diff --git a/src/netmover/config.py b/src/netmover/config.py index e0dbd78..5b43e0a 100644 --- a/src/netmover/config.py +++ b/src/netmover/config.py @@ -25,6 +25,12 @@ class Settings(BaseSettings): host: str = "127.0.0.1" port: int = Field(default=8080, ge=1, le=65535) + # Hinter einem Reverse Proxy mit TLS auf true setzen (Cookie nur per HTTPS). + cookie_secure: bool = False + # IPs, deren X-Forwarded-For/-Proto übernommen wird (Reverse Proxy). + forwarded_allow_ips: str = "127.0.0.1" + session_hours: int = Field(default=12, ge=1, le=24 * 30) + log_level: Literal["DEBUG", "INFO", "WARNING", "ERROR"] = "INFO" log_format: Literal["logfmt", "json"] = "logfmt" @@ -37,6 +43,10 @@ class Settings(BaseSettings): def db_path(self) -> Path: return self.data_dir / "netmover.db" + @property + def session_key_path(self) -> Path: + return self.data_dir / "session.key" + @property def secret_key_path(self) -> Path: return self.data_dir / "secret.key" diff --git a/src/netmover/mounting/manager.py b/src/netmover/mounting/manager.py index 50d4454..0fba6c3 100644 --- a/src/netmover/mounting/manager.py +++ b/src/netmover/mounting/manager.py @@ -572,7 +572,7 @@ class MountManager: self._notify("mount.error", m.name, msg) raise MountUnavailable(msg) - def usage(self, mount_id: int) -> tuple[int, int] | None: + def usage(self, mount_id: int, timeout: float | None = None) -> tuple[int, int] | None: """(gesamt, frei) in Bytes – nur bei eingehängten Kernel-Mounts.""" m, _ = self._load(mount_id) if not m.type.is_kernel_mount: @@ -581,7 +581,9 @@ class MountManager: if not self.backend.is_mounted(mp): return None try: - st = run_with_timeout(lambda: os.statvfs(mp), self.probe_timeout, f"statvfs:{m.name}") + st = run_with_timeout( + lambda: os.statvfs(mp), timeout or self.probe_timeout, f"statvfs:{m.name}" + ) except (OSError, OperationTimeout): return None return st.f_blocks * st.f_frsize, st.f_bavail * st.f_frsize diff --git a/src/netmover/web/__init__.py b/src/netmover/web/__init__.py new file mode 100644 index 0000000..b053307 --- /dev/null +++ b/src/netmover/web/__init__.py @@ -0,0 +1 @@ +"""Weboberfläche: FastAPI + Jinja2 + HTMX, serverseitig gerendert.""" diff --git a/src/netmover/web/app.py b/src/netmover/web/app.py new file mode 100644 index 0000000..0640b3e --- /dev/null +++ b/src/netmover/web/app.py @@ -0,0 +1,957 @@ +"""FastAPI-Anwendung: Middleware, Anmeldung, Seiten. + +Seiten werden serverseitig gerendert (Jinja2). HTMX nur dort, wo es echten +Nutzen bringt: Testergebnisse, Probelauf-Tabelle, aufklappbare Protokolle und +das automatische Aktualisieren der Statusseite. Alle Aktionen funktionieren +auch als normale Formulare (Post/Redirect/Get). +""" + +from __future__ import annotations + +import asyncio +import dataclasses +import json +import math +from collections.abc import AsyncIterator, Awaitable, Callable +from contextlib import asynccontextmanager +from dataclasses import dataclass +from datetime import UTC, datetime +from importlib.resources import files +from typing import Any + +from fastapi import APIRouter, Depends, FastAPI, Request +from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse, Response +from fastapi.staticfiles import StaticFiles +from fastapi.templating import Jinja2Templates +from sqlalchemy import func, or_, select +from starlette.concurrency import run_in_threadpool +from starlette.datastructures import UploadFile +from starlette.middleware.sessions import SessionMiddleware + +from netmover import __version__ +from netmover.admin import ( + AdminError, + MountInput, + RuleInput, + credential_for_test, + delete_mount, + mount_input_from_model, + parse_mount_form, + parse_rule_form, + rule_input_from_model, + save_mount, + save_rule, +) +from netmover.app_state import NetMover +from netmover.config import Settings, get_settings +from netmover.db import session_scope +from netmover.logging_setup import event, get_logger +from netmover.models import ( + CollisionPolicy, + CredentialKind, + Mount, + MountState, + MountType, + PatternType, + Rule, + RuleAction, + Run, + RunItem, + RunStatus, + utcnow, +) +from netmover.mounting.backend import MountError +from netmover.mounting.report import CheckReport +from netmover.notify import Notification +from netmover.settings_store import AppSettings, NotifyMode, load_settings, save_settings +from netmover.transfer import apply_imported_settings, export_config, import_config +from netmover.web import auth + +log = get_logger(__name__) + +PAGE_SIZE = 50 +STATE_LABELS = { + MountState.MOUNTED: "eingehängt", + MountState.UNMOUNTED: "ausgehängt", + MountState.DEGRADED: "gestört", + MountState.ERROR: "Fehler", +} +SFTP_STATE_LABELS = { + MountState.MOUNTED: "erreichbar", + MountState.UNMOUNTED: "nicht geprüft", + MountState.DEGRADED: "gestört", + MountState.ERROR: "nicht erreichbar", +} +RUN_LABELS = { + RunStatus.OK: "OK", + RunStatus.PARTIAL: "teilweise", + RunStatus.ERROR: "Fehler", + RunStatus.SKIPPED: "übersprungen", + RunStatus.RUNNING: "läuft", +} + + +# -- Jinja-Filter ----------------------------------------------------------------------- + + +def _ago(value: datetime | None, now: datetime | None = None) -> str: + if value is None: + return "–" + seconds = ((now or datetime.now(UTC)) - value).total_seconds() + future = seconds < 0 + seconds = abs(seconds) + if seconds < 60: + text = f"{int(seconds)} s" + elif seconds < 3600: + text = f"{int(seconds // 60)} min" + elif seconds < 86400: + text = f"{seconds / 3600:.1f} h".replace(".", ",") + else: + text = f"{int(seconds // 86400)} Tg." + return f"in {text}" if future else f"vor {text}" + + +def _localdt(value: datetime | None) -> str: + return value.astimezone().strftime("%d.%m.%Y %H:%M:%S") if value else "–" + + +def _bytes(value: int | None) -> str: + if value is None: + return "–" + units = ["B", "KB", "MB", "GB", "TB", "PB"] + n = float(value) + i = 0 + while n >= 1024 and i < len(units) - 1: + n /= 1024 + i += 1 + return f"{n:.1f} {units[i]}".replace(".", ",") if i else f"{int(n)} B" + + +def _duration(start: datetime | None, end: datetime | None) -> str: + if start is None or end is None: + return "–" + s = (end - start).total_seconds() + return f"{s:.1f} s".replace(".", ",") if s < 60 else f"{int(s // 60)} min {int(s % 60)} s" + + +TEMPLATES = Jinja2Templates(directory=str(files("netmover.web") / "templates")) +TEMPLATES.env.filters.update(ago=_ago, localdt=_localdt, bytes=_bytes) +TEMPLATES.env.globals.update( + version=__version__, + duration=_duration, + STATE_LABELS=STATE_LABELS, + SFTP_STATE_LABELS=SFTP_STATE_LABELS, + RUN_LABELS=RUN_LABELS, + MountType=MountType, + MountState=MountState, + RunStatus=RunStatus, + PatternType=PatternType, + RuleAction=RuleAction, + CollisionPolicy=CollisionPolicy, + CredentialKind=CredentialKind, + NotifyMode=NotifyMode, +) + + +def flash(request: Request, message: str, kind: str = "ok") -> None: + # Neu zuweisen statt anhängen: die Session erkennt nur Zuweisungen als Änderung. + request.session["flash"] = [*request.session.get("flash", []), [kind, message]] + + +def render(request: Request, name: str, status_code: int = 200, **ctx: Any) -> HTMLResponse: + flashes = request.session.pop("flash", []) if not name.startswith("partials/") else [] + return TEMPLATES.TemplateResponse( + request, + name, + { + "csrf": auth.csrf_token(request), + "flashes": flashes, + "logged_in": auth.is_logged_in(request), + "active": ctx.pop("active", ""), + **ctx, + }, + status_code=status_code, + ) + + +def redirect(url: str) -> RedirectResponse: + return RedirectResponse(url, status_code=303) + + +def nm(request: Request) -> NetMover: + app_state: NetMover = request.app.state.nm + return app_state + + +def _form_dict(form: Any) -> dict[str, str]: + return {k: v for k, v in form.items() if isinstance(v, str)} + + +# -- Schutz für alle geschützten Routen --------------------------------------------------- + + +async def guard(request: Request) -> None: + state = nm(request) + if not auth.password_is_set(state.session_factory): + raise auth.LoginRequired(setup=True) + if not auth.is_logged_in(request): + raise auth.LoginRequired() + await auth.check_csrf(request) + + +protected = APIRouter(dependencies=[Depends(guard)]) +public = APIRouter() + + +# -- Öffentlich: Health, Einrichtung, Anmeldung -------------------------------------------- + + +@public.get("/healthz") +async def healthz(request: Request) -> JSONResponse: + health = await run_in_threadpool(nm(request).health) + body = {"status": "ok" if health.ok else "error", "problems": health.problems} + return JSONResponse(body, status_code=200 if health.ok else 503) + + +@public.get("/setup", response_class=HTMLResponse) +async def setup_form(request: Request) -> Response: + if auth.password_is_set(nm(request).session_factory): + return redirect("/login") + return render(request, "setup.html") + + +@public.post("/setup", response_class=HTMLResponse) +async def setup_submit(request: Request) -> Response: + await auth.check_csrf(request) + state = nm(request) + if auth.password_is_set(state.session_factory): + return redirect("/login") + form = await request.form() + password = str(form.get("password") or "") + problem = auth.password_problem(password, str(form.get("confirm") or "")) + if not request.app.state.setup_code.matches(str(form.get("code") or "")): + problem = ( + "Einrichtungscode stimmt nicht – er steht im Log des Dienstes (journalctl -u