Ben Stull
415 lines
17 KiB
Python
415 lines
17 KiB
Python
"""FastAPI entrypoint.
|
|
|
|
Wires the §17 routers, the OAuth callbacks, the webhook receiver, and
|
|
the background reconciler. Per §4.2, single process, colocated SQLite —
|
|
no need for a separate worker.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import logging
|
|
import secrets
|
|
from contextlib import asynccontextmanager
|
|
|
|
from fastapi import APIRouter, FastAPI, HTTPException, Request, Response
|
|
from fastapi.responses import JSONResponse, RedirectResponse
|
|
from pydantic import BaseModel, Field
|
|
from starlette.middleware.sessions import SessionMiddleware
|
|
|
|
from . import (
|
|
api as api_routes,
|
|
auth,
|
|
cache,
|
|
db,
|
|
device_trust as device_trust_mod,
|
|
digest,
|
|
email_otc,
|
|
hygiene,
|
|
otc,
|
|
passcode as passcode_mod,
|
|
providers as providers_mod,
|
|
webhooks,
|
|
)
|
|
from .bot import Bot
|
|
from .config import load_config
|
|
from .gitea import Gitea
|
|
|
|
logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(name)s %(message)s")
|
|
log = logging.getLogger("rfc_app")
|
|
|
|
|
|
class OtcRequestBody(BaseModel):
|
|
email: str = Field(min_length=3, max_length=320)
|
|
|
|
|
|
class OtcVerifyBody(BaseModel):
|
|
email: str = Field(min_length=3, max_length=320)
|
|
code: str = Field(min_length=1, max_length=16)
|
|
# v0.11.0 — "trust this device for 30 days" checkbox on the Login.jsx
|
|
# OTC step. When true and verify succeeds, the server issues a fresh
|
|
# device-trust row and sets the `rfc_device_trust` cookie on the
|
|
# response. Defaults to false so existing clients that don't send
|
|
# the flag continue to behave the way they did pre-v0.11.0.
|
|
trust_device: bool = False
|
|
|
|
|
|
class PasscodeSetBody(BaseModel):
|
|
passcode: str = Field(min_length=1, max_length=64)
|
|
|
|
|
|
class PasscodeVerifyBody(BaseModel):
|
|
email: str = Field(min_length=3, max_length=320)
|
|
passcode: str = Field(min_length=1, max_length=64)
|
|
# v0.11.0 — same trust-device opt-in as the OTC verify body.
|
|
trust_device: bool = False
|
|
|
|
|
|
@asynccontextmanager
|
|
async def lifespan(app: FastAPI):
|
|
config = load_config()
|
|
db.run_migrations(config)
|
|
db.init(config)
|
|
gitea = Gitea(config)
|
|
bot = Bot(gitea)
|
|
reconciler = cache.Reconciler(config, gitea)
|
|
digest_sched = digest.DigestScheduler()
|
|
hygiene_sched = hygiene.HygieneScheduler(config=config, bot=bot)
|
|
|
|
# §18 carryover: the multi-provider LLM abstraction. Provider
|
|
# construction can fail (missing key, wrong env value) — if it does,
|
|
# the rest of the app still serves; chat endpoints surface a clear
|
|
# 503 instead of crashing the process.
|
|
try:
|
|
providers = providers_mod.load_from_config(config)
|
|
except Exception:
|
|
log.exception("provider construction failed; chat will be disabled")
|
|
providers = {}
|
|
|
|
app.state.config = config
|
|
app.state.gitea = gitea
|
|
app.state.bot = bot
|
|
app.state.reconciler = reconciler
|
|
app.state.providers = providers
|
|
|
|
app.include_router(_oauth_router(config))
|
|
app.include_router(api_routes.make_router(config, gitea, bot, providers))
|
|
app.include_router(webhooks.make_router(config, gitea))
|
|
|
|
reconciler.start()
|
|
digest_sched.start()
|
|
hygiene_sched.start()
|
|
log.info("RFC app started — meta repo %s/%s", config.gitea_org, config.meta_repo)
|
|
try:
|
|
yield
|
|
finally:
|
|
await hygiene_sched.stop()
|
|
await digest_sched.stop()
|
|
await reconciler.stop()
|
|
await gitea.close()
|
|
|
|
|
|
def create_app() -> FastAPI:
|
|
# The secret key is required at app construction (SessionMiddleware
|
|
# is added before lifespan runs), so we read just that one value
|
|
# eagerly via load_config(). Everything else waits for lifespan.
|
|
config = load_config()
|
|
app = FastAPI(lifespan=lifespan)
|
|
app.add_middleware(
|
|
SessionMiddleware,
|
|
secret_key=config.secret_key,
|
|
session_cookie="rfc_session",
|
|
max_age=60 * 60 * 24 * 30,
|
|
https_only=False,
|
|
)
|
|
return app
|
|
|
|
|
|
app = create_app()
|
|
|
|
|
|
def _set_device_trust_cookie(response: Response, raw_token: str) -> None:
|
|
"""Attach the v0.11.0 device-trust cookie to the response.
