Compare commits
1 Commits
fix/securi
...
a2ab541b73
| Author | SHA1 | Date | |
|---|---|---|---|
| a2ab541b73 |
29
.env.example
29
.env.example
@@ -1,34 +1,11 @@
|
||||
# HarborForge Backend Environment Variables (v0.4.0+ — wizard removed)
|
||||
# HarborForge Environment Variables
|
||||
|
||||
# --- Database (used by both the mysql container and the backend) -----------
|
||||
# Database
|
||||
MYSQL_ROOT_PASSWORD=harborforge_root
|
||||
MYSQL_DATABASE=harborforge
|
||||
MYSQL_USER=harborforge
|
||||
MYSQL_PASSWORD=harborforge_pass
|
||||
# Full DSN used by the backend container. Default points to a service
|
||||
# named "mysql" on the same docker network. Override if your DB is elsewhere.
|
||||
DATABASE_URL=mysql+pymysql://harborforge:harborforge_pass@mysql:3306/harborforge
|
||||
|
||||
# --- Application ----------------------------------------------------------
|
||||
# Must be 32+ chars and not a placeholder; use: openssl rand -hex 32
|
||||
# Application
|
||||
SECRET_KEY=change-me-use-openssl-rand-hex-32
|
||||
LOG_LEVEL=INFO
|
||||
|
||||
# When true: password login is disabled, all sign-in goes through OIDC,
|
||||
# user creation ignores any password (passwordless users that can only
|
||||
# authenticate via OIDC binding or API keys). Frontend hides password UI.
|
||||
HARBORFORGE_OIDC_ONLY=false
|
||||
|
||||
# --- Discord wakeup (optional; previously in wizard config) ---------------
|
||||
# Used by /agents/{id}/wakeup to spin a private Discord channel + DM.
|
||||
HARBORFORGE_DISCORD_GUILD_ID=
|
||||
HARBORFORGE_DISCORD_BOT_TOKEN=
|
||||
|
||||
# --- OIDC issuer / client_id / client_secret / redirect_uri ---------------
|
||||
# NOT env vars in v0.4.0+. Configure via:
|
||||
# docker exec hf-backend hf-cli config oidc \
|
||||
# --issuer https://login.example.com/realms/foo \
|
||||
# --client-id harborforge --client-secret <s> \
|
||||
# --redirect-uri https://hf-api.example.com/auth/oidc/callback \
|
||||
# --post-login-redirect https://hf.example.com/oidc/callback \
|
||||
# --enabled true
|
||||
|
||||
55
Dockerfile
55
Dockerfile
@@ -1,58 +1,25 @@
|
||||
# Stage 1: build dependencies
|
||||
FROM python:3.11-slim AS builder
|
||||
|
||||
WORKDIR /app
|
||||
|
||||
# Install build dependencies
|
||||
RUN apt-get update && apt-get install -y \
|
||||
build-essential \
|
||||
default-libmysqlclient-dev \
|
||||
pkg-config \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Pre-download wheels to avoid recompiling bcrypt from source
|
||||
RUN pip install --no-cache-dir --prefix=/install \
|
||||
'bcrypt==4.0.1' \
|
||||
'cffi>=2.0' \
|
||||
'pycparser>=2.0'
|
||||
|
||||
# Install Python dependencies
|
||||
COPY requirements.txt .
|
||||
RUN pip install --no-cache-dir --prefix=/install -r requirements.txt
|
||||
|
||||
# Stage 2: slim runtime
|
||||
FROM python:3.11-slim
|
||||
|
||||
WORKDIR /app
|
||||
|
||||
# Install runtime dependencies only (no build tools)
|
||||
# Install system dependencies
|
||||
RUN apt-get update && apt-get install -y \
|
||||
default-libmysqlclient-dev \
|
||||
build-essential \
|
||||
curl \
|
||||
default-libmysqlclient-dev \
|
||||
pkg-config \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Copy installed packages from builder
|
||||
COPY --from=builder /install /usr/local
|
||||
# Install Python dependencies
|
||||
COPY requirements.txt .
|
||||
RUN pip install --no-cache-dir -r requirements.txt
|
||||
|
||||
# Copy application code
|
||||
COPY app/ ./app/
|
||||
COPY requirements.txt ./
|
||||
|
||||
# Make entrypoint
|
||||
COPY entrypoint.sh .
|
||||
COPY . .
|
||||
RUN chmod +x entrypoint.sh
|
||||
|
||||
# Install hf-cli as a /usr/local/bin shim that re-enters the app package
|
||||
# (so `docker exec hf-backend hf-cli admin create-user ...` works). The
|
||||
# CLI reads the same DATABASE_URL / SECRET_KEY env as the backend.
|
||||
RUN printf '#!/bin/sh\nexec python -m app.cli "$@"\n' > /usr/local/bin/hf-cli && \
|
||||
chmod +x /usr/local/bin/hf-cli
|
||||
|
||||
# OIDC-only mode: when "true", password login is rejected, user creation
|
||||
# ignores passwords (passwordless users that sign in via a bound OIDC
|
||||
# identity / API keys). Overridable at runtime via the same env var.
|
||||
ARG HARBORFORGE_OIDC_ONLY=false
|
||||
ENV HARBORFORGE_OIDC_ONLY=${HARBORFORGE_OIDC_ONLY}
|
||||
|
||||
# Expose port
|
||||
EXPOSE 8000
|
||||
|
||||
# Wait for wizard config, then start uvicorn
|
||||
ENTRYPOINT ["./entrypoint.sh"]
|
||||
|
||||
232
README.md
232
README.md
@@ -1,163 +1,100 @@
|
||||
# HarborForge Backend
|
||||
|
||||
The core REST API for HarborForge — an Agent/人类协同任务管理平台 (Agent/Human collaborative task-management platform).
|
||||
Agent/人类协同任务管理平台 - FastAPI 后端
|
||||
|
||||
Part of the [HarborForge](../README.md) platform.
|
||||
## API Endpoints (38)
|
||||
|
||||
- **Role:** core REST API — users, projects, tasks, milestones, proposals, RBAC, webhooks, worklogs, notifications, monitor telemetry.
|
||||
- **Stack:** Python 3.11 · FastAPI · SQLAlchemy · MySQL
|
||||
- **Port:** `8000`
|
||||
### Auth
|
||||
- `POST /auth/token` - 登录获取 JWT token
|
||||
- `GET /auth/me` - 获取当前用户信息
|
||||
|
||||
The service reads its database configuration from the AbstractWizard config volume (falling back to env/defaults) and authenticates requests with JWT (HS256) signed by `SECRET_KEY`.
|
||||
### Issues
|
||||
|
||||
## Run / Build
|
||||
> Issues 和 Search 列表接口返回分页格式：`{items, total, page, page_size, total_pages}`
|
||||
> Issues 支持排序参数：`sort_by` (created_at/priority/title/due_date/status), `sort_order` (asc/desc)
|
||||
> Issues 支持额外过滤：`assignee_id`, `tag`
|
||||
|
||||
### Docker
|
||||
|
||||
```bash
|
||||
docker build -t harborforge-backend .
|
||||
docker run -p 8000:8000 \
|
||||
-e SECRET_KEY="$(openssl rand -hex 32)" \
|
||||
-v /path/to/config:/config \
|
||||
harborforge-backend
|
||||
```
|
||||
> Issues 和 Search 列表接口返回分页格式：
|
||||
> Issues 支持排序参数： (created_at/priority/title/due_date/status), (asc/desc)
|
||||
> Issues 支持额外过滤：,
|
||||
- `POST /issues` - 创建 issue（支持 resolution 决议案类型）
|
||||
- `GET /issues` - 列表（分页、排序、按 assignee/tag 过滤）（支持按 project/status/type 过滤）
|
||||
- `GET /issues/{id}` - 详情
|
||||
- `PATCH /issues/{id}` - 更新
|
||||
- `DELETE /issues/{id}` - 删除
|
||||
- `POST /issues/{id}/transition` - 状态变更（触发 webhook）
|
||||
- `GET /search/issues?q=keyword` - 搜索
|
||||
|
||||
### Local (uvicorn)
|
||||
### Comments
|
||||
- `POST /comments` - 创建评论
|
||||
- `GET /issues/{id}/comments` - 列表
|
||||
- `PATCH /comments/{id}` - 更新
|
||||
- `DELETE /comments/{id}` - 删除
|
||||
|
||||
```bash
|
||||
pip install -r requirements.txt
|
||||
export SECRET_KEY="$(openssl rand -hex 32)"
|
||||
uvicorn app.main:app --host 0.0.0.0 --port 8000
|
||||
```
|
||||
### Projects
|
||||
- `POST /projects` - 创建
|
||||
- `GET /projects` - 列表
|
||||
- `GET /projects/{id}` - 详情
|
||||
- `PATCH /projects/{id}` - 更新
|
||||
- `DELETE /projects/{id}` - 删除
|
||||
|
||||
On startup the app creates/migrates the schema, runs AbstractWizard
|
||||
initialization (admin user, default project, default roles), and starts a
|
||||
background monitor-polling thread.
|
||||
### Project Members
|
||||
- `POST /projects/{id}/members` - 添加成员
|
||||
- `GET /projects/{id}/members` - 列表
|
||||
- `DELETE /projects/{id}/members/{user_id}` - 移除
|
||||
|
||||
## Configuration
|
||||
### Users
|
||||
- `POST /users` - 注册
|
||||
- `GET /users` - 列表
|
||||
- `GET /users/{id}` - 详情
|
||||
- `PATCH /users/{id}` - 更新
|
||||
|
||||
Environment variables (also loadable from a `.env` file):
|
||||
### Webhooks
|
||||
- `POST /webhooks` - 创建
|
||||
- `GET /webhooks` - 列表
|
||||
- `GET /webhooks/{id}` - 详情
|
||||
- `PATCH /webhooks/{id}` - 更新
|
||||
- `DELETE /webhooks/{id}` - 删除
|
||||
- `GET /webhooks/{id}/logs` - 投递日志
|
||||
|
||||
| Variable | Default | Description |
|
||||
|----------|---------|-------------|
|
||||
| `SECRET_KEY` | *(none — must be set)* | JWT signing key (HS256). The server **refuses to start** with a weak/default/short value. |
|
||||
| `DATABASE_URL` | `mysql+pymysql://harborforge:harborforge_pass@mysql:3306/harborforge` | Fallback DB URL when the wizard config volume is absent. |
|
||||
| `ALGORITHM` | `HS256` | JWT algorithm. |
|
||||
| `ACCESS_TOKEN_EXPIRE_MINUTES` | `30` | Access-token lifetime. |
|
||||
| `LOG_LEVEL` | `INFO` | Log level. |
|
||||
| `CONFIG_DIR` | `/config` | AbstractWizard config volume directory. |
|
||||
| `CONFIG_FILE` | `harborforge.json` | Config file name within `CONFIG_DIR`. |
|
||||
### System
|
||||
- `GET /health` - 健康检查
|
||||
- `GET /version` - 版本信息
|
||||
- `GET /dashboard/stats` - 统计面板
|
||||
|
||||
Database resolution order: **wizard config volume** (`$CONFIG_DIR/$CONFIG_FILE` → `database` block) → `DATABASE_URL` env → built-in default.
|
||||
### Milestones
|
||||
- `POST /milestones` - 创建里程碑
|
||||
- `GET /milestones` - 列表（支持按 project/status 过滤）
|
||||
- `GET /milestones/{id}` - 详情
|
||||
- `PATCH /milestones/{id}` - 更新
|
||||
- `DELETE /milestones/{id}` - 删除
|
||||
- `GET /milestones/{id}/issues` - 里程碑下的 issue 列表
|
||||
- `GET /milestones/{id}/progress` - 里程碑完成进度
|
||||
|
||||
## Security
|
||||
### Notifications
|
||||
- `GET /notifications` - 列表（支持 user_id, unread_only 过滤）
|
||||
- `GET /notifications/count` - 未读通知计数
|
||||
- `POST /notifications/{id}/read` - 标记已读
|
||||
- `POST /notifications/read-all` - 全部标记已读
|
||||
|
||||
The current code enforces the following security posture. These are
|
||||
operational requirements, not optional hardening.
|
||||
### Issue Assignment
|
||||
- `POST /issues/{id}/assign` - 指派 issue（自动发送通知）
|
||||
|
||||
### Mandatory strong `SECRET_KEY`
|
||||
### Webhook Retry
|
||||
- `POST /webhooks/{id}/retry/{log_id}` - 重试失败的 webhook 投递
|
||||
|
||||
`app/core/config.py` validates `SECRET_KEY` at import time and **raises and
|
||||
refuses to start** if the value is empty, shorter than 32 characters, or a
|
||||
known default/placeholder (e.g. `change-me-in-production`, `secret`,
|
||||
`changeme`). Operators **must** provide a strong random key:
|
||||
### Time Tracking (Work Logs)
|
||||
- `POST /worklogs` - 记录工时
|
||||
- `GET /issues/{id}/worklogs` - 某 issue 的工时记录
|
||||
- `GET /issues/{id}/worklogs/summary` - 某 issue 工时汇总
|
||||
- `GET /users/{id}/worklogs` - 某用户的工时记录
|
||||
- `DELETE /worklogs/{id}` - 删除工时记录
|
||||
- `GET /projects/{id}/worklogs/summary` - 项目工时汇总（按用户分组）
|
||||
|
||||
```bash
|
||||
openssl rand -hex 32
|
||||
```
|
||||
|
||||
A weak signing key allows JWT forgery and full authentication bypass, so this
|
||||
check is intentionally fatal.
|
||||
|
||||
### API-key management is admin-only and masked
|
||||
|
||||
The `/api-keys` endpoints (`POST`, `GET`, `DELETE /api-keys/{id}`) all require
|
||||
a global admin (`require_admin`). Listing **never returns the full secret** —
|
||||
keys are masked to a short prefix/suffix (e.g. `abc123…9f`). The full key is
|
||||
only returned once, on creation.
|
||||
|
||||
### Webhooks router is admin-only with SSRF protection
|
||||
|
||||
The entire `/webhooks` router is mounted with `dependencies=[Depends(require_admin)]`,
|
||||
so every webhook endpoint (create/list/get/update/delete/logs/retry) requires a
|
||||
global admin. Webhook delivery (`app/services/webhook.py`) validates the target
|
||||
URL before sending:
|
||||
|
||||
- Only `http`/`https` schemes are allowed.
|
||||
- The host is DNS-resolved and **every** resolved address is rejected if it is
|
||||
private, loopback, link-local, multicast, reserved, or unspecified
|
||||
(SSRF protection).
|
||||
- HTTP redirects are disabled (`follow_redirects=False`).
|
||||
|
||||
### Project role hierarchy enforcement
|
||||
|
||||
`check_project_role` in `app/api/rbac.py` enforces a real, ordered role
|
||||
hierarchy rather than a flat membership check:
|
||||
|
||||
```
|
||||
guest(0) < viewer(1) < member(2) < dev(3) < mgr(4) < admin(5)
|
||||
```
|
||||
|
||||
A caller below the required rank is denied with `403`, and any unknown role on
|
||||
either side is denied by default. Global admins bypass project-level checks.
|
||||
|
||||
### Authentication on previously open endpoints
|
||||
|
||||
The following endpoints now require an authenticated caller
|
||||
(JWT bearer token **or** `X-API-Key`) and enforce ownership/permission:
|
||||
|
||||
- `DELETE /milestones/{id}` — requires milestone-edit permission.
|
||||
- `POST /worklogs` — worklogs are always attributed to the caller; only admins
|
||||
may log time for another user.
|
||||
- `DELETE /worklogs/{id}` — caller-scoped; non-admins cannot delete another
|
||||
user's worklog.
|
||||
- `POST /tasks/{task_code}/assign` and `POST /tasks/batch/assign`.
|
||||
- `GET /activity`.
|
||||
- `GET /export/tasks`.
|
||||
|
||||
## Authentication
|
||||
|
||||
- `POST /auth/token` — OAuth2 password grant; returns a JWT bearer token.
|
||||
- Authenticated requests send `Authorization: Bearer <token>` **or**
|
||||
`X-API-Key: <key>` (API keys map to a user and are created by admins).
|
||||
- `GET /auth/me` — current user.
|
||||
- `GET /auth/me/permissions`, `GET /auth/me/apikey-permissions` — permission introspection.
|
||||
|
||||
## Key API Areas
|
||||
|
||||
| Area | Prefix / Routes | Notes |
|
||||
|------|-----------------|-------|
|
||||
| Auth | `/auth/*` | token, current user, permission introspection |
|
||||
| Users | `/users` | registration, list/detail/update (list & mutate are admin-only) |
|
||||
| Projects | `/projects` | CRUD, members (`/projects/{id}/members`), worklog summary |
|
||||
| Project members | `/projects/{id}/members` | add/list/remove with role |
|
||||
| Milestones | `/projects/{id}/milestones`, `/milestones/{id}` | CRUD, items, progress |
|
||||
| Milestone actions | preflight / freeze / start / close | lifecycle transitions |
|
||||
| Tasks | `/tasks` | CRUD, transition, take, assign, batch transition/assign, tags, search |
|
||||
| Comments | `/comments`, `/tasks/{id}/comments` | CRUD |
|
||||
| Proposals | `/projects/{code}/proposals` | propose / accept / reject / reopen (legacy `/proposes`) |
|
||||
| Essentials | proposal essentials | feature/improvement/refactor items |
|
||||
| Meetings | `/meetings` | create/list/detail/update/delete/attend |
|
||||
| Roles & RBAC | `/roles` | roles, permissions, role-permission assignment |
|
||||
| Webhooks | `/webhooks` | **admin-only**; CRUD, logs, retry (SSRF-guarded delivery) |
|
||||
| API keys | `/api-keys` | **admin-only**; create/list (masked)/revoke |
|
||||
| Worklogs | `/worklogs`, `/tasks/{id}/worklogs`, `/users/{id}/worklogs` | time tracking & summaries |
|
||||
| Notifications | `/notifications` | list, unread count, mark read / read-all |
|
||||
| Activity | `/activity` | activity log (authenticated) |
|
||||
| Export | `/export/tasks` | CSV export (authenticated) |
|
||||
| Calendar | `/calendar` | scheduling / time slots |
|
||||
| Monitor | `/monitor` | public overview, admin providers/servers, heartbeat telemetry |
|
||||
| Dashboard | `/dashboard/stats` | aggregate statistics |
|
||||
| System | `/health`, `/version`, `/config/status` | health, version, init status |
|
||||
|
||||
## Task Types
|
||||
|
||||
| Type | 用途 |
|
||||
|------|------|
|
||||
| issue | 普通任务 |
|
||||
| story | 用户故事 |
|
||||
| test | 测试用例 |
|
||||
| resolution | 决议案（Agent 僵局提交）|
|
||||
### Export
|
||||
- `GET /export/issues` - 导出 issues CSV
|
||||
- `GET /issues/overdue` - 逾期未完成的 issue
|
||||
|
||||
## CLI
|
||||
|
||||
@@ -165,9 +102,18 @@ The legacy Python CLI (`cli.py`) has been retired. Use the Go-based `hf` CLI ins
|
||||
|
||||
See [HarborForge.Cli](../HarborForge.Cli/README.md) for installation and usage.
|
||||
|
||||
## Tech Stack
|
||||
## 技术栈
|
||||
|
||||
- Python 3.11 + FastAPI
|
||||
- SQLAlchemy + MySQL (auto schema create/migrate on startup)
|
||||
- JWT (python-jose, HS256) + bcrypt password hashing
|
||||
- SQLAlchemy + MySQL
|
||||
- JWT (python-jose)
|
||||
- Docker
|
||||
|
||||
## Issue Types
|
||||
|
||||
| Type | 用途 |
|
||||
|------|------|
|
||||
| task | 普通任务 |
|
||||
| story | 用户故事 |
|
||||
| test | 测试用例 |
|
||||
| resolution | 决议案（Agent 僵局提交）|
|
||||
|
||||
@@ -1,5 +1,4 @@
|
||||
"""Shared auth dependencies."""
|
||||
import hashlib
|
||||
from datetime import datetime, timedelta
|
||||
from fastapi import Depends, HTTPException, status
|
||||
from fastapi.security import OAuth2PasswordBearer, APIKeyHeader
|
||||
@@ -60,54 +59,20 @@ async def get_current_user(token: str = Depends(oauth2_scheme), db: Session = De
|
||||
return user
|
||||
|
||||
|
||||
def hash_api_key(raw: str) -> str:
|
||||
"""SHA-256 of a raw API key. Keys are high-entropy random tokens, so a
|
||||
fast hash (not bcrypt) is appropriate and allows O(1) lookup by hash."""
|
||||
return hashlib.sha256(raw.encode()).hexdigest()
|
||||
|
||||
|
||||
def _lookup_api_key(db: Session, key: str) -> models.User | None:
|
||||
"""Resolve an API key string to a User; mark last_used_at on hit."""
|
||||
if not key:
|
||||
return None
|
||||
key_obj = db.query(APIKey).filter(APIKey.key_hash == hash_api_key(key), APIKey.is_active == True).first() # noqa: E712
|
||||
if not key_obj:
|
||||
return None
|
||||
key_obj.last_used_at = datetime.utcnow()
|
||||
db.commit()
|
||||
return db.query(models.User).filter(models.User.id == key_obj.user_id).first()
|
||||
|
||||
|
||||
async def get_current_user_or_apikey(
|
||||
token: str = Depends(oauth2_scheme),
|
||||
api_key: str = Depends(apikey_header),
|
||||
db: Session = Depends(get_db)
|
||||
):
|
||||
"""Authenticate via JWT token (Authorization: Bearer <jwt>) OR API key
|
||||
(X-API-Key: <key>, OR — as a convenience for CLI clients that only know
|
||||
Bearer — Authorization: Bearer <api-key>; falls back when JWT decode fails).
|
||||
"""
|
||||
# Native X-API-Key header
|
||||
"""Authenticate via JWT token OR API key."""
|
||||
if api_key:
|
||||
user = _lookup_api_key(db, api_key)
|
||||
if user:
|
||||
return user
|
||||
|
||||
# Bearer header — try JWT first, then API key on decode failure
|
||||
if token:
|
||||
try:
|
||||
return await get_current_user(token=token, db=db)
|
||||
except HTTPException:
|
||||
user = _lookup_api_key(db, token)
|
||||
key_obj = db.query(APIKey).filter(APIKey.key == api_key, APIKey.is_active == True).first()
|
||||
if key_obj:
|
||||
key_obj.last_used_at = datetime.utcnow()
|
||||
db.commit()
|
||||
user = db.query(models.User).filter(models.User.id == key_obj.user_id).first()
|
||||
if user:
|
||||
return user
|
||||
raise
|
||||
|
||||
if token:
|
||||
return await get_current_user(token=token, db=db)
|
||||
raise HTTPException(status_code=401, detail="Not authenticated")
|
||||
|
||||
|
||||
def require_admin(current_user: models.User = Depends(get_current_user_or_apikey)) -> models.User:
|
||||
"""Dependency: caller must be a global admin (JWT or API key)."""
|
||||
if not getattr(current_user, "is_admin", False):
|
||||
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Admin privileges required")
|
||||
return current_user
|
||||
|
||||
@@ -81,28 +81,12 @@ def check_project_role(db: Session, user_id: int, project_id: int, min_role: str
|
||||
detail="Role not found"
|
||||
)
|
||||
|
||||
# Enforce a real role hierarchy. Higher rank == more privilege.
|
||||
_RANK = {
|
||||
"guest": 0,
|
||||
"viewer": 1,
|
||||
"member": 2,
|
||||
"dev": 3,
|
||||
"mgr": 4,
|
||||
"admin": 5,
|
||||
}
|
||||
role_rank = _RANK.get((role.name or "").lower())
|
||||
required_rank = _RANK.get((min_role or "member").lower())
|
||||
if role_rank is None or required_rank is None:
|
||||
# Unknown role on either side -> deny by default.
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_403_FORBIDDEN,
|
||||
detail=f"Insufficient project role (have '{role.name}', need '{min_role}')",
|
||||
)
|
||||
if role_rank < required_rank:
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_403_FORBIDDEN,
|
||||
detail=f"Insufficient project role (have '{role.name}', need '{min_role}')",
|
||||
)
|
||||
# Legacy compatibility: most current routes use non-hierarchical names like dev/mgr.
|
||||
# For now, any valid membership passes those broad checks; strict edit rules are handled
|
||||
# by the explicit can_edit_* helpers below.
|
||||
if min_role in {"dev", "mgr", "viewer", "member", "guest", "admin"}:
|
||||
return True
|
||||
|
||||
return True
|
||||
|
||||
|
||||
|
||||
@@ -11,15 +11,13 @@ from app.core.config import get_db, settings
|
||||
from app.models import models
|
||||
from app.models.role_permission import Permission, Role, RolePermission
|
||||
from app.schemas import schemas
|
||||
from app.api.deps import Token, verify_password, create_access_token, get_current_user, get_current_user_or_apikey
|
||||
from app.api.deps import Token, verify_password, create_access_token, get_current_user
|
||||
|
||||
router = APIRouter(prefix="/auth", tags=["Auth"])
|
||||
|
||||
|
||||
@router.post("/token", response_model=Token)
|
||||
async def login(form_data: OAuth2PasswordRequestForm = Depends(), db: Session = Depends(get_db)):
|
||||
if settings.HARBORFORGE_OIDC_ONLY:
|
||||
raise HTTPException(status_code=403, detail="Password login is disabled (OIDC only)")
|
||||
user = db.query(models.User).filter(models.User.username == form_data.username).first()
|
||||
if not user or not verify_password(form_data.password, user.hashed_password or ""):
|
||||
raise HTTPException(status_code=401, detail="Incorrect username or password",
|
||||
@@ -80,7 +78,7 @@ class PermissionIntrospectionResponse(BaseModel):
|
||||
|
||||
@router.get("/me/permissions", response_model=PermissionIntrospectionResponse)
|
||||
async def get_my_permissions(
|
||||
current_user: models.User = Depends(get_current_user_or_apikey),
|
||||
current_user: models.User = Depends(get_current_user),
|
||||
db: Session = Depends(get_db),
|
||||
):
|
||||
"""Return the current user's effective permissions for CLI help introspection."""