netmover)." + ) + if problem: + return render(request, "setup.html", status_code=400, error=problem) + await run_in_threadpool(auth.set_password, state.session_factory, password) + auth.login_session(request) + event(log, "auth.setup_done") + flash(request, "Passwort gesetzt. Willkommen bei NetMover!") + return redirect("/") + + +@public.get("/login", response_class=HTMLResponse) +async def login_form(request: Request) -> Response: + if not auth.password_is_set(nm(request).session_factory): + return redirect("/setup") + return render(request, "login.html") + + +@public.post("/login", response_class=HTMLResponse) +async def login_submit(request: Request) -> Response: + await auth.check_csrf(request) + throttle: auth.LoginThrottle = request.app.state.throttle + client = request.client.host if request.client else "?" + wait = throttle.locked_for(client) + if wait: + return render( + request, + "login.html", + status_code=429, + error=f"Zu viele Fehlversuche – bitte {math.ceil(wait / 60)} min warten.", + ) + form = await request.form() + ok = await run_in_threadpool( + auth.verify_password, nm(request).session_factory, str(form.get("password") or "") + ) + if not ok: + throttle.failure(client) + event(log, "auth.login_failed", level=30, client=client) + return render(request, "login.html", status_code=401, error="Passwort falsch.") + throttle.success(client) + auth.login_session(request) + event(log, "auth.login", client=client) + target = request.query_params.get("next", "/") + return redirect(target if target.startswith("/") and not target.startswith("//") else "/") + + +@protected.post("/logout") +async def logout(request: Request) -> Response: + request.session.clear() + return redirect("/login") + + +# -- Status ----------------------------------------------------------------------------------- + + +@dataclass +class MountView: + m: Mount + usage: tuple[int, int] | None + + +@dataclass +class RuleView: + r: Rule + last_run: Run | None + next_run: datetime | None + running_since: datetime | None + stale: bool + target: str + + +def _rule_target(r: Rule) -> str: + src = f"{r.src_mount.name}:/{r.src_subpath}" if r.src_subpath else f"{r.src_mount.name}:/" + if r.dst_mount is None: + dst = r.dst_path + else: + dst = f"{r.dst_mount.name}:/{r.dst_path}" if r.dst_path else f"{r.dst_mount.name}:/" + return f"{src} → {dst}" + + +async def _status_context(request: Request) -> dict[str, Any]: + state = nm(request) + health = await run_in_threadpool(state.health) + with state.session_factory() as s: + mounts = s.scalars(select(Mount).order_by(Mount.name)).all() + rules = s.scalars(select(Rule).order_by(Rule.name)).all() + last_runs = { + run.rule_id: run + for run in s.scalars( + select(Run).where( + Run.id.in_( + select(func.max(Run.id)) + .where(Run.status != RunStatus.SKIPPED) + .group_by(Run.rule_id) + ) + ) + ) + } + rule_views = [ + RuleView( + r, + last_runs.get(r.id), + state.scheduler.next_run(r.id), + state.runner.running_since(r.id), + r.id in health.stale_rules, + _rule_target(r), + ) + for r in rules + ] + for m in mounts: + s.expunge(m) + + async def usage(m: Mount) -> tuple[int, int] | None: + if m.state is not MountState.MOUNTED or not m.type.is_kernel_mount: + return None + return await run_in_threadpool(state.mounts.usage, m.id, 2.0) + + usages = await asyncio.gather(*(usage(m) for m in mounts)) + return { + "health": health, + "mounts": [MountView(m, u) for m, u in zip(mounts, usages, strict=True)], + "rules": rule_views, + "now": utcnow(), + } + + +@protected.get("/", response_class=HTMLResponse) +async def status_page(request: Request) -> Response: + return render(request, "status.html", active="status", **await _status_context(request)) + + +@protected.get("/partials/status", response_class=HTMLResponse) +async def status_partial(request: Request) -> Response: + return render(request, "partials/status_body.html", **await _status_context(request)) + + +@protected.post("/rules/{rule_id}/run") +async def rule_run_now(request: Request, rule_id: int) -> Response: + state = nm(request) + task = asyncio.create_task(state.scheduler.run_now(rule_id)) + request.app.state.tasks.add(task) + task.add_done_callback(request.app.state.tasks.discard) + flash(request, "Lauf gestartet – das Ergebnis erscheint gleich im Protokoll.") + return redirect(request.headers.get("referer") or "/") + + +# -- Anbindungen ---------------------------------------------------------------------------- + + +@protected.get("/mounts", response_class=HTMLResponse) +async def mounts_page(request: Request) -> Response: + with nm(request).session_factory() as s: + mounts = s.scalars(select(Mount).order_by(Mount.name)).all() + reports = { + m.id: CheckReport(**_report_data(m.last_test_result)) + for m in mounts + if m.last_test_result + } + pubkeys = { + m.id: m.credential.public_key + for m in mounts + if m.credential is not None and m.credential.public_key + } + return render( + request, "mounts.html", active="mounts", mounts=mounts, reports=reports, pubkeys=pubkeys + ) + + +def _report_data(raw: str | None) -> dict[str, Any]: + from netmover.mounting.report import CheckStep + + data: dict[str, Any] = json.loads(raw or "{}") + data.pop("roles", None) + data.pop("ok", None) + data["steps"] = [CheckStep(**st) for st in data.get("steps", [])] + return data + + +def _mount_form( + request: Request, + data: MountInput, + errors: dict[str, str], + mount: Mount | None = None, + status_code: int = 200, +) -> Response: + pub = mount.credential.public_key if mount is not None and mount.credential else None + return render( + request, + "mount_form.html", + status_code=status_code, + active="mounts", + d=data, + errors=errors, + mount=mount, + public_key=pub, + has_secret=bool(mount is not None and mount.credential is not None), + ) + + +@protected.get("/mounts/new", response_class=HTMLResponse) +async def mount_new(request: Request) -> Response: + return _mount_form(request, MountInput(), {}) + + +@protected.get("/mounts/{mount_id}/edit", response_class=HTMLResponse) +async def mount_edit(request: Request, mount_id: int) -> Response: + with nm(request).session_factory() as s: + m = s.get(Mount, mount_id) + if m is None: + return redirect("/mounts") + return _mount_form(request, mount_input_from_model(m), {}, m) + + +@protected.post("/mounts/new", response_class=HTMLResponse) +@protected.post("/mounts/{mount_id}/edit", response_class=HTMLResponse) +async def mount_save(request: Request, mount_id: int | None = None) -> Response: + state = nm(request) + data, errors = parse_mount_form(_form_dict(await request.form())) + with session_scope(state.session_factory) as s: + existing = s.get(Mount, mount_id) if mount_id is not None else None + if not errors: + try: + m, errors = save_mount(s, state.secrets, state.mounts, data, mount_id) + except AdminError as exc: + errors = {"_": str(exc)} + m = None + else: + m = None + if errors or m is None: + s.rollback() + existing = s.get(Mount, mount_id) if mount_id is not None else None + return _mount_form(request, data, errors, existing, status_code=400) + saved_id, name = m.id, m.name + is_sftp_key = m.type is MountType.SFTP and data.auth is CredentialKind.SSH_KEY + flash(request, f"Anbindung „{name}“ gespeichert.") + if is_sftp_key: + flash( + request, + "Öffentlichen Schlüssel beim Zielserver in authorized_keys eintragen, dann „Testen“.", + "info", + ) + state.scheduler.sync() + return redirect(f"/mounts#mount-{saved_id}") + + +@protected.post("/mounts/test", response_class=HTMLResponse) +async def mount_test_form(request: Request) -> Response: + """„Testen“ im Formular – mit den (noch nicht gespeicherten) Eingaben.""" + state = nm(request) + form = _form_dict(await request.form()) + data, errors = parse_mount_form(form) + if errors: + return render(request, "partials/check_result.html", errors=errors, report=None) + existing_id = int(form["mount_id"]) if form.get("mount_id", "").isdigit() else None + with state.session_factory() as s: + existing = s.get(Mount, existing_id) if existing_id else None + cred = credential_for_test(data, existing, state.secrets) + cfg = data.config() + if data.type is MountType.SFTP and existing is not None: + cfg = dataclasses.replace(cfg, host_key=existing.host_key) + report = await run_in_threadpool(state.mounts.check, cfg, cred, None) + return render(request, "partials/check_result.html", report=report, errors={}) + + +@protected.post("/mounts/{mount_id}/test", response_class=HTMLResponse) +async def mount_test(request: Request, mount_id: int) -> Response: + state = nm(request) + with state.session_factory() as s: + m = s.get(Mount, mount_id) + if m is None: + return HTMLResponse("Anbindung existiert nicht.", status_code=404) + data = mount_input_from_model(m) + cred = credential_for_test(data, m, state.secrets) + from netmover.mounting.manager import MountConfig + + cfg = MountConfig.from_model(m) + report = await run_in_threadpool(state.mounts.check, cfg, cred, mount_id) + return render(request, "partials/check_result.html", report=report, errors={}) + + +async def _mount_action( + request: Request, mount_id: int, fn: Callable[[int], None], ok: str +) -> Response: + try: + await run_in_threadpool(fn, mount_id) + flash(request, ok) + except (MountError, LookupError) as exc: + flash(request, str(exc), "error") + return redirect(f"/mounts#mount-{mount_id}") + + +@protected.post("/mounts/{mount_id}/mount") +async