|
|
|
|
HttpOnly + Secure + SameSite=Lax + 30-day Max-Age + Path=/. The
|
|
cookie value is the raw token; server-side storage is the hash.
|
|
The cookie is "essential" per the v0.13.0 cookie-consent contract
|
|
(it is part of authentication), so we set it regardless of the
|
|
user's analytics / other-cookies choice.
|
|
|
|
Secure=True means the cookie is only ever sent over HTTPS. The
|
|
SessionMiddleware in `create_app` keeps `https_only=False` for
|
|
dev parity, but the device-trust cookie holds a 30-day credential
|
|
and must not travel cleartext — production deployments serve over
|
|
HTTPS, so Secure on the device-trust cookie is non-negotiable.
|
|
"""
|
|
response.set_cookie(
|
|
key=device_trust_mod.COOKIE_NAME,
|
|
value=raw_token,
|
|
max_age=device_trust_mod.COOKIE_MAX_AGE_SECONDS,
|
|
path="/",
|
|
secure=True,
|
|
httponly=True,
|
|
samesite="lax",
|
|
)
|
|
|
|
|
|
def _clear_device_trust_cookie(response: Response) -> None:
|
|
"""Delete the device-trust cookie on the response.
|
|
|
|
Used when the framework detects a presented cookie that is
|
|
expired, revoked, or otherwise stale — the next request from
|
|
this device will not carry a dead token.
|
|
"""
|
|
response.delete_cookie(
|
|
key=device_trust_mod.COOKIE_NAME,
|
|
path="/",
|
|
secure=True,
|
|
httponly=True,
|
|
samesite="lax",
|
|
)
|
|
|
|
|
|
def _oauth_router(config) -> APIRouter:
|
|
router = APIRouter()
|
|
|
|
@router.get("/auth/login")
|
|
async def login(request: Request):
|
|
state = auth.new_state()
|
|
request.session[auth.SESSION_STATE_KEY] = state
|
|
return RedirectResponse(auth.authorization_url(config, state))
|
|
|
|
@router.get("/auth/callback")
|
|
async def callback(request: Request, code: str = "", state: str = ""):
|
|
if not code:
|
|
raise HTTPException(400, "Missing code")
|
|
stored_state = request.session.get(auth.SESSION_STATE_KEY)
|
|
if not stored_state or not secrets.compare_digest(stored_state, state):
|
|
raise HTTPException(400, "Invalid state")
|
|
token_data = await auth.exchange_code(config, code)
|
|
access_token = token_data.get("access_token")
|
|
if not access_token:
|
|
raise HTTPException(400, "Token exchange failed")
|
|
profile = await auth.fetch_user_profile(config, access_token)
|
|
if not auth.is_allowed_sign_in(profile):
|
|
# Private-beta gate: clear any partial OAuth state and bounce to
|
|
# the public /beta-pending page. The session is left empty so the
|
|
# rejected viewer continues as anonymous read-only.
|
|
request.session.pop(auth.SESSION_STATE_KEY, None)
|
|
return RedirectResponse("/beta-pending")
|
|
user = auth.provision_user(config, profile)
|
|
auth.store_session(request, user)
|
|
return RedirectResponse("/")
|
|
|
|
@router.get("/auth/logout")
|
|
async def logout(request: Request):
|
|
request.session.clear()
|
|
return RedirectResponse("/")
|
|
|
|
# ---------------------------------------------------------------
|
|
# v0.7.0: email + one-time-code sign-in (§6.2).
|
|
#
|
|
# Replaces the OAuth gesture as the primary human-auth path. The
|
|
# /auth/callback handler above remains functional as a fallback;
|
|
# the new UI no longer surfaces it. A future release retires the
|
|
# OAuth path entirely once every active user has signed in at
|
|
# least once via OTC.
|
|
# ---------------------------------------------------------------
|
|
|
|
@router.post("/auth/otc/request")
|
|
async def otc_request(body: OtcRequestBody):
|
|
outcome = otc.request_code(body.email)
|
|
if outcome.reason == "cooldown":