|
||||
|
||||
@@ -21,11 +21,6 @@ from app.core.config import get_db
|
||||
from app.models.calendar import SchedulePlan, SlotStatus, SlotType, TimeSlot
|
||||
from app.models.models import User
|
||||
from app.models.agent import Agent, AgentStatus, ExhaustReason
|
||||
from app.models.schedule_type import ScheduleType
|
||||
from app.services.special_slot_materialiser import (
|
||||
materialise_special_slots_for_claw,
|
||||
materialise_special_slots_for_user,
|
||||
)
|
||||
from app.schemas.calendar import (
|
||||
AgentHeartbeatResponse,
|
||||
AgentStatusUpdateRequest,
|
||||
@@ -52,7 +47,6 @@ from app.schemas.calendar import (
|
||||
)
|
||||
from app.services.agent_heartbeat import get_pending_slots_for_agent
|
||||
from app.services.agent_status import (
|
||||
AgentStatusError,
|
||||
record_heartbeat,
|
||||
transition_to_busy,
|
||||
transition_to_idle,
|
||||
@@ -149,8 +143,6 @@ def _slot_to_response(slot: TimeSlot) -> TimeSlotResponse:
|
||||
priority=slot.priority,
|
||||
status=slot.status.value if hasattr(slot.status, "value") else str(slot.status),
|
||||
plan_id=slot.plan_id,
|
||||
is_admin_locked=bool(getattr(slot, "is_admin_locked", False)),
|
||||
special_slot_id=getattr(slot, "special_slot_id", None),
|
||||
created_at=slot.created_at,
|
||||
updated_at=slot.updated_at,
|
||||
)
|
||||
@@ -176,48 +168,6 @@ def create_slot(
|
||||
"""
|
||||
target_date = payload.date or date_type.today()
|
||||
|
||||
# --- Maintenance-window guard ---
|
||||
# Non-`system` slots may not be placed inside the schedule_type's
|
||||
# 1-hour maintenance window. The window is admin-territory, reserved
|
||||
# for materialised special slots from `schedule_type_special_slots`.
|
||||
# `system` slot_type is itself reserved server-side (the materialiser
|
||||
# is the only legitimate caller) — refuse it here outright so the
|
||||
# public API cannot manufacture a fake admin-locked slot.
|
||||
if payload.slot_type == SlotType.SYSTEM:
|
||||
raise HTTPException(
|
||||
status_code=422,
|
||||
detail=(
|
||||
"slot_type='system' is reserved for schedule_type special slots "
|
||||
"and cannot be created via this endpoint"
|
||||
),
|
||||
)
|
||||
_agent_for_user = (
|
||||
db.query(Agent).filter(Agent.user_id == current_user.id).first()
|
||||
)
|
||||
if _agent_for_user and _agent_for_user.schedule_type_id:
|
||||
st = (
|
||||
db.query(ScheduleType)
|
||||
.filter(ScheduleType.id == _agent_for_user.schedule_type_id)
|
||||
.first()
|
||||
)
|
||||
if st and _scheduled_inside_window(
|
||||
payload.scheduled_at,
|
||||
payload.estimated_duration,
|
||||
st.maintenance_from,
|
||||
st.maintenance_to,
|
||||
):
|
||||
mf_h, mf_m = divmod(st.maintenance_from, 60)
|
||||
mt_h, mt_m = divmod(st.maintenance_to, 60)
|
||||
raise HTTPException(
|
||||
status_code=422,
|
||||
detail=(
|
||||
f"slot at {payload.scheduled_at} duration {payload.estimated_duration}min "
|
||||
f"intersects the maintenance window "
|
||||
f"{mf_h:02d}:{mf_m:02d}-{mt_h:02d}:{mt_m:02d} UTC of "
|
||||
f"schedule_type '{st.name}' — that window is admin-reserved"
|
||||
),
|
||||
)
|
||||
|
||||
# --- Overlap check (hard reject) ---
|
||||
conflicts = check_overlap_for_create(
|
||||
db,
|
||||
@@ -286,8 +236,6 @@ def _real_slot_to_item(slot: TimeSlot) -> CalendarSlotItem:
|
||||
priority=slot.priority,
|
||||
status=slot.status.value if hasattr(slot.status, "value") else str(slot.status),
|
||||
plan_id=slot.plan_id,
|
||||
is_admin_locked=bool(getattr(slot, "is_admin_locked", False)),
|
||||
special_slot_id=getattr(slot, "special_slot_id", None),
|
||||
created_at=slot.created_at,
|
||||
updated_at=slot.updated_at,
|
||||
)
|
||||
@@ -341,47 +289,7 @@ def _require_agent(db: Session, agent_id: str, claw_identifier: str) -> Agent:
|
||||
return agent
|
||||
|
||||
|
||||
def _scheduled_inside_window(
|
||||
scheduled_at,
|
||||
estimated_duration_minutes: int,
|
||||
window_from_min: int,
|
||||
window_to_min: int,
|
||||
) -> bool:
|
||||
"""True if [scheduled_at, scheduled_at+duration] intersects [from, to).
|
||||
|
||||
Window bounds are minutes-since-UTC-midnight (0-1439). Handles the
|
||||
case where the window crosses UTC midnight (e.g. 23:30→01:00).
|
||||
"""
|
||||
start_min = scheduled_at.hour * 60 + scheduled_at.minute
|
||||
end_min = start_min + max(estimated_duration_minutes, 1)
|
||||
if window_to_min > window_from_min:
|
||||
# normal same-day window
|
||||
return start_min < window_to_min and end_min > window_from_min
|
||||
# wrap-around: window = [from..1440) ∪ [0..to)
|
||||
return (start_min < 1440 and end_min > window_from_min) or end_min > window_to_min
|
||||
|
||||
|
||||
# Admin-locked special slots accept only these agent-driven status
|
||||
# transitions; movement / cancellation / arbitrary status edits are
|
||||
# rejected because the schedule_type owner is the source of truth.
|
||||
_ADMIN_LOCKED_ALLOWED_STATUSES = {
|
||||
SlotStatusEnum.ONGOING,
|
||||
SlotStatusEnum.PAUSED,
|
||||
SlotStatusEnum.FINISHED,
|
||||
SlotStatusEnum.ABORTED,
|
||||
}
|
||||
|
||||
|
||||
def _apply_agent_slot_update(slot: TimeSlot, payload: SlotAgentUpdate) -> None:
|
||||
if getattr(slot, "is_admin_locked", False):
|
||||
if payload.status not in _ADMIN_LOCKED_ALLOWED_STATUSES:
|
||||
raise HTTPException(
|
||||
status_code=423,
|
||||
detail=(
|
||||
f"slot {slot.id} is admin-locked (special slot); only "
|
||||
f"ongoing/paused/finished/aborted are allowed via agent-update"
|
||||
),
|
||||
)
|
||||
slot.status = payload.status.value
|
||||
if payload.started_at is not None:
|
||||
slot.started_at = payload.started_at
|
||||
@@ -453,68 +361,6 @@ def agent_heartbeat(
|
||||
)
|
||||
|
||||
|
||||
@router.get(
|
||||
"/sync",
|
||||
summary="Sync today's schedules for all agents on a claw instance",
|
||||
)
|
||||
def sync_schedules(
|
||||
x_claw_identifier: str = Header(..., alias="X-Claw-Identifier"),
|
||||
db: Session = Depends(get_db),
|
||||
):
|
||||
"""Return today's slots for all agents belonging to the given claw instance.
|
||||
|
||||
Used by the HF OpenClaw plugin to maintain a local schedule cache.
|
||||
Returns a dict of { agent_id: [slots] } for all agents with matching
|
||||
claw_identifier.
|
||||
"""
|
||||
today = date_type.today()
|
||||
|
||||
# Materialise today's special slots for every agent on this claw
|
||||
# before reading. This is idempotent — re-runs against an already-
|
||||
# materialised (agent, date, template) are no-ops. Plugin's runSync
|
||||
# picks them up like any other slot via the normal real_slots query.
|
||||
materialise_special_slots_for_claw(db, x_claw_identifier, today, commit=True)
|
||||
|
||||
# Find all agents on this claw instance
|
||||
agents = (
|
||||
db.query(Agent)
|
||||
.filter(Agent.claw_identifier == x_claw_identifier)
|
||||
.all()
|
||||
)
|
||||
|
||||
schedules: dict[str, list[dict]] = {}
|
||||
for agent in agents:
|
||||
# Get real slots for today
|
||||
real_slots = (
|
||||
db.query(TimeSlot)
|
||||
.filter(
|
||||
TimeSlot.user_id == agent.user_id,
|
||||
TimeSlot.date == today,
|
||||
TimeSlot.status.notin_(list(_INACTIVE_STATUSES)),
|
||||
)
|
||||
.all()
|
||||
)
|
||||
items = [_real_slot_to_item(s).model_dump(mode="json") for s in real_slots]
|
||||
|
||||
# Get virtual plan slots
|
||||
virtual_slots = get_virtual_slots_for_date(db, agent.user_id, today)
|
||||
for vs in virtual_slots:
|
||||
items.append(_virtual_slot_to_item(vs).model_dump(mode="json"))
|
||||
|
||||
schedules[agent.agent_id] = items
|
||||
|
||||
# Record heartbeat for liveness
|
||||
for agent in agents:
|
||||
record_heartbeat(db, agent)
|
||||
db.commit()
|
||||
|
||||
return {
|
||||
"schedules": schedules,
|
||||
"date": today.isoformat(),
|
||||
"agent_count": len(agents),
|
||||
}
|
||||
|
||||
|
||||
@router.patch(
|
||||
"/slots/{slot_id}/agent-update",
|
||||
response_model=TimeSlotEditResponse,
|
||||
@@ -562,29 +408,6 @@ def agent_update_virtual_slot(
|
||||
return TimeSlotEditResponse(slot=_slot_to_response(slot), warnings=[])
|
||||
|
||||
|
||||
@router.get(
|
||||
"/agent/status",
|
||||
summary="Read an agent's current runtime status (no side effects)",
|
||||
)
|
||||
def get_agent_status(
|
||||
agent_id: str = Query(..., description="Target agent_id"),
|
||||
x_claw_identifier: str = Header(..., alias="X-Claw-Identifier"),
|
||||
db: Session = Depends(get_db),
|
||||
):
|
||||
"""Return `{agent_id, status}` so callers (Fabric.OpenclawPlugin's
|
||||
triage on-call gate, etc.) can decide whether the agent is currently
|
||||
eligible without flipping their state.
|
||||
|
||||
No-op for unknown agents — returns 404 with `{detail: 'Agent not
|
||||
found'}` so the caller can decide whether to fail-open or fail-closed.
|
||||
"""
|
||||
agent = _require_agent(db, agent_id, x_claw_identifier)
|
||||
return {
|
||||
"agent_id": agent.agent_id,
|
||||
"status": agent.status.value if hasattr(agent.status, 'value') else str(agent.status),
|
||||
}
|
||||
|
||||
|
||||
@router.post(
|
||||
"/agent/status",
|
||||
summary="Update agent runtime status from plugin",
|
||||
@@ -595,31 +418,19 @@ def update_agent_status(
|
||||
):
|
||||
agent = _require_agent(db, payload.agent_id, payload.claw_identifier)
|
||||
target = (payload.status or '').lower().strip()
|
||||
# Idempotent same-state transition: a 'busy → busy' request is a
|
||||
# no-op rather than a 500. Lets plugin status gates / cli `--set`
|
||||
# be safe to fire-and-forget without first reading current state.
|
||||
current = agent.status.value if hasattr(agent.status, 'value') else str(agent.status)
|
||||
if current == target:
|
||||
return {"ok": True, "agent_id": agent.agent_id, "status": current, "no_change": True}
|
||||
try:
|
||||
if target == AgentStatus.IDLE.value:
|
||||
transition_to_idle(db, agent)
|
||||
elif target == AgentStatus.BUSY.value:
|
||||
transition_to_busy(db, agent, slot_type=SlotType.WORK)
|
||||
elif target == AgentStatus.ON_CALL.value:
|
||||
transition_to_busy(db, agent, slot_type=SlotType.ON_CALL)
|
||||
elif target == AgentStatus.OFFLINE.value:
|
||||
transition_to_offline(db, agent)
|
||||
elif target == AgentStatus.EXHAUSTED.value:
|
||||
reason = ExhaustReason.BILLING if payload.exhaust_reason == 'billing' else ExhaustReason.RATE_LIMIT
|
||||
transition_to_exhausted(db, agent, reason=reason, recovery_at=payload.recovery_at)
|
||||
else:
|
||||
raise HTTPException(status_code=400, detail="Unsupported agent status")
|
||||
except AgentStatusError as e:
|
||||
# State-machine violation (e.g. busy → busy via wrong precondition)
|
||||
# → 409 with the rejected transition explained, instead of a 500.
|
||||
db.rollback()
|
||||
raise HTTPException(status_code=409, detail=str(e))
|
||||
if target == AgentStatus.IDLE.value:
|
||||
transition_to_idle(db, agent)
|
||||
elif target == AgentStatus.BUSY.value:
|
||||
transition_to_busy(db, agent, slot_type=SlotType.WORK)
|
||||
elif target == AgentStatus.ON_CALL.value:
|
||||
transition_to_busy(db, agent, slot_type=SlotType.ON_CALL)
|
||||
elif target == AgentStatus.OFFLINE.value:
|
||||
transition_to_offline(db, agent)
|
||||
elif target == AgentStatus.EXHAUSTED.value:
|
||||
reason = ExhaustReason.BILLING if payload.exhaust_reason == 'billing' else ExhaustReason.RATE_LIMIT
|
||||
transition_to_exhausted(db, agent, reason=reason, recovery_at=payload.recovery_at)
|
||||
else:
|
||||
raise HTTPException(status_code=400, detail="Unsupported agent status")
|
||||
db.commit()
|
||||
return {"ok": True, "agent_id": agent.agent_id, "status": agent.status.value if hasattr(agent.status, 'value') else str(agent.status)}
|
||||
|
||||
@@ -647,10 +458,6 @@ def get_calendar_day(
|
||||
"""
|
||||
target_date = date or date_type.today()
|
||||
|
||||
# Materialise today's special slots for this user before reading,
|
||||
# so the day-view returns them alongside any user-created slots.
|
||||
materialise_special_slots_for_user(db, current_user.id, target_date, commit=True)
|
||||
|
||||
# 1. Fetch real slots for the day
|
||||
real_slots = (
|
||||
db.query(TimeSlot)
|
||||
@@ -726,20 +533,6 @@ def edit_real_slot(
|
||||
if slot is None:
|
||||
raise HTTPException(status_code=404, detail="Slot not found")
|
||||
|
||||
# --- Admin-locked guard ---
|
||||
# Special slots materialised from a schedule_type template are
|
||||
# admin-owned; agents may complete/abort/pause/resume via the
|
||||
# plugin-facing agent-update endpoint but cannot edit time/type/
|
||||
# duration/event-data via this user-facing edit endpoint.
|
||||
if getattr(slot, "is_admin_locked", False):
|
||||
raise HTTPException(
|
||||
status_code=423,
|
||||
detail=(
|
||||
f"slot {slot.id} is admin-locked (materialised from a special "
|
||||
f"slot template); only the schedule_type owner can edit it"
|
||||
),
|
||||
)
|
||||
|
||||
# --- Past-slot guard ---
|
||||
try:
|
||||
guard_edit_real_slot(db, slot)
|
||||
@@ -907,16 +700,6 @@ def cancel_real_slot(
|
||||
if slot is None:
|
||||
raise HTTPException(status_code=404, detail="Slot not found")
|
||||
|
||||
# --- Admin-locked guard ---
|
||||
if getattr(slot, "is_admin_locked", False):
|
||||
raise HTTPException(
|
||||
status_code=423,
|
||||
detail=(
|
||||
f"slot {slot.id} is admin-locked (materialised from a special "
|
||||
f"slot template); only the schedule_type owner can cancel it"
|
||||
),
|
||||
)
|
||||
|
||||
# --- Past-slot guard ---
|
||||
try:
|
||||
guard_cancel_real_slot(db, slot)
|
||||
|
||||
@@ -32,12 +32,8 @@ def create_comment(comment: schemas.CommentCreate, db: Session = Depends(get_db)
|
||||
if not task:
|
||||
raise HTTPException(status_code=404, detail="Task not found")
|
||||
check_project_role(db, current_user.id, task.project_id, min_role="viewer")
|
||||
|
||||
# Always attribute the comment to the authenticated caller — never trust
|
||||
# a client-supplied author_id (prevents author spoofing).
|
||||
data = comment.model_dump()
|
||||
data.pop("author_id", None)
|
||||
db_comment = models.Comment(**data, author_id=current_user.id)
|
||||
|
||||
db_comment = models.Comment(**comment.model_dump())
|
||||
db.add(db_comment)
|
||||
db.commit()
|
||||
db.refresh(db_comment)
|
||||
|
||||
@@ -12,7 +12,7 @@ from sqlalchemy import func as sqlfunc
|
||||
from pydantic import BaseModel
|
||||
|
||||
from app.core.config import get_db
|
||||
from app.api.deps import get_current_user_or_apikey, require_admin, hash_api_key
|
||||
from app.api.deps import get_current_user_or_apikey
|
||||
from app.api.rbac import check_project_role, ensure_can_edit_milestone
|
||||
from app.models import models
|
||||
from app.models.apikey import APIKey
|
||||
@@ -49,8 +49,7 @@ class APIKeyCreate(BaseModel):
|
||||
|
||||
class APIKeyResponse(BaseModel):
|
||||
id: int
|
||||
key: str | None = None # full secret — only populated on create/reset
|
||||
key_prefix: str | None = None # masked display for listings
|
||||
key: str
|
||||
name: str
|
||||
user_id: int
|
||||
is_active: bool
|
||||
@@ -61,44 +60,28 @@ class APIKeyResponse(BaseModel):
|
||||
|
||||
|
||||
@router.post("/api-keys", response_model=APIKeyResponse, status_code=status.HTTP_201_CREATED, tags=["API Keys"])
|
||||
def create_api_key(data: APIKeyCreate, db: Session = Depends(get_db),
|
||||
_: models.User = Depends(require_admin)):
|
||||
def create_api_key(data: APIKeyCreate, db: Session = Depends(get_db)):
|
||||
user = db.query(models.User).filter(models.User.id == data.user_id).first()
|
||||
if not user:
|
||||
raise HTTPException(status_code=404, detail="User not found")
|
||||
key = secrets.token_hex(32)
|
||||
db_key = APIKey(key_hash=hash_api_key(key), key_prefix=key[:8], name=data.name, user_id=data.user_id)
|
||||
db_key = APIKey(key=key, name=data.name, user_id=data.user_id)
|
||||
db.add(db_key)
|
||||
db.commit()
|
||||
db.refresh(db_key)
|
||||
# Return the raw key once (it is never stored or shown again).
|
||||
return {
|
||||
"id": db_key.id, "key": key, "key_prefix": db_key.key_prefix,
|
||||
"name": db_key.name, "user_id": db_key.user_id, "is_active": db_key.is_active,
|
||||
"created_at": db_key.created_at, "last_used_at": db_key.last_used_at,
|
||||
}
|
||||
return db_key
|
||||
|
||||
|
||||
@router.get("/api-keys", response_model=List[APIKeyResponse], tags=["API Keys"])
|
||||
def list_api_keys(user_id: int = None, db: Session = Depends(get_db),
|
||||
_: models.User = Depends(require_admin)):
|
||||
def list_api_keys(user_id: int = None, db: Session = Depends(get_db)):
|
||||
query = db.query(APIKey)
|
||||
if user_id:
|
||||
query = query.filter(APIKey.user_id == user_id)
|
||||
keys = query.all()
|
||||
# Never expose the secret on listing — the raw key isn't stored. Show only
|
||||
# the masked prefix.
|
||||
return [{
|
||||
"id": k.id, "key": None,
|
||||
"key_prefix": (k.key_prefix + "…") if k.key_prefix else None,
|
||||
"name": k.name, "user_id": k.user_id, "is_active": k.is_active,
|
||||
"created_at": k.created_at, "last_used_at": k.last_used_at,
|
||||
} for k in keys]
|
||||
return query.all()
|
||||
|
||||
|
||||
@router.delete("/api-keys/{key_id}", status_code=status.HTTP_204_NO_CONTENT, tags=["API Keys"])
|
||||
def revoke_api_key(key_id: int, db: Session = Depends(get_db),
|
||||
_: models.User = Depends(require_admin)):
|
||||
def revoke_api_key(key_id: int, db: Session = Depends(get_db)):
|
||||
key_obj = db.query(APIKey).filter(APIKey.id == key_id).first()
|
||||
if not key_obj:
|
||||
raise HTTPException(status_code=404, detail="API key not found")
|
||||
@@ -123,8 +106,7 @@ class ActivityLogResponse(BaseModel):
|
||||
|
||||
@router.get("/activity", response_model=List[ActivityLogResponse], tags=["Activity"])
|
||||
def list_activity(entity_type: str = None, entity_id: int = None, user_id: int = None,
|
||||
limit: int = 50, db: Session = Depends(get_db),
|
||||
_: models.User = Depends(get_current_user_or_apikey)):
|
||||
limit: int = 50, db: Session = Depends(get_db)):
|
||||
query = db.query(ActivityLog)
|
||||
if entity_type:
|
||||
query = query.filter(ActivityLog.entity_type == entity_type)
|
||||
@@ -141,10 +123,7 @@ def list_activity(entity_type: str = None, entity_id: int = None, user_id: int =
|
||||
def create_milestone(ms: schemas.MilestoneCreate, db: Session = Depends(get_db), current_user: models.User = Depends(get_current_user_or_apikey)):
|
||||
import json
|
||||
project = db.query(models.Project).filter(models.Project.id == ms.project_id).first()
|
||||
if not project:
|
||||
raise HTTPException(status_code=404, detail="Project not found")
|
||||
check_project_role(db, current_user.id, project.id, min_role="mgr")
|
||||
project_code = project.project_code if project.project_code else f"P{ms.project_id}"
|
||||
project_code = project.project_code if project and project.project_code else f"P{ms.project_id}"
|
||||
|
||||
max_ms = db.query(MilestoneModel).filter(MilestoneModel.project_id == ms.project_id).order_by(MilestoneModel.id.desc()).first()
|
||||
next_num = (max_ms.id + 1) if max_ms else 1
|
||||
@@ -220,10 +199,8 @@ def update_milestone(milestone_id: str, ms_update: schemas.MilestoneUpdate, db:
|
||||
|
||||
|
||||
@router.delete("/milestones/{milestone_id}", status_code=status.HTTP_204_NO_CONTENT, tags=["Milestones"])
|
||||
def delete_milestone(milestone_id: str, db: Session = Depends(get_db),
|
||||
current_user: models.User = Depends(get_current_user_or_apikey)):
|
||||
def delete_milestone(milestone_id: str, db: Session = Depends(get_db)):
|
||||
ms = _resolve_milestone(db, milestone_id)
|
||||
ensure_can_edit_milestone(db, current_user.id, ms)
|
||||
db.delete(ms)
|
||||
db.commit()
|
||||
return None
|
||||
@@ -345,18 +322,16 @@ class WorkLogResponse(BaseModel):
|
||||
|
||||
|
||||
@router.post("/worklogs", response_model=WorkLogResponse, status_code=status.HTTP_201_CREATED, tags=["Time Tracking"])
|
||||
def create_worklog(wl: WorkLogCreate, db: Session = Depends(get_db),
|
||||
current_user: models.User = Depends(get_current_user_or_apikey)):
|
||||
def create_worklog(wl: WorkLogCreate, db: Session = Depends(get_db)):
|
||||
task = db.query(Task).filter(Task.id == wl.task_id).first()
|
||||
if not task:
|
||||
raise HTTPException(status_code=404, detail="Task not found")
|
||||
user = db.query(models.User).filter(models.User.id == wl.user_id).first()
|
||||
if not user:
|
||||
raise HTTPException(status_code=404, detail="User not found")
|
||||
if wl.hours <= 0:
|
||||
raise HTTPException(status_code=400, detail="Hours must be positive")
|
||||
data = wl.model_dump()
|
||||
# Worklogs are always attributed to the caller (non-admins cannot log time for others).
|
||||
if not current_user.is_admin or not data.get("user_id"):
|
||||
data["user_id"] = current_user.id
|
||||
db_wl = WorkLog(**data)
|
||||
db_wl = WorkLog(**wl.model_dump())
|
||||
db.add(db_wl)
|
||||
db.commit()
|
||||
db.refresh(db_wl)
|
||||
@@ -395,13 +370,10 @@ def task_worklog_summary(task_id: str, db: Session = Depends(get_db)):
|
||||
|
||||
|
||||
@router.delete("/worklogs/{worklog_id}", status_code=status.HTTP_204_NO_CONTENT, tags=["Time Tracking"])
|
||||
def delete_worklog(worklog_id: int, db: Session = Depends(get_db),
|
||||
current_user: models.User = Depends(get_current_user_or_apikey)):
|
||||
def delete_worklog(worklog_id: int, db: Session = Depends(get_db)):
|
||||
wl = db.query(WorkLog).filter(WorkLog.id == worklog_id).first()
|
||||
if not wl:
|
||||
raise HTTPException(status_code=404, detail="Work log not found")
|
||||
if not current_user.is_admin and wl.user_id != current_user.id:
|
||||
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Cannot delete another user's worklog")
|
||||
db.delete(wl)
|
||||
db.commit()
|
||||
return None
|
||||
@@ -410,8 +382,7 @@ def delete_worklog(worklog_id: int, db: Session = Depends(get_db),
|
||||
# ============ Export ============
|
||||
|
||||
@router.get("/export/tasks", tags=["Export"])
|
||||
def export_tasks_csv(project_id: int = None, db: Session = Depends(get_db),
|
||||
_: models.User = Depends(get_current_user_or_apikey)):
|
||||
def export_tasks_csv(project_id: int = None, db: Session = Depends(get_db)):
|
||||
query = db.query(Task)
|
||||
if project_id:
|
||||
query = query.filter(Task.project_id == project_id)
|
||||
@@ -500,15 +471,14 @@ def create_milestone_task(project_code: str, milestone_id: str, task_data: dict,
|
||||
project = db.query(models.Project).filter(models.Project.project_code == project_code).first()
|
||||
if not project:
|
||||
raise HTTPException(status_code=404, detail="Project not found")
|
||||
check_project_role(db, current_user.id, project.id, min_role="dev")
|
||||
|
||||
|
||||
ms = db.query(MilestoneModel).filter(MilestoneModel.milestone_code == milestone_id, MilestoneModel.project_id == project.id).first()
|
||||
if not ms:
|
||||
raise HTTPException(status_code=404, detail="Milestone not found")
|
||||
|
||||
|
||||
if ms.status and hasattr(ms.status, "value") and ms.status.value == "undergoing":
|
||||
raise HTTPException(status_code=400, detail="Cannot add items to a milestone that is undergoing")
|
||||
|
||||
|
||||
milestone_code = ms.milestone_code or f"m{ms.id}"
|
||||
max_task = db.query(Task).filter(Task.milestone_id == ms.id).order_by(Task.id.desc()).first()
|
||||
next_num = (max_task.id + 1) if max_task else 1
|
||||
@@ -635,7 +605,6 @@ def create_support(project_code: str, milestone_id: str, support_data: dict, db:
|
||||
project = db.query(models.Project).filter(models.Project.project_code == project_code).first()
|
||||
if not project:
|
||||
raise HTTPException(status_code=404, detail="Project not found")
|
||||
check_project_role(db, current_user.id, project.id, min_role="dev")
|
||||
|
||||
ms = db.query(MilestoneModel).filter(MilestoneModel.milestone_code == milestone_id, MilestoneModel.project_id == project.id).first()
|
||||
if not ms:
|
||||
@@ -782,15 +751,14 @@ def create_meeting(project_code: str, milestone_id: str, meeting_data: dict, db:
|
||||
project = db.query(models.Project).filter(models.Project.project_code == project_code).first()
|
||||
if not project:
|
||||
raise HTTPException(status_code=404, detail="Project not found")
|
||||
check_project_role(db, current_user.id, project.id, min_role="dev")
|
||||
|
||||
|
||||
ms = db.query(MilestoneModel).filter(MilestoneModel.milestone_code == milestone_id, MilestoneModel.project_id == project.id).first()
|
||||
if not ms:
|
||||
raise HTTPException(status_code=404, detail="Milestone not found")
|
||||
|
||||
|
||||
if ms.status and hasattr(ms.status, "value") and ms.status.value == "undergoing":
|
||||
raise HTTPException(status_code=400, detail="Cannot add items to a milestone that is undergoing")
|
||||
|
||||
|
||||
milestone_code = ms.milestone_code or f"m{ms.id}"
|
||||
max_meeting = db.query(Meeting).filter(Meeting.milestone_id == ms.id).order_by(Meeting.id.desc()).first()
|
||||
next_num = (max_meeting.id + 1) if max_meeting else 1
|
||||
|
||||
@@ -1,346 +0,0 @@
|
||||
"""OIDC (OpenID Connect) login + admin-configurable provider settings.