def mount_mount(request: Request, mount_id: int) -> Response: + return await _mount_action(request, mount_id, nm(request).mounts.mount, "Eingehängt.") + + +@protected.post("/mounts/{mount_id}/unmount") +async def mount_unmount(request: Request, mount_id: int) -> Response: + return await _mount_action(request, mount_id, nm(request).mounts.unmount, "Ausgehängt.") + + +@protected.post("/mounts/{mount_id}/delete") +async def mount_delete(request: Request, mount_id: int) -> Response: + state = nm(request) + + def work() -> None: + with session_scope(state.session_factory) as s: + delete_mount(s, state.mounts, mount_id) + + try: + await run_in_threadpool(work) + flash(request, "Anbindung gelöscht.") + except (AdminError, MountError) as exc: + flash(request, str(exc), "error") + return redirect("/mounts") + + +@protected.post("/mounts/{mount_id}/reset-hostkey") +async def mount_reset_hostkey(request: Request, mount_id: int) -> Response: + with session_scope(nm(request).session_factory) as s: + m = s.get(Mount, mount_id) + if m is not None: + m.host_key = None + m.state = MountState.UNMOUNTED + flash( + request, + "Hostschlüssel zurückgesetzt – beim nächsten „Testen“ wird er neu festgehalten.", + "info", + ) + return redirect(f"/mounts#mount-{mount_id}") + + +# -- Regeln ----------------------------------------------------------------------------------- + + +def _rule_form( + request: Request, + d: RuleInput, + errors: dict[str, str], + rule_id: int | None, + status_code: int = 200, +) -> Response: + with nm(request).session_factory() as s: + mounts = s.scalars(select(Mount).order_by(Mount.name)).all() + for m in mounts: + s.expunge(m) + return render( + request, + "rule_form.html", + status_code=status_code, + active="rules", + d=d, + errors=errors, + rule_id=rule_id, + src_mounts=[m for m in mounts if m.type.is_kernel_mount], + src_options=[("", "– wählen –")] + + [(m.id, m.name) for m in mounts if m.type.is_kernel_mount], + dst_options=[("", "– wählen –")] + [(m.id, f"{m.name} ({m.type.value})") for m in mounts], + ) + + +@protected.get("/rules", response_class=HTMLResponse) +async def rules_page(request: Request) -> Response: + ctx = await _status_context(request) + return render(request, "rules.html", active="rules", rules=ctx["rules"], now=ctx["now"]) + + +@protected.get("/rules/new", response_class=HTMLResponse) +async def rule_new(request: Request) -> Response: + return _rule_form(request, RuleInput(), {}, None) + + +@protected.get("/rules/{rule_id}/edit", response_class=HTMLResponse) +async def rule_edit(request: Request, rule_id: int) -> Response: + with nm(request).session_factory() as s: + r = s.get(Rule, rule_id) + if r is None: + return redirect("/rules") + d = rule_input_from_model(r) + return _rule_form(request, d, {}, rule_id) + + +@protected.post("/rules/new", response_class=HTMLResponse) +@protected.post("/rules/{rule_id}/edit", response_class=HTMLResponse) +async def rule_save(request: Request, rule_id: int | None = None) -> Response: + state = nm(request) + form = _form_dict(await request.form()) + with session_scope(state.session_factory) as s: + d, errors = parse_rule_form(s, form) + r = None + if not errors: + try: + r, errors = save_rule(s, d, rule_id) + except AdminError as exc: + errors = {"_": str(exc)} + if errors or r is None: + s.rollback() + return _rule_form(request, d, errors, rule_id, status_code=400) + name = r.name + state.scheduler.sync() + flash(request, f"Regel „{name}“ gespeichert.") + return redirect("/rules") + + +@protected.post("/rules/{rule_id}/toggle") +async def rule_toggle(request: Request, rule_id: int) -> Response: + state = nm(request) + with session_scope(state.session_factory) as s: + r = s.get(Rule, rule_id) + if r is not None: + r.enabled = not r.enabled + flash(request, f"Regel „{r.name}“ {'aktiviert' if r.enabled else 'deaktiviert'}.") + state.scheduler.sync() + return redirect("/rules") + + +@protected.post("/rules/{rule_id}/delete") +async def rule_delete(request: Request, rule_id: int) -> Response: + state = nm(request) + with session_scope(state.session_factory) as s: + r = s.get(Rule, rule_id) + if r is not None: + s.delete(r) + flash(request, f"Regel „{r.name}“ gelöscht.") + state.scheduler.sync() + return redirect("/rules") + + +@protected.post("/rules/{rule_id}/dryrun", response_class=HTMLResponse) +async def rule_dryrun(request: Request, rule_id: int) -> Response: + state = nm(request) + run_id = await state.scheduler.run_now(rule_id, dry_run=True) + with state.session_factory() as s: + run = s.get(Run, run_id) if run_id else None + items = s.scalars(select(RunItem).where(RunItem.run_id == run_id)).all() if run_id else [] + return