Complete LinkSyncServer and LinkSyncExtension implementation
LinkSyncServer: - Fix app.py imports, add CORS middleware, lifespan events - Create api/routes.py router aggregator - Create config/settings.py for centralized configuration - Rewrite models/base.py with proper relationships and serialization - Rewrite all API endpoints with real DB integration (auth, links, collections, sync, queries, tags) - Add admin endpoints (user management, stats, audit log) - Complete query parser with recursive descent and proper precedence - Complete query executor with set operations and field filters - Set up Alembic migrations with initial schema - Create web interface (templates, CSS, JS) - Add 42 passing tests (auth, links, collections, queries) - Add deploy.ps1 and deploy.sh scripts - Update README with deployment workflow LinkSyncExtension: - Create utils/api.js (REST client with retries, auth, error handling) - Create utils/sync.js (3 sync modes + conflict detection) - Create utils/collection.js (collection management) - Create utils/query-engine.js (client-side query parser) - Rewrite background.js (sync loop, bookmark events, message routing) - Rewrite popup.js (tabs, settings modal, notifications, CRUD) - Update popup.html (tabbed interface, query builder, modal) - Update popup.css (full redesign) - Create content/content.js (page metadata extraction) - Create options.html/js (dedicated settings page) - Generate icons (48x48, 96x96) - Update manifest.json (host permissions, content scripts, options) - Create AGENTS.md
This commit is contained in:
DavidSaylor
@@ -2,151 +2,275 @@
|
||||
LinkSyncServer - Authentication Endpoints
|
||||
"""
|
||||
|
||||
from fastapi import APIRouter, Depends, HTTPException, status, Request
|
||||
from fastapi.security import OAuth2PasswordBearer, OAuth2PasswordRequestForm
|
||||
from sqlalchemy.orm import Session
|
||||
from typing import Optional
|
||||
import secrets
|
||||
import hashlib
|
||||
import os
|
||||
import secrets
|
||||
from datetime import datetime, timedelta
|
||||
from typing import Optional
|
||||
|
||||
import bcrypt
|
||||
import jwt
|
||||
from fastapi import APIRouter, Depends, HTTPException, Request, status
|
||||
from fastapi.security import OAuth2PasswordBearer, OAuth2PasswordRequestForm
|
||||
from pydantic import BaseModel, EmailStr
|
||||
|
||||
from models.base import User, ApiKey
|
||||
from models.base import get_engine
|
||||
|
||||
# Fix: Define get_db dependency
|
||||
def get_db():
|
||||
"""Get database engine/session for testing without full DB setup."""
|
||||
return None # Mock - in production would return actual session
|
||||
from config.settings import settings
|
||||
from models.base import ApiKey, User, get_session
|
||||
|
||||
router = APIRouter(prefix="/api/auth", tags=["Authentication"])
|
||||
|
||||
# JWT configuration
|
||||
SECRET_KEY = secrets.token_urlsafe(32)
|
||||
ALGORITHM = "HS256"
|
||||
ACCESS_TOKEN_EXPIRE_MINUTES = 1440
|
||||
|
||||
oauth2_scheme = OAuth2PasswordBearer(tokenUrl="/api/auth/login", auto_error=False)
|
||||
|
||||
|
||||
def create_access_token(data: dict, expires_delta: Optional[timedelta] = None):
|
||||
"""Create JWT access token."""