|
||||
|
||||
Provider config (issuer / client_id / client_secret / redirect_uri /
|
||||
scopes / post_login_redirect / admin_role / enabled) lives entirely in
|
||||
the `oidc_settings` DB table (single row, id=1) and is set via either
|
||||
the admin UI or `docker exec hf-backend hf-cli config oidc ...`.
|
||||
HARBORFORGE_OIDC_ONLY is the only OIDC-related env var (deploy-time
|
||||
policy: when true, password login is disabled).
|
||||
|
||||
Sign-in policy: an OIDC identity must already be bound to an hf user
|
||||
(see PUT /users/{id}/oidc-binding). Unbound identities are rejected.
|
||||
"""
|
||||
import logging
|
||||
from datetime import timedelta
|
||||
from urllib.parse import urlencode
|
||||
|
||||
from fastapi import APIRouter, Depends, HTTPException, Request
|
||||
from fastapi.responses import RedirectResponse
|
||||
from pydantic import BaseModel
|
||||
from sqlalchemy.orm import Session
|
||||
|
||||
from app.core.config import get_db, settings
|
||||
from app.models import models
|
||||
from app.models.oidc_settings import OidcSettings
|
||||
from app.api.deps import create_access_token, get_current_user, get_current_user_or_apikey
|
||||
|
||||
router = APIRouter(prefix="/auth", tags=["Auth"])
|
||||
logger = logging.getLogger("harborforge.oidc")
|
||||
|
||||
|
||||
# ---- effective config (DB row overrides env) ------------------------------
|
||||
|
||||
class EffectiveOidc:
|
||||
def __init__(self, enabled, issuer, client_id, client_secret,
|
||||
redirect_uri, scopes, post_login_redirect, admin_role):
|
||||
self.enabled = enabled
|
||||
self.issuer = issuer
|
||||
self.client_id = client_id
|
||||
self.client_secret = client_secret
|
||||
self.redirect_uri = redirect_uri
|
||||
self.scopes = scopes or "openid email profile"
|
||||
self.post_login_redirect = post_login_redirect
|
||||
self.admin_role = (admin_role or "admin").strip() or "admin"
|
||||
|
||||
@property
|
||||
def configured(self) -> bool:
|
||||
return bool(self.enabled and self.issuer and self.client_id)
|
||||
|
||||
def fingerprint(self) -> str:
|
||||
return "|".join([
|
||||
str(self.enabled), self.issuer or "", self.client_id or "",
|
||||
self.client_secret or "", self.redirect_uri or "", self.scopes or "",
|
||||
])
|
||||
|
||||
|
||||
def get_effective_oidc(db: Session) -> EffectiveOidc:
|
||||
"""DB row is the only source of truth — no env fallback. If the row is
|
||||
absent OIDC is treated as unconfigured (login attempts will 503)."""
|
||||
row = db.query(OidcSettings).filter(OidcSettings.id == 1).first()
|
||||
if row is None:
|
||||
return EffectiveOidc(False, "", "", "", "", "", "", "admin")
|
||||
return EffectiveOidc(
|
||||
bool(row.enabled),
|
||||
row.issuer or "",
|
||||
row.client_id or "",
|
||||
row.client_secret or "",
|
||||
row.redirect_uri or "",
|
||||
row.scopes or "",
|
||||
row.post_login_redirect or "",
|
||||
getattr(row, "admin_role", None) or "admin",
|
||||
)
|
||||
|
||||
|
||||
# Authlib client cache, rebuilt when the effective config changes.
|
||||
_oauth = None
|
||||
_oauth_fp = None
|
||||
|
||||
|
||||
def _client(cfg: EffectiveOidc):
|
||||
global _oauth, _oauth_fp
|
||||
if not cfg.configured:
|
||||
raise HTTPException(status_code=503, detail="OIDC is not configured")
|
||||
fp = cfg.fingerprint()
|
||||
if _oauth is None or _oauth_fp != fp:
|
||||
from authlib.integrations.starlette_client import OAuth
|
||||
oauth = OAuth()
|
||||
oauth.register(
|
||||
name="oidc",
|
||||
server_metadata_url=cfg.issuer.rstrip("/") + "/.well-known/openid-configuration",
|
||||
client_id=cfg.client_id,
|
||||
client_secret=cfg.client_secret,
|
||||
client_kwargs={"scope": cfg.scopes},
|
||||
)
|
||||
_oauth, _oauth_fp = oauth, fp
|
||||
return _oauth.oidc
|
||||
|
||||
|
||||
def _invalidate_client():
|
||||
global _oauth, _oauth_fp
|
||||
_oauth = None
|
||||
_oauth_fp = None
|
||||
|
||||
|
||||
def _collect_roles(claims: dict, token: dict) -> set[str]:
|
||||
"""Roles from common OIDC claim shapes, across the ID-token/userinfo
|
||||
claims and the (unverified) access token — Keycloak puts realm/client
|
||||
roles in the access token by default."""
|
||||
pools = [claims if isinstance(claims, dict) else {}]
|
||||
at = token.get("access_token")
|
||||
if at:
|
||||
try:
|
||||
from jose import jwt as _jwt
|
||||
pools.append(_jwt.get_unverified_claims(at))
|
||||
except Exception:
|
||||
pass
|
||||
roles: set[str] = set()
|
||||
for p in pools:
|
||||
if not isinstance(p, dict):
|
||||
continue
|
||||
ra = p.get("realm_access")
|
||||
if isinstance(ra, dict):
|
||||
roles.update(ra.get("roles") or [])
|
||||
res = p.get("resource_access")
|
||||
if isinstance(res, dict):
|
||||
for v in res.values():
|
||||
if isinstance(v, dict):
|
||||
roles.update(v.get("roles") or [])
|
||||
for key in ("roles", "role", "groups"):
|
||||
val = p.get(key)
|
||||
if isinstance(val, str):
|
||||
roles.add(val)
|
||||
elif isinstance(val, (list, tuple)):
|
||||
roles.update(str(x) for x in val)
|
||||
return {str(r).strip().lstrip("/").lower() for r in roles if r}
|
||||
|
||||
|
||||
def _frontend(cfg: EffectiveOidc, qs: dict | None = None, fragment: str | None = None) -> str:
|
||||
base = cfg.post_login_redirect or "/"
|
||||
url = base
|
||||
if qs:
|
||||
url += ("&" if "?" in base else "?") + urlencode(qs)
|
||||
if fragment:
|
||||
url += "#" + fragment
|
||||
return url
|
||||
|
||||
|
||||
# ---- public auth config ---------------------------------------------------
|
||||
|
||||
@router.get("/config")
|
||||
def auth_config(db: Session = Depends(get_db)):
|
||||
cfg = get_effective_oidc(db)
|
||||
return {
|
||||
"oidc_enabled": cfg.configured,
|
||||
"oidc_only": bool(settings.HARBORFORGE_OIDC_ONLY),
|
||||
"password_login": not bool(settings.HARBORFORGE_OIDC_ONLY),
|
||||
"oidc_login_url": "/auth/oidc/login",
|
||||
}
|
||||
|
||||
|
||||
# ---- sign-in / link flows -------------------------------------------------
|
||||
|
||||
@router.get("/oidc/login")
|
||||
async def oidc_login(request: Request, db: Session = Depends(get_db)):
|
||||
cfg = get_effective_oidc(db)
|
||||
oidc = _client(cfg)
|
||||
request.session.pop("hf_oidc_uid", None)
|
||||
request.session["hf_oidc_mode"] = "login"
|
||||
return await oidc.authorize_redirect(request, cfg.redirect_uri)
|
||||
|
||||
|
||||
@router.get("/oidc/link")
|
||||
async def oidc_link(request: Request, db: Session = Depends(get_db),
|
||||
current_user: models.User = Depends(get_current_user)):
|
||||
if settings.HARBORFORGE_OIDC_ONLY:
|
||||
raise HTTPException(status_code=403, detail="Self-service linking is disabled in OIDC-only mode")
|
||||
cfg = get_effective_oidc(db)
|
||||
oidc = _client(cfg)
|
||||
request.session["hf_oidc_mode"] = "link"
|
||||
request.session["hf_oidc_uid"] = current_user.id
|
||||
return await oidc.authorize_redirect(request, cfg.redirect_uri)
|
||||
|
||||
|
||||
@router.get("/oidc/callback")
|
||||
async def oidc_callback(request: Request, db: Session = Depends(get_db)):
|
||||
cfg = get_effective_oidc(db)
|
||||
oidc = _client(cfg)
|
||||
mode = request.session.pop("hf_oidc_mode", "login")
|
||||
link_uid = request.session.pop("hf_oidc_uid", None)
|
||||
try:
|
||||
token = await oidc.authorize_access_token(request)
|
||||
except Exception:
|
||||
return RedirectResponse(_frontend(cfg, {"oidc_error": "exchange_failed"}))
|
||||
|
||||
claims = token.get("userinfo") or {}
|
||||
if not claims:
|
||||
try:
|
||||
claims = await oidc.userinfo(token=token)
|
||||
except Exception:
|
||||
claims = {}
|
||||
subject = claims.get("sub")
|
||||
issuer = claims.get("iss") or cfg.issuer
|
||||
if not subject:
|
||||
return RedirectResponse(_frontend(cfg, {"oidc_error": "no_subject"}))
|
||||
|
||||
if mode == "link":
|
||||
if settings.HARBORFORGE_OIDC_ONLY or link_uid is None:
|
||||
return RedirectResponse(_frontend(cfg, {"oidc_error": "link_not_allowed"}))
|
||||
user = db.query(models.User).filter(models.User.id == link_uid).first()
|
||||
if not user:
|
||||
return RedirectResponse(_frontend(cfg, {"oidc_error": "user_gone"}))
|
||||
clash = db.query(models.User).filter(
|
||||
models.User.oidc_issuer == issuer,
|
||||
models.User.oidc_subject == subject,
|
||||
models.User.id != user.id,
|
||||
).first()
|
||||
if clash:
|
||||
return RedirectResponse(_frontend(cfg, {"oidc_error": "already_bound"}))
|
||||
user.oidc_issuer = issuer
|
||||
user.oidc_subject = subject
|
||||
db.commit()
|
||||
return RedirectResponse(_frontend(cfg, {"oidc_linked": "1"}))
|
||||
|
||||
user = db.query(models.User).filter(
|
||||
models.User.oidc_issuer == issuer,
|
||||
models.User.oidc_subject == subject,
|
||||
).first()
|
||||
|
||||
# OIDC-only bootstrap: before any admin is linked, an IdP user whose
|
||||
# token carries the configured admin role auto-connects to the unbound
|
||||
# hf admin. Self-closes once any admin is bound.
|
||||
if user is None and settings.HARBORFORGE_OIDC_ONLY:
|
||||
any_admin_bound = db.query(models.User).filter(
|
||||
models.User.is_admin == True, # noqa: E712
|
||||
models.User.oidc_subject.isnot(None),
|
||||
).first()
|
||||
if not any_admin_bound and cfg.admin_role.lower() in _collect_roles(claims, token):
|
||||
taken = db.query(models.User).filter(
|
||||
models.User.oidc_issuer == issuer,
|
||||
models.User.oidc_subject == subject,
|
||||
).first()
|
||||
if taken is None:
|
||||
boot = db.query(models.User).filter(
|
||||
models.User.is_admin == True, # noqa: E712
|
||||
models.User.is_active == True, # noqa: E712
|
||||
models.User.oidc_subject.is_(None),
|
||||
).order_by(models.User.id).first()
|
||||
if boot is not None:
|
||||
boot.oidc_issuer = issuer
|
||||
boot.oidc_subject = subject
|
||||
db.commit()
|
||||
logger.info("OIDC bootstrap: auto-connected admin '%s' via admin role", boot.username)
|
||||
user = boot
|
||||
|
||||
if not user or not user.is_active or user.username in ("acc-mgr", "deleted-user"):
|
||||
return RedirectResponse(_frontend(cfg, {"oidc_error": "not_linked"}))
|
||||
|
||||
access_token = create_access_token(
|
||||
data={"sub": str(user.id)},
|
||||
expires_delta=timedelta(minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES),
|
||||
)
|
||||
return RedirectResponse(_frontend(cfg, fragment=urlencode({"token": access_token})))
|
||||
|
||||
|
||||
# ---- admin: OIDC provider settings ----------------------------------------
|
||||
|
||||
def _require_admin_any(current_user: models.User = Depends(get_current_user_or_apikey)) -> models.User:
|
||||
"""Admin via JWT OR API key. The API-key path is the recovery channel
|
||||
when OIDC-only mode is on and OIDC is not yet/incorrectly configured."""
|
||||
if not getattr(current_user, "is_admin", False):
|
||||
raise HTTPException(status_code=403, detail="Admin privileges required")
|
||||
return current_user
|
||||
|
||||
|
||||
class OidcSettingsIn(BaseModel):
|
||||
enabled: bool | None = None
|
||||
issuer: str | None = None
|
||||
client_id: str | None = None
|
||||
client_secret: str | None = None # blank/omitted = keep existing
|
||||
redirect_uri: str | None = None
|
||||
scopes: str | None = None
|
||||
post_login_redirect: str | None = None
|
||||
admin_role: str | None = None
|
||||
|
||||
|
||||
class OidcSettingsOut(BaseModel):
|
||||
enabled: bool
|
||||
issuer: str | None
|
||||
client_id: str | None
|
||||
has_client_secret: bool
|
||||
redirect_uri: str | None
|
||||
scopes: str | None
|
||||
post_login_redirect: str | None
|
||||
admin_role: str
|
||||
oidc_only: bool # read-only (deploy env)
|
||||
effective_enabled: bool # provider actually usable
|
||||
source: str # "db" or "env"
|
||||
|
||||
|
||||
@router.get("/oidc/settings", response_model=OidcSettingsOut)
|
||||
def get_oidc_settings(db: Session = Depends(get_db), _: models.User = Depends(_require_admin_any)):
|
||||
row = db.query(OidcSettings).filter(OidcSettings.id == 1).first()
|
||||
cfg = get_effective_oidc(db)
|
||||
return OidcSettingsOut(
|
||||
enabled=bool(row.enabled) if row else False,
|
||||
issuer=(row.issuer if row else None) or None,
|
||||
client_id=(row.client_id if row else None) or None,
|
||||
has_client_secret=bool(row.client_secret if row else None),
|
||||
redirect_uri=(row.redirect_uri if row else None) or None,
|
||||
scopes=(row.scopes if row else None) or None,
|
||||
post_login_redirect=(row.post_login_redirect if row else None) or None,
|
||||
admin_role=cfg.admin_role,
|
||||
oidc_only=bool(settings.HARBORFORGE_OIDC_ONLY),
|
||||
effective_enabled=cfg.configured,
|
||||
source="db",
|
||||
)
|
||||
|
||||
|
||||
@router.put("/oidc/settings", response_model=OidcSettingsOut)
|
||||
def update_oidc_settings(payload: OidcSettingsIn, db: Session = Depends(get_db),
|
||||
_: models.User = Depends(_require_admin_any)):
|
||||
row = db.query(OidcSettings).filter(OidcSettings.id == 1).first()
|
||||
if row is None:
|
||||
row = OidcSettings(id=1, enabled=False)
|
||||
db.add(row)
|
||||
|
||||
if payload.enabled is not None:
|
||||
row.enabled = payload.enabled
|
||||
if payload.issuer is not None:
|
||||
row.issuer = payload.issuer.strip() or None
|
||||
if payload.client_id is not None:
|
||||
row.client_id = payload.client_id.strip() or None
|
||||
# client_secret: only overwrite when a non-empty value is supplied
|
||||
if payload.client_secret:
|
||||
row.client_secret = payload.client_secret
|
||||
if payload.redirect_uri is not None:
|
||||
row.redirect_uri = payload.redirect_uri.strip() or None
|
||||
if payload.scopes is not None:
|
||||
row.scopes = payload.scopes.strip() or None
|
||||
if payload.post_login_redirect is not None:
|
||||
row.post_login_redirect = payload.post_login_redirect.strip() or None
|
||||
if payload.admin_role is not None:
|
||||
row.admin_role = payload.admin_role.strip() or None
|
||||
|
||||
db.commit()
|
||||
_invalidate_client()
|
||||
return get_oidc_settings(db=db, _=_)
|
||||
@@ -153,27 +153,9 @@ def _generate_project_code(db, name: str) -> str:
|
||||
|
||||
@router.post("", response_model=schemas.ProjectResponse, status_code=status.HTTP_201_CREATED)
|
||||
def create_project(project: schemas.ProjectCreate, db: Session = Depends(get_db), current_user: models.User = Depends(get_current_user_or_apikey)):
|
||||
# Project creation is gated by the `project.create` global permission
|
||||
# (admin auto-grants by virtue of is_admin). Any role granted that perm
|
||||
# via the Role Editor can create projects.
|
||||
# Check if user is admin
|
||||
if not current_user.is_admin:
|
||||
from app.models.role_permission import Permission, RolePermission
|
||||
has = (
|
||||
db.query(Permission.id)
|
||||
.join(RolePermission, RolePermission.permission_id == Permission.id)
|
||||
.filter(
|
||||
RolePermission.role_id == current_user.role_id,
|
||||
Permission.name == "project.create",
|
||||
)
|
||||
.first()
|
||||
if current_user.role_id
|
||||
else None
|
||||
)
|
||||
if not has:
|
||||
raise HTTPException(
|
||||
status_code=403,
|
||||
detail="Permission denied: project.create required",
|
||||
)
|
||||
raise HTTPException(status_code=403, detail="Only admins can create projects")
|
||||
# Auto-fill owner_name from owner_id
|
||||
user = db.query(models.User).filter(models.User.id == project.owner_id).first()
|
||||
if not user:
|
||||
|
||||
@@ -1,235 +0,0 @@
|
||||
"""ScheduleType API router.
|
||||
|
||||
CRUD for schedule types (work/entertainment time periods)
|
||||
and agent schedule type assignment.
|
||||
"""
|
||||
|
||||
from fastapi import APIRouter, Depends, HTTPException, Header
|
||||
from sqlalchemy.orm import Session
|
||||
from typing import List
|
||||
|
||||
from app.core.config import get_db
|
||||
from app.api.deps import get_current_user_or_apikey
|
||||
from app.models.models import User
|
||||
from app.models.agent import Agent
|
||||
from app.models.schedule_type import ScheduleType
|
||||
from app.models.role_permission import Permission, RolePermission
|
||||
from app.schemas.schedule_type import (
|
||||
ScheduleTypeCreate,
|
||||
ScheduleTypeUpdate,
|
||||
ScheduleTypeResponse,
|
||||
AgentScheduleTypeAssign,
|
||||
)
|
||||
|
||||
router = APIRouter(prefix="/schedule-types", tags=["ScheduleTypes"])
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Permission helpers
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
def _has_permission(db: Session, user: User, permission_name: str) -> bool:
|
||||
if user.is_admin:
|
||||
return True
|
||||
if not user.role_id:
|
||||
return False
|
||||
return (
|
||||
db.query(RolePermission)
|
||||
.join(Permission)
|
||||
.filter(
|
||||
RolePermission.role_id == user.role_id,
|
||||
Permission.name == permission_name,
|
||||
)
|
||||
.first()
|
||||
is not None
|
||||
)
|
||||
|
||||
|
||||
def _require_schedule_read(db: Session, user: User) -> User:
|
||||
if not _has_permission(db, user, "schedule_type.read"):
|
||||
raise HTTPException(403, "Permission denied: schedule_type.read")
|
||||
return user
|
||||
|
||||
|
||||
def _require_schedule_manage(db: Session, user: User) -> User:
|
||||
if not _has_permission(db, user, "schedule_type.manage"):
|
||||
raise HTTPException(403, "Permission denied: schedule_type.manage")
|
||||
return user
|
||||
|
||||
|
||||
def _attach_derived(st: ScheduleType) -> ScheduleType:
|
||||
"""Attach derived fields (maintenance_duration_minutes) so the
|
||||
pydantic ScheduleTypeResponse picks them up via from_attributes.
|
||||
|
||||
Pydantic with from_attributes reads attributes off the ORM object;
|
||||
setting a transient attr here avoids having to convert through dict.
|
||||
"""
|
||||
if st is not None:
|
||||
st.maintenance_duration_minutes = st.compute_maintenance_duration()
|
||||
return st
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Schedule Type CRUD
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
@router.get(
|
||||
"/",
|
||||
response_model=List[ScheduleTypeResponse],
|
||||
summary="List all schedule types",
|
||||
)
|
||||
def list_schedule_types(
|
||||
db: Session = Depends(get_db),
|
||||
current_user: User = Depends(get_current_user_or_apikey),
|
||||
):
|
||||
_require_schedule_read(db, current_user)
|
||||
return [_attach_derived(st) for st in db.query(ScheduleType).all()]
|
||||
|
||||
|
||||
@router.post(
|
||||
"/",
|
||||
response_model=ScheduleTypeResponse,
|
||||
summary="Create a schedule type",
|
||||
)
|
||||
def create_schedule_type(
|
||||
payload: ScheduleTypeCreate,
|
||||
db: Session = Depends(get_db),
|
||||
current_user: User = Depends(get_current_user_or_apikey),
|
||||
):
|
||||
_require_schedule_manage(db, current_user)
|
||||
|
||||
existing = db.query(ScheduleType).filter(ScheduleType.name == payload.name).first()
|
||||
if existing:
|
||||
raise HTTPException(409, f"Schedule type '{payload.name}' already exists")
|
||||
|
||||
st = ScheduleType(
|
||||
name=payload.name,
|
||||
work_from=payload.work_from,
|
||||
work_to=payload.work_to,
|
||||
entertainment_from=payload.entertainment_from,
|
||||
entertainment_to=payload.entertainment_to,
|
||||
maintenance_from=payload.maintenance_from,
|
||||
maintenance_to=payload.maintenance_to,
|
||||
)
|
||||
db.add(st)
|
||||
db.commit()
|
||||
db.refresh(st)
|
||||
return _attach_derived(st)
|
||||
|
||||
|
||||
@router.patch(
|
||||
"/{schedule_type_id}",
|
||||
response_model=ScheduleTypeResponse,
|
||||
summary="Update a schedule type",
|
||||
)
|
||||
def update_schedule_type(
|
||||
schedule_type_id: int,
|
||||
payload: ScheduleTypeUpdate,
|
||||
db: Session = Depends(get_db),
|
||||
current_user: User = Depends(get_current_user_or_apikey),
|
||||
):
|
||||
_require_schedule_manage(db, current_user)
|
||||
|
||||
st = db.query(ScheduleType).filter(ScheduleType.id == schedule_type_id).first()
|
||||
if not st:
|
||||
raise HTTPException(404, "Schedule type not found")
|
||||
|
||||
update_fields = payload.model_dump(exclude_unset=True)
|
||||
for field, value in update_fields.items():
|
||||
setattr(st, field, value)
|
||||
|
||||
# Re-validate maintenance after merge (partial updates can put the row
|
||||
# into an invalid window combo that the pydantic schema couldn't catch
|
||||
# because it only saw one field).
|
||||
from app.schemas.schedule_type import _validate_maintenance_window
|
||||
try:
|
||||
_validate_maintenance_window(st.maintenance_from, st.maintenance_to)
|
||||
except ValueError as e:
|
||||
db.rollback()
|
||||
raise HTTPException(422, str(e))
|
||||
|
||||
db.commit()
|
||||
db.refresh(st)
|
||||
return _attach_derived(st)
|
||||
|
||||
|
||||
@router.delete(
|
||||
"/{schedule_type_id}",
|
||||
summary="Delete a schedule type",
|
||||
)
|
||||
def delete_schedule_type(
|
||||
schedule_type_id: int,
|
||||
db: Session = Depends(get_db),
|
||||
current_user: User = Depends(get_current_user_or_apikey),
|
||||
):
|
||||
_require_schedule_manage(db, current_user)
|
||||
|
||||
st = db.query(ScheduleType).filter(ScheduleType.id == schedule_type_id).first()
|
||||
if not st:
|
||||
raise HTTPException(404, "Schedule type not found")
|
||||
|
||||
# Check if any agents are using this schedule type
|
||||
agents_using = db.query(Agent).filter(Agent.schedule_type_id == schedule_type_id).count()
|
||||
if agents_using > 0:
|
||||
raise HTTPException(
|
||||
409,
|
||||
f"Cannot delete: {agents_using} agent(s) are assigned to this schedule type",
|
||||
)
|
||||
|
||||
db.delete(st)
|
||||
db.commit()
|
||||
return {"ok": True, "deleted": schedule_type_id}
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Agent schedule type assignment (agent-facing, uses X-Agent-ID header)
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
@router.get(
|
||||
"/agent/me",
|
||||
response_model=ScheduleTypeResponse | None,
|
||||
summary="Get my schedule type",
|
||||
)
|
||||
def get_my_schedule_type(
|
||||
x_agent_id: str = Header(..., alias="X-Agent-ID"),
|
||||
x_claw_identifier: str = Header(..., alias="X-Claw-Identifier"),
|
||||
db: Session = Depends(get_db),
|
||||
):
|
||||
agent = (
|
||||
db.query(Agent)
|
||||
.filter(Agent.agent_id == x_agent_id, Agent.claw_identifier == x_claw_identifier)
|
||||
.first()
|
||||
)
|
||||
if not agent:
|
||||
raise HTTPException(404, "Agent not found")
|
||||
|
||||
if not agent.schedule_type_id:
|
||||
return None
|
||||
|
||||
st = db.query(ScheduleType).filter(ScheduleType.id == agent.schedule_type_id).first()
|
||||
return _attach_derived(st) if st else None
|
||||
|
||||
|
||||
@router.put(
|
||||
"/agent/{agent_id}/assign",
|
||||
summary="Assign a schedule type to an agent",
|
||||
)
|
||||
def assign_schedule_type(
|
||||
agent_id: str,
|
||||
payload: AgentScheduleTypeAssign,
|
||||
db: Session = Depends(get_db),
|
||||
current_user: User = Depends(get_current_user_or_apikey),
|
||||
):
|
||||
_require_schedule_manage(db, current_user)
|
||||
|
||||
agent = db.query(Agent).filter(Agent.agent_id == agent_id).first()
|
||||
if not agent:
|
||||
raise HTTPException(404, f"Agent '{agent_id}' not found")
|
||||
|
||||
st = db.query(ScheduleType).filter(ScheduleType.name == payload.schedule_type_name).first()
|
||||
if not st:
|
||||
raise HTTPException(404, f"Schedule type '{payload.schedule_type_name}' not found")
|
||||
|
||||
agent.schedule_type_id = st.id
|
||||
db.commit()
|
||||
return {"ok": True, "agent_id": agent_id, "schedule_type": st.name}
|
||||
@@ -1,226 +0,0 @@
|
||||
"""Special-slot CRUD for a ScheduleType (admin-only).
