Printers and groups (Client) are now scoped to an Owner identified by an opaque
bearer key (secrets.token_urlsafe(32)) stored in an httponly cookie, defaulting
to temporary. First-visit modal offers backup-key download (marks permanent) or
temporary-only choice. /session/restore re-attaches a fresh browser to a saved
key. Every printer-facing route enforces ownership (404 on mismatch, not just
filtering) since printer IDs are sequential ints. Drivers stay global/shared.
On upgrade, pre-existing printer/client rows backfill to a synthetic legacy Owner;
its key is written to {DATA_DIR}/legacy_owner_key.txt for manual restore.
SECURITY: Added Origin/Referer same-origin check on POST /session/restore to
block login-CSRF/session-fixation attacks (cross-site form POST can't re-point
victim's cookie at attacker's Owner without hitting that check first).
Tests: 140 pass (2 deselected: pre-existing locale-flaky, unrelated to this change).
Verified live: modal on first visit, isolation between browsers, backup-key
download and restore flow work end-to-end.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
193 lines
6.5 KiB
Python
193 lines
6.5 KiB
Python
"""Printer CRUD API — POST /printers, DELETE /printers/{id}, PATCH /printers/{id}."""
|
|
from __future__ import annotations
|
|
|
|
from collections import defaultdict
|
|
from pathlib import Path
|
|
|
|
from fastapi import APIRouter, Form, Request
|
|
from fastapi.responses import HTMLResponse, RedirectResponse
|
|
from fastapi.templating import Jinja2Templates
|
|
from peewee import JOIN
|
|
|
|
from imptune.db.models import Client, Driver, Printer
|
|
|
|
router = APIRouter(prefix="/printers")
|
|
|
|
templates = Jinja2Templates(
|
|
directory=str(Path(__file__).parent.parent / "templates")
|
|
)
|
|
|
|
_VALID_DUPLEX = {"OneSided", "LongEdge", "ShortEdge"}
|
|
_VALID_PAPER = {"A4", "Letter", "Legal"}
|
|
|
|
|
|
def _error_response(message: str, status_code: int = 400) -> HTMLResponse:
|
|
"""Return an HTMX-friendly error fragment swapped into #printer-list."""
|
|
return HTMLResponse(
|
|
content=f"<div id='printer-list' class='error'><p>{message}</p></div>",
|
|
status_code=status_code,
|
|
)
|
|
|
|
|
|
def _render_printer_list(request: Request) -> HTMLResponse:
|
|
"""Query printers with LEFT JOIN on client and render grouped partial."""
|
|
import json
|
|
|
|
owner = request.state.owner
|
|
query = (
|
|
Printer.select(Printer, Client)
|
|
.join(Client, JOIN.LEFT_OUTER)
|
|
.where(Printer.owner == owner)
|
|
.order_by(Client.name, Printer.name)
|
|
)
|
|
grouped: dict[str, list[Printer]] = defaultdict(list)
|
|
for p in query:
|
|
client_name = p.client.name if p.client_id else "Unassigned"
|
|
grouped[client_name].append(p)
|
|
|
|
clients = list(Client.select().where(Client.owner == owner).order_by(Client.name))
|
|
all_drivers = list(Driver.select().order_by(Driver.uploaded_at.desc()))
|
|
driver_data = [
|
|
{"driver": d, "names": json.loads(d.driver_desc) if d.driver_desc else []}
|
|
for d in all_drivers
|
|
]
|
|
|
|
return templates.TemplateResponse(
|
|
request=request,
|
|
name="partials/printer_list.html",
|
|
context={"grouped": grouped, "clients": clients, "driver_data": driver_data},
|
|
)
|
|
|
|
|
|
@router.post("", response_class=HTMLResponse)
|
|
def create_printer(
|
|
request: Request,
|
|
name: str = Form(...),
|
|
ip_address: str = Form(...),
|
|
port_name: str = Form(...),
|
|
duplex_mode: str = Form("OneSided"),
|
|
color_mode: str = Form(""),
|
|
paper_size: str = Form("A4"),
|
|
collate: str = Form(""),
|
|
client_id: str = Form(""),
|
|
driver_id: str = Form(""),
|
|
) -> HTMLResponse:
|
|
"""Create a new printer configuration.
|
|
|
|
Boolean fields (color_mode, collate) use HTML checkbox convention:
|
|
"on" = True, absent/empty = False.
|
|
"""
|
|
name = name.strip()
|
|
ip_address = ip_address.strip()
|
|
port_name = port_name.strip()
|
|
|
|
if not name:
|
|
return _error_response("Printer name is required.")