|
||||
class RegisterRequest(BaseModel):
|
||||
username: str
|
||||
email: EmailStr
|
||||
password: str
|
||||
is_admin: bool = False
|
||||
|
||||
|
||||
class TokenResponse(BaseModel):
|
||||
access_token: str
|
||||
token_type: str
|
||||
user: dict
|
||||
|
||||
|
||||
class ApiKeyResponse(BaseModel):
|
||||
api_key: str
|
||||
key_id: str
|
||||
name: str
|
||||
expires_at: Optional[str] = None
|
||||
|
||||
|
||||
def hash_password(password: str) -> str:
|
||||
return bcrypt.hashpw(
|
||||
password.encode("utf-8"),
|
||||
bcrypt.gensalt(rounds=settings.BCRYPT_COST_FACTOR),
|
||||
).decode("utf-8")
|
||||
|
||||
|
||||
def verify_password(plain_password: str, hashed_password: str) -> bool:
|
||||
return bcrypt.checkpw(
|
||||
plain_password.encode("utf-8"), hashed_password.encode("utf-8")
|
||||
)
|
||||
|
||||
|
||||
def create_access_token(data: dict, expires_delta: Optional[timedelta] = None) -> str:
|
||||
to_encode = data.copy()
|
||||
if expires_delta:
|
||||
expire = datetime.utcnow() + expires_delta
|
||||
else:
|
||||
expire = datetime.utcnow() + timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES)
|
||||
expire = datetime.utcnow() + (
|
||||
expires_delta or timedelta(minutes=settings.JWT_ACCESS_TOKEN_EXPIRE_MINUTES)
|
||||
)
|
||||
to_encode.update({"exp": expire})
|
||||
encoded_jwt = jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)
|
||||
return encoded_jwt
|
||||
return jwt.encode(to_encode, settings.SECRET_KEY, algorithm=settings.JWT_ALGORITHM)
|
||||
|
||||
|
||||
def get_user_from_token(token: str):
|
||||
"""Get user from JWT token."""
|
||||
def get_current_user(token: str = Depends(oauth2_scheme)) -> dict:
|
||||
if not token:
|
||||
raise HTTPException(status_code=401, detail="Not authenticated")
|
||||
try:
|
||||
payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
|
||||
payload = jwt.decode(
|
||||
token, settings.SECRET_KEY, algorithms=[settings.JWT_ALGORITHM]
|
||||
)
|
||||
username: str = payload.get("sub")
|
||||
user_type: str = payload.get("type")
|
||||
if user_type != "access":
|
||||
raise HTTPException(status_code=401, detail="Invalid token type")
|
||||
if username is None:
|
||||
raise HTTPException(status_code=401, detail="Invalid token")
|
||||
return {"username": username, "type": "access"}
|
||||
return {"username": username, "role": payload.get("role", "user")}
|
||||
except jwt.ExpiredSignatureError:
|
||||
raise HTTPException(status_code=401, detail="Token expired")
|
||||
except jwt.InvalidTokenError:
|
||||
raise HTTPException(status_code=401, detail="Invalid token")
|
||||
|
||||
|
||||
def require_admin(current_user: dict = Depends(get_current_user)) -> dict:
|
||||
if current_user.get("role") != "admin":
|
||||
raise HTTPException(status_code=403, detail="Admin access required")
|
||||
return current_user
|
||||
|
||||
|
||||
def get_db():
|
||||
session = get_session()
|
||||
try:
|
||||
yield session
|
||||
finally:
|
||||
session.close()
|
||||
|
||||
|
||||
@router.post("/register", response_model=dict)
|
||||
async def register(
|
||||
username: str,
|
||||
email: str,
|
||||
password: str,
|
||||
is_admin: bool = False,
|
||||
):
|
||||
"""Register new user."""
|
||||
return {
|
||||
"message": "User registered successfully",
|
||||
"user": {
|
||||
"id": "test-user-id",
|
||||
"username": username,
|
||||
"email": email,
|
||||
"role": "admin" if is_admin else "user"
|
||||
async def register(data: RegisterRequest):
|
||||
db = get_session()
|
||||
try:
|
||||
existing = db.query(User).filter(
|
||||
(User.username == data.username) | (User.email == data.email)
|
||||
).first()
|
||||
if existing:
|
||||
raise HTTPException(status_code=400, detail="Username or email already exists")
|
||||
|
||||
user = User(
|
||||
username=data.username,
|
||||
email=data.email,
|
||||
password_hash=hash_password(data.password),
|
||||
role="admin" if data.is_admin else "user",
|
||||
is_active=True,
|
||||
)
|
||||
db.add(user)
|
||||
db.commit()
|
||||
db.refresh(user)
|
||||
|
||||
return {
|
||||
"message": "User registered successfully",
|
||||
"user": user.to_dict(),
|
||||
}
|
||||
}
|
||||
finally:
|
||||
db.close()
|
||||
|
||||
|
||||
@router.post("/login", response_model=dict)
|
||||
async def login(
|
||||
form_data: OAuth2PasswordRequestForm = Depends(),
|
||||
admin_username: Optional[str] = None,
|
||||
admin_password_hash: Optional[str] = None,
|
||||
):
|
||||
"""Login and get access token."""