|
||||
|
||||
A "special slot" is a recurring slot template tied to a ScheduleType.
|
||||
The system materialises one `time_slots` row per agent on that
|
||||
schedule_type per date, scheduled inside the schedule_type's
|
||||
maintenance window. Materialised rows are `is_admin_locked=true` —
|
||||
agents can complete / abort / pause / resume them but cannot move
|
||||
or cancel them.
|
||||
|
||||
All endpoints require `schedule_type.manage` (admin auto-grants).
|
||||
"""
|
||||
|
||||
from typing import List
|
||||
|
||||
from fastapi import APIRouter, Depends, HTTPException
|
||||
from sqlalchemy.orm import Session
|
||||
|
||||
from app.core.config import get_db
|
||||
from app.api.deps import get_current_user_or_apikey
|
||||
from app.models.models import User
|
||||
from app.models.role_permission import Permission, RolePermission
|
||||
from app.models.schedule_type import ScheduleType
|
||||
from app.models.schedule_type_special_slot import ScheduleTypeSpecialSlot
|
||||
from app.schemas.schedule_type_special_slot import (
|
||||
SpecialSlotCreate,
|
||||
SpecialSlotUpdate,
|
||||
SpecialSlotResponse,
|
||||
)
|
||||
|
||||
|
||||
router = APIRouter(prefix="/schedule-types", tags=["ScheduleTypes"])
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Permission helpers — mirror schedule_type.py's local helpers so this router
|
||||
# doesn't have to depend on internal symbols of the other router.
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
def _has_permission(db: Session, user: User, permission_name: str) -> bool:
|
||||
if user.is_admin:
|
||||
return True
|
||||
if not user.role_id:
|
||||
return False
|
||||
return (
|
||||
db.query(RolePermission)
|
||||
.join(Permission)
|
||||
.filter(
|
||||
RolePermission.role_id == user.role_id,
|
||||
Permission.name == permission_name,
|
||||
)
|
||||
.first()
|
||||
is not None
|
||||
)
|
||||
|
||||
|
||||
def _require_schedule_manage(db: Session, user: User) -> User:
|
||||
if not _has_permission(db, user, "schedule_type.manage"):
|
||||
raise HTTPException(403, "Permission denied: schedule_type.manage")
|
||||
return user
|
||||
|
||||
|
||||
def _require_schedule_read(db: Session, user: User) -> User:
|
||||
if not _has_permission(db, user, "schedule_type.read"):
|
||||
raise HTTPException(403, "Permission denied: schedule_type.read")
|
||||
return user
|
||||
|
||||
|
||||
def _fetch_schedule_type(db: Session, schedule_type_id: int) -> ScheduleType:
|
||||
st = db.query(ScheduleType).filter(ScheduleType.id == schedule_type_id).first()
|
||||
if not st:
|
||||
raise HTTPException(404, f"ScheduleType {schedule_type_id} not found")
|
||||
return st
|
||||
|
||||
|
||||
def _validate_fits_window(
|
||||
minute_in_window: int,
|
||||
estimated_duration: int,
|
||||
maintenance_duration_minutes: int,
|
||||
) -> None:
|
||||
"""Reject special slots that wouldn't fit inside the parent's maintenance window."""
|
||||
if minute_in_window + estimated_duration > maintenance_duration_minutes:
|
||||
raise HTTPException(
|
||||
422,
|
||||
(
|
||||
f"special slot does not fit in maintenance window: "
|
||||
f"minute_in_window={minute_in_window} + "
|
||||
f"estimated_duration={estimated_duration} > "
|
||||
f"maintenance window {maintenance_duration_minutes}min"
|
||||
),
|
||||
)
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Endpoints
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
@router.get(
|
||||
"/{schedule_type_id}/special-slots",
|
||||
response_model=List[SpecialSlotResponse],
|
||||
summary="List special slots for a schedule type",
|
||||
)
|
||||
def list_special_slots(
|
||||
schedule_type_id: int,
|
||||
db: Session = Depends(get_db),
|
||||
current_user: User = Depends(get_current_user_or_apikey),
|
||||
):
|
||||
_require_schedule_read(db, current_user)
|
||||
_fetch_schedule_type(db, schedule_type_id)
|
||||
return (
|
||||
db.query(ScheduleTypeSpecialSlot)
|
||||
.filter(ScheduleTypeSpecialSlot.schedule_type_id == schedule_type_id)
|
||||
.order_by(
|
||||
ScheduleTypeSpecialSlot.minute_in_window.asc(),
|
||||
ScheduleTypeSpecialSlot.id.asc(),
|
||||
)
|
||||
.all()
|
||||
)
|
||||
|
||||
|
||||
@router.post(
|
||||
"/{schedule_type_id}/special-slots",
|
||||
response_model=SpecialSlotResponse,
|
||||
summary="Create a special slot for a schedule type (admin)",
|
||||
)
|
||||
def create_special_slot(
|
||||
schedule_type_id: int,
|
||||
payload: SpecialSlotCreate,
|
||||
db: Session = Depends(get_db),
|
||||
current_user: User = Depends(get_current_user_or_apikey),
|
||||
):
|
||||
_require_schedule_manage(db, current_user)
|
||||
st = _fetch_schedule_type(db, schedule_type_id)
|
||||
_validate_fits_window(payload.minute_in_window, payload.estimated_duration, st.compute_maintenance_duration())
|
||||
|
||||
dup = (
|
||||
db.query(ScheduleTypeSpecialSlot)
|
||||
.filter(
|
||||
ScheduleTypeSpecialSlot.schedule_type_id == schedule_type_id,
|
||||
ScheduleTypeSpecialSlot.name == payload.name,
|
||||
)
|
||||
.first()
|
||||
)
|
||||
if dup:
|
||||
raise HTTPException(
|
||||
409,
|
||||
f"special slot '{payload.name}' already exists for schedule_type {schedule_type_id}",
|
||||
)
|
||||
|
||||
slot = ScheduleTypeSpecialSlot(
|
||||
schedule_type_id=schedule_type_id,
|
||||
name=payload.name,
|
||||
description=payload.description,
|
||||
minute_in_window=payload.minute_in_window,
|
||||
estimated_duration=payload.estimated_duration,
|
||||
priority=payload.priority,
|
||||
event_data=payload.event_data,
|
||||
is_active=payload.is_active,
|
||||
created_by_user_id=current_user.id,
|
||||
)
|
||||
db.add(slot)
|
||||
db.commit()
|
||||
db.refresh(slot)
|
||||
return slot
|
||||
|
||||
|
||||
@router.patch(
|
||||
"/{schedule_type_id}/special-slots/{slot_id}",
|
||||
response_model=SpecialSlotResponse,
|
||||
summary="Update a special slot (admin)",
|
||||
)
|
||||
def update_special_slot(
|
||||
schedule_type_id: int,
|
||||
slot_id: int,
|
||||
payload: SpecialSlotUpdate,
|
||||
db: Session = Depends(get_db),
|
||||
current_user: User = Depends(get_current_user_or_apikey),
|
||||
):
|
||||
_require_schedule_manage(db, current_user)
|
||||
slot = (
|
||||
db.query(ScheduleTypeSpecialSlot)
|
||||
.filter(
|
||||
ScheduleTypeSpecialSlot.id == slot_id,
|
||||
ScheduleTypeSpecialSlot.schedule_type_id == schedule_type_id,
|
||||
)
|
||||
.first()
|
||||
)
|
||||
if not slot:
|
||||
raise HTTPException(404, "Special slot not found")
|
||||
|
||||
update_fields = payload.model_dump(exclude_unset=True)
|
||||
next_min = update_fields.get("minute_in_window", slot.minute_in_window)
|
||||
next_dur = update_fields.get("estimated_duration", slot.estimated_duration)
|
||||
parent = _fetch_schedule_type(db, schedule_type_id)
|
||||
_validate_fits_window(next_min, next_dur, parent.compute_maintenance_duration())
|
||||
|
||||
for field, value in update_fields.items():
|
||||
setattr(slot, field, value)
|
||||
db.commit()
|
||||
db.refresh(slot)
|
||||
return slot
|
||||
|
||||
|
||||
@router.delete(
|
||||
"/{schedule_type_id}/special-slots/{slot_id}",
|
||||
summary="Delete a special slot (admin)",
|
||||
)
|
||||
def delete_special_slot(
|
||||
schedule_type_id: int,
|
||||
slot_id: int,
|
||||
db: Session = Depends(get_db),
|
||||
current_user: User = Depends(get_current_user_or_apikey),
|
||||
):
|
||||
_require_schedule_manage(db, current_user)
|
||||
slot = (
|
||||
db.query(ScheduleTypeSpecialSlot)
|
||||
.filter(
|
||||
ScheduleTypeSpecialSlot.id == slot_id,
|
||||
ScheduleTypeSpecialSlot.schedule_type_id == schedule_type_id,
|
||||
)
|
||||
.first()
|
||||
)
|
||||
if not slot:
|
||||
raise HTTPException(404, "Special slot not found")
|
||||
db.delete(slot)
|
||||
db.commit()
|
||||
return {"ok": True, "deleted": slot_id}
|
||||
@@ -576,10 +576,8 @@ def take_task(
|
||||
# ---- Assignment ----
|
||||
|
||||
@router.post("/tasks/{task_code}/assign")
|
||||
def assign_task(task_code: str, assignee_id: int, db: Session = Depends(get_db),
|
||||
current_user: models.User = Depends(get_current_user_or_apikey)):
|
||||
def assign_task(task_code: str, assignee_id: int, db: Session = Depends(get_db)):
|
||||
task = _resolve_task(db, task_code)
|
||||
ensure_can_edit_task(db, current_user.id, task)
|
||||
user = db.query(models.User).filter(models.User.id == assignee_id).first()
|
||||
if not user:
|
||||
raise HTTPException(status_code=404, detail="User not found")
|
||||
@@ -767,8 +765,7 @@ def batch_transition(
|
||||
|
||||
|
||||
@router.post("/tasks/batch/assign")
|
||||
def batch_assign(data: BatchAssign, db: Session = Depends(get_db),
|
||||
current_user: models.User = Depends(get_current_user_or_apikey)):
|
||||
def batch_assign(data: BatchAssign, db: Session = Depends(get_db)):
|
||||
user = db.query(models.User).filter(models.User.id == data.assignee_id).first()
|
||||
if not user:
|
||||
raise HTTPException(status_code=404, detail="Assignee not found")
|
||||
@@ -776,7 +773,6 @@ def batch_assign(data: BatchAssign, db: Session = Depends(get_db),
|
||||
for task_code in data.task_codes:
|
||||
task = db.query(Task).filter(Task.task_code == task_code).first()
|
||||
if task:
|
||||
ensure_can_edit_task(db, current_user.id, task)
|
||||
task.assignee_id = data.assignee_id
|
||||
updated.append(task.task_code)
|
||||
db.commit()
|
||||
|
||||
@@ -7,9 +7,8 @@ from pydantic import BaseModel
|
||||
from sqlalchemy.exc import IntegrityError
|
||||
from sqlalchemy.orm import Session
|
||||
|
||||
from app.api.deps import get_current_user, get_current_user_or_apikey, get_password_hash, hash_api_key
|
||||
from app.core.config import get_db, settings
|
||||
from app.init_bootstrap import DELETED_USER_USERNAME
|
||||
from app.api.deps import get_current_user, get_current_user_or_apikey, get_password_hash
|
||||
from app.core.config import get_db
|
||||
from app.models import models
|
||||
from app.models.agent import Agent
|
||||
from app.models.role_permission import Permission, Role, RolePermission
|
||||
@@ -32,18 +31,12 @@ def _user_response(user: models.User) -> dict:
|
||||
"role_name": user.role_name,
|
||||
"agent_id": user.agent.agent_id if user.agent else None,
|
||||
"discord_user_id": user.discord_user_id,
|
||||
"oidc_issuer": user.oidc_issuer,
|
||||
"oidc_subject": user.oidc_subject,
|
||||
"created_at": user.created_at,
|
||||
}
|
||||
return data
|
||||
|
||||
|
||||
def require_admin(current_user: models.User = Depends(get_current_user_or_apikey)):
|
||||
# Accept either OAuth2 JWT or X-API-Key (incl. Bearer-as-apikey fallback)
|
||||
# so CLI clients using their provisioned api-key can hit admin-gated user
|
||||
# routes (list / get / update / patch). The admin gate still reads
|
||||
# User.is_admin — only the auth carrier broadens.
|
||||
def require_admin(current_user: models.User = Depends(get_current_user)):
|
||||
if not current_user.is_admin:
|
||||
raise HTTPException(status_code=403, detail="Admin required")
|
||||
return current_user
|
||||
@@ -72,29 +65,11 @@ def require_account_creator(
|
||||
raise HTTPException(status_code=403, detail="Account creation permission required")
|
||||
|
||||
|
||||
def _resolve_user_role(db: Session, role_id: int | None, *, is_agent: bool = False) -> Role:
|
||||
"""Resolve target role for user creation.
|
||||
|
||||
Default policy when caller didn't pin role_id:
|
||||
- is_agent (i.e. payload had agent_id/claw_identifier) → general-agent
|
||||
- human user → guest
|
||||
|
||||
general-agent ≈ guest + user.reset-self-apikey so agents can rotate
|
||||
their own API key without admin intervention. Created in
|
||||
init_bootstrap.py on every startup; falls back to guest if absent
|
||||
(e.g. very old DB that hasn't been re-seeded yet).
|
||||
"""
|
||||
def _resolve_user_role(db: Session, role_id: int | None) -> Role:
|
||||
if role_id is None:
|
||||
default_name = "general-agent" if is_agent else "guest"
|
||||
role = db.query(Role).filter(Role.name == default_name).first()
|
||||
if not role and is_agent:
|
||||
# general-agent missing from this DB → fall back to guest, log warn
|
||||
role = db.query(Role).filter(Role.name == "guest").first()
|
||||
role = db.query(Role).filter(Role.name == "guest").first()
|
||||
if not role:
|
||||
raise HTTPException(
|
||||
status_code=500,
|
||||
detail=f"Default role '{default_name}' is missing (DB not seeded)",
|
||||
)
|
||||
raise HTTPException(status_code=500, detail="Default guest role is missing")
|
||||
return role
|
||||
|
||||
role = db.query(Role).filter(Role.id == role_id).first()
|
||||
@@ -134,14 +109,8 @@ def create_user(
|
||||
if existing_agent:
|
||||
raise HTTPException(status_code=400, detail="agent_id already in use")
|
||||
|
||||
assigned_role = _resolve_user_role(db, user.role_id, is_agent=has_agent_id)
|
||||
# In OIDC-only mode, ignore any supplied password: the user is created
|
||||
# passwordless (cannot password-login) and is expected to sign in via a
|
||||
# bound OIDC identity. API keys still work for such users.
|
||||
if settings.HARBORFORGE_OIDC_ONLY:
|
||||
hashed_password = None
|
||||
else:
|
||||
hashed_password = get_password_hash(user.password) if user.password else None
|
||||
assigned_role = _resolve_user_role(db, user.role_id)
|
||||
hashed_password = get_password_hash(user.password) if user.password else None
|
||||
db_user = models.User(
|
||||
username=user.username,
|
||||
email=user.email,
|
||||
@@ -221,7 +190,7 @@ def update_user(
|
||||
if payload.full_name is not None:
|
||||
user.full_name = payload.full_name
|
||||
|
||||
if payload.password is not None and payload.password.strip() and not settings.HARBORFORGE_OIDC_ONLY:
|
||||
if payload.password is not None and payload.password.strip():
|
||||
user.hashed_password = get_password_hash(payload.password)
|
||||
|
||||
if payload.role_id is not None:
|
||||
@@ -243,151 +212,6 @@ def update_user(
|
||||
return _user_response(user)
|
||||
|
||||
|
||||
@router.patch("/{identifier}/bind-agent", response_model=schemas.UserResponse)
|
||||
def bind_agent(
|
||||
identifier: str,
|
||||
payload: schemas.UserBindAgentRequest,
|
||||
db: Session = Depends(get_db),
|
||||
_: models.User = Depends(require_account_creator),
|
||||
):
|
||||
"""Bind an existing user to (agent_id, claw_identifier).
|
||||
|
||||
Backfill path for users that were created via `hf user create` before
|
||||
the cli supported `--agent-id` / `--claw-identifier` flags. Creates
|
||||
the `agents` row that should have been written at user-create time.
|
||||
|
||||
Idempotent: if the user is already bound to the same
|
||||
(agent_id, claw_identifier), returns the user unchanged (200, no-op).
|
||||
|
||||
Rejects (409) if:
|
||||
- the user is bound to a DIFFERENT (agent_id, claw_identifier)
|
||||
- the requested agent_id is already in use by another user
|
||||
|
||||
Permission: account.create (admin auto-grants) — same gate as
|
||||
POST /users so the surface stays symmetric.
|
||||
"""
|
||||
user = _find_user_by_id_or_username(db, identifier)
|
||||
if not user:
|
||||
raise HTTPException(status_code=404, detail="User not found")
|
||||
|
||||
existing_agent_for_user = db.query(Agent).filter(Agent.user_id == user.id).first()
|
||||
if existing_agent_for_user:
|
||||
if (
|
||||
existing_agent_for_user.agent_id == payload.agent_id
|
||||
and existing_agent_for_user.claw_identifier == payload.claw_identifier
|
||||
):
|
||||
# idempotent re-bind
|
||||
return _user_response(user)
|
||||
raise HTTPException(
|
||||
status_code=409,
|
||||
detail=(
|
||||
f"User '{user.username}' is already bound to agent "
|
||||
f"'{existing_agent_for_user.agent_id}' on claw "
|
||||
f"'{existing_agent_for_user.claw_identifier}'"
|
||||
),
|
||||
)
|
||||
|
||||
existing_for_agent_id = (
|
||||
db.query(Agent).filter(Agent.agent_id == payload.agent_id).first()
|
||||
)
|
||||
if existing_for_agent_id:
|
||||
raise HTTPException(
|
||||
status_code=409,
|
||||
detail=f"agent_id '{payload.agent_id}' already in use by another user",
|
||||
)
|
||||
|
||||
db.add(
|
||||
Agent(
|
||||
user_id=user.id,
|
||||
agent_id=payload.agent_id,
|
||||
claw_identifier=payload.claw_identifier,
|
||||
)
|
||||
)
|
||||
db.commit()
|
||||
db.refresh(user)
|
||||
return _user_response(user)
|
||||
|
||||
|
||||
_BUILTIN_USERNAMES = {"acc-mgr", DELETED_USER_USERNAME}
|
||||
|
||||
|
||||
def _reassign_user_references(db: Session, old_id: int, new_id: int) -> None:
|
||||
"""Reassign all foreign key references from old_id to new_id, then delete
|
||||
records that would be meaningless under deleted-user (api_keys, notifications,
|
||||
project memberships)."""
|
||||
from app.models.apikey import APIKey
|
||||
from app.models.notification import Notification
|
||||
from app.models.activity import ActivityLog as Activity
|
||||
from app.models.worklog import WorkLog as WorkLogModel
|
||||
from app.models.meeting import Meeting, MeetingParticipant
|
||||
from app.models.task import Task
|
||||
from app.models.support import Support
|
||||
from app.models.proposal import Proposal
|
||||
from app.models.milestone import Milestone
|
||||
from app.models.calendar import TimeSlot, SchedulePlan
|
||||
from app.models.minimum_workload import MinimumWorkload
|
||||
from app.models.essential import Essential
|
||||
|
||||
# Delete records that are meaningless without the real user
|
||||
db.query(APIKey).filter(APIKey.user_id == old_id).delete()
|
||||
db.query(Notification).filter(Notification.user_id == old_id).delete()
|
||||
db.query(models.ProjectMember).filter(models.ProjectMember.user_id == old_id).delete()
|
||||
|
||||
# Reassign ownership/authorship references
|
||||
db.query(models.Project).filter(models.Project.owner_id == old_id).update(
|
||||
{"owner_id": new_id})
|
||||
db.query(models.Comment).filter(models.Comment.author_id == old_id).update(
|
||||
{"author_id": new_id})
|
||||
db.query(Activity).filter(Activity.user_id == old_id).update(
|
||||
{"user_id": new_id})
|
||||
db.query(WorkLogModel).filter(WorkLogModel.user_id == old_id).update(
|
||||
{"user_id": new_id})
|
||||
|
||||
# Tasks
|
||||
db.query(Task).filter(Task.reporter_id == old_id).update(
|
||||
{"reporter_id": new_id})
|
||||
db.query(Task).filter(Task.assignee_id == old_id).update(
|
||||
{"assignee_id": new_id})
|
||||
db.query(Task).filter(Task.created_by_id == old_id).update(
|
||||
{"created_by_id": new_id})
|
||||
|
||||
# Meetings
|
||||
db.query(Meeting).filter(Meeting.reporter_id == old_id).update(
|
||||
{"reporter_id": new_id})
|
||||
db.query(MeetingParticipant).filter(MeetingParticipant.user_id == old_id).update(
|
||||
{"user_id": new_id})
|
||||
|
||||
# Support
|
||||
db.query(Support).filter(Support.reporter_id == old_id).update(
|
||||
{"reporter_id": new_id})
|
||||
db.query(Support).filter(Support.assignee_id == old_id).update(
|
||||
{"assignee_id": new_id})
|
||||
|
||||
# Proposals
|
||||
db.query(Proposal).filter(Proposal.created_by_id == old_id).update(
|
||||
{"created_by_id": new_id})
|
||||
|
||||
# Milestones
|
||||
db.query(Milestone).filter(Milestone.created_by_id == old_id).update(
|
||||
{"created_by_id": new_id})
|
||||
|
||||
# Calendar
|
||||
db.query(TimeSlot).filter(TimeSlot.user_id == old_id).update(
|
||||
{"user_id": new_id})
|
||||
db.query(SchedulePlan).filter(SchedulePlan.user_id == old_id).update(
|
||||
{"user_id": new_id})
|
||||
|
||||
# Minimum workload / Essential
|
||||
db.query(MinimumWorkload).filter(MinimumWorkload.user_id == old_id).update(
|
||||
{"user_id": new_id})
|
||||
db.query(Essential).filter(Essential.created_by_id == old_id).update(
|
||||
{"created_by_id": new_id})
|
||||
|
||||
# Agent profile
|
||||
db.query(Agent).filter(Agent.user_id == old_id).update(
|
||||
{"user_id": new_id})
|
||||
|
||||
|
||||
@router.delete("/{identifier}", status_code=status.HTTP_204_NO_CONTENT)
|
||||
def delete_user(
|
||||
identifier: str,
|
||||
@@ -399,26 +223,17 @@ def delete_user(
|
||||
raise HTTPException(status_code=404, detail="User not found")
|
||||
if current_user.id == user.id:
|
||||
raise HTTPException(status_code=400, detail="You cannot delete your own account")
|
||||
# Protect built-in accounts from deletion
|
||||
if user.is_admin:
|
||||
raise HTTPException(status_code=400, detail="Admin accounts cannot be deleted")
|
||||
if user.username in _BUILTIN_USERNAMES:
|
||||
raise HTTPException(
|
||||
status_code=400,
|
||||
detail=f"The {user.username} account is a built-in account and cannot be deleted",
|
||||
)
|
||||
|
||||
deleted_user = db.query(models.User).filter(
|
||||
models.User.username == DELETED_USER_USERNAME
|
||||
).first()
|
||||
if not deleted_user:
|
||||
raise HTTPException(
|
||||
status_code=500,
|
||||
detail="Built-in deleted-user account not found. Backend startup failed to seed it; restart the container.",
|
||||
)
|
||||
|
||||
_reassign_user_references(db, user.id, deleted_user.id)
|
||||
db.delete(user)
|
||||
db.commit()
|
||||
if user.username == "acc-mgr":
|
||||
raise HTTPException(status_code=400, detail="The acc-mgr account is a built-in account and cannot be deleted")
|
||||
try:
|
||||
db.delete(user)
|
||||
db.commit()
|
||||
except IntegrityError:
|
||||
db.rollback()
|
||||
raise HTTPException(status_code=400, detail="User has related records. Deactivate the account instead.")
|
||||
return None
|
||||
|
||||
|
||||
@@ -426,7 +241,7 @@ def delete_user(
|
||||
def reset_user_apikey(
|
||||
identifier: str,
|
||||
db: Session = Depends(get_db),
|
||||
current_user: models.User = Depends(get_current_user_or_apikey),
|
||||
current_user: models.User = Depends(get_current_user),
|
||||
):
|
||||
"""Reset (regenerate) a user's API key.
|
||||
|
||||
@@ -434,8 +249,6 @@ def reset_user_apikey(
|
||||
- user.reset-apikey: can reset any user's API key
|
||||
- user.reset-self-apikey: can reset only own API key
|
||||
- admin: can reset any user's API key
|
||||
|
||||
Accepts both OAuth2 Bearer token and X-API-Key authentication.
