Complete admin package restructuring

packages/sshecret-admin/src/sshecret_admin/frontend/views/__init__.py

@@ -0,0 +1 @@
+"""Frontend views."""

packages/sshecret-admin/src/sshecret_admin/frontend/views/audit.py

@@ -0,0 +1,103 @@
+"""Audit view factory."""
+
+# pyright: reportUnusedFunction=false
+import logging
+import math
+from typing import Annotated
+from fastapi import APIRouter, Depends, Request, Response
+from pydantic import BaseModel
+
+from sshecret_admin.auth import User
+from sshecret_admin.services import AdminBackend
+
+from ..dependencies import FrontendDependencies
+
+LOG = logging.getLogger(__name__)
+
+
+class PagingInfo(BaseModel):
+
+    page: int
+    limit: int
+    total: int
+    offset: int = 0
+
+    @property
+    def first(self) -> int:
+        """The first result number."""
+        return self.offset + 1
+
+    @property
+    def last(self) -> int:
+        """Return the last result number."""
+        return self.offset + self.limit
+
+    @property
+    def total_pages(self) -> int:
+        """Return total pages."""
+        return math.ceil(self.total / self.limit)
+
+
+def create_router(dependencies: FrontendDependencies) -> APIRouter:
+    """Create clients router."""
+
+    app = APIRouter()
+    templates = dependencies.templates
+
+    async def resolve_audit_entries(
+        request: Request, current_user: User, admin: AdminBackend, page: int
+    ) -> Response:
+        """Resolve audit entries."""
+        LOG.info("Page: %r", page)
+        total_messages = await admin.get_audit_log_count()
+        per_page = 20
+        offset = 0
+        if page > 1:
+            offset = (page - 1) * per_page
+
+        entries = await admin.get_audit_log(offset=offset, limit=per_page)
+        LOG.info("Entries: %r", entries)
+        page_info = PagingInfo(
+            page=page, limit=per_page, total=total_messages, offset=offset
+        )
+        if request.headers.get("HX-Request"):
+            return templates.TemplateResponse(
+                request,
+                "audit/inner.html.j2",
+                {
+                    "entries": entries,
+                    "page_info": page_info,
+                },
+            )
+        return templates.TemplateResponse(
+            request,
+            "audit/index.html.j2",
+            {
+                "page_title": "Audit",
+                "entries": entries,
+                "user": current_user.username,
+                "page_info": page_info,
+            },
+        )
+
+    @app.get("/audit/")
+    async def get_audit_entries(
+        request: Request,
+        current_user: Annotated[User, Depends(dependencies.get_user_from_access_token)],
+        admin: Annotated[AdminBackend, Depends(dependencies.get_admin_backend)],
+    ) -> Response:
+        """Get audit entries."""
+        return await resolve_audit_entries(request, current_user, admin, 1)
+
+    @app.get("/audit/page/{page}")
+    async def get_audit_entries_page(
+        request: Request,
+        current_user: Annotated[User, Depends(dependencies.get_user_from_access_token)],
+        admin: Annotated[AdminBackend, Depends(dependencies.get_admin_backend)],
+        page: int,
+    ) -> Response:
+        """Get audit entries."""
+        LOG.info("Get audit entries page: %r", page)
+        return await resolve_audit_entries(request, current_user, admin, page)
+
+    return app

