OneSided' %}selected{% endif %} x-text="$store.i18n.t('one_sided')">One-sided</option>
<option value="LongEdge" {% if p.duplex_mode == 'LongEdge' %}selected{% endif %} x-text="$store.i18n.t('long_edge')">Long edge</option>
<option value="ShortEdge" {% if p.duplex_mode == 'ShortEdge' %}selected{% endif %} x-text="$store.i18n.t('short_edge')">Short edge</option>
</select>
</label>
<label>
<span class="label-text" x-text="$store.i18n.t('paper_size')">Paper size</span>
<select name="paper_size">
<option value="A4" {% if p.paper_size == 'A4' %}selected{% endif %}>A4</option>
<option value="Letter" {% if p.paper_size == 'Letter' %}selected{% endif %}>Letter</option>
<option value="Legal" {% if p.paper_size == 'Legal' %}selected{% endif %}>Legal</option>
</select>
</label>
</div>
<div class="check-row">
<label>
<input type="checkbox" name="color_mode" value="on" {% if p.color_mode %}checked{% endif %}>
<span x-text="$store.i18n.t('color_mode')">Color</span>
</label>
<label>
<input type="checkbox" name="collate" value="on" {% if p.collate %}checked{% endif %}>
<span x-text="$store.i18n.t('collate')">Collate</span>
</label>
</div>
</fieldset>
</div>
<div class="dialog-foot">
<button type="button" class="btn ghost"
onclick="document.getElementById('edit-modal-{{ p.id }}').close()"
x-text="$store.i18n.t('cancel')">Cancel</button>
<button type="submit" class="btn" x-text="$store.i18n.t('save')">Save</button>
</div>
</form>
</div>
</article>
</dialog>