render(request, "partials/dryrun.html", run=run, items=items) + + +# -- Protokoll -------------------------------------------------------------------------------- + + +@protected.get("/log", response_class=HTMLResponse) +async def log_page(request: Request) -> Response: + q = request.query_params + rule_id = int(q["rule"]) if q.get("rule", "").isdigit() else None + status = q.get("status") or "" + active_only = q.get("all") != "1" + page = max(1, int(q["page"])) if q.get("page", "").isdigit() else 1 + with nm(request).session_factory() as s: + stmt = select(Run, Rule.name).join(Rule, Rule.id == Run.rule_id) + if rule_id: + stmt = stmt.where(Run.rule_id == rule_id) + if status in {st.value for st in RunStatus}: + stmt = stmt.where(Run.status == RunStatus(status)) + if active_only: + stmt = stmt.where( + or_(Run.seen > 0, Run.status != RunStatus.OK, Run.message.is_not(None)) + ) + total = s.scalar(select(func.count()).select_from(stmt.subquery())) or 0 + rows = s.execute( + stmt.order_by(Run.started_at.desc(), Run.id.desc()) + .offset((page - 1) * PAGE_SIZE) + .limit(PAGE_SIZE) + ).all() + rules = s.execute(select(Rule.id, Rule.name).order_by(Rule.name)).all() + return render( + request, + "log.html", + active="log", + rows=rows, + rules=rules, + rule_id=rule_id, + status=status, + active_only=active_only, + page=page, + pages=max(1, math.ceil(total / PAGE_SIZE)), + total=total, + ) + + +@protected.get("/log/{run_id}/items", response_class=HTMLResponse) +async def log_items(request: Request, run_id: int) -> Response: + with nm(request).session_factory() as s: + items = s.scalars( + select(RunItem).where(RunItem.run_id == run_id).order_by(RunItem.id) + ).all() + run = s.get(Run, run_id) + return render(request, "partials/run_items.html", items=items, run=run) + + +# -- Einstellungen ------------------------------------------------------------------------------ + + +@protected.get("/settings", response_class=HTMLResponse) +async def settings_page(request: Request) -> Response: + cfg = load_settings(nm(request).session_factory) + return render(request, "settings.html", active="settings", cfg=cfg, errors={}) + + +@protected.post("/settings", response_class=HTMLResponse) +async def settings_save(request: Request) -> Response: + state = nm(request) + form = _form_dict(await request.form()) + cfg = load_settings(state.session_factory) + errors: dict[str, str] = {} + try: + cfg.retention_days = int(form.get("retention_days") or 30) + if not 1 <= cfg.retention_days <= 3650: + errors["retention_days"] = "Zwischen 1 und 3650 Tagen." + cfg.notify_after = int(form.get("notify_after") or 3) + if cfg.notify_after < 1: + errors["notify_after"] = "Mindestens 1." + except ValueError: + errors["retention_days"] = "Bitte ganze Zahlen angeben." + try: + cfg.notify_mode = NotifyMode(form.get("notify_mode") or "off") + except ValueError: + errors["notify_mode"] = "Ungültig." + url = (form.get("webhook_url") or "").strip() + if url != auth_mask(cfg.webhook_url): # Maske unverändert = URL behalten + if url and not url.startswith(("http://", "https://")): + errors["webhook_url"] = "URL muss mit http:// oder https:// beginnen." + cfg.webhook_url = url + cfg.notify_recovery = form.get("notify_recovery") == "on" + cfg.webhook_template = form.get("webhook_template") or cfg.webhook_template + cfg.webhook_content_type = (form.get("webhook_content_type") or "application/json").strip() + if errors: + return render( + request, "settings.html", status_code=400, active="settings", cfg=cfg, errors=errors + ) + save_settings(state.session_factory, cfg) + flash(request, "Einstellungen gespeichert.") + return redirect("/settings") + + +def auth_mask(url: str) -> str: + """Webhook-URL nur gekürzt anzeigen – sie enthält oft ein Token.""" + if not url: + return "" + head, _, _rest = url.partition("://") + host = _rest.split("/", 1)[0] + return f"{head}://{host}/••••••" + + +TEMPLATES.env.globals["mask_url"] = auth_mask + + +@protected.post("/settings/webhook-test", response_class=HTMLResponse) +async def settings_webhook_test(request: Request) -> Response: + state = nm(request) + cfg = load_settings(state.session_factory) + if not cfg.webhook_url: + return HTMLResponse('

Keine Webhook-URL gespeichert.

') + from netmover.notify import http_sender + from netmover.notify import render as render_body + + body = render_body( + cfg.webhook_template, + cfg.webhook_content_type, + Notification("test", "NetMover: Testnachricht", "Webhook funktioniert."), + ) + try: + await run_in_threadpool(http_sender, cfg.webhook_url, cfg.webhook_content_type, body) + except Exception as exc: + return HTMLResponse(f'

Fehlgeschlagen: {type(exc).__name__}

') + return HTMLResponse('

Testnachricht gesendet.