|
|
if not ip_address:
|
|
return _error_response("IP address is required.")
|
|
if not port_name:
|
|
return _error_response("Port name is required.")
|
|
if duplex_mode not in _VALID_DUPLEX:
|
|
return _error_response(f"Invalid duplex mode: {duplex_mode}.")
|
|
if paper_size not in _VALID_PAPER:
|
|
return _error_response(f"Invalid paper size: {paper_size}.")
|
|
|
|
# Convert checkbox values
|
|
color_mode_bool = color_mode == "on"
|
|
collate_bool = collate == "on"
|
|
|
|
owner = request.state.owner
|
|
|
|
# Resolve optional FK IDs — client must belong to this owner
|
|
client_fk = int(client_id) if client_id.strip() else None
|
|
if client_fk is not None:
|
|
if Client.get_or_none((Client.id == client_fk) & (Client.owner == owner)) is None:
|
|
return _error_response(f"Client {client_fk} not found.", status_code=404)
|
|
driver_fk = int(driver_id) if driver_id.strip() else None
|
|
|
|
Printer.create(
|
|
name=name,
|
|
ip_address=ip_address,
|
|
port_name=port_name,
|
|
duplex_mode=duplex_mode,
|
|
color_mode=color_mode_bool,
|
|
paper_size=paper_size,
|
|
collate=collate_bool,
|
|
owner=owner,
|
|
client=client_fk,
|
|
driver=driver_fk,
|
|
)
|
|
|
|
return RedirectResponse(url="/printers", status_code=303)
|
|
|
|
|
|
@router.delete("/{printer_id}", response_class=HTMLResponse)
|
|
def delete_printer(request: Request, printer_id: int) -> HTMLResponse:
|
|
"""Delete a printer by ID. Returns updated printer list partial."""
|
|
deleted = (
|
|
Printer.delete()
|
|
.where((Printer.id == printer_id) & (Printer.owner == request.state.owner))
|
|
.execute()
|
|
)
|
|
if not deleted:
|
|
return _error_response(f"Printer {printer_id} not found.", status_code=404)
|
|
|
|
return _render_printer_list(request)
|
|
|
|
|
|
@router.patch("/{printer_id}", response_class=HTMLResponse)
|
|
def update_printer(
|
|
request: Request,
|
|
printer_id: int,
|
|
name: str = Form(...),
|
|
ip_address: str = Form(""),
|
|
port_name: str = Form(""),
|
|
duplex_mode: str = Form("OneSided"),
|
|
color_mode: str = Form(""),
|
|
paper_size: str = Form("A4"),
|
|
collate: str = Form(""),
|
|
client_id: str = Form(""),
|
|
driver_id: str = Form(""),
|
|
) -> HTMLResponse:
|
|
"""Update an existing printer configuration in-place."""
|
|
from datetime import UTC, datetime
|
|
|
|
owner = request.state.owner
|
|
printer = Printer.get_or_none((Printer.id == printer_id) & (Printer.owner == owner))
|
|
if printer is None:
|
|
return _error_response(f"Printer {printer_id} not found.", status_code=404)
|
|
|
|
name = name.strip()
|
|
ip_address = ip_address.strip() or printer.ip_address
|
|
port_name = port_name.strip() or printer.port_name
|
|
|
|
if not name:
|
|
return _error_response("Printer name is required.")
|
|
if not ip_address:
|
|
return _error_response("IP address is required.")
|
|
if not port_name:
|
|
return _error_response("Port name is required.")
|
|
if duplex_mode not in _VALID_DUPLEX:
|
|
return _error_response(f"Invalid duplex mode: {duplex_mode}.")
|
|
if paper_size not in _VALID_PAPER:
|
|
return _error_response(f"Invalid paper size: {paper_size}.")
|
|
|
|
client_fk = int(client_id) if client_id.strip() else None
|
|
if client_fk is not None:
|
|
if Client.get_or_none((Client.id == client_fk) & (Client.owner == owner)) is None:
|
|
return _error_response(f"Client {client_fk} not found.", status_code=404)
|
|
|
|
printer.name = name
|
|
printer.ip_address = ip_address
|
|
printer.port_name = port_name
|
|
printer.duplex_mode = duplex_mode
|
|
printer.color_mode = color_mode == "on"
|
|
printer.paper_size = paper_size
|
|
printer.collate = collate == "on"
|
|
printer.client = client_fk
|
|
printer.driver = int(driver_id) if driver_id.strip() else None
|
|
printer.updated_at = datetime.now(UTC).replace(tzinfo=None)
|
|
printer.save()
|
|
|
|
return _render_printer_list(request)
|