|
||||
"""
|
||||
import secrets
|
||||
from app.models.apikey import APIKey
|
||||
@@ -464,10 +277,9 @@ def reset_user_apikey(
|
||||
existing_key.is_active = False
|
||||
db.flush()
|
||||
|
||||
# Create new key (store only the hash + a display prefix)
|
||||
# Create new key
|
||||
new_key = APIKey(
|
||||
key_hash=hash_api_key(new_key_value),
|
||||
key_prefix=new_key_value[:8],
|
||||
key=new_key_value,
|
||||
name=f"{target_user.username}-key",
|
||||
user_id=target_user.id,
|
||||
is_active=True,
|
||||
@@ -510,92 +322,3 @@ def list_user_worklogs(
|
||||
if current_user.id != user.id and not current_user.is_admin:
|
||||
raise HTTPException(status_code=403, detail="Forbidden")
|
||||
return db.query(WorkLog).filter(WorkLog.user_id == user.id).order_by(WorkLog.logged_date.desc()).limit(limit).all()
|
||||
|
||||
|
||||
# ---- OIDC identity binding ------------------------------------------------
|
||||
|
||||
class OidcBindingRequest(BaseModel):
|
||||
issuer: str
|
||||
subject: str
|
||||
|
||||
|
||||
class OidcBindingResponse(BaseModel):
|
||||
user_id: int
|
||||
username: str
|
||||
oidc_issuer: str | None = None
|
||||
oidc_subject: str | None = None
|
||||
|
||||
|
||||
def _assert_can_manage_oidc_binding(db: Session, caller: models.User, target: models.User) -> None:
|
||||
"""Global admins may (un)bind anyone. Non-admin account managers may
|
||||
only operate on non-privileged accounts — never on an admin or another
|
||||
privileged account — otherwise binding an attacker-controlled OIDC
|
||||
identity to an admin would be a privilege-escalation primitive."""
|
||||
if getattr(caller, "is_admin", False):
|
||||
return
|
||||
privileged = (
|
||||
getattr(target, "is_admin", False)
|
||||
or target.username in ("acc-mgr", "deleted-user")
|
||||
or _has_global_permission(db, target, "account.create")
|
||||
or _has_global_permission(db, target, "user.reset-apikey")
|
||||
)
|
||||
if privileged:
|
||||
raise HTTPException(
|
||||
status_code=403,
|
||||
detail="Only a global admin may manage the OIDC binding of a privileged account",
|
||||
)
|
||||
|
||||
|
||||
@router.put("/{identifier}/oidc-binding", response_model=OidcBindingResponse)
|
||||
def bind_user_oidc(
|
||||
identifier: str,
|
||||
payload: OidcBindingRequest,
|
||||
db: Session = Depends(get_db),
|
||||
caller: models.User = Depends(require_account_creator),
|
||||
):
|
||||
"""Bind an hf user to an external OIDC identity (issuer + subject).
|
||||
|
||||
Admin or account-manager (JWT or API key). Account managers may not
|
||||
target privileged/admin accounts. One OIDC identity maps to at most
|
||||
one user."""
|
||||
issuer = (payload.issuer or "").strip()
|
||||
subject = (payload.subject or "").strip()
|
||||
if not issuer or not subject:
|
||||
raise HTTPException(status_code=400, detail="issuer and subject are required")
|
||||
user = _find_user_by_id_or_username(db, identifier)
|
||||
if not user:
|
||||
raise HTTPException(status_code=404, detail="User not found")
|
||||
_assert_can_manage_oidc_binding(db, caller, user)
|
||||
clash = db.query(models.User).filter(
|
||||
models.User.oidc_issuer == issuer,
|
||||
models.User.oidc_subject == subject,
|
||||
models.User.id != user.id,
|
||||
).first()
|
||||
if clash:
|
||||
raise HTTPException(status_code=409, detail=f"OIDC identity already bound to user '{clash.username}'")
|
||||
user.oidc_issuer = issuer
|
||||
user.oidc_subject = subject
|
||||
db.commit()
|
||||
db.refresh(user)
|
||||
return OidcBindingResponse(user_id=user.id, username=user.username,
|
||||
oidc_issuer=user.oidc_issuer, oidc_subject=user.oidc_subject)
|
||||
|
||||
|
||||
@router.delete("/{identifier}/oidc-binding", response_model=OidcBindingResponse)
|
||||
def unbind_user_oidc(
|
||||
identifier: str,
|
||||
db: Session = Depends(get_db),
|
||||
caller: models.User = Depends(require_account_creator),
|
||||
):
|
||||
"""Remove a user's OIDC binding. Admin or account-manager; account
|
||||
managers may not target privileged/admin accounts."""
|
||||
user = _find_user_by_id_or_username(db, identifier)
|
||||
if not user:
|
||||
raise HTTPException(status_code=404, detail="User not found")
|
||||
_assert_can_manage_oidc_binding(db, caller, user)
|
||||
user.oidc_issuer = None
|
||||
user.oidc_subject = None
|
||||
db.commit()
|
||||
db.refresh(user)
|
||||
return OidcBindingResponse(user_id=user.id, username=user.username,
|
||||
oidc_issuer=None, oidc_subject=None)
|
||||
|
||||
@@ -5,13 +5,11 @@ from fastapi import APIRouter, Depends, HTTPException, status, BackgroundTasks
|
||||
from sqlalchemy.orm import Session
|
||||
|
||||
from app.core.config import get_db
|
||||
from app.api.deps import require_admin
|
||||
from app.models.webhook import Webhook, WebhookLog
|
||||
from app.schemas.webhook import WebhookCreate, WebhookUpdate, WebhookResponse, WebhookLogResponse
|
||||
from app.services.webhook import fire_webhooks_sync
|
||||
|
||||
# Webhook management is admin-only (registration, inspection, retry, logs).
|
||||
router = APIRouter(prefix="/webhooks", tags=["Webhooks"], dependencies=[Depends(require_admin)])
|
||||
router = APIRouter(prefix="/webhooks", tags=["Webhooks"])
|
||||
|
||||
|
||||
@router.post("", response_model=WebhookResponse, status_code=status.HTTP_201_CREATED)
|
||||
|
||||
@@ -1,10 +0,0 @@
|
||||
"""hf-cli — operator commands run inside the backend container.
|
||||
|
||||
Subjects:
|
||||
admin — bootstrap / manage the initial admin user
|
||||
config — runtime config (OIDC, etc.)
|
||||
|
||||
Invoked via the shim at /usr/local/bin/hf-cli (Dockerfile-installed):
|
||||
docker exec hf-backend hf-cli admin create-user --email me@example.com --password '...'
|
||||
docker exec hf-backend hf-cli config oidc --issuer ... --client-id ... --enabled true
|
||||
"""
|
||||
@@ -1,68 +0,0 @@
|
||||
"""hf-cli entry point. Dispatches to subject-specific modules."""
|
||||
import sys
|
||||
|
||||
|
||||
def _load_all_models() -> None:
|
||||
"""Import every model module so SQLAlchemy's declarative registry
|
||||
resolves cross-table relationships (e.g. User.role, User.agent).
|
||||
|
||||
main.py's startup() does the same thing for the web server; the CLI
|
||||
skips startup() but still queries User → would otherwise hit
|
||||
`KeyError: 'Agent'` when SA tries to resolve relationship targets.
|
||||
Keep this list in sync with main.py's startup import list.
|
||||
"""
|
||||
from app.models import ( # noqa: F401
|
||||
models, webhook, apikey, activity, milestone, notification, worklog,
|
||||
monitor, role_permission, task, support, meeting, proposal, propose,
|
||||
essential, agent, calendar, minimum_workload, schedule_type,
|
||||
schedule_type_special_slot, oidc_settings,
|
||||
)
|
||||
|
||||
|
||||
_load_all_models()
|
||||
|
||||
|
||||
USAGE = """Usage:
|
||||
hf-cli admin create-user --email <e> [--username <u>] [--full-name <n>]
|
||||
[--password <p>] [--oidc-issuer <url> --oidc-subject <sub>]
|
||||
hf-cli admin list
|
||||
hf-cli admin set-role --username <u> --role <admin|mgr|dev|guest|account-manager>
|
||||
hf-cli admin reset-password --username <u> --password <p>
|
||||
hf-cli admin bind-oidc --username <u> --oidc-issuer <url> --oidc-subject <sub>
|
||||
|
||||
hf-cli config oidc [--issuer <url>] [--client-id <id>] [--client-secret <s>]
|
||||
[--redirect-uri <url>] [--post-login-redirect <url>]
|
||||
[--scopes "openid email profile"] [--admin-role <role>]
|
||||
[--enabled true|false] [--show-secret]
|
||||
|
||||
Reads DATABASE_URL + SECRET_KEY from the same env as the backend. Run
|
||||
inside the backend container: `docker exec hf-backend hf-cli ...`.
|
||||
"""
|
||||
|
||||
|
||||
def main() -> int:
|
||||
args = sys.argv[1:]
|
||||
if len(args) < 1:
|
||||
sys.stderr.write(USAGE)
|
||||
return 1
|
||||
|
||||
subject = args[0]
|
||||
rest = args[1:]
|
||||
|
||||
if subject == "admin":
|
||||
from app.cli import admin
|
||||
return admin.dispatch(rest)
|
||||
if subject == "config":
|
||||
from app.cli import config
|
||||
return config.dispatch(rest)
|
||||
if subject in ("-h", "--help", "help"):
|
||||
sys.stdout.write(USAGE)
|
||||
return 0
|
||||
|
||||
sys.stderr.write(f"unknown subject: {subject}\n\n")
|
||||
sys.stderr.write(USAGE)
|
||||
return 1
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
sys.exit(main())
|
||||
269
app/cli/admin.py
269
app/cli/admin.py
@@ -1,269 +0,0 @@
|
||||
"""hf-cli admin … — bootstrap and manage the deployment's admin user."""
|
||||
import argparse
|
||||
import json
|
||||
import sys
|
||||
|
||||
from sqlalchemy.exc import IntegrityError
|
||||
|
||||
from app.api.deps import get_password_hash
|
||||
from app.core.config import SessionLocal, settings
|
||||
from app.models import models
|
||||
from app.models.role_permission import Role
|
||||
|
||||
|
||||
def _open_db():
|
||||
return SessionLocal()
|
||||
|
||||
|
||||
def _emit(payload: dict) -> None:
|
||||
sys.stdout.write(json.dumps(payload, indent=2) + "\n")
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# create-user
|
||||
# ---------------------------------------------------------------------------
|
||||
def _cmd_create_user(argv: list[str]) -> int:
|
||||
p = argparse.ArgumentParser(prog="hf-cli admin create-user")
|
||||
p.add_argument("--email", required=True)
|
||||
p.add_argument("--username", default=None,
|
||||
help="Defaults to email's local-part if omitted.")
|
||||
p.add_argument("--full-name", default="Admin")
|
||||
p.add_argument("--password", default=None,
|
||||
help="Required when HARBORFORGE_OIDC_ONLY=false. Ignored "
|
||||
"when OIDC_ONLY=true (use --oidc-issuer/--oidc-subject).")
|
||||
p.add_argument("--oidc-issuer", default=None,
|
||||
help="Bind the new admin to this OIDC issuer at creation. "
|
||||
"Required in OIDC_ONLY mode for the bootstrap admin.")
|
||||
p.add_argument("--oidc-subject", default=None,
|
||||
help="OIDC subject claim (sub) to bind the new admin to.")
|
||||
args = p.parse_args(argv)
|
||||
|
||||
username = args.username or args.email.split("@", 1)[0]
|
||||
oidc_only = bool(settings.HARBORFORGE_OIDC_ONLY)
|
||||
|
||||
if oidc_only:
|
||||
if not (args.oidc_issuer and args.oidc_subject):
|
||||
sys.stderr.write(
|
||||
"HARBORFORGE_OIDC_ONLY=true: must pass --oidc-issuer and "
|
||||
"--oidc-subject so the new admin can sign in.\n"
|
||||
)
|
||||
return 2
|
||||
hashed_password = None
|
||||
else:
|
||||
if not args.password:
|
||||
sys.stderr.write("--password is required when OIDC_ONLY is false.\n")
|
||||
return 2
|
||||
hashed_password = get_password_hash(args.password)
|
||||
|
||||
if (args.oidc_issuer and not args.oidc_subject) or (args.oidc_subject and not args.oidc_issuer):
|
||||
sys.stderr.write("--oidc-issuer and --oidc-subject must be passed together.\n")
|
||||
return 2
|
||||
|
||||
db = _open_db()
|
||||
try:
|
||||
existing = db.query(models.User).filter(models.User.username == username).first()
|
||||
if existing:
|
||||
sys.stderr.write(f"user '{username}' already exists (id={existing.id})\n")
|
||||
return 3
|
||||
|
||||
admin_role = db.query(Role).filter(Role.name == "admin").first()
|
||||
if not admin_role:
|
||||
sys.stderr.write(
|
||||
"admin role not found — backend startup seed should create it. "
|
||||
"Restart the container then retry.\n"
|
||||
)
|
||||
return 4
|
||||
|
||||
user = models.User(
|
||||
username=username,
|
||||
email=args.email,
|
||||
full_name=args.full_name,
|
||||
hashed_password=hashed_password,
|
||||
is_admin=True,
|
||||
is_active=True,
|
||||
role_id=admin_role.id,
|
||||
oidc_issuer=(args.oidc_issuer or None),
|
||||
oidc_subject=(args.oidc_subject or None),
|
||||
)
|
||||
db.add(user)
|
||||
try:
|
||||
db.commit()
|
||||
except IntegrityError as e:
|
||||
db.rollback()
|
||||
sys.stderr.write(f"DB integrity error: {e.orig}\n")
|
||||
return 5
|
||||
db.refresh(user)
|
||||
|
||||
_emit({
|
||||
"ok": True,
|
||||
"created": True,
|
||||
"user": {
|
||||
"id": user.id,
|
||||
"username": user.username,
|
||||
"email": user.email,
|
||||
"full_name": user.full_name,
|
||||
"is_admin": user.is_admin,
|
||||
"role_id": user.role_id,
|
||||
"oidc_issuer": user.oidc_issuer,
|
||||
"oidc_subject": user.oidc_subject,
|
||||
"has_password": user.hashed_password is not None,
|
||||
},
|
||||
})
|
||||
return 0
|
||||
finally:
|
||||
db.close()
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# list
|
||||
# ---------------------------------------------------------------------------
|
||||
def _cmd_list(_argv: list[str]) -> int:
|
||||
db = _open_db()
|
||||
try:
|
||||
admins = (
|
||||
db.query(models.User)
|
||||
.filter(models.User.is_admin == True) # noqa: E712
|
||||
.order_by(models.User.id.asc())
|
||||
.all()
|
||||
)
|
||||
_emit({
|
||||
"ok": True,
|
||||
"count": len(admins),
|
||||
"admins": [
|
||||
{
|
||||
"id": u.id,
|
||||
"username": u.username,
|
||||
"email": u.email,
|
||||
"is_active": u.is_active,
|
||||
"oidc_bound": bool(u.oidc_issuer and u.oidc_subject),
|
||||
"has_password": u.hashed_password is not None,
|
||||
}
|
||||
for u in admins
|
||||
],
|
||||
})
|
||||
return 0
|
||||
finally:
|
||||
db.close()
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# set-role
|
||||
# ---------------------------------------------------------------------------
|
||||
def _cmd_set_role(argv: list[str]) -> int:
|
||||
p = argparse.ArgumentParser(prog="hf-cli admin set-role")
|
||||
p.add_argument("--username", required=True)
|
||||
p.add_argument("--role", required=True)
|
||||
args = p.parse_args(argv)
|
||||
|
||||
db = _open_db()
|
||||
try:
|
||||
user = db.query(models.User).filter(models.User.username == args.username).first()
|
||||
if not user:
|
||||
sys.stderr.write(f"user '{args.username}' not found\n")
|
||||
return 3
|
||||
role = db.query(Role).filter(Role.name == args.role).first()
|
||||
if not role:
|
||||
sys.stderr.write(f"role '{args.role}' not found\n")
|
||||
return 4
|
||||
user.role_id = role.id
|
||||
user.is_admin = (args.role == "admin")
|
||||
db.commit()
|
||||
_emit({
|
||||
"ok": True,
|
||||
"user": {"id": user.id, "username": user.username, "role": role.name, "is_admin": user.is_admin},
|
||||
})
|
||||
return 0
|
||||
finally:
|
||||
db.close()
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# reset-password
|
||||
# ---------------------------------------------------------------------------
|
||||
def _cmd_reset_password(argv: list[str]) -> int:
|
||||
p = argparse.ArgumentParser(prog="hf-cli admin reset-password")
|
||||
p.add_argument("--username", required=True)
|
||||
p.add_argument("--password", required=True)
|
||||
args = p.parse_args(argv)
|
||||
|
||||
if settings.HARBORFORGE_OIDC_ONLY:
|
||||
sys.stderr.write("HARBORFORGE_OIDC_ONLY=true: password login is disabled.\n")
|
||||
return 2
|
||||
|
||||
db = _open_db()
|
||||
try:
|
||||
user = db.query(models.User).filter(models.User.username == args.username).first()
|
||||
if not user:
|
||||
sys.stderr.write(f"user '{args.username}' not found\n")
|
||||
return 3
|
||||
user.hashed_password = get_password_hash(args.password)
|
||||
db.commit()
|
||||
_emit({"ok": True, "user": {"id": user.id, "username": user.username, "password_reset": True}})
|
||||
return 0
|
||||
finally:
|
||||
db.close()
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# bind-oidc — attach an OIDC identity to an existing admin
|
||||
# ---------------------------------------------------------------------------
|
||||
def _cmd_bind_oidc(argv: list[str]) -> int:
|
||||
p = argparse.ArgumentParser(prog="hf-cli admin bind-oidc")
|
||||
p.add_argument("--username", required=True)
|
||||
p.add_argument("--oidc-issuer", required=True)
|
||||
p.add_argument("--oidc-subject", required=True)
|
||||
args = p.parse_args(argv)
|
||||
|
||||
db = _open_db()
|
||||
try:
|
||||
user = db.query(models.User).filter(models.User.username == args.username).first()
|
||||
if not user:
|
||||
sys.stderr.write(f"user '{args.username}' not found\n")
|
||||
return 3
|
||||
clash = db.query(models.User).filter(
|
||||
models.User.oidc_issuer == args.oidc_issuer,
|
||||
models.User.oidc_subject == args.oidc_subject,
|
||||
models.User.id != user.id,
|
||||
).first()
|
||||
if clash:
|
||||
sys.stderr.write(f"OIDC subject already bound to '{clash.username}' (id={clash.id})\n")
|
||||
return 4
|
||||
user.oidc_issuer = args.oidc_issuer
|
||||
user.oidc_subject = args.oidc_subject
|
||||
db.commit()
|
||||
_emit({
|
||||
"ok": True,
|
||||
"user": {
|
||||
"id": user.id,
|
||||
"username": user.username,
|
||||
"oidc_issuer": user.oidc_issuer,
|
||||
"oidc_subject": user.oidc_subject,
|
||||
},
|
||||
})
|
||||
return 0
|
||||
finally:
|
||||
db.close()
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# dispatcher
|
||||
# ---------------------------------------------------------------------------
|
||||
ACTIONS = {
|
||||
"create-user": _cmd_create_user,
|
||||
"list": _cmd_list,
|
||||
"set-role": _cmd_set_role,
|
||||
"reset-password": _cmd_reset_password,
|
||||
"bind-oidc": _cmd_bind_oidc,
|
||||
}
|
||||
|
||||
|
||||
def dispatch(argv: list[str]) -> int:
|
||||
if not argv:
|
||||
sys.stderr.write("admin: missing action; one of: " + ", ".join(ACTIONS) + "\n")
|
||||
return 1
|
||||
action, rest = argv[0], argv[1:]
|
||||
fn = ACTIONS.get(action)
|
||||
if not fn:
|
||||
sys.stderr.write(f"admin: unknown action '{action}'; valid: {', '.join(ACTIONS)}\n")
|
||||
return 1
|
||||
return fn(rest)
|
||||
@@ -1,108 +0,0 @@
|
||||
"""hf-cli config … — runtime configuration stored in DB.
|
||||
|
||||
Currently only the OIDC provider config has a CLI surface (it used to
|
||||
live in the AbstractWizard config). Mirrors dialectic-cli's
|
||||
`config oidc` shape: only the flags you pass are mutated, the rest stays
|
||||
unchanged. Prints the post-update row with client_secret masked unless
|
||||
--show-secret is given.
|
||||
"""
|
||||
import argparse
|
||||
import json
|
||||
import sys
|
||||
|
||||
from app.core.config import SessionLocal
|
||||
from app.models.oidc_settings import OidcSettings
|
||||
|
||||
|
||||
def _emit(payload: dict) -> None:
|
||||
sys.stdout.write(json.dumps(payload, indent=2) + "\n")
|
||||
|
||||
|
||||
def _bool(v: str) -> bool:
|
||||
return v.lower() in ("1", "true", "yes", "on")
|
||||
|
||||
|
||||
def _cmd_oidc(argv: list[str]) -> int:
|
||||
p = argparse.ArgumentParser(prog="hf-cli config oidc")
|
||||
p.add_argument("--issuer", default=None)
|
||||
p.add_argument("--client-id", default=None)
|
||||
p.add_argument("--client-secret", default=None)
|
||||
p.add_argument("--redirect-uri", default=None)
|
||||
p.add_argument("--post-login-redirect", default=None)
|
||||
p.add_argument("--scopes", default=None,
|
||||
help='Default: "openid email profile"')
|
||||
p.add_argument("--admin-role", default=None,
|
||||
help="OIDC role name that bootstraps an unbound hf admin "
|
||||
"on first OIDC-only login. Default: admin.")
|
||||
p.add_argument("--enabled", default=None,
|
||||
help="true|false. Without this flag the row's existing "
|
||||
"value is preserved.")
|
||||
p.add_argument("--show-secret", action="store_true",
|
||||
help="Reveal client_secret in the output (local audit "
|
||||
"only — never paste into chat).")
|
||||
args = p.parse_args(argv)
|
||||
|
||||
db = SessionLocal()
|
||||
try:
|
||||
row = db.query(OidcSettings).filter(OidcSettings.id == 1).first()
|
||||
if row is None:
|
||||
row = OidcSettings(id=1, enabled=False)
|
||||
db.add(row)
|
||||
|
||||
if args.issuer is not None:
|
||||
row.issuer = args.issuer.strip() or None
|
||||
if args.client_id is not None:
|
||||
row.client_id = args.client_id.strip() or None
|
||||
if args.client_secret is not None:
|
||||
row.client_secret = args.client_secret or None
|
||||
if args.redirect_uri is not None:
|
||||
row.redirect_uri = args.redirect_uri.strip() or None
|
||||
if args.post_login_redirect is not None:
|
||||
row.post_login_redirect = args.post_login_redirect.strip() or None
|
||||
if args.scopes is not None:
|
||||
row.scopes = args.scopes.strip() or None
|
||||
if args.admin_role is not None:
|
||||
row.admin_role = args.admin_role.strip() or None
|
||||
if args.enabled is not None:
|
||||
row.enabled = _bool(args.enabled)
|
||||
|
||||
db.commit()
|
||||
db.refresh(row)
|
||||
|
||||
out: dict = {
|
||||
"enabled": bool(row.enabled),
|
||||
"issuer": row.issuer,
|
||||
"client_id": row.client_id,
|
||||
"redirect_uri": row.redirect_uri,
|
||||
"post_login_redirect": row.post_login_redirect,
|
||||
"scopes": row.scopes,
|
||||
"admin_role": row.admin_role,
|
||||
}
|
||||
if args.show_secret:
|
||||
out["client_secret"] = row.client_secret
|
||||
elif row.client_secret:
|
||||
out["client_secret"] = "***set***"
|
||||
else:
|
||||
out["client_secret"] = None
|
||||
|
||||
_emit({"ok": True, "config": out})
|
||||
return 0
|
||||
finally:
|
||||
db.close()
|
||||
|
||||
|
||||
ACTIONS = {
|
||||
"oidc": _cmd_oidc,
|
||||
}
|
||||
|
||||
|
||||
def dispatch(argv: list[str]) -> int:
|
||||
if not argv:
|
||||
sys.stderr.write("config: missing action; one of: " + ", ".join(ACTIONS) + "\n")
|
||||
return 1
|
||||
action, rest = argv[0], argv[1:]
|
||||
fn = ACTIONS.get(action)
|
||||
if not fn:
|
||||
sys.stderr.write(f"config: unknown action '{action}'; valid: {', '.join(ACTIONS)}\n")
|
||||
return 1
|
||||
return fn(rest)
|
||||
@@ -1,13 +1,34 @@
|
||||
"""Backend runtime settings — env-only (no wizard / no config volume).
|
||||
|
||||
OIDC issuer/client_id/etc. live in the `oidc_settings` DB table set
|
||||
via `hf-cli config oidc ...`. The OIDC_ONLY flag remains env-driven
|
||||
because it's a deploy-time policy, not a per-tenant runtime config.
|
||||
"""
|
||||
import os
|
||||
import json
|
||||
from sqlalchemy import create_engine
|
||||
from sqlalchemy.ext.declarative import declarative_base
|
||||
from sqlalchemy.orm import sessionmaker
|
||||
from pydantic_settings import BaseSettings
|
||||
from typing import Optional
|
||||
|
||||
|
||||
def _resolve_db_url(env_url: str) -> str:
|
||||
"""Read DB config from wizard config volume if available, else use env."""