packages/sshecret-admin/src/sshecret_admin/frontend/views/auth.py

@@ -0,0 +1,143 @@
+"""Authentication related views factory."""
+
+# pyright: reportUnusedFunction=false
+import logging
+from pydantic import BaseModel
+from typing import Annotated
+from fastapi import APIRouter, Depends, Query, Request, Response, status
+from fastapi.responses import RedirectResponse
+from fastapi.security import OAuth2PasswordRequestForm
+from sqlmodel import Session
+from starlette.datastructures import URL
+
+from sshecret_admin.auth import (
+    User,
+    authenticate_user,
+    create_access_token,
+    create_refresh_token,
+)
+
+from ..dependencies import FrontendDependencies
+from ..exceptions import RedirectException
+
+LOG = logging.getLogger(__name__)
+
+
+class LoginError(BaseModel):
+    """Login error."""
+
+    title: str
+    message: str
+
+
+def create_router(dependencies: FrontendDependencies) -> APIRouter:
+    """Create auth router."""
+
+    app = APIRouter()
+    templates = dependencies.templates
+
+    @app.get("/login")
+    async def get_login(
+        request: Request,
+        login_status: Annotated[bool, Depends(dependencies.get_login_status)],
+        error_title: str | None = None,
+        error_message: str | None = None,
+    ):
+        """Get index."""
+        if login_status:
+            return RedirectResponse("/dashboard")
+        login_error: LoginError | None = None
+        if error_title and error_message:
+            login_error = LoginError(title=error_title, message=error_message)
+        return templates.TemplateResponse(
+            request,
+            "login.html",
+            {
+                "page_title": "Login",
+                "page_description": "Login page.",
+                "login_error": login_error,
+            },
+        )
+
+    @app.post("/login")
+    async def login_user(
+        request: Request,
+        response: Response,
+        session: Annotated[Session, Depends(dependencies.get_db_session)],
+        form_data: Annotated[OAuth2PasswordRequestForm, Depends()],
+        next: Annotated[str, Query()] = "/dashboard",
+        error_title: str | None = None,
+        error_message: str | None = None,
+    ):
+        """Log in user."""
+        if error_title and error_message:
+            login_error = LoginError(title=error_title, message=error_message)
+            return templates.TemplateResponse(
+                request,
+                "login.html",
+                {
+                    "page_title": "Login",
+                    "page_description": "Login page.",
+                    "login_error": login_error,
+                },
+            )
+
+        user = authenticate_user(session, form_data.username, form_data.password)
+        login_failed = RedirectException(
+            to=URL("/login").include_query_params(
+                error_title="Login Error", error_message="Invalid username or password"
+            )
+        )
+        if not user:
+            raise login_failed
+        token_data: dict[str, str] = {"sub": user.username}
+        access_token = create_access_token(dependencies.settings, data=token_data)
+        refresh_token = create_refresh_token(dependencies.settings, data=token_data)
+        response = RedirectResponse(url=next, status_code=status.HTTP_302_FOUND)
+        response.set_cookie(
+            "access_token",
+            value=access_token,
+            httponly=True,
+            secure=False,
+            samesite="strict",
+        )
+        response.set_cookie(
+            "refresh_token",
+            value=refresh_token,
+            httponly=True,
+            secure=False,
+            samesite="strict",
+        )
+        return response
+
+    @app.get("/refresh")
+    async def get_refresh_token(
+        response: Response,
+        user: Annotated[User, Depends(dependencies.get_user_from_refresh_token)],
+        next: Annotated[str, Query()],
+    ):
+        """Refresh tokens.
+
+        We might as well refresh the long-lived one here.
+        """
+        token_data: dict[str, str] = {"sub": user.username}
+        access_token = create_access_token(dependencies.settings, data=token_data)
+        refresh_token = create_refresh_token(dependencies.settings, data=token_data)
+        response = RedirectResponse(url=next, status_code=status.HTTP_302_FOUND)
+        response.set_cookie(
+            "access_token",
+            value=access_token,
+            httponly=True,
+            secure=False,
+            samesite="strict",
+        )
+        response.set_cookie(
+            "refresh_token",
+            value=refresh_token,
+            httponly=True,
+            secure=False,
+            samesite="strict",
+        )
+        return response
+
+    return app