|
|
# Loud failure per the rate-limit primitive — the abuse
|
|
# surface should be visible to clients hammering /request.
|
|
raise HTTPException(429, "Wait before requesting another code")
|
|
if outcome.sent and outcome.code is not None:
|
|
email_otc.send_otc_email(body.email.strip(), outcome.code)
|
|
# 202 regardless of allowlist/invalid — don't leak which
|
|
# emails are recognized.
|
|
return {"ok": True}
|
|
|
|
@router.post("/auth/otc/verify")
|
|
async def otc_verify(body: OtcVerifyBody, request: Request, response: Response):
|
|
result = otc.verify_code(body.email, body.code)
|
|
if not result.ok or result.user is None:
|
|
raise HTTPException(400, "Invalid or expired code")
|
|
auth.store_session(request, result.user)
|
|
# v0.8.0: surface `needs_profile` so the Login.jsx surface can
|
|
# decide whether to advance to the first/last/why capture step
|
|
# or jump straight to "/". `needs_profile=true` iff the user
|
|
# is `permission_state='pending'` AND the row has no profile
|
|
# fields yet — a fresh OTC user. Grandfathered users
|
|
# (`permission_state='granted'`) and pending users who already
|
|
# captured their fields both read as false.
|
|
row = db.conn().execute(
|
|
"SELECT first_name, last_name, beta_request_reason FROM users WHERE id = ?",
|
|
(result.user.user_id,),
|
|
).fetchone()
|
|
first_name = (row["first_name"] if row else None) or ""
|
|
last_name = (row["last_name"] if row else None) or ""
|
|
beta_request_reason = (row["beta_request_reason"] if row else None) or ""
|
|
needs_profile = (
|
|
result.user.permission_state == "pending"
|
|
and not first_name
|
|
and not last_name
|
|
and not beta_request_reason
|
|
)
|
|
# v0.11.0 — opt-in device trust. The checkbox lives on the
|
|
# Login.jsx OTC step; when true, the server mints a fresh
|
|
# device-trust row and sets the long-lived cookie. The cookie
|
|
# is "essential" per the v0.13.0 consent contract (it is part
|
|
# of authentication, not analytics) so it lands regardless of
|
|
# the user's analytics / other-cookies choice. We capture the
|
|
# User-Agent at issuance so the /settings/devices surface can
|
|
# render a rough device label.
|
|
if body.trust_device:
|
|
ua = request.headers.get("user-agent", "")
|
|
outcome = device_trust_mod.issue(result.user.user_id, ua)
|
|
_set_device_trust_cookie(response, outcome.raw_token)
|
|
return {
|
|
"ok": True,
|
|
"user": {
|
|
"id": result.user.user_id,
|
|
"display_name": result.user.display_name,
|
|
"email": result.user.email,
|
|
"role": result.user.role,
|
|
"permission_state": result.user.permission_state,
|
|
},
|
|
"needs_profile": needs_profile,
|
|
}
|
|
|
|
# ---------------------------------------------------------------
|
|
# v0.10.0: user-set passcodes after OTC (§6.2, roadmap item #8).
|
|
#
|
|
# After a successful OTC sign-in, a contributor may set a passcode
|
|
# and use email + passcode for subsequent sign-ins. OTC remains the
|
|
# forgot-passcode fallback — a verify failure beyond 5 consecutive
|
|
# attempts locks the passcode path for 15 minutes; the OTC path is
|
|
# unaffected by the lockout.
|
|
# ---------------------------------------------------------------
|
|
|
|
@router.get("/auth/passcode/check")
|
|
async def passcode_check(email: str = ""):
|
|
"""Does this email have a passcode set? Anonymous endpoint —
|
|
the Login.jsx flow calls this after the user types their email
|
|
to decide whether to render a passcode input or fall back to
|
|
OTC. We surface only the boolean; lockout state, the hash, and
|
|
the set-at stamp are not leaked here."""
|
|
status = passcode_mod.passcode_status(email)
|
|
return {"has_passcode": status.has_passcode}
|
|
|
|
@router.post("/auth/passcode/set")
|
|
async def passcode_set(body: PasscodeSetBody, request: Request):
|
|
"""Set or replace the signed-in user's passcode. Requires an
|
|
active session (OTC- or passcode-authenticated)."""
|
|
user = auth.require_user(request)
|
|
try:
|
|
passcode_mod.set_passcode(user.user_id, body.passcode)
|
|
except passcode_mod.PasscodeValidationError as e:
|
|
raise HTTPException(422, str(e))
|
|
return {"ok": True}
|
|
|
|
@router.delete("/auth/passcode")
|
|
async def passcode_delete(request: Request):
|
|
"""Remove the signed-in user's passcode. The user is back to
|
|
OTC-only on next sign-in."""