|
||||
|
||||
# Admin login check
|
||||
if admin_username and admin_password_hash:
|
||||
if form_data.username == admin_username and form_data.password == admin_password_hash:
|
||||
@router.post("/login", response_model=TokenResponse)
|
||||
async def login(form_data: OAuth2PasswordRequestForm = Depends()):
|
||||
db = get_session()
|
||||
try:
|
||||
if (
|
||||
form_data.username == settings.ADMIN_USERNAME
|
||||
and form_data.password == settings.ADMIN_PASSWORD
|
||||
):
|
||||
user = db.query(User).filter(User.username == settings.ADMIN_USERNAME).first()
|
||||
if not user:
|
||||
user = User(
|
||||
username=settings.ADMIN_USERNAME,
|
||||
email="admin@linksync.local",
|
||||
password_hash=hash_password(settings.ADMIN_PASSWORD),
|
||||
role="admin",
|
||||
is_active=True,
|
||||
)
|
||||
db.add(user)
|
||||
db.commit()
|
||||
db.refresh(user)
|
||||
|
||||
token = create_access_token(
|
||||
data={"sub": admin_username, "type": "access"}
|
||||
data={"sub": user.username, "role": user.role, "type": "access"}
|
||||
)
|
||||
return {
|
||||
"access_token": token,
|
||||
"token_type": "bearer",
|
||||
"user": {"username": admin_username, "role": "admin"}
|
||||
"user": {"username": user.username, "role": user.role},
|
||||
}
|
||||
|
||||
# Regular user login - demo: accept any valid credentials
|
||||
token = create_access_token(
|
||||
data={"sub": form_data.username, "type": "access"}
|
||||
)
|
||||
return {
|
||||
"access_token": token,
|
||||
"token_type": "bearer",
|
||||
"user": {"username": form_data.username, "role": "user"}
|
||||
}
|
||||
|
||||
user = db.query(User).filter(User.username == form_data.username).first()
|
||||
if not user or not verify_password(form_data.password, user.password_hash):
|
||||
raise HTTPException(status_code=401, detail="Invalid credentials")
|
||||
|
||||
if not user.is_active:
|
||||
raise HTTPException(status_code=403, detail="Account disabled")
|
||||
|
||||
token = create_access_token(
|
||||
data={"sub": user.username, "role": user.role, "type": "access"}
|
||||
)
|
||||
return {
|
||||
"access_token": token,
|
||||
"token_type": "bearer",
|
||||
"user": {"username": user.username, "role": user.role},
|
||||
}
|
||||
finally:
|
||||
db.close()
|
||||
|
||||
|
||||
@router.post("/logout")
|
||||
async def logout():
|
||||
"""Logout (client-side token invalidation)."""
|
||||
return {"message": "Logged out successfully"}
|
||||
|
||||
|
||||
@router.post("/api-key", response_model=dict)
|
||||
async def create_api_key(user_data: dict = {}):
|
||||
"""Create new API key for authenticated user."""
|
||||
key = secrets.token_urlsafe(64)
|
||||
return {"api_key": key, "expires_in": None}
|
||||
@router.post("/api-key", response_model=ApiKeyResponse)
|
||||
async def create_api_key(
|
||||
name: str = "default",
|
||||
current_user: dict = Depends(get_current_user),
|
||||
):
|
||||
db = get_session()
|
||||
try:
|
||||
raw_key = secrets.token_urlsafe(64)
|
||||
key_hash = hashlib.sha256(raw_key.encode()).hexdigest()
|
||||
|
||||
user = db.query(User).filter(User.username == current_user["username"]).first()
|
||||
if not user:
|
||||
raise HTTPException(status_code=404, detail="User not found")
|
||||
|
||||
api_key = ApiKey(
|
||||
user_id=user.id,
|
||||
key_hash=key_hash,
|
||||
name=name,
|
||||
is_active=True,
|
||||
)
|
||||
db.add(api_key)
|
||||
db.commit()
|
||||
db.refresh(api_key)
|
||||
|
||||
return {
|
||||
"api_key": raw_key,
|
||||
"key_id": api_key.id,
|
||||
"name": api_key.name,
|
||||
"expires_at": api_key.expires_at.isoformat() if api_key.expires_at else None,
|
||||
}
|
||||
finally:
|
||||
db.close()
|
||||
|
||||
|
||||
@router.get("/api-key/{key_id}")
|
||||
async def get_api_key_info(key_id: str):
|
||||
"""Get API key information."""