packages/sshecret-admin/src/sshecret_admin/frontend/views/clients.py

@@ -0,0 +1,237 @@
+"""clients view factory."""
+
+# pyright: reportUnusedFunction=false
+import ipaddress
+import logging
+import uuid
+from typing import Annotated
+from fastapi import APIRouter, Depends, Form, Request, Response
+from pydantic import BaseModel, IPvAnyAddress, IPvAnyNetwork
+
+from sshecret.backend import ClientFilter
+from sshecret.backend.models import FilterType
+from sshecret.crypto import validate_public_key
+from sshecret_admin.auth import User
+from sshecret_admin.services import AdminBackend
+
+from ..dependencies import FrontendDependencies
+
+LOG = logging.getLogger(__name__)
+
+
+class ClientUpdate(BaseModel):
+
+    id: uuid.UUID
+    name: str
+    description: str
+    public_key: str
+    sources: str | None = None
+
+
+class ClientCreate(BaseModel):
+
+    name: str
+    public_key: str
+    description: str | None
+    sources: str | None
+
+
+def create_router(dependencies: FrontendDependencies) -> APIRouter:
+    """Create clients router."""
+
+    app = APIRouter()
+    templates = dependencies.templates
+
+    @app.get("/clients")
+    async def get_clients(
+        request: Request,
+        current_user: Annotated[User, Depends(dependencies.get_user_from_access_token)],
+        admin: Annotated[AdminBackend, Depends(dependencies.get_admin_backend)],
+    ) -> Response:
+        """Get clients."""
+        clients = await admin.get_clients()
+        LOG.info("Clients %r", clients)
+        return templates.TemplateResponse(
+            request,
+            "clients/index.html.j2",
+            {
+                "page_title": "Clients",
+                "clients": clients,
+                "user": current_user.username,
+            },
+        )
+
+    @app.post("/clients/query")
+    async def query_clients(
+        request: Request,
+        _current_user: Annotated[
+            User, Depends(dependencies.get_user_from_access_token)
+        ],
+        admin: Annotated[AdminBackend, Depends(dependencies.get_admin_backend)],
+        query: Annotated[str, Form()],
+    ) -> Response:
+        """Query for a client."""
+        query_filter: ClientFilter | None = None
+        if query:
+            name = f"%{query}%"
+            query_filter = ClientFilter(name=name, filter_name=FilterType.LIKE)
+        clients = await admin.get_clients(query_filter)
+        return templates.TemplateResponse(
+            request,
+            "clients/inner.html.j2",
+            {
+                "clients": clients,
+            },
+        )
+
+    @app.put("/clients/{id}")
+    async def update_client(
+        request: Request,
+        id: str,
+        _current_user: Annotated[
+            User, Depends(dependencies.get_user_from_access_token)
+        ],
+        admin: Annotated[AdminBackend, Depends(dependencies.get_admin_backend)],
+        client: Annotated[ClientUpdate, Form()],
+    ):
+        """Update a client."""
+        original_client = await admin.get_client(id)
+        if not original_client:
+            return templates.TemplateResponse(
+                request, "fragments/error.html", {"message": "Client not found"}
+            )
+
+        sources: list[IPvAnyAddress | IPvAnyNetwork] = []
+        if client.sources:
+            source_str = client.sources.split(",")
+            for source in source_str:
+                if "/" in source:
+                    sources.append(ipaddress.ip_network(source.strip()))
+                else:
+                    sources.append(ipaddress.ip_address(source.strip()))
+        client_fields = client.model_dump(exclude_unset=True)
+
+        del client_fields["sources"]
+        if sources:
+            client_fields["policies"] = sources
+
+        LOG.info("Fields: %r", client_fields)
+        updated_client = original_client.model_copy(update=client_fields)
+
+        await admin.update_client(updated_client)
+
+        clients = await admin.get_clients()
+        headers = {"Hx-Refresh": "true"}
+        return templates.TemplateResponse(
+            request,
+            "clients/inner.html.j2",
+            {
+                "clients": clients,
+            },
+            headers=headers,
+        )
+
+    @app.delete("/clients/{id}")
+    async def delete_client(
+        request: Request,
+        id: str,
+        _current_user: Annotated[
+            User, Depends(dependencies.get_user_from_access_token)
+        ],
+        admin: Annotated[AdminBackend, Depends(dependencies.get_admin_backend)],
+    ) -> Response:
+        """Delete a client."""
+        await admin.delete_client(id)
+        clients = await admin.get_clients()
+        headers = {"Hx-Refresh": "true"}
+        return templates.TemplateResponse(
+            request,
+            "clients/inner.html.j2",
+            {
+                "clients": clients,
+            },
+            headers=headers,
+        )
+
+    @app.post("/clients/")
+    async def create_client(
+        request: Request,
+        _current_user: Annotated[
+            User, Depends(dependencies.get_user_from_access_token)
+        ],
+        admin: Annotated[AdminBackend, Depends(dependencies.get_admin_backend)],
+        client: Annotated[ClientCreate, Form()],
+    ) -> Response:
+        """Create client."""
+        sources: list[str] | None = None
+        if client.sources:
+            sources = [source.strip() for source in client.sources.split(",")]
+        await admin.create_client(
+            client.name, client.public_key.rstrip(), client.description, sources
+        )
+        clients = await admin.get_clients()
+        headers = {"Hx-Refresh": "true"}
+        return templates.TemplateResponse(
+            request,
+            "clients/inner.html.j2",
+            {
+                "clients": clients,
+            },
+            headers=headers,
+        )
+
+    @app.post("/clients/validate/source")
+    async def validate_client_source(
+        request: Request,
+        _current_user: Annotated[
+            User, Depends(dependencies.get_user_from_access_token)
+        ],
+        sources: Annotated[str, Form()],
+    ) -> Response:
+        """Validate source."""
+        source_str = sources.split(",")
+        for source in source_str:
+            if "/" in source:
+                try:
+                    _network = ipaddress.ip_network(source.strip())
+                except Exception:
+                    return templates.TemplateResponse(
+                        request,
+                        "/clients/field_invalid.html.j2",
+                        {"explanation": f"Invalid network {source.strip()}"},
+                    )
+            else:
+                try:
+                    _address = ipaddress.ip_address(source.strip())
+                except Exception:
+                    return templates.TemplateResponse(
+                        request,
+                        "/clients/field_invalid.html.j2",
+                        {"explanation": f"Invalid address {source.strip()}"},
+                    )
+        return templates.TemplateResponse(
+            request,
+            "/clients/field_valid.html.j2",
+        )
+
+    @app.post("/clients/validate/public_key")
+    async def validate_client_public_key(
+        request: Request,
+        _current_user: Annotated[
+            User, Depends(dependencies.get_user_from_access_token)
+        ],
+        public_key: Annotated[str, Form()],
+    ) -> Response:
+        """Validate source."""
+        if validate_public_key(public_key.rstrip()):
+            return templates.TemplateResponse(
+                request,
+                "/clients/field_valid.html.j2",
+            )
+        return templates.TemplateResponse(
+            request,
+            "/clients/field_invalid.html.j2",
+            {"explanation": "Invalid value. Not a valid SSH RSA Public Key."},
+        )
+
+    return app

