kawaandClaude Opus 5
b397d3dc3d
Session - COOKIE_SECURE=false no longer persists the owner key for ten years. services/session.cookie_kwargs() drops max_age in that mode, so the browser holds the key in memory and the session ends with the window. Everything still persists server-side; only the browser link is temporary. base.html shows a warning banner (FR/EN) and an extra paragraph in the onboarding modal, and the README explains the trade-off and the backup-key escape hatch. - Both cookie writers (middleware, POST /session/restore) go through cookie_kwargs() so the policy cannot drift between them. - The CSRF guard on /session/restore compared request.url.scheme against the Origin header. Behind a TLS-terminating proxy uvicorn sees http while the browser sends https, so every legitimate restore was rejected with 403. It now compares hosts only, including X-Forwarded-Host. - /static/*, /favicon.ico and /robots.txt skip the middleware. Each cookieless hit was inserting an Owner row no browser could ever use. Reliability - Malformed printer-form FK fields no longer escape as HTTP 500: a non-numeric client_id/driver_id raised ValueError and an unknown driver_id hit a FOREIGN KEY constraint. Both are now 400/404 HTMX fragments, and the duplicated field checks moved into _validate_fields(). - Package exports stream. build_intunewin() encrypts the inner ZIP in 1 MB chunks against temp files with a streaming HMAC and SHA256, and both endpoints serve the result with FileResponse plus a background cleanup task. A 100 MB driver used to be held in memory three or four times over per concurrent download. The byte layout is unchanged. - FileResponse also escapes the download filename, which was previously interpolated raw into Content-Disposition. - python-multipart >= 0.0.18 (CVE-2024-53981, reachable from /drivers/upload) and Pillow >= 10.3 (CVE-2024-28219, reachable from icon upload). - icons.py reads cfg.ICONS_DIR instead of re-deriving the path from DATA_DIR, matching the .intunewin export. UI - Sidebar/topbar shell, inline SVG icon macros (partials/icons.html), card and data-table components, grouped printer list, and the dedicated /printers/new page replacing partials/printer_form.html. Tests - 194 pass with a bare `pytest tests/`: tests/conftest.py now forces cfg.COOKIE_SECURE = False like the e2e conftest already did, so the Secure cookie is no longer dropped over http://testserver. - New coverage for the malformed-FK guards, the chunk-boundary cases in the encrypt loop (every residue mod _CHUNK plus a multi-megabyte payload), temp-dir cleanup after both exports, and the whole COOKIE_SECURE matrix. - test_printer_edit.py located the Edit button by its translated label, so it only passed on English-locale machines. It now targets the showModal() hook, which also cuts the e2e run from 84s to 15s. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
66 lines
2.1 KiB
Python
66 lines
2.1 KiB
Python
"""Owner session routes — backup-key download and restore-on-new-browser."""
|
|
from __future__ import annotations
|
|
|
|
from pathlib import Path
|
|
|
|
from fastapi import APIRouter, Form, Request
|
|
from fastapi.responses import HTMLResponse, PlainTextResponse, RedirectResponse
|
|
from fastapi.templating import Jinja2Templates
|
|
|
|
from imptune.db.models import Owner
|
|
from imptune.services.session import COOKIE_NAME, cookie_kwargs, is_same_origin
|
|
|
|
router = APIRouter(prefix="/session")
|
|
|
|
templates = Jinja2Templates(
|
|
directory=str(Path(__file__).parent.parent / "templates")
|
|
)
|
|
|
|
|
|
@router.get("/key/download")
|
|
def download_key(request: Request) -> PlainTextResponse:
|
|
"""Mark the current owner permanent and hand back its key as a backup file."""
|
|
owner: Owner = request.state.owner
|
|
if not owner.is_permanent:
|
|
owner.is_permanent = True
|
|
owner.save()
|
|
|
|
return PlainTextResponse(
|
|
content=owner.key,
|
|
headers={"Content-Disposition": 'attachment; filename="imptune-backup-key.txt"'},
|
|
)
|
|
|
|
|
|
@router.get("/restore", response_class=HTMLResponse)
|
|
def restore_page(request: Request, error: str = "") -> HTMLResponse:
|
|
return templates.TemplateResponse(
|
|
request=request,
|
|
name="session_restore.html",
|
|
context={"error": error},
|
|
)
|
|
|
|
|
|
@router.post("/restore")
|
|
def restore_session(request: Request, key: str = Form(...)):
|
|
"""Re-associate this browser with a previously downloaded backup key."""
|
|
if not is_same_origin(request):
|
|
return templates.TemplateResponse(
|
|
request=request,
|
|
name="session_restore.html",
|
|
context={"error": "Request rejected — please submit this form directly from this site."},
|
|
status_code=403,
|
|
)
|
|
|
|
owner = Owner.get_or_none(Owner.key == key.strip())
|
|
if owner is None:
|
|
return templates.TemplateResponse(
|
|
request=request,
|
|
name="session_restore.html",
|
|
context={"error": "Key not found."},
|
|
status_code=404,
|
|
)
|
|
|
|
response = RedirectResponse(url="/", status_code=303)
|
|
response.set_cookie(COOKIE_NAME, owner.key, **cookie_kwargs())
|
|
return response
|