|
||||
return {"key_id": key_id, "active": True}
|
||||
async def get_api_key_info(
|
||||
key_id: str,
|
||||
current_user: dict = Depends(get_current_user),
|
||||
):
|
||||
db = get_session()
|
||||
try:
|
||||
user = db.query(User).filter(User.username == current_user["username"]).first()
|
||||
if not user:
|
||||
raise HTTPException(status_code=404, detail="User not found")
|
||||
|
||||
api_key = db.query(ApiKey).filter(
|
||||
ApiKey.id == key_id, ApiKey.user_id == user.id
|
||||
).first()
|
||||
if not api_key:
|
||||
raise HTTPException(status_code=404, detail="API key not found")
|
||||
|
||||
return {
|
||||
"key_id": api_key.id,
|
||||
"name": api_key.name,
|
||||
"is_active": api_key.is_active,
|
||||
"expires_at": api_key.expires_at.isoformat() if api_key.expires_at else None,
|
||||
"created_at": api_key.created_at.isoformat() if api_key.created_at else None,
|
||||
}
|
||||
finally:
|
||||
db.close()
|
||||
|
||||
|
||||
@router.delete("/api-key/{key_id}")
|
||||
async def delete_api_key(key_id: str):
|
||||
"""Delete API key."""
|
||||
return {"message": "API key deleted successfully"}
|
||||
|
||||
|
||||
@router.get("/me", response_model=dict)
|
||||
async def get_current_user_info(token: str = Depends(oauth2_scheme)):
|
||||
"""Get current user info."""
|
||||
user_data = get_user_from_token(token)
|
||||
return {"username": user_data["username"]}
|
||||
|
||||
|
||||
@router.get("/token", response_model=dict)
|
||||
async def get_token_info(token: str = Depends(oauth2_scheme)):
|
||||
"""Get token information."""
|
||||
async def delete_api_key(
|
||||
key_id: str,
|
||||
current_user: dict = Depends(get_current_user),
|
||||
):
|
||||
db = get_session()
|
||||
try:
|
||||
payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
|
||||
return {"username": payload.get("sub"), "exp": payload.get("exp")}
|
||||
except jwt.ExpiredSignatureError:
|
||||
raise HTTPException(status_code=401, detail="Token expired")
|
||||
except jwt.InvalidTokenError:
|
||||
raise HTTPException(status_code=401, detail="Invalid token")
|
||||
user = db.query(User).filter(User.username == current_user["username"]).first()
|
||||
if not user:
|
||||
raise HTTPException(status_code=404, detail="User not found")
|
||||
|
||||
api_key = db.query(ApiKey).filter(
|
||||
ApiKey.id == key_id, ApiKey.user_id == user.id
|
||||
).first()
|
||||
if not api_key:
|
||||
raise HTTPException(status_code=404, detail="API key not found")
|
||||
|
||||
db.delete(api_key)
|
||||
db.commit()
|
||||
return {"message": "API key deleted successfully"}
|
||||
finally:
|
||||
db.close()
|
||||
|
||||
|
||||
@router.get("/me")
|
||||
async def get_current_user_info(current_user: dict = Depends(get_current_user)):
|
||||
db = get_session()
|
||||
try:
|
||||
user = db.query(User).filter(User.username == current_user["username"]).first()
|
||||
if not user:
|
||||
raise HTTPException(status_code=404, detail="User not found")
|
||||
return user.to_dict()
|
||||
finally:
|
||||
db.close()
|
||||
|
||||
Reference in New Issue
Block a user