packages/sshecret-admin/src/sshecret_admin/frontend/views/index.py

@@ -0,0 +1,70 @@
+"""Front page view factory."""
+
+# pyright: reportUnusedFunction=false
+import logging
+from typing import Annotated
+from fastapi import APIRouter, Depends, Request
+from fastapi.responses import RedirectResponse
+from pydantic import BaseModel
+from sshecret_admin.auth import User
+from sshecret_admin.services import AdminBackend
+
+from ..dependencies import FrontendDependencies
+
+LOG = logging.getLogger(__name__)
+
+START_PAGE = "/dashboard"
+LOGIN_PAGE = "/login"
+
+
+class StatsView(BaseModel):
+    """Stats for the frontend."""
+
+    clients: int = 0
+    secrets: int = 0
+    audit_events: int = 0
+
+
+async def get_stats(admin: AdminBackend) -> StatsView:
+    """Get stats for the frontpage."""
+    clients = await admin.get_clients()
+    secrets = await admin.get_secrets()
+    audit = await admin.get_audit_log_count()
+    return StatsView(clients=len(clients), secrets=len(secrets), audit_events=audit)
+
+
+def create_router(dependencies: FrontendDependencies) -> APIRouter:
+    """Create auth router."""
+
+    app = APIRouter()
+    templates = dependencies.templates
+
+    @app.get("/")
+    def get_index(logged_in: Annotated[bool, Depends(dependencies.get_login_status)]):
+        """Get the index."""
+        next = LOGIN_PAGE
+        if logged_in:
+            next = START_PAGE
+
+        return RedirectResponse(url=next)
+
+    @app.get("/dashboard")
+    async def get_dashboard(
+        request: Request,
+        admin: Annotated[AdminBackend, Depends(dependencies.get_admin_backend)],
+        current_user: Annotated[User, Depends(dependencies.get_user_from_access_token)],
+    ):
+        """Dashboard for mocking up the dashboard."""
+        stats = await get_stats(admin)
+
+        return templates.TemplateResponse(
+            request,
+            "dashboard.html",
+            {
+                "page_title": "sshecret",
+                "user": current_user.username,
+                "stats": stats,
+            },
+        )
+
+    return app

