kawaandClaude Haiku 4.5
ed41f7f520
Printers and groups (Client) are now scoped to an Owner identified by an opaque
bearer key (secrets.token_urlsafe(32)) stored in an httponly cookie, defaulting
to temporary. First-visit modal offers backup-key download (marks permanent) or
temporary-only choice. /session/restore re-attaches a fresh browser to a saved
key. Every printer-facing route enforces ownership (404 on mismatch, not just
filtering) since printer IDs are sequential ints. Drivers stay global/shared.
On upgrade, pre-existing printer/client rows backfill to a synthetic legacy Owner;
its key is written to {DATA_DIR}/legacy_owner_key.txt for manual restore.
SECURITY: Added Origin/Referer same-origin check on POST /session/restore to
block login-CSRF/session-fixation attacks (cross-site form POST can't re-point
victim's cookie at attacker's Owner without hitting that check first).
Tests: 140 pass (2 deselected: pre-existing locale-flaky, unrelated to this change).
Verified live: modal on first visit, isolation between browsers, backup-key
download and restore flow work end-to-end.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
43 lines
1.3 KiB
Python
43 lines
1.3 KiB
Python
import os
|
|
from contextlib import asynccontextmanager
|
|
from pathlib import Path
|
|
|
|
from fastapi import FastAPI
|
|
from fastapi.staticfiles import StaticFiles
|
|
|
|
from imptune.api import clients, drivers, health, icons, pages, packages, printers, scripts, session
|
|
from imptune.config import DATA_DIR, DRIVERS_DIR, ICONS_DIR
|
|
from imptune.db.database import db, init_db
|
|
from imptune.services.session import OwnerSessionMiddleware
|
|
|
|
|
|
@asynccontextmanager
|
|
async def lifespan(app: FastAPI):
|
|
os.makedirs(DATA_DIR, exist_ok=True)
|
|
os.makedirs(DRIVERS_DIR, exist_ok=True)
|
|
os.makedirs(ICONS_DIR, exist_ok=True)
|
|
init_db()
|
|
yield
|
|
# Close DB connection on shutdown so test fixtures can re-initialize cleanly
|
|
if not db.is_closed():
|
|
db.close()
|
|
|
|
|
|
app = FastAPI(title="ImpTune", lifespan=lifespan)
|
|
app.add_middleware(OwnerSessionMiddleware)
|
|
|
|
# Serve baked-in static assets (pico.min.css, htmx.min.js, alpine.min.js)
|
|
_static_dir = Path(__file__).parent / "static"
|
|
app.mount("/static", StaticFiles(directory=str(_static_dir)), name="static")
|
|
|
|
# Register routers
|
|
app.include_router(health.router)
|
|
app.include_router(pages.router)
|
|
app.include_router(drivers.router)
|
|
app.include_router(printers.router)
|
|
app.include_router(clients.router)
|
|
app.include_router(scripts.router)
|
|
app.include_router(packages.router)
|
|
app.include_router(icons.router)
|
|
app.include_router(session.router)
|