fm crewmate
05d768343c
The P0 templates loaded Alpine.js from cdn.jsdelivr.net and Tailwind from cdn.tailwindcss.com, so LAN-only demo clients got a login page whose JS never engaged (stuck form). Vendor both libraries under app/static/vendor/ (alpine-3.17.2.min.js, tailwind-3.4.17.js) served same-origin at /static, point base.html at local paths, and drop both CDN hosts from the CSP (script-src/style-src stay 'self' 'unsafe-inline'; connect-src 'self'). HTML pages now ship Cache-Control: no-cache; vendored assets are cached public, max-age=31536000, immutable (versioned filenames). HSTS stays TLS-gated. Adds tests/test_frontend_vendoring.py (no external script src on /login, both vendor paths 200, no-cache + immutable header checks, CSP without CDN hosts).
215 lines
8.6 KiB
Python
215 lines
8.6 KiB
Python
"""Denya OneCare — FastAPI application entry point."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import logging
|
|
from contextlib import asynccontextmanager
|
|
from pathlib import Path
|
|
|
|
from fastapi import FastAPI
|
|
from fastapi.middleware.cors import CORSMiddleware
|
|
from fastapi.staticfiles import StaticFiles
|
|
from sqlalchemy import text
|
|
|
|
from app.core.config import settings
|
|
from app.core.database import Base, async_session_factory, engine
|
|
from app.routers import auth, health, pages, tickets, whatsapp
|
|
from app.services.seed import (
|
|
normalize_legacy_user_emails,
|
|
normalize_legacy_user_roles,
|
|
seed_categories,
|
|
seed_units,
|
|
seed_users,
|
|
)
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
|
|
async def ensure_legacy_schema(conn) -> None:
|
|
"""Add columns/data changes from alembic migrations that legacy create_all databases lack."""
|
|
result = await conn.execute(text("PRAGMA table_info(categories)"))
|
|
columns = {row[1] for row in result}
|
|
if "show_in_form" not in columns:
|
|
await conn.execute(
|
|
text("ALTER TABLE categories ADD COLUMN show_in_form BOOLEAN NOT NULL DEFAULT 1")
|
|
)
|
|
logger.info("Added missing categories.show_in_form column (legacy database)")
|
|
|
|
result = await conn.execute(text("SELECT name FROM sqlite_master WHERE type='table' AND name='tickets'"))
|
|
if result.scalar():
|
|
result = await conn.execute(text("PRAGMA table_info(tickets)"))
|
|
ticket_columns = {row[1] for row in result}
|
|
if "phone" not in ticket_columns:
|
|
await conn.execute(
|
|
text("ALTER TABLE tickets ADD COLUMN phone VARCHAR(50)")
|
|
)
|
|
logger.info("Added missing tickets.phone column (legacy database)")
|
|
if "reported_at" not in ticket_columns:
|
|
await conn.execute(
|
|
text("ALTER TABLE tickets ADD COLUMN reported_at DATETIME")
|
|
)
|
|
await conn.execute(
|
|
text("UPDATE tickets SET reported_at = created_at WHERE reported_at IS NULL")
|
|
)
|
|
logger.info("Added missing tickets.reported_at column (legacy database)")
|
|
result = await conn.execute(
|
|
text(
|
|
"UPDATE categories SET name = 'Missing Item' "
|
|
"WHERE type = 'cs' AND name = 'Lost Property' AND parent_id IS NULL "
|
|
"AND NOT EXISTS (SELECT 1 FROM categories c2 "
|
|
"WHERE c2.type = 'cs' AND c2.name = 'Missing Item' AND c2.parent_id IS NULL)"
|
|
)
|
|
)
|
|
if result.rowcount:
|
|
logger.info("Renamed legacy 'Lost Property' category to 'Missing Item'")
|
|
|
|
|
|
@asynccontextmanager
|
|
async def lifespan(app: FastAPI):
|
|
"""Initialise database and seed data on startup."""
|
|
logger.info("Starting Denya OneCare …")
|
|
async with engine.begin() as conn:
|
|
await conn.run_sync(Base.metadata.create_all)
|
|
await ensure_legacy_schema(conn)
|
|
async with async_session_factory() as session:
|
|
await seed_users(session)
|
|
# P0 role-model unification: converge legacy nickname roles (e.g.
|
|
# ``technician``/``cs``/``fm``) onto the canonical taxonomy at startup.
|
|
await normalize_legacy_user_roles(session)
|
|
await normalize_legacy_user_emails(session)
|
|
await session.commit()
|
|
await seed_units(session, json_path=str(settings.BASE_DIR / "apartment_mapping.json"))
|
|
await session.commit()
|
|
await seed_categories(session)
|
|
await session.commit()
|
|
yield
|
|
await engine.dispose()
|
|
logger.info("Denya OneCare stopped.")
|
|
|
|
|
|
app = FastAPI(
|
|
title=settings.APP_NAME,
|
|
version="0.1.0",
|
|
lifespan=lifespan,
|
|
)
|
|
|
|
|
|
# ── Security headers (P0 batch) ──────────────────────────────────────
|
|
class SecurityHeadersMiddleware:
|
|
"""Set hardening headers on every HTTP response.
