84 lines
2.6 KiB
Python
84 lines
2.6 KiB
Python
"""Endpoints that stay reachable without a token.
|
|
|
|
`bin/wait-deploy` polls /api/version from whatever machine you pushed from, and
|
|
the browser needs /api/login before it has a session, so these routes stay
|
|
outside the protected API router.
|
|
"""
|
|
import os
|
|
import json
|
|
from datetime import datetime, timezone
|
|
|
|
from fastapi import APIRouter, HTTPException, Request, Response, status
|
|
from fastapi.responses import FileResponse
|
|
from pydantic import BaseModel
|
|
|
|
from app.api.deps import (
|
|
SESSION_COOKIE,
|
|
SESSION_MAX_AGE,
|
|
configured_token,
|
|
create_session,
|
|
password_matches,
|
|
token_matches,
|
|
)
|
|
from app.api.captures import capture_path
|
|
|
|
router = APIRouter(prefix="/api")
|
|
|
|
# Coolify injects the deployed commit; absent when running locally.
|
|
SOURCE_COMMIT = os.environ.get("SOURCE_COMMIT", "dev")
|
|
STARTED_AT = datetime.now(timezone.utc).replace(microsecond=0).isoformat()
|
|
|
|
|
|
class LoginRequest(BaseModel):
|
|
password: str
|
|
|
|
|
|
@router.get("/health")
|
|
def health():
|
|
return {"status": "ok", "service": "chart"}
|
|
|
|
|
|
@router.get("/version")
|
|
def version():
|
|
return {"commit": SOURCE_COMMIT, "started_at": STARTED_AT}
|
|
|
|
|
|
@router.get("/debug/captures/{capture_id}")
|
|
def get_debug_capture(capture_id: str):
|
|
path = capture_path(capture_id, ".png")
|
|
if path is None:
|
|
raise HTTPException(404, "Capture not found")
|
|
return FileResponse(path, media_type="image/png")
|
|
|
|
|
|
@router.get("/debug/captures/{capture_id}/meta")
|
|
def get_debug_capture_metadata(capture_id: str):
|
|
path = capture_path(capture_id, ".json")
|
|
if path is None:
|
|
raise HTTPException(404, "Capture not found")
|
|
return json.loads(path.read_text(encoding="utf-8"))
|
|
|
|
|
|
@router.post("/login", status_code=status.HTTP_204_NO_CONTENT)
|
|
def login(credentials: LoginRequest, request: Request, response: Response):
|
|
presented_token = request.headers.get("x-chart-token", "")
|
|
token_login = bool(configured_token(request.app)) and token_matches(
|
|
request.app, presented_token
|
|
)
|
|
if not token_login and not password_matches(request.app, credentials.password):
|
|
raise HTTPException(status.HTTP_401_UNAUTHORIZED, "Incorrect password")
|
|
forwarded_proto = request.headers.get("x-forwarded-proto", "").split(",", 1)[0]
|
|
response.set_cookie(
|
|
SESSION_COOKIE,
|
|
create_session(request.app),
|
|
max_age=SESSION_MAX_AGE,
|
|
httponly=True,
|
|
secure=request.url.scheme == "https" or forwarded_proto == "https",
|
|
samesite="strict",
|
|
path="/",
|
|
)
|
|
|
|
|
|
@router.post("/logout", status_code=status.HTTP_204_NO_CONTENT)
|
|
def logout(response: Response):
|
|
response.delete_cookie(SESSION_COOKIE, path="/", httponly=True, samesite="strict")
|