|
||||
config_dir = os.getenv("CONFIG_DIR", "/config")
|
||||
config_file = os.getenv("CONFIG_FILE", "harborforge.json")
|
||||
config_path = os.path.join(config_dir, config_file)
|
||||
|
||||
if os.path.exists(config_path):
|
||||
try:
|
||||
with open(config_path, "r") as f:
|
||||
cfg = json.load(f)
|
||||
db_cfg = cfg.get("database")
|
||||
if db_cfg:
|
||||
host = db_cfg.get("host", "mysql")
|
||||
port = db_cfg.get("port", 3306)
|
||||
user = db_cfg.get("user", "harborforge")
|
||||
password = db_cfg.get("password", "harborforge_pass")
|
||||
database = db_cfg.get("database", "harborforge")
|
||||
return f"mysql+pymysql://{user}:{password}@{host}:{port}/{database}"
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
return env_url
|
||||
|
||||
|
||||
class Settings(BaseSettings):
|
||||
@@ -17,38 +38,15 @@ class Settings(BaseSettings):
|
||||
ALGORITHM: str = "HS256"
|
||||
ACCESS_TOKEN_EXPIRE_MINUTES: int = 30
|
||||
|
||||
# When true: no password login at all. Password login endpoint rejects,
|
||||
# user creation ignores any password (passwordless users that only sign
|
||||
# in via a bound OIDC identity / API keys), frontend hides password UI.
|
||||
HARBORFORGE_OIDC_ONLY: bool = False
|
||||
|
||||
# Mark the OIDC state/session cookie Secure (HTTPS-only). Defaults to True
|
||||
# for production; set SESSION_COOKIE_SECURE=false for plain-HTTP local dev.
|
||||
SESSION_COOKIE_SECURE: bool = True
|
||||
|
||||
class Config:
|
||||
env_file = ".env"
|
||||
|
||||
|
||||
settings = Settings()
|
||||
|
||||
# Fail fast on a weak/default JWT signing key (prevents token forgery).
|
||||
_WEAK_SECRETS = {
|
||||
"change-me-in-production",
|
||||
"change_me_in_production",
|
||||
"change-me-use-openssl-rand-hex-32",
|
||||
"secret",
|
||||
"changeme",
|
||||
"",
|
||||
}
|
||||
if settings.SECRET_KEY in _WEAK_SECRETS or len(settings.SECRET_KEY) < 32:
|
||||
raise RuntimeError(
|
||||
"Insecure SECRET_KEY: set a strong random value "
|
||||
"(e.g. `openssl rand -hex 32`) via the SECRET_KEY env var. "
|
||||
"Refusing to start with a default/short key."
|
||||
)
|
||||
|
||||
engine = create_engine(settings.DATABASE_URL, pool_pre_ping=True)
|
||||
# Resolve DB URL: wizard config volume > env > default
|
||||
_db_url = _resolve_db_url(settings.DATABASE_URL)
|
||||
engine = create_engine(_db_url, pool_pre_ping=True)
|
||||
SessionLocal = sessionmaker(autocommit=False, autoflush=False, bind=engine)
|
||||
Base = declarative_base()
|
||||
|
||||
|
||||
@@ -1,42 +1,103 @@
|
||||
"""
|
||||
HarborForge unconditional startup seeds — runs every time backend boots.
|
||||
HarborForge initialization from AbstractWizard config volume.
|
||||
|
||||
Seeds default permissions, default roles, the `acc-mgr` built-in (account
|
||||
provisioning agent), and the `deleted-user` foreign-key sink. Idempotent;
|
||||
existing rows are left alone.
|
||||
|
||||
Wizard/.json config bootstrap has been removed entirely as of v0.4.0.
|
||||
First-deploy admin user, OIDC settings, and discord webhook config all
|
||||
moved to operator-driven flows:
|
||||
|
||||
docker exec hf-backend hf-cli admin create-user --email ... --password ...
|
||||
docker exec hf-backend hf-cli config oidc --issuer ... --client-id ...
|
||||
|
||||
Builtin accounts created here:
|
||||
- acc-mgr (account-manager role) — cannot log in, used by the
|
||||
account-creation API as a system principal
|
||||
- deleted-user — FK sink so user delete doesn't cascade
|
||||
|
||||
The bootstrap admin user is NOT created here — that's CLI-driven so
|
||||
operators pick the email/password themselves.
|
||||
Reads config from shared volume (written by AbstractWizard).
|
||||
On startup, creates admin user and default project if not exists.
|
||||
"""
|
||||
import os
|
||||
import json
|
||||
import logging
|
||||
from sqlalchemy.orm import Session
|
||||
|
||||
from app.models import models
|
||||
from app.models.role_permission import Role, Permission, RolePermission
|
||||
from app.api.deps import get_password_hash
|
||||
|
||||
logger = logging.getLogger("harborforge.bootstrap")
|
||||
logger = logging.getLogger("harborforge.init")
|
||||
|
||||
CONFIG_DIR = os.getenv("CONFIG_DIR", "/config")
|
||||
CONFIG_FILE = os.getenv("CONFIG_FILE", "harborforge.json")
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Permissions catalog (canonical; new perms get added on every release)
|
||||
# ---------------------------------------------------------------------------
|
||||
def load_config() -> dict | None:
|
||||
"""Load initialization config from shared volume."""
|
||||
config_path = os.path.join(CONFIG_DIR, CONFIG_FILE)
|
||||
if not os.path.exists(config_path):
|
||||
logger.info("No config file at %s, skipping initialization", config_path)
|
||||
return None
|
||||
try:
|
||||
with open(config_path, "r") as f:
|
||||
return json.load(f)
|
||||
except Exception as e:
|
||||
logger.warning("Failed to read config %s: %s", config_path, e)
|
||||
return None
|
||||
|
||||
|
||||
def get_db_url(config: dict) -> str | None:
|
||||
"""Build DATABASE_URL from wizard config, or fall back to env."""
|
||||
db_cfg = config.get("database")
|
||||
if not db_cfg:
|
||||
return os.getenv("DATABASE_URL")
|
||||
|
||||
host = db_cfg.get("host", "mysql")
|
||||
port = db_cfg.get("port", 3306)
|
||||
user = db_cfg.get("user", "harborforge")
|
||||
password = db_cfg.get("password", "harborforge_pass")
|
||||
database = db_cfg.get("database", "harborforge")
|
||||
return f"mysql+pymysql://{user}:{password}@{host}:{port}/{database}"
|
||||
|
||||
|
||||
def init_admin_user(db: Session, admin_cfg: dict) -> models.User | None:
|
||||
"""Create admin user if not exists."""
|
||||
username = admin_cfg.get("username", "admin")
|
||||
existing = db.query(models.User).filter(models.User.username == username).first()
|
||||
if existing:
|
||||
logger.info("Admin user '%s' already exists (id=%d), skipping", username, existing.id)
|
||||
return existing
|
||||
|
||||
password = admin_cfg.get("password", "changeme")
|
||||
user = models.User(
|
||||
username=username,
|
||||
email=admin_cfg.get("email", f"{username}@harborforge.local"),
|
||||
full_name=admin_cfg.get("full_name", "Admin"),
|
||||
hashed_password=get_password_hash(password),
|
||||
is_admin=True,
|
||||
is_active=True,
|
||||
)
|
||||
db.add(user)
|
||||
db.commit()
|
||||
db.refresh(user)
|
||||
logger.info("Created admin user '%s' (id=%d)", username, user.id)
|
||||
return user
|
||||
|
||||
|
||||
def init_default_project(db: Session, project_cfg: dict, owner_id: int, owner_name: str = "") -> None:
|
||||
"""Create default project if configured and not exists."""
|
||||
name = project_cfg.get("name")
|
||||
if not name:
|
||||
return
|
||||
existing = db.query(models.Project).filter(models.Project.name == name).first()
|
||||
if existing:
|
||||
logger.info("Project '%s' already exists (id=%d), skipping", name, existing.id)
|
||||
return
|
||||
|
||||
project = models.Project(
|
||||
name=name,
|
||||
description=project_cfg.get("description", ""),
|
||||
owner_name=project_cfg.get("owner") or owner_name or "",
|
||||
owner_id=owner_id,
|
||||
)
|
||||
db.add(project)
|
||||
db.commit()
|
||||
db.refresh(project)
|
||||
logger.info("Created default project '%s' (id=%d)", name, project.id)
|
||||
|
||||
|
||||
# Default permissions that will be created if not exist
|
||||
DEFAULT_PERMISSIONS = [
|
||||
# Project permissions
|
||||
("project.read", "View project", "project"),
|
||||
("project.write", "Edit project", "project"),
|
||||
("project.create", "Create a project", "project"),
|
||||
("project.delete", "Delete project", "project"),
|
||||
("project.manage_members", "Manage project members", "project"),
|
||||
# Task/Milestone permissions
|
||||
@@ -77,17 +138,11 @@ DEFAULT_PERMISSIONS = [
|
||||
("calendar.manage", "Manage calendar settings and workload policies", "calendar"),
|
||||
# Webhook
|
||||
("webhook.manage", "Manage webhooks", "admin"),
|
||||
# Project member management (used by DELETE /projects/{id}/members/{user_id})
|
||||
("member.remove", "Remove a project member", "project"),
|
||||
# Schedule type (calendar templates) — read covers list+detail, manage covers
|
||||
# create/edit/delete on schedule_types AND their special slots.
|
||||
("schedule_type.read", "View schedule types and special slots", "calendar"),
|
||||
("schedule_type.manage", "Create / edit / delete schedule types and slots", "calendar"),
|
||||
]
|
||||
|
||||
|
||||
def init_default_permissions(db: Session) -> list[Permission]:
|
||||
"""Insert any missing perms from DEFAULT_PERMISSIONS. Returns all rows."""
|
||||
"""Create default permissions if they don't exist. Returns all permissions."""
|
||||
created = []
|
||||
for name, description, category in DEFAULT_PERMISSIONS:
|
||||
existing = db.query(Permission).filter(Permission.name == name).first()
|
||||
@@ -96,16 +151,21 @@ def init_default_permissions(db: Session) -> list[Permission]:
|
||||
db.add(perm)
|
||||
created.append(perm)
|
||||
logger.info("Created permission '%s'", name)
|
||||
|
||||
if created:
|
||||
db.commit()
|
||||
|
||||
# Return all permissions
|
||||
return db.query(Permission).all()
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Default roles + permission set per role
|
||||
# Default role → permission mapping
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
# mgr: project management + all milestone/task/proposal actions
|
||||
_MGR_PERMISSIONS = {
|
||||
"project.read", "project.write", "project.create", "project.manage_members",
|
||||
"project.read", "project.write", "project.manage_members",
|
||||
"task.create", "task.read", "task.write", "task.delete",
|
||||
"milestone.create", "milestone.read", "milestone.write", "milestone.delete",
|
||||
"milestone.freeze", "milestone.start", "milestone.close",
|
||||
@@ -116,6 +176,7 @@ _MGR_PERMISSIONS = {
|
||||
"user.reset-self-apikey",
|
||||
}
|
||||
|
||||
# dev: day-to-day development work — no freeze/start/close milestone, no accept/reject proposal
|
||||
_DEV_PERMISSIONS = {
|
||||
"project.read",
|
||||
"task.create", "task.read", "task.write",
|
||||
@@ -128,34 +189,20 @@ _DEV_PERMISSIONS = {
|
||||
|
||||
_ACCOUNT_MANAGER_PERMISSIONS = {
|
||||
"account.create",
|
||||
"user.reset-apikey",
|
||||
}
|
||||
|
||||
# Default role for agents (assigned automatically by POST /users when
|
||||
# the create-user payload carries agent_id/claw_identifier — see
|
||||
# app/api/routers/users.py:_resolve_user_role). Guest-tier reads +
|
||||
# self-service API-key rotation so agents can manage their own creds
|
||||
# without admin intervention.
|
||||
_GENERAL_AGENT_PERMISSIONS = {
|
||||
"project.read",
|
||||
"task.read",
|
||||
"milestone.read",
|
||||
"monitor.read",
|
||||
"calendar.read",
|
||||
"user.reset-self-apikey",
|
||||
}
|
||||
|
||||
# Role definitions: (name, description, permission_set)
|
||||
_DEFAULT_ROLES = [
|
||||
("admin", "Administrator - full access to all features", None), # None ⇒ all perms
|
||||
("admin", "Administrator - full access to all features", None), # None ⇒ all perms
|
||||
("account-manager", "Account manager - can only create accounts", _ACCOUNT_MANAGER_PERMISSIONS),
|
||||
("mgr", "Manager - project & milestone management", _MGR_PERMISSIONS),
|
||||
("dev", "Developer - task execution & daily work", _DEV_PERMISSIONS),
|
||||
("general-agent", "General agent - read-only + self API key rotation", _GENERAL_AGENT_PERMISSIONS),
|
||||
("guest", "Guest - read-only access", None), # special: *.read only
|
||||
("guest", "Guest - read-only access", None), # special: *.read only
|
||||
]
|
||||
|
||||
|
||||
def _ensure_role(db: Session, name: str, description: str, is_global: bool = True) -> Role:
|
||||
"""Get or create a role by name."""
|
||||
role = db.query(Role).filter(Role.name == name).first()
|
||||
if not role:
|
||||
role = Role(name=name, description=description, is_global=is_global)
|
||||
@@ -167,8 +214,13 @@ def _ensure_role(db: Session, name: str, description: str, is_global: bool = Tru
|
||||
|
||||
|
||||
def _sync_role_permissions(db: Session, role: Role, target_perm_names: set[str] | None) -> None:
|
||||
"""Additive: grants missing perms, never revokes manually-granted ones.
|
||||
``target_perm_names is None`` means **all** perms (admin)."""
|
||||
"""Ensure *role* has exactly the permissions in *target_perm_names*.
|
||||
|
||||
* ``None`` means **all** permissions (admin).
|
||||
* The special sentinel ``"__read_only__"`` is handled by the caller passing
|
||||
just the ``*.read`` names.
|
||||
Only adds missing permissions; never removes manually-granted ones (additive).
|
||||
"""
|
||||
all_perms = db.query(Permission).all()
|
||||
perm_by_name = {p.name: p for p in all_perms}
|
||||
|
||||
@@ -182,40 +234,45 @@ def _sync_role_permissions(db: Session, role: Role, target_perm_names: set[str]
|
||||
for pid in wanted_ids - existing_ids:
|
||||
db.add(RolePermission(role_id=role.id, permission_id=pid))
|
||||
added += 1
|
||||
|
||||
if added:
|
||||
db.commit()
|
||||
logger.info("Assigned %d new permissions to role '%s'", added, role.name)
|
||||
|
||||
|
||||
def init_default_roles(db: Session) -> None:
|
||||
"""Create default roles (admin/account-manager/mgr/dev/guest) + permissions."""
|
||||
def init_admin_role(db: Session, admin_user: models.User) -> None:
|
||||
"""Create default roles (admin / mgr / dev / guest) with preset permissions."""
|
||||
|
||||
all_perms = db.query(Permission).all()
|
||||
read_perm_names = {p.name for p in all_perms if p.name.endswith(".read")}
|
||||
|
||||
for name, description, perm_set in _DEFAULT_ROLES:
|
||||
role = _ensure_role(db, name, description)
|
||||
|
||||
if name == "guest":
|
||||
_sync_role_permissions(db, role, read_perm_names)
|
||||
else:
|
||||
_sync_role_permissions(db, role, perm_set)
|
||||
logger.info("Default roles ready (admin / account-manager / mgr / dev / guest)")
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Built-in user accounts (system principals, cannot log in)
|
||||
# ---------------------------------------------------------------------------
|
||||
DELETED_USER_USERNAME = "deleted-user"
|
||||
logger.info("Default roles setup complete (admin, mgr, dev, guest)")
|
||||
|
||||
|
||||
def init_acc_mgr_user(db: Session) -> models.User | None:
|
||||
"""The account-manager system principal. Holds the `account-manager`
|
||||
role so the account-creation API can attribute new users to it. No
|
||||
password, no OIDC binding — cannot log in."""
|
||||
"""Create the built-in acc-mgr user if not exists.
|
||||
|
||||
This user:
|
||||
- Has role 'account-manager' (can only create accounts)
|
||||
- Cannot log in (no password, hashed_password=None)
|
||||
- Cannot be deleted (enforced in delete endpoint)
|
||||
- Is created automatically after wizard initialization
|
||||
"""
|
||||
username = "acc-mgr"
|
||||
existing = db.query(models.User).filter(models.User.username == username).first()
|
||||
if existing:
|
||||
logger.info("acc-mgr user already exists (id=%d), skipping", existing.id)
|
||||
return existing
|
||||
|
||||
# Find account-manager role
|
||||
acc_mgr_role = db.query(Role).filter(Role.name == "account-manager").first()
|
||||
if not acc_mgr_role:
|
||||
logger.warning("account-manager role not found, skipping acc-mgr user creation")
|
||||
@@ -225,7 +282,7 @@ def init_acc_mgr_user(db: Session) -> models.User | None:
|
||||
username=username,
|
||||
email="acc-mgr@harborforge.internal",
|
||||
full_name="Account Manager",
|
||||
hashed_password=None,
|
||||
hashed_password=None, # Cannot log in — no password
|
||||
is_admin=False,
|
||||
is_active=True,
|
||||
role_id=acc_mgr_role.id,
|
||||
@@ -237,42 +294,33 @@ def init_acc_mgr_user(db: Session) -> models.User | None:
|
||||
return user
|
||||
|
||||
|
||||
def init_deleted_user(db: Session) -> models.User | None:
|
||||
"""FK sink for deleted users — when a real user is deleted, all FK
|
||||
references reassign here instead of cascading."""
|
||||
existing = db.query(models.User).filter(
|
||||
models.User.username == DELETED_USER_USERNAME
|
||||
).first()
|
||||
if existing:
|
||||
return existing
|
||||
def run_init(db: Session) -> None:
|
||||
"""Main initialization entry point. Reads config from shared volume."""
|
||||
config = load_config()
|
||||
if not config:
|
||||
return
|
||||
|
||||
user = models.User(
|
||||
username=DELETED_USER_USERNAME,
|
||||
email="deleted-user@harborforge.internal",
|
||||
full_name="Deleted User",
|
||||
hashed_password=None,
|
||||
is_admin=False,
|
||||
is_active=False,
|
||||
role_id=None,
|
||||
)
|
||||
db.add(user)
|
||||
db.commit()
|
||||
db.refresh(user)
|
||||
logger.info("Created deleted-user (id=%d)", user.id)
|
||||
return user
|
||||
logger.info("Running HarborForge initialization from wizard config")
|
||||
|
||||
# Initialize default permissions and admin role (always run)
|
||||
all_perms = init_default_permissions(db)
|
||||
logger.info("Default permissions initialized: %d total", len(all_perms))
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Top-level bootstrap entry point — called from main.py startup
|
||||
# ---------------------------------------------------------------------------
|
||||
def run_bootstrap(db: Session) -> None:
|
||||
"""Idempotent startup seed. Safe to call on every boot.
|
||||
# Admin user
|
||||
admin_cfg = config.get("admin")
|
||||
admin_user = None
|
||||
if admin_cfg:
|
||||
admin_user = init_admin_user(db, admin_cfg)
|
||||
# Create admin role and assign to admin user
|
||||
if admin_user:
|
||||
init_admin_role(db, admin_user)
|
||||
|
||||
Does NOT create the admin user — that's CLI-driven (see hf-cli admin
|
||||
create-user) so operators pick credentials.
|
||||
"""
|
||||
init_default_permissions(db)
|
||||
init_default_roles(db)
|
||||
# Built-in acc-mgr user (after roles are created)
|
||||
init_acc_mgr_user(db)
|
||||
init_deleted_user(db)
|
||||
logger.info("Bootstrap seeds complete")
|
||||
|
||||
# Default project
|
||||
project_cfg = config.get("default_project")
|
||||
if project_cfg and admin_user:
|
||||
init_default_project(db, project_cfg, admin_user.id, admin_user.username)
|
||||
|
||||
logger.info("Initialization complete")
|
||||
148
app/main.py
148
app/main.py
@@ -1,9 +1,6 @@
|
||||
"""HarborForge API — Agent/人类协同任务管理平台"""
|
||||
from fastapi import FastAPI
|
||||
from fastapi.middleware.cors import CORSMiddleware
|
||||
from starlette.middleware.sessions import SessionMiddleware
|
||||
|
||||
from app.core.config import settings
|
||||
|
||||
app = FastAPI(
|
||||
title="HarborForge API",
|
||||
@@ -20,17 +17,6 @@ app.add_middleware(
|
||||
allow_headers=["*"],
|
||||
)
|
||||
|
||||
# Short-lived signed session cookie — only used to carry the OIDC
|
||||
# state/nonce between /auth/oidc/login and the callback.
|
||||
app.add_middleware(
|
||||
SessionMiddleware,
|
||||
secret_key=settings.SECRET_KEY,
|
||||
session_cookie="hf_oidc",
|
||||
same_site="lax",
|
||||
https_only=settings.SESSION_COOKIE_SECURE,
|
||||
max_age=600,
|
||||
)
|
||||
|
||||
# Health & version (kept at top level)
|
||||
@app.get("/health", tags=["System"])
|
||||
def health_check():
|
||||
@@ -42,22 +28,24 @@ def version():
|
||||
|
||||
@app.get("/config/status", tags=["System"])
|
||||
def config_status():
|
||||
"""Has the deployment been bootstrapped (admin user exists)?
|
||||
|
||||
Frontend hits this on mount to decide whether to show login or a
|
||||
"no admin yet, run hf-cli admin create-user" placeholder. With the
|
||||
wizard removed in v0.4.0 the only deploy-time bootstrap step is the
|
||||
operator running `docker exec hf-backend hf-cli admin create-user ...`
|
||||
once; this endpoint just reports whether that has happened.
|
||||
"""
|
||||
from app.core.config import SessionLocal
|
||||
from app.models import models
|
||||
db = SessionLocal()
|
||||
"""Check if HarborForge has been initialized (reads from config volume).
|
||||
Frontend uses this instead of contacting the wizard directly."""
|
||||
import os, json
|
||||
config_dir = os.getenv("CONFIG_DIR", "/config")
|
||||
config_file = os.getenv("CONFIG_FILE", "harborforge.json")
|
||||
config_path = os.path.join(config_dir, config_file)
|
||||
if not os.path.exists(config_path):
|
||||
return {"initialized": False}
|
||||
try:
|
||||
admin_count = db.query(models.User).filter(models.User.is_admin == True).count() # noqa: E712
|
||||
return {"initialized": admin_count > 0}
|
||||
finally:
|
||||
db.close()
|
||||
with open(config_path, "r") as f:
|
||||
cfg = json.load(f)
|
||||
return {
|
||||
"initialized": cfg.get("initialized", False),
|
||||
"backend_url": cfg.get("backend_url"),
|
||||
"discord": cfg.get("discord") or {},
|
||||
}
|
||||
except Exception:
|
||||
return {"initialized": False}
|
||||
|
||||
# Register routers
|
||||
from app.api.routers.auth import router as auth_router
|
||||
@@ -75,13 +63,9 @@ from app.api.routers.proposes import router as proposes_router # legacy compat
|
||||
from app.api.routers.milestone_actions import router as milestone_actions_router
|
||||
from app.api.routers.meetings import router as meetings_router
|
||||
from app.api.routers.essentials import router as essentials_router
|
||||
from app.api.routers.schedule_type import router as schedule_type_router
|
||||
from app.api.routers.schedule_type_special_slot import router as schedule_type_special_slot_router
|
||||
from app.api.routers.calendar import router as calendar_router
|
||||
from app.api.routers.oidc import router as oidc_router
|
||||
|
||||
app.include_router(auth_router)
|
||||
app.include_router(oidc_router)
|
||||
app.include_router(tasks_router)
|
||||
app.include_router(projects_router)
|
||||
app.include_router(users_router)
|
||||
@@ -96,8 +80,6 @@ app.include_router(proposes_router) # legacy compat
|
||||
app.include_router(milestone_actions_router)
|
||||
app.include_router(meetings_router)
|
||||
app.include_router(essentials_router)
|
||||
app.include_router(schedule_type_router)
|
||||
app.include_router(schedule_type_special_slot_router)
|
||||
app.include_router(calendar_router)
|
||||
|
||||
|
||||
@@ -293,18 +275,6 @@ def _migrate_schema():
|
||||
if _has_table(db, "users") and not _has_column(db, "users", "discord_user_id"):
|
||||
db.execute(text("ALTER TABLE users ADD COLUMN discord_user_id VARCHAR(32) NULL"))
|
||||
|
||||
# --- users OIDC binding (issuer + subject), unique together ---
|
||||
if _has_table(db, "users") and not _has_column(db, "users", "oidc_issuer"):
|
||||
db.execute(text("ALTER TABLE users ADD COLUMN oidc_issuer VARCHAR(255) NULL"))
|
||||
if _has_table(db, "users") and not _has_column(db, "users", "oidc_subject"):
|
||||
db.execute(text("ALTER TABLE users ADD COLUMN oidc_subject VARCHAR(255) NULL"))
|
||||
if _has_table(db, "users") and _has_column(db, "users", "oidc_subject"):
|
||||
_ensure_unique_index(db, "users", "uq_users_oidc_identity", "oidc_issuer, oidc_subject")
|
||||
|
||||
# --- oidc_settings.admin_role (added after the table shipped) ---
|
||||
if _has_table(db, "oidc_settings") and not _has_column(db, "oidc_settings", "admin_role"):
|
||||
db.execute(text("ALTER TABLE oidc_settings ADD COLUMN admin_role VARCHAR(128) NULL"))
|
||||
|
||||
# --- monitored_servers.api_key for heartbeat v2 ---
|
||||
if _has_table(db, "monitored_servers") and not _has_column(db, "monitored_servers", "api_key"):
|
||||
db.execute(text("ALTER TABLE monitored_servers ADD COLUMN api_key VARCHAR(64) NULL"))
|
||||
@@ -393,80 +363,6 @@ def _migrate_schema():
|
||||
if _has_table(db, "time_slots") and not _has_column(db, "time_slots", "wakeup_sent_at"):
|
||||
db.execute(text("ALTER TABLE time_slots ADD COLUMN wakeup_sent_at DATETIME NULL"))
|
||||
|
||||
# --- agents: add schedule_type_id FK ---
|
||||
if _has_table(db, "agents") and not _has_column(db, "agents", "schedule_type_id"):
|
||||
db.execute(text("ALTER TABLE agents ADD COLUMN schedule_type_id INTEGER NULL"))
|
||||
|
||||
# --- schedule_types: add maintenance_from / maintenance_to ---
|
||||
# Default 8:00–9:00 UTC for existing rows; the maintenance
|
||||
# duration invariant (1-180min) is enforced at the schema
|
||||
# level for any NEW rows by ScheduleTypeCreate validator.
|
||||
if _has_table(db, "schedule_types"):
|
||||
if not _has_column(db, "schedule_types", "maintenance_from"):
|
||||
db.execute(text(
|
||||
"ALTER TABLE schedule_types ADD COLUMN maintenance_from INT NOT NULL DEFAULT 8"
|
||||
))
|
||||
if not _has_column(db, "schedule_types", "maintenance_to"):
|
||||
db.execute(text(
|
||||
"ALTER TABLE schedule_types ADD COLUMN maintenance_to INT NOT NULL DEFAULT 9"
|
||||
))