|
|
|
|
* ``X-Frame-Options: DENY`` and ``X-Content-Type-Options: nosniff`` on
|
|
all responses;
|
|
* CSP on HTML pages (login + app pages). Alpine.js and Tailwind are
|
|
vendored same-origin (``/static/vendor/``), so no external hosts are
|
|
allowed and the page is fully self-contained — safe on LAN-only demo
|
|
clients. Inline scripts/styles stay enabled for the Alpine/tailwind
|
|
runtime;
|
|
* ``Cache-Control: no-cache`` on HTML pages so templates always
|
|
revalidate (the vendored assets themselves are cached immutably via
|
|
versioned filenames);
|
|
* ``Strict-Transport-Security`` only when TLS terminates (https scheme
|
|
or ``X-Forwarded-Proto: https`` from the reverse proxy).
|
|
"""
|
|
|
|
HSTS = "max-age=31536000; includeSubDomains"
|
|
CSP = (
|
|
"default-src 'self'; "
|
|
"script-src 'self' 'unsafe-inline'; "
|
|
"style-src 'self' 'unsafe-inline'; "
|
|
"img-src 'self' data: blob:; "
|
|
"font-src 'self' data:; "
|
|
"connect-src 'self'; "
|
|
"frame-ancestors 'none'; "
|
|
"base-uri 'self'; "
|
|
"form-action 'self'; "
|
|
"object-src 'none'"
|
|
)
|
|
|
|
def __init__(self, app):
|
|
self.app = app
|
|
|
|
async def __call__(self, scope, receive, send):
|
|
if scope["type"] != "http":
|
|
await self.app(scope, receive, send)
|
|
return
|
|
|
|
is_tls = scope.get("scheme") == "https"
|
|
for name, value in scope.get("headers") or []:
|
|
if name.lower() == b"x-forwarded-proto":
|
|
first = value.decode("latin-1").split(",", 1)[0].strip().lower()
|
|
if first == "https":
|
|
is_tls = True
|
|
|
|
async def send_wrapper(message):
|
|
if message["type"] == "http.response.start":
|
|
headers = list(message.get("headers") or [])
|
|
content_type = next(
|
|
(v for k, v in headers if k.lower() == b"content-type"), b""
|
|
)
|
|
if content_type.startswith(b"text/html"):
|
|
headers.append((b"content-security-policy", self.CSP.encode()))
|
|
# Templates must always revalidate: never serve a stale
|
|
# page that still points at old vendored filenames.
|
|
headers.append((b"cache-control", b"no-cache"))
|
|
headers.append((b"x-frame-options", b"DENY"))
|
|
headers.append((b"x-content-type-options", b"nosniff"))
|
|
if is_tls:
|
|
headers.append((b"strict-transport-security", self.HSTS.encode()))
|
|
message["headers"] = headers
|
|
await send(message)
|
|
|
|
await self.app(scope, receive, send_wrapper)
|
|
|
|
|
|
app.add_middleware(SecurityHeadersMiddleware)
|
|
|
|
# ── CORS (HARDENING.md P0.2 — explicit origin allow-list, never "*") ──
|
|
_origins = [o.strip() for o in settings.CORS_ORIGINS.split(",") if o.strip()]
|
|
if "*" in _origins or not _origins:
|
|
raise RuntimeError(
|
|
"CORS_ORIGINS must be an explicit comma-separated origin allow-list "
|
|
"(e.g. 'https://denya.sysloggh.net,http://localhost:8000'). "
|
|
"'*' with allow_credentials=True is invalid and unsafe. Refusing to start."
|
|
)
|
|
app.add_middleware(
|
|
CORSMiddleware,
|
|
allow_origins=_origins,
|
|
allow_credentials=True,
|
|
allow_methods=["*"],
|
|
allow_headers=["*"],
|
|
)
|
|
|
|
# ── Static files (uploads + vendored frontend assets) ────────────────
|
|
class ImmutableStaticFiles(StaticFiles):
|
|
"""StaticFiles that serves long-lived immutable cache headers.
|
|
|
|
Used for the vendored frontend libraries under ``app/static/vendor/``
|
|
(Alpine.js + Tailwind Play). Their URLs embed the version, so upgrading
|
|
later just bumps the filename and clients fetch the new artifact instead
|
|
of a stale immutable copy.
|
|
"""
|
|
|
|
def file_response(self, full_path, stat_result, scope, status_code=200):
|
|
response = super().file_response(full_path, stat_result, scope, status_code)
|
|
response.headers["cache-control"] = "public, max-age=31536000, immutable"
|
|
return response
|
|
|
|
|
|
uploads_dir = Path(settings.BASE_DIR / "uploads")
|
|
uploads_dir.mkdir(parents=True, exist_ok=True)
|
|
app.mount("/uploads", StaticFiles(directory=str(uploads_dir)), name="uploads")
|
|
|
|
# Alpine.js/Tailwind are vendored same-origin so LAN-only demo clients render
|
|
# the login/dashboards with no external network (see app/templates/base.html).
|
|
static_dir = Path(__file__).resolve().parent / "static"
|
|
static_dir.mkdir(parents=True, exist_ok=True)
|
|
app.mount("/static", ImmutableStaticFiles(directory=str(static_dir)), name="static")
|
|
|
|
# ── Routers ──────────────────────────────────────────────────────────
|
|
app.include_router(health.router)
|
|
app.include_router(auth.router)
|
|
app.include_router(whatsapp.router)
|
|
app.include_router(tickets.router)
|
|
app.include_router(pages.router)
|