packages/sshecret-admin/src/sshecret_admin/frontend/views/secrets.py

@@ -0,0 +1,181 @@
+#!/usr/bin/env python3
+
+
+# pyright: reportUnusedFunction=false
+import logging
+import secrets as pysecrets
+from typing import Annotated, Any
+from fastapi import APIRouter, Depends, Form, Request
+from pydantic import BaseModel, BeforeValidator, Field
+
+from sshecret_admin.auth import User
+from sshecret_admin.services import AdminBackend
+
+from ..dependencies import FrontendDependencies
+
+LOG = logging.getLogger(__name__)
+
+
+def split_clients(clients: Any) -> Any:  # pyright: ignore[reportAny]
+    """Split clients."""
+    if isinstance(clients, list):
+        return clients  # pyright: ignore[reportUnknownVariableType]
+    if not isinstance(clients, str):
+        raise ValueError("Invalid type for clients.")
+    if not clients:
+        return []
+    return [client.rstrip() for client in clients.split(",")]
+
+
+def handle_select_bool(value: Any) -> Any:  # pyright: ignore[reportAny]
+    """Handle boolean from select."""
+    if isinstance(value, bool):
+        return value
+    if value == "on":
+        return True
+    if value == "off":
+        return False
+
+
+class CreateSecret(BaseModel):
+    """Create secret model."""
+
+    name: str
+    value: str | None = None
+    auto_generate: Annotated[bool, BeforeValidator(handle_select_bool)] = False
+    clients: Annotated[list[str], BeforeValidator(split_clients)] = Field(
+        default_factory=list
+    )
+
+
+def create_router(dependencies: FrontendDependencies) -> APIRouter:
+    """Create secrets router."""
+
+    app = APIRouter()
+    templates = dependencies.templates
+
+    @app.get("/secrets/")
+    async def get_secrets(
+        request: Request,
+        current_user: Annotated[User, Depends(dependencies.get_user_from_access_token)],
+        admin: Annotated[AdminBackend, Depends(dependencies.get_admin_backend)],
+    ):
+        """Get secrets index page."""
+        secrets = await admin.get_detailed_secrets()
+        clients = await admin.get_clients()
+        return templates.TemplateResponse(
+            request,
+            "secrets/index.html.j2",
+            {
+                "page_title": "Secrets",
+                "secrets": secrets,
+                "user": current_user.username,
+                "clients": clients,
+            },
+        )
+
+    @app.post("/secrets/")
+    async def add_secret(
+        request: Request,
+        _current_user: Annotated[
+            User, Depends(dependencies.get_user_from_access_token)
+        ],
+        admin: Annotated[AdminBackend, Depends(dependencies.get_admin_backend)],
+        secret: Annotated[CreateSecret, Form()],
+    ):
+        """Add secret."""
+        LOG.info("secret: %s", secret.model_dump_json(indent=2))
+
+        clients = await admin.get_clients()
+        if secret.value:
+            value = secret.value
+        else:
+            value = pysecrets.token_urlsafe(32)
+
+        await admin.add_secret(secret.name, value, secret.clients)
+        secrets = await admin.get_detailed_secrets()
+        return templates.TemplateResponse(
+            request,
+            "secrets/inner.html.j2",
+            {
+                "secrets": secrets,
+                "clients": clients,
+            },
+        )
+
+    @app.delete("/secrets/{name}/clients/{id}")
+    async def remove_client_secret_access(
+        request: Request,
+        name: str,
+        id: str,
+        _current_user: Annotated[
+            User, Depends(dependencies.get_user_from_access_token)
+        ],
+        admin: Annotated[AdminBackend, Depends(dependencies.get_admin_backend)],
+    ):
+        """Remove a client's access to a secret."""
+        await admin.delete_client_secret(id, name)
+        clients = await admin.get_clients()
+
+        secrets = await admin.get_detailed_secrets()
+        headers = {"Hx-Refresh": "true"}
+
+        return templates.TemplateResponse(
+            request,
+            "secrets/inner.html.j2",
+            {"clients": clients, "secret": secrets},
+            headers=headers,
+        )
+
+    @app.post("/secrets/{name}/clients/")
+    async def add_secret_to_client(
+        request: Request,
+        name: str,
+        client: Annotated[str, Form()],
+        _current_user: Annotated[
+            User, Depends(dependencies.get_user_from_access_token)
+        ],
+        admin: Annotated[AdminBackend, Depends(dependencies.get_admin_backend)],
+    ):
+        """Add a secret to a client."""
+        await admin.create_client_secret(client, name)
+        clients = await admin.get_clients()
+        secrets = await admin.get_detailed_secrets()
+        headers = {"Hx-Refresh": "true"}
+
+        return templates.TemplateResponse(
+            request,
+            "secrets/inner.html.j2",
+            {
+                "clients": clients,
+                "secrets": secrets,
+            },
+            headers=headers,
+        )
+
+    @app.delete("/secrets/{name}")
+    async def delete_secret(
+        request: Request,
+        name: str,
+        _current_user: Annotated[
+            User, Depends(dependencies.get_user_from_access_token)
+        ],
+        admin: Annotated[AdminBackend, Depends(dependencies.get_admin_backend)],
+    ):
+        """Delete a secret."""
+        await admin.delete_secret(name)
+        clients = await admin.get_clients()
+        secrets = await admin.get_detailed_secrets()
+        headers = {"Hx-Refresh": "true"}
+
+        return templates.TemplateResponse(
+            request,
+            "secrets/inner.html.j2",
+            {
+                "clients": clients,
+                "secrets": secrets,
+            },
+            headers=headers,
+        )
+
+    return app