|
|
user = auth.require_user(request)
|
|
passcode_mod.clear_passcode(user.user_id)
|
|
return {"ok": True}
|
|
|
|
@router.post("/auth/passcode/verify")
|
|
async def passcode_verify(body: PasscodeVerifyBody, request: Request, response: Response):
|
|
"""Sign in with email + passcode. Returns the standard session
|
|
payload on success; HTTP 423 with `locked_until` when the
|
|
account is in the lockout window; HTTP 400 for every other
|
|
failure (the wrong-vs-unknown distinction is intentionally
|
|
collapsed so a probing client cannot enumerate emails).
|
|
|
|
v0.11.0: the body's `trust_device` flag, if true, mints a
|
|
fresh device-trust row and sets the long-lived cookie. Same
|
|
opt-in contract as `/auth/otc/verify`."""
|
|
result = passcode_mod.verify_passcode(body.email, body.passcode)
|
|
if result.reason == "locked":
|
|
raise HTTPException(
|
|
423,
|
|
{
|
|
"detail": "Too many failed attempts; sign in with a one-time code instead",
|
|
"locked_until": result.locked_until,
|
|
},
|
|
)
|
|
if not result.ok or result.user is None:
|
|
raise HTTPException(400, "Invalid passcode")
|
|
auth.store_session(request, result.user)
|
|
if body.trust_device:
|
|
ua = request.headers.get("user-agent", "")
|
|
outcome = device_trust_mod.issue(result.user.user_id, ua)
|
|
_set_device_trust_cookie(response, outcome.raw_token)
|
|
return {
|
|
"ok": True,
|
|
"user": {
|
|
"id": result.user.user_id,
|
|
"display_name": result.user.display_name,
|
|
"email": result.user.email,
|
|
"role": result.user.role,
|
|
},
|
|
}
|
|
|
|
# ---------------------------------------------------------------
|
|
# v0.11.0: trust device for 30 days (§6.2, roadmap item #9).
|
|
#
|
|
# The /auth/device-trust/start endpoint resolves a presented
|
|
# `rfc_device_trust` cookie. If it matches a non-expired,
|
|
# non-revoked row, the session is re-established and the client
|
|
# is told to skip OTC/passcode entry. A stale cookie (expired or
|
|
# revoked) is cleared on the response. A miss is structurally
|
|
# silent — the client falls back to the email step.
|
|
#
|
|
# The endpoint is anonymous-reachable: a returning visitor with
|
|
# the cookie hits this before the email step. We do not gate it
|
|
# on a session because the entire point is to establish one.
|
|
# ---------------------------------------------------------------
|
|
|
|
@router.post("/auth/device-trust/start")
|
|
async def device_trust_start(request: Request):
|
|
"""Sign in via a presented device-trust cookie.
|
|
|
|
On a hit, re-establishes the session in the cookie store and
|
|
returns a user payload shaped like /auth/otc/verify (minus
|
|
`needs_profile`, which a returning device-trust user is
|
|
structurally past — they signed in at least once before).
|
|
On a miss, returns 401 + clears the stale cookie. An
|
|
'unknown' miss (cookie present but no row matches) also
|
|
clears, since the token is dead to the server either way.
|
|
|
|
Note on response construction: we return a `JSONResponse`
|
|
directly rather than raising `HTTPException` on the miss
|
|
path because FastAPI's exception handler builds a new
|
|
response from scratch and would drop any `set_cookie` /
|
|
`delete_cookie` calls. The hand-built `JSONResponse` lets
|
|
us attach the cookie-clear header alongside the 401.
|
|
"""
|
|
raw = request.cookies.get(device_trust_mod.COOKIE_NAME, "")
|
|
if not raw:
|
|
return JSONResponse({"detail": "No device trust"}, status_code=401)
|
|
outcome = device_trust_mod.lookup(raw)
|
|
if not outcome.ok or outcome.user is None:
|
|
# Clear the stale cookie so subsequent requests don't
|
|
# keep replaying a dead token. We surface 401 in all
|
|
# cases so a probing client can't tell "your row was
|
|
# revoked" from "this token never existed".
|
|
response = JSONResponse({"detail": "Device trust invalid"}, status_code=401)
|
|
_clear_device_trust_cookie(response)
|
|
return response
|
|
auth.store_session(request, outcome.user)
|
|
return {
|
|
"ok": True,
|
|
"user": {
|
|
"id": outcome.user.user_id,
|
|
"display_name": outcome.user.display_name,
|
|
"email": outcome.user.email,
|
|
"role": outcome.user.role,
|
|
"permission_state": outcome.user.permission_state,
|
|
},
|
|
}
|
|
|
|
return router
|