|
||||
|
||||
# --- minutes-since-midnight migration (PR #21+) ---
|
||||
# The 6 schedule_type window columns used to hold *hours*
|
||||
# (0-23). PR #21 changed semantics to *minutes since UTC
|
||||
# midnight* (0-1439). Detect the legacy regime by checking
|
||||
# if ANY row has all 6 values ≤ 23 — if so, multiply each
|
||||
# by 60 to convert. Idempotent: post-conversion values are
|
||||
# all ≥ 0 and usually well above 23, so guard never fires
|
||||
# twice.
|
||||
row = db.execute(text(
|
||||
"SELECT MAX(GREATEST(work_from, work_to, entertainment_from, entertainment_to, maintenance_from, maintenance_to)) AS m "
|
||||
"FROM schedule_types"
|
||||
)).fetchone()
|
||||
if row is not None and row.m is not None and row.m <= 23:
|
||||
db.execute(text(
|
||||
"UPDATE schedule_types SET "
|
||||
" work_from = work_from * 60, "
|
||||
" work_to = work_to * 60, "
|
||||
" entertainment_from = entertainment_from * 60, "
|
||||
" entertainment_to = entertainment_to * 60, "
|
||||
" maintenance_from = maintenance_from * 60, "
|
||||
" maintenance_to = maintenance_to * 60"
|
||||
))
|
||||
|
||||
# --- time_slots: admin-locked + special_slot pointer ---
|
||||
if _has_table(db, "time_slots"):
|
||||
if not _has_column(db, "time_slots", "is_admin_locked"):
|
||||
db.execute(text(
|
||||
"ALTER TABLE time_slots ADD COLUMN is_admin_locked TINYINT(1) NOT NULL DEFAULT 0"
|
||||
))
|
||||
if not _has_column(db, "time_slots", "special_slot_id"):
|
||||
db.execute(text(
|
||||
"ALTER TABLE time_slots ADD COLUMN special_slot_id INTEGER NULL"
|
||||
))
|
||||
# Index for the materialiser's idempotency lookup
|
||||
db.execute(text(
|
||||
"CREATE INDEX idx_time_slots_special_slot_id ON time_slots (special_slot_id)"
|
||||
))
|
||||
|
||||
# --- api_keys: migrate legacy plaintext `key` -> hashed `key_hash` ---
|
||||
# Only runs on deployments that still have the old plaintext column;
|
||||
# fresh installs get key_hash/key_prefix directly from create_all.
|
||||
if _has_table(db, "api_keys") and _has_column(db, "api_keys", "key"):
|
||||
if not _has_column(db, "api_keys", "key_hash"):
|
||||
db.execute(text("ALTER TABLE api_keys ADD COLUMN key_hash VARCHAR(64) NULL"))
|
||||
if not _has_column(db, "api_keys", "key_prefix"):
|
||||
db.execute(text("ALTER TABLE api_keys ADD COLUMN key_prefix VARCHAR(16) NULL"))
|
||||
db.execute(text("ALTER TABLE api_keys MODIFY COLUMN `key` VARCHAR(64) NULL"))
|
||||
db.execute(text("UPDATE api_keys SET key_hash = SHA2(`key`, 256), key_prefix = LEFT(`key`, 8) WHERE key_hash IS NULL AND `key` IS NOT NULL"))
|
||||
db.execute(text("UPDATE api_keys SET `key` = NULL WHERE `key` IS NOT NULL"))
|
||||
_ensure_unique_index(db, "api_keys", "idx_api_keys_key_hash", "key_hash")
|
||||
|
||||
# --- schedule_type_special_slots: create-table is handled by
|
||||
# Base.metadata.create_all on first boot; no migration needed here
|
||||
# because there is no legacy table to evolve. Future schema bumps
|
||||
# to that table go in this block.
|
||||
|
||||
db.commit()
|
||||
except Exception as e:
|
||||
db.rollback()
|
||||
@@ -501,17 +397,15 @@ def _sync_default_user_roles(db):
|
||||
@app.on_event("startup")
|
||||
def startup():
|
||||
from app.core.config import Base, engine, SessionLocal
|
||||
from app.models import models, webhook, apikey, activity, milestone, notification, worklog, monitor, role_permission, task, support, meeting, proposal, propose, essential, agent, calendar, minimum_workload, schedule_type, schedule_type_special_slot, oidc_settings
|
||||
from app.models import models, webhook, apikey, activity, milestone, notification, worklog, monitor, role_permission, task, support, meeting, proposal, propose, essential, agent, calendar, minimum_workload
|
||||
Base.metadata.create_all(bind=engine)
|
||||
_migrate_schema()
|
||||
|
||||
# Idempotent startup seed: permissions, default roles, built-in
|
||||
# accounts (acc-mgr, deleted-user). The admin user + OIDC config are
|
||||
# NOT created here — they're operator-driven via hf-cli.
|
||||
from app.init_bootstrap import run_bootstrap
|
||||
# Initialize from AbstractWizard (admin user, default project, etc.)
|
||||
from app.init_wizard import run_init
|
||||
db = SessionLocal()
|
||||
try:
|
||||
run_bootstrap(db)
|
||||
run_init(db)
|
||||
_sync_default_user_roles(db)
|
||||
finally:
|
||||
db.close()
|
||||
|
||||
@@ -131,15 +131,6 @@ class Agent(Base):
|
||||
comment="rate_limit | billing — why the agent is exhausted",
|
||||
)
|
||||
|
||||
# -- schedule type ------------------------------------------------------
|
||||
|
||||
schedule_type_id = Column(
|
||||
Integer,
|
||||
ForeignKey("schedule_types.id"),
|
||||
nullable=True,
|
||||
comment="FK to schedule_types — defines work/entertainment periods",
|
||||
)
|
||||
|
||||
# -- timestamps ---------------------------------------------------------
|
||||
|
||||
created_at = Column(DateTime(timezone=True), server_default=func.now())
|
||||
@@ -147,4 +138,3 @@ class Agent(Base):
|
||||
# -- relationships ------------------------------------------------------
|
||||
|
||||
user = relationship("User", back_populates="agent", uselist=False)
|
||||
schedule_type = relationship("ScheduleType", lazy="joined")
|
||||
|
||||
@@ -7,10 +7,7 @@ class APIKey(Base):
|
||||
__tablename__ = "api_keys"
|
||||
|
||||
id = Column(Integer, primary_key=True, index=True)
|
||||
# The raw key is never stored — only its SHA-256 hash. `key_prefix` holds
|
||||
# the first few chars for human-readable display/masking in listings.
|
||||
key_hash = Column(String(64), unique=True, nullable=False, index=True)
|
||||
key_prefix = Column(String(16), nullable=True)
|
||||
key = Column(String(64), unique=True, nullable=False, index=True)
|
||||
name = Column(String(100), nullable=False) # e.g. "agent-zhi", "agent-lyn"
|
||||
user_id = Column(Integer, ForeignKey("users.id"), nullable=False)
|
||||
is_active = Column(Boolean, default=True)
|
||||
|
||||
@@ -178,37 +178,11 @@ class TimeSlot(Base):
|
||||
comment="Source plan if materialized from a SchedulePlan; set NULL on edit/cancel",
|
||||
)
|
||||
|
||||
# -----------------------------------------------------------------
|
||||
# Admin-locked slots are materialised from a ScheduleTypeSpecialSlot
|
||||
# template. The agent can complete / abort / pause / resume them but
|
||||
# cannot edit their time, type, duration, or cancel them outright —
|
||||
# the slot exists because admin decided every agent on the parent
|
||||
# schedule_type should run it. See `_apply_agent_slot_update` for
|
||||
# the enforcement.
|
||||
# -----------------------------------------------------------------
|
||||
is_admin_locked = Column(
|
||||
Boolean,
|
||||
nullable=False,
|
||||
server_default="0",
|
||||
comment="True for slots materialised from a schedule_type special slot template.",
|
||||
)
|
||||
|
||||
# Pointer back to the template that materialised this slot. NULL for
|
||||
# all user-created or plan-generated slots. Lets us cascade updates
|
||||
# and surface 'why is this on my calendar' to the agent.
|
||||
special_slot_id = Column(
|
||||
Integer,
|
||||
ForeignKey("schedule_type_special_slots.id", ondelete="SET NULL"),
|
||||
nullable=True,
|
||||
index=True,
|
||||
)
|
||||
|
||||
created_at = Column(DateTime(timezone=True), server_default=func.now())
|
||||
updated_at = Column(DateTime(timezone=True), onupdate=func.now())
|
||||
|
||||
# relationship ----------------------------------------------------------
|
||||
plan = relationship("SchedulePlan", back_populates="materialized_slots")
|
||||
special_slot = relationship("ScheduleTypeSpecialSlot")
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
from sqlalchemy import Column, Integer, String, Text, DateTime, ForeignKey, Enum, Boolean, JSON, Time, UniqueConstraint
|
||||
from sqlalchemy import Column, Integer, String, Text, DateTime, ForeignKey, Enum, Boolean, JSON, Time
|
||||
from sqlalchemy.orm import relationship
|
||||
from sqlalchemy.sql import func
|
||||
from app.core.config import Base
|
||||
@@ -66,9 +66,6 @@ class Project(Base):
|
||||
|
||||
class User(Base):
|
||||
__tablename__ = "users"
|
||||
__table_args__ = (
|
||||
UniqueConstraint("oidc_issuer", "oidc_subject", name="uq_users_oidc_identity"),
|
||||
)
|
||||
|
||||
id = Column(Integer, primary_key=True, index=True)
|
||||
username = Column(String(50), unique=True, nullable=False)
|
||||
@@ -76,10 +73,6 @@ class User(Base):
|
||||
hashed_password = Column(String(255), nullable=True)
|
||||
full_name = Column(String(100), nullable=True)
|
||||
discord_user_id = Column(String(32), nullable=True)
|
||||
# OIDC binding: an hf user is linked to at most one external OIDC identity
|
||||
# (issuer + subject). Unique together so one IdP identity maps to one user.
|
||||
oidc_issuer = Column(String(255), nullable=True)
|
||||
oidc_subject = Column(String(255), nullable=True)
|
||||
is_active = Column(Boolean, default=True)
|
||||
is_admin = Column(Boolean, default=False)
|
||||
role_id = Column(Integer, ForeignKey("roles.id"), nullable=True)
|
||||
|
||||
@@ -1,25 +0,0 @@
|
||||
from sqlalchemy import Column, Integer, String, Boolean, DateTime
|
||||
from sqlalchemy.sql import func
|
||||
from app.core.config import Base
|
||||
|
||||
|
||||
class OidcSettings(Base):
|
||||
"""Single-row (id=1) runtime OIDC configuration.
|
||||
|
||||
When a row exists its non-empty fields override the OIDC_* env vars,
|
||||
so the provider can be configured from the admin UI without a redeploy.
|
||||
"""
|
||||
__tablename__ = "oidc_settings"
|
||||
|
||||
id = Column(Integer, primary_key=True, default=1)
|
||||
enabled = Column(Boolean, default=False, nullable=False)
|
||||
issuer = Column(String(255), nullable=True)
|
||||
client_id = Column(String(255), nullable=True)
|
||||
client_secret = Column(String(512), nullable=True)
|
||||
redirect_uri = Column(String(512), nullable=True)
|
||||
scopes = Column(String(255), nullable=True)
|
||||
post_login_redirect = Column(String(512), nullable=True)
|
||||
# OIDC role name that, in OIDC-only mode, auto-connects an unbound
|
||||
# hf admin on first login (bootstrap). Default "admin".
|
||||
admin_role = Column(String(128), nullable=True)
|
||||
updated_at = Column(DateTime(timezone=True), server_default=func.now(), onupdate=func.now())
|
||||
@@ -1,83 +0,0 @@
|
||||
"""ScheduleType model — defines work/entertainment/maintenance time periods.
|
||||
|
||||
Each ScheduleType defines the daily work, entertainment, and maintenance
|
||||
windows for agents who reference this type. All bounds are stored as
|
||||
**minutes-since-UTC-midnight** (0-1439 inclusive) so half-hour and other
|
||||
sub-hour boundaries are exact.
|
||||
|
||||
Maintenance window length is variable (1-180 minutes) and admin-owned;
|
||||
agent slots cannot intersect it (see `app/api/routers/calendar.py`).
|
||||
|
||||
Historical note: pre-PR #21 the columns held *hours* (0-23) and the
|
||||
maintenance window was hard-fixed at exactly 1 hour. The additive
|
||||
migration in `_migrate_schema()` multiplies legacy values by 60 so
|
||||
existing rows convert transparently.
|
||||
"""
|
||||
|
||||
from sqlalchemy import Column, Integer, String, DateTime
|
||||
from sqlalchemy.orm import relationship
|
||||
from sqlalchemy.sql import func
|
||||
from app.core.config import Base
|
||||
|
||||
|
||||
class ScheduleType(Base):
|
||||
"""Work/entertainment/maintenance period definition."""
|
||||
|
||||
__tablename__ = "schedule_types"
|
||||
|
||||
id = Column(Integer, primary_key=True, index=True)
|
||||
|
||||
name = Column(
|
||||
String(64),
|
||||
nullable=False,
|
||||
unique=True,
|
||||
comment="Human-readable schedule type name (e.g., 'standard', 'night-shift')",
|
||||
)
|
||||
|
||||
# Minutes since UTC midnight, 0-1439 inclusive.
|
||||
work_from = Column(Integer, nullable=False, comment="Work period start (minutes since UTC midnight)")
|
||||
work_to = Column(Integer, nullable=False, comment="Work period end (minutes since UTC midnight)")
|
||||
|
||||
entertainment_from = Column(Integer, nullable=False, comment="Entertainment start (minutes since UTC midnight)")
|
||||
entertainment_to = Column(Integer, nullable=False, comment="Entertainment end (minutes since UTC midnight)")
|
||||
|
||||
# Maintenance window — admin-owned, variable length (1-180 min).
|
||||
# Default 8:00–9:00 UTC = 480–540 minutes for existing rows.
|
||||
maintenance_from = Column(
|
||||
Integer,
|
||||
nullable=False,
|
||||
server_default="480",
|
||||
comment="Maintenance start (minutes since UTC midnight, default 480 = 8:00 UTC).",
|
||||
)
|
||||
maintenance_to = Column(
|
||||
Integer,
|
||||
nullable=False,
|
||||
server_default="540",
|
||||
comment="Maintenance end (minutes since UTC midnight, default 540 = 9:00 UTC). Duration ((to-from) mod 1440) must be in [1, 180].",
|
||||
)
|
||||
|
||||
created_at = Column(DateTime(timezone=True), server_default=func.now())
|
||||
updated_at = Column(DateTime(timezone=True), onupdate=func.now())
|
||||
|
||||
# relationship ---------------------------------------------------
|
||||
special_slots = relationship(
|
||||
"ScheduleTypeSpecialSlot",
|
||||
back_populates="schedule_type",
|
||||
cascade="all, delete-orphan",
|
||||
)
|
||||
|
||||
# ---------------------------------------------------------------
|
||||
# Convenience methods used by the API layer + materialiser.
|
||||
# ---------------------------------------------------------------
|
||||
|
||||
def compute_maintenance_duration(self) -> int:
|
||||
"""Maintenance window length in minutes (handles 23→0 wrap)."""
|
||||
return (self.maintenance_to - self.maintenance_from) % 1440 or 1440
|
||||
|
||||
def window_contains(self, start_min: int, end_min: int, win_from: int, win_to: int) -> bool:
|
||||
"""True if [start_min, end_min) intersects [win_from, win_to) (handles wrap)."""
|
||||
# Normalise into [0, 1440) — same logic as the helper in calendar.py.
|
||||
if win_to > win_from:
|
||||
return start_min < win_to and end_min > win_from
|
||||
# wrap window crosses midnight: [win_from..1440) ∪ [0..win_to)
|
||||
return start_min < win_to or end_min > win_from
|
||||
@@ -1,116 +0,0 @@
|
||||
"""ScheduleTypeSpecialSlot — admin-managed slot template tied to a ScheduleType.
|
||||
|
||||
A "special slot" is a recurring slot template that the system materializes
|
||||
into every matching agent's `time_slots` row each day. It exists for tasks
|
||||
that admin wants to enforce across an entire schedule type cohort, e.g.:
|
||||
|
||||
* `plan-schedule` — daily planning slot all agents on this type must run
|
||||
* `secret-rotation-window` — security maintenance
|
||||
* `policy-update` — read updated agent policies
|
||||
|
||||
Rules:
|
||||
* Only admins (`schedule_type.manage` permission) may create / edit /
|
||||
delete special slots.
|
||||
* The slot's `minute_in_window` offset must place it inside the parent
|
||||
schedule_type's maintenance window (`maintenance_from..maintenance_from+59`).
|
||||
* Materialised `time_slots` rows from a special slot carry
|
||||
`is_admin_locked=true` so the agent-side `PATCH .../agent-update`
|
||||
refuses status/time edits other than complete/abort/pause/resume.
|
||||
* Materialisation produces one `time_slots` row per agent using this
|
||||
schedule_type per date, with `slot_type=system`, `event_type=system_event`,
|
||||
`event_data={"special_slot_id": <id>, "special_slot_name": "<name>",
|
||||
"source": "schedule_type_special_slot", ...admin-supplied...}`.
|
||||
"""
|
||||
|
||||
from sqlalchemy import Column, Integer, String, ForeignKey, JSON, DateTime, Boolean, UniqueConstraint
|
||||
from sqlalchemy.orm import relationship
|
||||
from sqlalchemy.sql import func
|
||||
|
||||
from app.core.config import Base
|
||||
|
||||
|
||||
class ScheduleTypeSpecialSlot(Base):
|
||||
"""Admin-managed daily slot template attached to a ScheduleType."""
|
||||
|
||||
__tablename__ = "schedule_type_special_slots"
|
||||
__table_args__ = (
|
||||
# One slot template per (schedule_type, name) so admin can use the
|
||||
# `name` field as a stable, human-readable identifier for the cohort.
|
||||
UniqueConstraint("schedule_type_id", "name", name="uq_special_slot_type_name"),
|
||||
)
|
||||
|
||||
id = Column(Integer, primary_key=True, index=True)
|
||||
|
||||
schedule_type_id = Column(
|
||||
Integer,
|
||||
ForeignKey("schedule_types.id", ondelete="CASCADE"),
|
||||
nullable=False,
|
||||
index=True,
|
||||
)
|
||||
|
||||
name = Column(
|
||||
String(64),
|
||||
nullable=False,
|
||||
comment="Short identifier, e.g. 'plan-schedule', 'secret-rotation'",
|
||||
)
|
||||
|
||||
description = Column(
|
||||
String(512),
|
||||
nullable=True,
|
||||
comment="Human-readable note on what this slot is for",
|
||||
)
|
||||
|
||||
minute_in_window = Column(
|
||||
Integer,
|
||||
nullable=False,
|
||||
server_default="0",
|
||||
comment=(
|
||||
"Minute offset (0-59) inside the schedule_type maintenance window. "
|
||||
"The materialised time_slot's scheduled_at becomes "
|
||||
"maintenance_from:minute_in_window:00 UTC."
|
||||
),
|
||||
)
|
||||
|
||||
estimated_duration = Column(
|
||||
Integer,
|
||||
nullable=False,
|
||||
server_default="15",
|
||||
comment="Duration in minutes. Must fit inside the maintenance window.",
|
||||
)
|
||||
|
||||
priority = Column(
|
||||
Integer,
|
||||
nullable=False,
|
||||
server_default="50",
|
||||
comment="Wake priority — higher value wakes first if multiple slots are due.",
|
||||
)
|
||||
|
||||
event_data = Column(
|
||||
JSON,
|
||||
nullable=True,
|
||||
comment=(
|
||||
"Admin-supplied JSON payload that gets merged into every "
|
||||
"materialised slot's event_data. Use this to pass a workflow "
|
||||
"tag, suggested_workload, or any other context the agent "
|
||||
"should see in its wakeup message."
|
||||
),
|
||||
)
|
||||
|
||||
is_active = Column(
|
||||
Boolean,
|
||||
nullable=False,
|
||||
server_default="1",
|
||||
comment="Soft-disable without deleting; inactive templates are skipped during materialisation.",
|
||||
)
|
||||
|
||||
created_by_user_id = Column(
|
||||
Integer,
|
||||
ForeignKey("users.id"),
|
||||
nullable=False,
|
||||
)
|
||||
|
||||
created_at = Column(DateTime(timezone=True), server_default=func.now())
|
||||
updated_at = Column(DateTime(timezone=True), onupdate=func.now())
|
||||
|
||||
# relationship ---------------------------------------------------
|
||||
schedule_type = relationship("ScheduleType", back_populates="special_slots")
|
||||
@@ -144,8 +144,6 @@ class TimeSlotResponse(BaseModel):
|
||||
priority: int
|
||||
status: str
|
||||
plan_id: Optional[int] = None
|
||||
is_admin_locked: bool = False
|
||||
special_slot_id: Optional[int] = None
|
||||
created_at: Optional[dt_datetime] = None
|
||||
updated_at: Optional[dt_datetime] = None
|
||||
|
||||
@@ -228,8 +226,6 @@ class CalendarSlotItem(BaseModel):
|
||||
priority: int
|
||||
status: str
|
||||
plan_id: Optional[int] = None
|
||||
is_admin_locked: bool = False
|
||||
special_slot_id: Optional[int] = None
|
||||
created_at: Optional[dt_datetime] = None
|
||||
updated_at: Optional[dt_datetime] = None
|
||||
|
||||
|
||||
@@ -1,83 +0,0 @@
|
||||
"""Schemas for ScheduleType CRUD.
|
||||
|
||||
All `*_from` / `*_to` values are **minutes since UTC midnight** (0-1439).
|
||||
A maintenance window of variable length is allowed (1-180 minutes,
|
||||
handles 23→0 wrap).
|
||||
"""
|
||||
|
||||
from pydantic import BaseModel, Field, model_validator
|
||||
from typing import Optional
|
||||
|
||||
|
||||
_MAX_MIN = 1440 # 24 * 60 — exclusive upper bound
|
||||
|
||||
|
||||
def _maintenance_duration(maint_from: int, maint_to: int) -> int:
|
||||
"""Maintenance window length in minutes; treats from==to as 24h (invalid)."""
|
||||
return (maint_to - maint_from) % _MAX_MIN or _MAX_MIN
|
||||
|
||||
|
||||
def _validate_maintenance_window(maint_from: int, maint_to: int) -> None:
|
||||
dur = _maintenance_duration(maint_from, maint_to)
|
||||
if dur < 1 or dur > 180:
|
||||
raise ValueError(
|
||||
f"maintenance window duration must be in [1, 180] minutes; "
|
||||
f"got {dur} (from={maint_from}, to={maint_to})"
|
||||
)
|
||||
|
||||
|
||||
def _validate_minute_field(name: str, value: int) -> None:
|
||||
if value < 0 or value >= _MAX_MIN:
|
||||
raise ValueError(f"{name} must be in [0, {_MAX_MIN}); got {value}")
|
||||
|
||||
|
||||
class ScheduleTypeCreate(BaseModel):
|
||||
name: str = Field(..., min_length=1, max_length=64)
|
||||
work_from: int = Field(..., ge=0, lt=_MAX_MIN, description="Work start (minutes since UTC midnight, 0-1439)")
|
||||
work_to: int = Field(..., ge=0, lt=_MAX_MIN)
|
||||
entertainment_from: int = Field(..., ge=0, lt=_MAX_MIN)
|
||||
entertainment_to: int = Field(..., ge=0, lt=_MAX_MIN)
|
||||
maintenance_from: int = Field(480, ge=0, lt=_MAX_MIN, description="Maintenance start (default 480 = 8:00 UTC)")
|
||||
maintenance_to: int = Field(540, ge=0, lt=_MAX_MIN, description="Maintenance end; (to-from) mod 1440 in [1,180]")
|
||||
|
||||
@model_validator(mode="after")
|
||||
def _check_maintenance(self):
|
||||
_validate_maintenance_window(self.maintenance_from, self.maintenance_to)
|
||||
return self
|
||||
|
||||
|
||||
class ScheduleTypeUpdate(BaseModel):
|
||||
name: Optional[str] = Field(None, min_length=1, max_length=64)
|
||||
work_from: Optional[int] = Field(None, ge=0, lt=_MAX_MIN)
|
||||
work_to: Optional[int] = Field(None, ge=0, lt=_MAX_MIN)
|
||||
entertainment_from: Optional[int] = Field(None, ge=0, lt=_MAX_MIN)
|
||||
entertainment_to: Optional[int] = Field(None, ge=0, lt=_MAX_MIN)
|
||||
maintenance_from: Optional[int] = Field(None, ge=0, lt=_MAX_MIN)
|
||||
maintenance_to: Optional[int] = Field(None, ge=0, lt=_MAX_MIN)
|
||||
|
||||
@model_validator(mode="after")
|
||||
def _check_maintenance(self):
|
||||
# Only validate when both fields are present together; partial-
|
||||
# update validation against the merged row happens at apply time.
|
||||
if self.maintenance_from is not None and self.maintenance_to is not None:
|
||||
_validate_maintenance_window(self.maintenance_from, self.maintenance_to)
|
||||
return self
|
||||
|
||||
|
||||
class ScheduleTypeResponse(BaseModel):
|
||||
id: int
|
||||
name: str
|
||||
work_from: int
|
||||
work_to: int
|
||||
entertainment_from: int
|
||||
entertainment_to: int
|
||||
maintenance_from: int
|
||||
maintenance_to: int
|
||||
maintenance_duration_minutes: Optional[int] = None # derived; populated by router
|
||||
|
||||
class Config:
|
||||
from_attributes = True
|
||||
|
||||
|
||||
class AgentScheduleTypeAssign(BaseModel):
|
||||
schedule_type_name: str = Field(..., description="Name of the schedule type to assign")
|
||||
@@ -1,43 +0,0 @@
|
||||
"""Schemas for ScheduleTypeSpecialSlot CRUD (admin-only)."""
|
||||
|
||||
from datetime import datetime
|
||||
from typing import Any, Optional
|
||||
|
||||
from pydantic import BaseModel, Field
|
||||
|
||||
|
||||
class SpecialSlotCreate(BaseModel):
|
||||
name: str = Field(..., min_length=1, max_length=64)
|
||||
description: Optional[str] = Field(None, max_length=512)
|
||||
minute_in_window: int = Field(0, ge=0, le=179, description="Minute offset (0-179) inside the schedule_type maintenance window")
|
||||
estimated_duration: int = Field(15, ge=1, le=180, description="Duration in minutes; must fit inside the maintenance window (1-180min)")
|
||||
priority: int = Field(50, ge=0, le=99)
|
||||
event_data: Optional[dict[str, Any]] = Field(None, description="JSON payload merged into every materialised slot's event_data")
|
||||
is_active: bool = True
|
||||
|
||||
|
||||
class SpecialSlotUpdate(BaseModel):
|
||||
name: Optional[str] = Field(None, min_length=1, max_length=64)
|
||||
description: Optional[str] = Field(None, max_length=512)
|
||||
minute_in_window: Optional[int] = Field(None, ge=0, le=179)
|
||||
estimated_duration: Optional[int] = Field(None, ge=1, le=180)
|
||||
priority: Optional[int] = Field(None, ge=0, le=99)
|
||||
event_data: Optional[dict[str, Any]] = None
|
||||
is_active: Optional[bool] = None
|
||||
|
||||
|
||||
class SpecialSlotResponse(BaseModel):
|
||||
id: int
|
||||
schedule_type_id: int
|
||||
name: str
|
||||
description: Optional[str]
|
||||
minute_in_window: int
|
||||
estimated_duration: int
|
||||
priority: int
|
||||
event_data: Optional[dict[str, Any]]
|
||||
is_active: bool
|
||||
created_by_user_id: int
|
||||
created_at: datetime
|
||||
|
||||
class Config:
|
||||
from_attributes = True
|
||||
@@ -1,4 +1,4 @@
|
||||
from pydantic import BaseModel, Field
|
||||
from pydantic import BaseModel
|
||||
from typing import Optional, List
|
||||
from datetime import datetime, time
|
||||
from enum import Enum
|
||||
@@ -105,9 +105,7 @@ class CommentBase(BaseModel):
|
||||
|
||||
class CommentCreate(CommentBase):
|
||||
task_id: int
|
||||
# author_id is NOT accepted from the client — the comment is always
|
||||
# attributed to the authenticated caller (server-side) to prevent
|
||||
# author spoofing.
|
||||
author_id: int
|
||||
|
||||
|
||||
class CommentUpdate(BaseModel):
|
||||
@@ -188,19 +186,6 @@ class UserUpdate(BaseModel):
|
||||
discord_user_id: Optional[str] = None
|
||||
|
||||
|
||||
class UserBindAgentRequest(BaseModel):
|
||||
"""Request body for PATCH /users/{identifier}/bind-agent.
|
||||
|
||||
Binds an existing user to (agent_id, claw_identifier) by inserting a
|
||||
row in the `agents` table. Both fields required (mirrors the
|
||||
create-time invariant in UserCreate). Idempotent: re-binding the same
|
||||
user to the same (agent_id, claw_identifier) returns the existing
|
||||
Agent row instead of 409.
|
||||
"""
|
||||
agent_id: str = Field(..., min_length=1, max_length=128)
|
||||
claw_identifier: str = Field(..., min_length=1, max_length=128)
|
||||
|
||||
|
||||
class UserResponse(UserBase):
|
||||
id: int
|
||||
is_active: bool
|
||||
@@ -209,10 +194,8 @@ class UserResponse(UserBase):
|
||||
role_name: Optional[str] = None
|
||||
agent_id: Optional[str] = None
|
||||
discord_user_id: Optional[str] = None
|
||||
oidc_issuer: Optional[str] = None
|
||||
oidc_subject: Optional[str] = None
|
||||
created_at: datetime
|
||||
|
||||
|
||||
class Config:
|
||||
from_attributes = True
|
||||
|
||||
|
||||
@@ -1,25 +1,17 @@
|
||||
from __future__ import annotations
|
||||
|
||||
import os
|
||||
from datetime import datetime, timezone
|
||||
from typing import Any
|
||||
|
||||
import requests
|
||||
from fastapi import HTTPException
|
||||
|
||||
from app.services.harborforge_config import get_discord_wakeup_config
|
||||
|
||||
DISCORD_API_BASE = "https://discord.com/api/v10"
|
||||
WAKEUP_CATEGORY_NAME = "HarborForge Wakeup"
|
||||
|
||||
|
||||
def _discord_config() -> dict[str, str | None]:
|
||||
"""Discord wakeup is configured via env vars (previously read from the
|
||||
AbstractWizard config file). Returns guild_id+bot_token or Nones."""
|
||||
return {
|
||||
"guild_id": os.getenv("HARBORFORGE_DISCORD_GUILD_ID") or None,
|
||||
"bot_token": os.getenv("HARBORFORGE_DISCORD_BOT_TOKEN") or None,
|
||||
}
|
||||
|
||||
|
||||
def _headers(bot_token: str) -> dict[str, str]:
|
||||
return {
|
||||
"Authorization": f"Bot {bot_token}",
|
||||
@@ -42,7 +34,7 @@ def _ensure_category(guild_id: str, bot_token: str) -> str | None:
|
||||
|
||||
|
||||
def create_private_wakeup_channel(discord_user_id: str, title: str, message: str) -> dict[str, Any]:
|
||||
cfg = _discord_config()
|
||||
cfg = get_discord_wakeup_config()
|
||||
guild_id = cfg.get("guild_id")
|
||||
bot_token = cfg.get("bot_token")
|
||||
if not guild_id or not bot_token:
|
||||
|
||||
26
app/services/harborforge_config.py
Normal file
26
app/services/harborforge_config.py
Normal file
@@ -0,0 +1,26 @@
|
||||
import json
|
||||
import os
|
||||
from typing import Any
|
||||
|
||||
CONFIG_DIR = os.getenv("CONFIG_DIR", "/config")
|
||||
CONFIG_FILE = os.getenv("CONFIG_FILE", "harborforge.json")
|
||||
|
||||
|
||||
def load_runtime_config() -> dict[str, Any]:
|
||||
config_path = os.path.join(CONFIG_DIR, CONFIG_FILE)
|
||||
if not os.path.exists(config_path):
|
||||
return {}
|
||||
try:
|
||||
with open(config_path, "r") as f:
|
||||
return json.load(f)
|
||||
except Exception:
|
||||
return {}
|
||||
|
||||
|
||||
def get_discord_wakeup_config() -> dict[str, str | None]:
|
||||
cfg = load_runtime_config()
|
||||
discord_cfg = cfg.get("discord") or {}
|
||||
return {
|
||||
"guild_id": discord_cfg.get("guild_id"),
|
||||
"bot_token": discord_cfg.get("bot_token"),
|
||||
}
|
||||
@@ -1,175 +0,0 @@
|
||||
"""Materialise schedule_type special slots into per-agent time_slots rows.
|
||||
|
||||
A ScheduleTypeSpecialSlot is a template — it lives on the schedule_type.
|
||||
For an agent on that schedule_type to actually be woken, the system must
|
||||
emit a row in `time_slots` with `slot_type=system`, `is_admin_locked=true`,
|
||||
`special_slot_id=<template_id>` for the agent's `user_id` on the target
|
||||
date. This module is the single materialisation point.
|
||||
|
||||
Called from:
|
||||
* GET /calendar/day — before returning slots, materialise today's special
|
||||
slots for the calling user.
|
||||
* GET /calendar/sync — before returning per-claw schedules, materialise
|
||||
today's special slots for every agent on this claw whose schedule_type
|
||||
has any active special slot template.
|
||||
|
||||
Idempotent: re-running on the same (agent, date, special_slot_template)
|
||||
is a no-op — uniqueness is enforced via SELECT-then-insert. We do not add
|
||||
a DB-level unique constraint because the time_slots table is already
|
||||
indexed by (user_id, date) and an extra composite index is overkill for
|
||||
the low cardinality of (agents × special-slot-templates) per day.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
from datetime import date as date_type, time as time_type
|
||||
from typing import Iterable
|
||||
|
||||
from sqlalchemy.orm import Session
|
||||
|
||||
from app.models.agent import Agent
|
||||
from app.models.calendar import TimeSlot, SlotType, SlotStatus, EventType
|
||||
from app.models.schedule_type import ScheduleType
|
||||
from app.models.schedule_type_special_slot import ScheduleTypeSpecialSlot
|
||||
|
||||
|
||||
def materialise_special_slots_for_user(
|
||||
db: Session,
|
||||
user_id: int,
|
||||
target_date: date_type,
|
||||
commit: bool = True,
|
||||
) -> list[TimeSlot]:
|
||||
"""Materialise today's special slots for one agent (identified by user_id).
|
||||
|
||||
Returns the list of newly created rows (may be empty if all already exist
|
||||
or the agent has no schedule_type / no active templates).
|
||||
"""
|
||||
agent = db.query(Agent).filter(Agent.user_id == user_id).first()
|
||||
if not agent or not agent.schedule_type_id:
|
||||
return []
|
||||
|
||||
return _materialise_for_agent(db, agent, target_date, commit=commit)
|
||||
|
||||
|
||||
def materialise_special_slots_for_claw(
|
||||
db: Session,
|
||||
claw_identifier: str,
|
||||
target_date: date_type,
|
||||
commit: bool = True,
|
||||
) -> list[TimeSlot]:
|
||||
"""Materialise today's special slots for every agent on a claw instance.
|
||||
|
||||
Used by the multi-agent `/calendar/sync` endpoint so plugin-driven
|
||||
`runSync` cycles see the special slots without each agent having to
|
||||
hit `/calendar/day` first.
|
||||
"""
|
||||
agents = (
|
||||
db.query(Agent)
|
||||
.filter(
|
||||
Agent.claw_identifier == claw_identifier,
|
||||
Agent.schedule_type_id.isnot(None),
|
||||
)
|
||||
.all()
|
||||
)
|
||||
created: list[TimeSlot] = []
|
||||
for agent in agents:
|
||||
created.extend(_materialise_for_agent(db, agent, target_date, commit=False))
|
||||
if commit and created:
|
||||
db.commit()
|
||||
return created
|
||||
|
||||
|
||||
def _materialise_for_agent(
|
||||
db: Session,
|
||||
agent: Agent,
|
||||
target_date: date_type,
|
||||
commit: bool,
|
||||
) -> list[TimeSlot]:
|
||||
st: ScheduleType | None = (
|
||||
db.query(ScheduleType).filter(ScheduleType.id == agent.schedule_type_id).first()
|
||||
)
|
||||
if not st:
|
||||
return []
|
||||
|
||||
templates: Iterable[ScheduleTypeSpecialSlot] = (
|
||||
db.query(ScheduleTypeSpecialSlot)
|
||||
.filter(
|
||||
ScheduleTypeSpecialSlot.schedule_type_id == st.id,
|
||||
ScheduleTypeSpecialSlot.is_active.is_(True),
|
||||
)
|
||||
.all()
|
||||
)
|
||||
|
||||
created: list[TimeSlot] = []
|
||||
for tpl in templates:
|
||||
if _already_materialised(db, agent.user_id, target_date, tpl.id):
|
||||
continue
|
||||
slot = _build_time_slot_from_template(
|
||||
user_id=agent.user_id,
|
||||
target_date=target_date,
|
||||
schedule_type=st,
|
||||
template=tpl,
|
||||
)
|
||||
db.add(slot)
|
||||
created.append(slot)
|
||||
|
||||
if commit and created:
|
||||
db.commit()
|
||||
for slot in created:
|
||||
db.refresh(slot)
|
||||
return created
|
||||
|
||||
|
||||
def _already_materialised(
|
||||
db: Session,
|
||||
user_id: int,
|
||||
target_date: date_type,
|
||||
template_id: int,
|
||||
) -> bool:
|
||||
return (
|
||||
db.query(TimeSlot.id)
|
||||
.filter(
|
||||
TimeSlot.user_id == user_id,
|
||||
TimeSlot.date == target_date,
|
||||
TimeSlot.special_slot_id == template_id,
|
||||
)
|
||||
.first()
|
||||
is not None
|
||||
)
|
||||
|
||||
|
||||
def _build_time_slot_from_template(
|
||||
*,
|
||||
user_id: int,
|
||||
target_date: date_type,
|
||||
schedule_type: ScheduleType,
|
||||
template: ScheduleTypeSpecialSlot,
|
||||
) -> TimeSlot:
|
||||
# schedule_type.maintenance_from is minutes-since-UTC-midnight; the
|
||||
# template's minute_in_window is an offset inside that window. Combined
|
||||
# offset must fit in [0, 1440) and produce a wall-clock time_type.
|
||||
total_min = (schedule_type.maintenance_from + template.minute_in_window) % 1440
|
||||
scheduled_at = time_type(hour=total_min // 60, minute=total_min % 60, second=0)
|
||||
# Merge admin-supplied event_data with bookkeeping pointers so the
|
||||
# agent (and ARD) can identify the template at wake time.
|
||||
merged_event_data = dict(template.event_data or {})
|
||||
merged_event_data.setdefault("source", "schedule_type_special_slot")
|
||||
merged_event_data["special_slot_id"] = template.id
|
||||
merged_event_data["special_slot_name"] = template.name
|
||||
merged_event_data["schedule_type_id"] = schedule_type.id
|
||||
merged_event_data["schedule_type_name"] = schedule_type.name
|
||||
|
||||
return TimeSlot(
|
||||
user_id=user_id,
|
||||
date=target_date,
|
||||
slot_type=SlotType.SYSTEM,
|
||||
estimated_duration=template.estimated_duration,
|
||||
scheduled_at=scheduled_at,
|
||||
attended=False,
|
||||
event_type=EventType.SYSTEM_EVENT,
|
||||
event_data=merged_event_data,
|
||||
priority=template.priority,
|
||||
status=SlotStatus.NOT_STARTED,
|
||||
is_admin_locked=True,
|
||||
special_slot_id=template.id,
|
||||
)
|
||||
@@ -2,41 +2,12 @@ import json
|
||||
import hmac
|
||||
import hashlib
|
||||
import logging
|
||||
import socket
|
||||
import ipaddress
|
||||
from urllib.parse import urlparse
|
||||
from sqlalchemy.orm import Session
|
||||
from app.models.webhook import Webhook, WebhookLog
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
|
||||
def _validate_webhook_url(url: str) -> None:
|
||||
"""Raise ValueError if the URL would target a non-public address (SSRF guard)."""
|
||||
parsed = urlparse(url)
|
||||
if parsed.scheme not in ("http", "https"):
|
||||
raise ValueError(f"unsupported scheme: {parsed.scheme!r}")
|
||||
host = parsed.hostname
|
||||
if not host:
|
||||
raise ValueError("missing host")
|
||||
# Resolve every address the host maps to and reject non-global ranges.
|
||||
try:
|
||||
infos = socket.getaddrinfo(host, parsed.port or (443 if parsed.scheme == "https" else 80))
|
||||
except socket.gaierror as e:
|
||||
raise ValueError(f"DNS resolution failed: {e}")
|
||||
for info in infos:
|
||||
ip = ipaddress.ip_address(info[4][0])
|
||||
if (
|
||||
ip.is_private
|
||||
or ip.is_loopback
|
||||
or ip.is_link_local
|
||||
or ip.is_multicast
|
||||
or ip.is_reserved
|
||||
or ip.is_unspecified
|
||||
):
|
||||
raise ValueError(f"host resolves to non-public address {ip}")
|
||||
|
||||
|
||||
def fire_webhooks_sync(event: str, payload: dict, project_id: int, db: Session):
|
||||
"""Find matching webhooks and send payloads (sync version)."""
|
||||
import httpx
|
||||
@@ -64,8 +35,6 @@ def fire_webhooks_sync(event: str, payload: dict, project_id: int, db: Session):
|
||||
payload=payload_json,
|
||||
)
|
||||
try:
|
||||
_validate_webhook_url(wh.url)
|
||||
|
||||
headers = {"Content-Type": "application/json"}
|
||||
if wh.secret:
|
||||
sig = hmac.new(
|
||||
@@ -73,7 +42,7 @@ def fire_webhooks_sync(event: str, payload: dict, project_id: int, db: Session):
|
||||
).hexdigest()
|
||||
headers["X-Webhook-Signature"] = sig
|
||||
|
||||
with httpx.Client(timeout=10.0, follow_redirects=False) as client:
|
||||
with httpx.Client(timeout=10.0) as client:
|
||||
resp = client.post(wh.url, content=payload_json, headers=headers)
|
||||
log.response_status = resp.status_code
|
||||
log.response_body = resp.text[:1000]
|
||||
|
||||
@@ -1,99 +0,0 @@
|
||||
# OIDC 接入 — 测试点描述
|
||||
|
||||
覆盖范围：OIDC 登录、hf 用户与 OIDC 身份绑定、`HARBORFORGE_OIDC_ONLY`
|
||||
模式、管理员 OIDC 配置页面。涉及仓库分支 `feature/oidc-login`
|
||||
（`HarborForge.Backend` + `HarborForge.Frontend`）。
|
||||
|
||||
“本地状态” 列：✅ 已用真实 Keycloak 在本地栈端到端验证；🟡 已用接口/构建
|
||||
验证但未走真实 IdP UI；⬜ 待测。
|
||||
|
||||
## 0. 测试环境
|
||||
|
||||
- 后端 `http://127.0.0.1:18000`、前端 `http://127.0.0.1:13000`（本地验证栈）
|
||||
- IdP：Keycloak 容器，realm `hf`，confidential client `hf-client`
|
||||
- IdP 测试用户：`tester` / `Test123!`（emailVerified=true）
|
||||
- 关键约束：**issuer URL 必须浏览器与后端容器都能用同一地址访问**
|
||||
（否则 token `iss` 校验失败）。本地用宿主机 IP 统一两端。
|
||||
- 配置项（运行时 env 或 DB，DB 覆盖 env）：
|
||||
`OIDC_ENABLED / OIDC_ISSUER / OIDC_CLIENT_ID / OIDC_CLIENT_SECRET /
|
||||
OIDC_REDIRECT_URI / OIDC_SCOPES / OIDC_POST_LOGIN_REDIRECT`；
|
||||
部署级 `HARBORFORGE_OIDC_ONLY`（Docker ARG/ENV，前后端均有）。
|
||||
|
||||
## 1. 管理员 OIDC 配置（页面 + API）
|
||||
|
||||
| # | 测试点 | 步骤 | 预期 | 本地 |
|
||||
|---|--------|------|------|------|
|
||||
|1.1|读取初始配置|`GET /auth/oidc/settings`（admin）|返回 `source=env`，`has_client_secret=false`，`effective_enabled` 反映 env|✅|
|
||||
|1.2|保存配置|`PUT /auth/oidc/settings` 填 issuer/client/secret/redirect/scopes/post_login|200，`source=db`，`effective_enabled=true`|✅|
|
||||
|1.3|client_secret 只写不回显|保存后再 `GET`|响应无明文 secret，仅 `has_client_secret=true`|✅|
|
||||
|1.4|secret 留空保留原值|`PUT` 不带 `client_secret`|原 secret 不变，登录仍可用|🟡|
|
||||
|1.5|配置即时生效|保存后 `GET /auth/config`|`oidc_enabled` 立即变化，无需重启|✅|
|
||||
|1.6|页面仅 admin 可见|非 admin 访问 `/settings/oidc`|被重定向到 `/`；侧栏无入口；API 返回 401/403|🟡|
|
||||
|1.7|页面展示 Callback URL|打开 OIDC 设置页|醒目显示需在 IdP 注册的 redirect/callback URL、当前状态与配置来源|🟡|
|
||||
|
||||
## 2. OIDC 登录流程（授权码）
|
||||
|
||||
| # | 测试点 | 步骤 | 预期 | 本地 |
|
||||
|---|--------|------|------|------|
|
||||
|2.1|发起登录|`GET /auth/oidc/login`|302 跳转到 IdP authorize 端点（state/nonce 入会话 cookie）|✅|
|
||||
|2.2|IdP 登录成功回跳|在 IdP 输入 `tester/Test123!`|302 回 `…/auth/oidc/callback?code=…&state=…`|✅|
|
||||
|2.3|回调换码并签发|后端处理 callback|校验 ID token(JWKS)→定位绑定用户→签发 hf JWT→302 到前端 `post_login#token=…`|✅|
|
||||
|2.4|登录态可用|用返回 token 调 `GET /auth/me`|返回被绑定的 hf 用户|✅|
|
||||
|2.5|前端按钮|登录页点 “Sign in with SSO”|全页跳转到后端 `/auth/oidc/login`|🟡|
|
||||
|2.6|未配置 OIDC|`OIDC` 关闭时访问 `/auth/oidc/login`|503 “OIDC is not configured”|🟡|
|
||||
|2.7|token 交换失败|code 失效/被篡改|回前端 `?oidc_error=exchange_failed`，登录页提示|⬜|
|
||||
|
||||
## 3. hf 用户 ↔ OIDC 身份绑定
|
||||
|
||||
| # | 测试点 | 步骤 | 预期 | 本地 |
|
||||
|---|--------|------|------|------|
|
||||
|3.1|管理员绑定|`PUT /users/{id}/oidc-binding` {issuer,subject}（admin 或 acc-manager）|200，用户响应含 `oidc_issuer/oidc_subject`|✅|
|
||||
|3.2|未绑定身份拒绝登录|解绑后用该 IdP 账号登录|回 `?oidc_error=not_linked`，**不签发 token**（不自动开号）|✅|
|
||||
|3.3|身份唯一性|把同一 (issuer,subject) 绑到另一用户|409 冲突|✅|
|
||||
|3.4|解绑|`DELETE /users/{id}/oidc-binding`|200，绑定清空|✅|
|
||||
|3.5|绑定鉴权|无凭据 / 普通用户调用绑定 API|401 / 403|✅|
|
||||
|3.6|API key 通道|admin 的 API key 调用绑定/配置 API|200（支持 JWT 或 API key）|✅|
|
||||
|3.7|自助绑定（非 ONLY）|登录用户点侧栏 “Link OIDC account” 走一次 OIDC|回 `?oidc_linked=1`，当前账号绑定成功|🟡|
|
||||
|3.8|自助绑定冲突|自助绑定到已被占用的身份|`?oidc_error=already_bound`|⬜|
|
||||
|3.9|OIDC_ONLY 下禁自助|ONLY 模式访问 `/auth/oidc/link`|403（仅管理员 API 可绑）|🟡|
|
||||
|
||||
## 4. HARBORFORGE_OIDC_ONLY 模式
|
||||
|
||||
| # | 测试点 | 步骤 | 预期 | 本地 |
|
||||
|---|--------|------|------|------|
|
||||
|4.1|配置反映|ONLY=true 时 `GET /auth/config`|`oidc_only=true`，`password_login=false`|✅|
|
||||
|4.2|禁用密码登录|`POST /auth/token`|403 “Password login is disabled (OIDC only)”|✅|
|
||||
|4.3|建用户忽略密码|`POST /users` 带 password|201，但 DB `hashed_password=NULL`（无密码用户）|✅|
|
||||
|4.4|改用户忽略密码|`PATCH /users/{id}` 带 password|密码不被设置|🟡|
|
||||
|4.5|无密码用户仍可用|对该用户绑定 OIDC、生成 API key|绑定 200、`reset-apikey` 200；可经 OIDC 登录|✅|
|
||||
|4.6|前端隐藏密码 UI|ONLY 模式打开登录页 / 用户管理页|无用户名密码框；用户管理无密码/重置密码组件|🟡|
|
||||
|4.7|防锁死恢复|ONLY 模式且 OIDC 配错|管理员 API key 仍可调 `GET/PUT /auth/oidc/settings` 修复|✅|
|
||||
|
||||
## 5. 回归（不破坏既有功能）
|
||||
|
||||
| # | 测试点 | 步骤 | 预期 | 本地 |
|
||||
|---|--------|------|------|------|
|
||||
|5.1|默认模式密码登录|未开 ONLY 时 `POST /auth/token`|正常 200 签发 token|✅|
|
||||
|5.2|用户响应新增字段|`GET /users` `/users/{id}` `/auth/me`|含 `oidc_issuer/oidc_subject`（未绑定为 null）|✅|
|
||||
|5.3|启动迁移幂等|新旧库重复启动后端|`users.oidc_*` 列与 `oidc_settings` 表存在，无报错|✅|
|
||||
|5.4|前端构建|`npm run build`（Docker 镜像）|TS 编译通过|✅|
|
||||
|5.5|后端导入|镜像内 `import app.main`|无导入错误，OIDC 路由注册|✅|
|
||||
|5.6|镜像参数|前后端 Dockerfile|含 `ARG/ENV HARBORFORGE_OIDC_ONLY`|✅|
|
||||
|
||||
## 6. 安全检查点
|
||||
|
||||
- ID token 经 IdP JWKS 校验（Authlib discovery + nonce）；签发的是 hf 原有
|
||||
HS256 JWT，依赖强 `SECRET_KEY`（弱 key 后端拒绝启动）。
|
||||
- `client_secret` 持久化在 DB，接口永不回显。
|
||||
- 绑定/配置接口强制 admin（或 account-manager 绑定），支持 API key 作为
|
||||
OIDC_ONLY 下的恢复通道。
|
||||
- 未绑定 OIDC 身份一律拒绝，不自动开号（防越权开户）。
|
||||
- `redirect_uri` 必须在 IdP 精确注册；后端回跳前端地址来自服务端配置
|
||||
（`post_login_redirect`），不接受客户端传入，避免开放重定向。
|
||||
|
||||
## 7. 已知限制 / 待补
|
||||
|
||||
- 真实浏览器交互（点按钮、IdP 同意页、SameSite cookie 行为）需人工过一遍
|
||||
（本地已用 curl 无头跑通授权码全流程，逻辑等价）。
|
||||
- 多 IdP / 多 issuer、token 刷新、登出联动（SLO）未实现，超出本次范围。
|
||||
- 自助绑定相关 UI（3.7/3.8）建议人工在浏览器复核。
|
||||
@@ -1,5 +1,19 @@
|
||||
#!/bin/sh
|
||||
# HarborForge backend entrypoint. All config comes from env vars (DATABASE_URL,
|
||||
# SECRET_KEY, HARBORFORGE_OIDC_ONLY, etc.). First-deploy admin user + OIDC
|
||||
# issuer config are operator-driven via `docker exec hf-backend hf-cli ...`.
|
||||
# Wait for wizard config before starting uvicorn
|
||||
CONFIG_DIR="${CONFIG_DIR:-/config}"
|
||||
CONFIG_FILE="${CONFIG_FILE:-harborforge.json}"
|
||||
CONFIG_PATH="$CONFIG_DIR/$CONFIG_FILE"
|
||||
|
||||
echo "HarborForge Backend - waiting for config..."
|
||||
echo " Config path: $CONFIG_PATH"
|
||||
|
||||
while true; do
|
||||
if [ -f "$CONFIG_PATH" ]; then
|
||||
echo " Config found! Starting backend..."
|
||||
break
|
||||
fi
|
||||
echo " Config not ready, waiting 5s... (run setup wizard via SSH tunnel)"
|
||||
sleep 5
|
||||
done
|
||||
|
||||
exec uvicorn app.main:app --host 0.0.0.0 --port 8000
|
||||
|
||||
@@ -12,5 +12,3 @@ alembic==1.13.1
|
||||
python-dotenv==1.0.0
|
||||
httpx==0.27.0
|
||||
requests==2.31.0
|
||||
authlib==1.3.2
|
||||
itsdangerous==2.2.0
|
||||
|
||||
@@ -15,7 +15,7 @@ from fastapi.testclient import TestClient
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Patch the production engine/SessionLocal BEFORE importing app so that
|
||||
# startup events (Base.metadata.create_all, init_bootstrap, etc.) use the
|
||||
# startup events (Base.metadata.create_all, init_wizard, etc.) use the
|
||||
# in-memory SQLite database instead of trying to connect to MySQL.
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
|
||||
Reference in New Issue
Block a user