') + + +@protected.post("/settings/password", response_class=HTMLResponse) +async def settings_password(request: Request) -> Response: + state = nm(request) + form = _form_dict(await request.form()) + if not await run_in_threadpool( + auth.verify_password, state.session_factory, form.get("current", "") + ): + flash(request, "Aktuelles Passwort falsch.", "error") + return redirect("/settings") + problem = auth.password_problem(form.get("password", ""), form.get("confirm", "")) + if problem: + flash(request, problem, "error") + return redirect("/settings") + await run_in_threadpool(auth.set_password, state.session_factory, form["password"]) + auth.login_session(request) + flash(request, "Passwort geändert.") + return redirect("/settings") + + +@protected.get("/settings/export") +async def settings_export(request: Request) -> Response: + state = nm(request) + with state.session_factory() as s: + data = export_config(s, load_settings(state.session_factory)) + stamp = datetime.now().strftime("%Y%m%d-%H%M") + return Response( + json.dumps(data, ensure_ascii=False, indent=2), + media_type="application/json", + headers={"Content-Disposition": f'attachment; filename="netmover-{stamp}.json"'}, + ) + + +@protected.post("/settings/import") +async def settings_import(request: Request) -> Response: + state = nm(request) + form = await request.form() + upload = form.get("file") + if not isinstance(upload, UploadFile): + flash(request, "Keine Datei ausgewählt.", "error") + return redirect("/settings") + raw = await upload.read(2 * 1024 * 1024 + 1) + if len(raw) > 2 * 1024 * 1024: + flash(request, "Datei zu groß.", "error") + return redirect("/settings") + try: + data = json.loads(raw) + except ValueError: + flash(request, "Keine gültige JSON-Datei.", "error") + return redirect("/settings") + with session_scope(state.session_factory) as s: + report = import_config(s, state.mounts, data) + if report.settings: + save_settings( + state.session_factory, + apply_imported_settings(load_settings(state.session_factory), report.settings), + ) + state.scheduler.sync() + if report.created: + flash(request, "Importiert: " + ", ".join(report.created)) + if report.skipped: + flash(request, "Übersprungen: " + ", ".join(report.skipped), "info") + for err in report.errors: + flash(request, err, "error") + if report.created: + flash( + request, + "Zugangsdaten bitte bei den Anbindungen neu eingeben; importierte Regeln " + "sind deaktiviert.", + "info", + ) + return redirect("/settings") + + +# -- Anwendung ---------------------------------------------------------------------------------- + + +SECURITY_HEADERS = { + "Content-Security-Policy": ( + "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; " + "frame-ancestors 'none'; form-action 'self'; base-uri 'none'" + ), + "X-Frame-Options": "DENY", + "X-Content-Type-Options": "nosniff", + "Referrer-Policy": "same-origin", +} + + +def create_app(settings: Settings | None = None, state: NetMover | None = None) -> FastAPI: + settings = settings or get_settings() + + @asynccontextmanager + async def lifespan(app: FastAPI) -> AsyncIterator[None]: + app_state = state or NetMover(settings) + app.state.nm = app_state + app.state.setup_code = auth.SetupCode() + app.state.throttle = auth.LoginThrottle() + app.state.tasks = set() + if not auth.password_is_set(app_state.session_factory): + event( + log, + "setup.required", + level=30, + code=app.state.setup_code.code, + hint="Diesen Code bei der Ersteinrichtung im Browser eingeben", + ) + app_state.start() + try: + yield + finally: + app_state.stop() + + app = FastAPI( + title="NetMover", + version=__version__, + lifespan=lifespan, + docs_url=None, + redoc_url=None, + openapi_url=None, + ) + + @app.middleware("http") + async def security_headers( + request: Request, call_next: Callable[[Request], Awaitable[Response]] + ) -> Response: + response = await call_next(request) + for k, v in SECURITY_HEADERS.items(): + response.headers.setdefault(k, v) + if request.url.path not in ("/healthz",) and not request.url.path.startswith("/static/"): + response.headers.setdefault("Cache-Control", "no-store") + return response + + app.add_middleware( + SessionMiddleware, + secret_key=auth.load_or_create_session_key(settings.session_key_path), + session_cookie="netmover_session", + max_age=settings.session_hours * 3600, + same_site="lax", + https_only=settings.cookie_secure, + ) + + @app.exception_handler(auth.LoginRequired) + async def login_required(request: Request, exc: auth.LoginRequired) -> Response: + target = "/setup" if exc.setup else f"/login?next={request.url.path}" + if request.headers.get("hx-request"): + return Response(status_code=204, headers={"HX-Redirect": target}) + return redirect(target) + + app.mount( + "/static", StaticFiles(directory=str(files("netmover.web") / "static")), name="static" + ) + app.include_router(public) + app.include_router(protected) + return app + + +__all__ = ["AppSettings", "create_app"] diff --git a/src/netmover/web/auth.py b/src/netmover/web/auth.py new file mode 100644 index 0000000..68f219b --- /dev/null +++ b/src/netmover/web/auth.py @@ -0,0 +1,163 @@ +"""Anmeldung, Einrichtung beim ersten Start, CSRF und Sperre bei Fehlversuchen. + +* Ein einziges Administratorkonto; Passwort-Hash (Argon2) in ``settings``. +* Erster Start: Ohne Passwort führt jede Seite zur Einrichtung. Dafür wird ein + einmaliger Einrichtungscode ins Log geschrieben – so kann nicht irgendwer im + LAN, der die Seite zuerst öffnet, das Passwort festlegen. +* Session-Cookie ``HttpOnly``, ``SameSite=Lax`` (Starlette-SessionMiddleware, + signiert). CSRF-Token pro Session, Pflicht bei jedem POST – als Formularfeld + ``csrf_token`` oder Header ``X-CSRF-Token`` (HTMX). +""" + +from __future__ import annotations + +import hmac +import secrets +import threading +import time +from collections import defaultdict, deque +from pathlib import Path + +from argon2 import PasswordHasher +from argon2.exceptions import InvalidHashError, VerificationError +from fastapi import HTTPException, Request +from sqlalchemy.orm import Session, sessionmaker + +from netmover.settings_store import get_value, set_value + +PASSWORD_KEY = "auth.admin_password_hash" # noqa: S105 – Schlüsselname +MIN_PASSWORD_LENGTH = 10 +SAFE_METHODS = frozenset({"GET", "HEAD", "OPTIONS"}) + +_hasher = PasswordHasher() + + +class LoginRequired(Exception): + def __init__(self, setup: bool = False) -> None: + self.setup = setup + + +def load_or_create_session_key(path: Path) -> str: + import os + + path.parent.mkdir(parents=True, exist_ok=True) + try: + fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600) + except FileExistsError: + return path.read_text().strip() + key = secrets.token_urlsafe(48) + with os.fdopen(fd, "w") as fh: + fh.write(key + "\n") + return key + + +def password_is_set(factory: sessionmaker[Session]) -> bool: + return bool(get_value(factory, PASSWORD_KEY)) + + +def set_password(factory: sessionmaker[Session], password: str) -> None: + set_value(factory, PASSWORD_KEY, _hasher.hash(password)) + + +def verify_password(factory: sessionmaker[Session], password: str) -> bool: + stored = get_value(factory, PASSWORD_KEY) + if not stored: + return False + try: + _hasher.verify(stored, password) + except (VerificationError, InvalidHashError): + return False + if _hasher.check_needs_rehash(stored): + set_value(factory, PASSWORD_KEY, _hasher.hash(password)) + return True + + +def password_problem(password: str, confirm: str) -> str | None: + if len(password) < MIN_PASSWORD_LENGTH: + return f"Mindestens {MIN_PASSWORD_LENGTH} Zeichen." + if password != confirm: + return "Die Passwörter stimmen nicht überein." + return None + + +# -- Session / CSRF ------------------------------------------------------------------- + + +def csrf_token(request: Request) -> str: + token = request.session.get("csrf") + if not isinstance(token, str): + token = secrets.token_urlsafe(32) + request.session["csrf"] = token + return token + + +def login_session(request: Request) -> None: + """Neue Session nach erfolgreicher Anmeldung (Schutz vor Session-Fixation).""" + request.session.clear() + request.session["user"] = "admin" + request.session["csrf"] = secrets.token_urlsafe(32) + request.session["since"] = int(time.time()) + + +def is_logged_in(request: Request) -> bool: + return request.session.get("user") == "admin" + + +async def check_csrf(request: Request) -> None: + if request.method in SAFE_METHODS: + return + expected = request.session.get("csrf") + sent = request.headers.get("x-csrf-token") + if sent is None: + form = await request.form() + value = form.get("csrf_token") + sent = value if isinstance(value, str) else None + if not expected or not sent or not hmac.compare_digest(str(expected), sent): + raise HTTPException(status_code=403, detail="CSRF-Token fehlt oder ist ungültig.") + + +# -- Sperre bei Fehlversuchen -------------------------------------------------------------- + + +class LoginThrottle: + """Nach ``limit`` Fehlversuchen innerhalb von ``window`` Sekunden wird die + Client-IP für ``lockout`` Sekunden gesperrt.""" + + def __init__(self, limit: int = 5, window: float = 900, lockout: float = 300) -> None: + self.limit = limit + self.window = window + self.lockout = lockout + self._fails: dict[str, deque[float]] = defaultdict(deque) + self._locked: dict[str, float] = {} + self._lock = threading.Lock() + + def locked_for(self, client: str) -> float: + with self._lock: + until = self._locked.get(client, 0) + return max(0.0, until - time.monotonic()) + + def failure(self, client: str) -> None: + now = time.monotonic() + with self._lock: + q = self._fails[client] + q.append(now) + while q and now - q[0] > self.window: + q.popleft() + if len(q) >= self.limit: + self._locked[client] = now + self.lockout + q.clear() + + def success(self, client: str) -> None: + with self._lock: + self._fails.pop(client, None) + self._locked.pop(client, None) + + +class SetupCode: + """Einmaliger Code für die Ersteinrichtung (steht im Log).""" + + def __init__(self) -> None: + self.code = "-".join(secrets.token_hex(2) for _ in range(3)) + + def matches(self, value: str) -> bool: + return hmac.compare_digest(self.code, value.strip().lower()) diff --git a/src/netmover/web/static/app.css b/src/netmover/web/static/app.css new file mode 100644 index 0000000..1489183 --- /dev/null +++ b/src/netmover/web/static/app.css @@ -0,0 +1,111 @@ +/* NetMover – handgeschrieben, ohne Build-Schritt. Hell/Dunkel nach Systemeinstellung. */ +:root { + --bg: #f6f7f9; --card: #fff; --fg: #1d2330; --muted: #5d6676; --line: #dfe3ea; + --accent: #2f6fde; --accent-fg: #fff; --ok: #1e8e3e; --warn: #b26a00; --err: #c62828; + --ok-bg: #e6f4ea; --warn-bg: #fff4e0; --err-bg: #fdecea; --info-bg: #e8f0fe; + --radius: 8px; --gap: 12px; + font: 15px/1.45 system-ui, -apple-system, "Segoe UI", Roboto, sans-serif; +} +@media (prefers-color-scheme: dark) { + :root { + --bg: #12151b; --card: #1b2028; --fg: #e6e9ef; --muted: #9aa3b2; --line: #2c333e; + --accent: #6b9bff; --accent-fg: #0b1020; --ok: #57c27a; --warn: #f0a63a; --err: #ff6b6b; + --ok-bg: #16301f; --warn-bg: #36280f; --err-bg: #3a1717; --info-bg: #182540; + } +} +* { box-sizing: border-box; } +body { margin: 0; background: var(--bg); color: var(--fg); } +a { color: var(--accent); } +code, pre, .mono { font-family: ui-monospace, "SFMono-Regular", Menlo, Consolas, monospace; font-size: .9em; } +pre { white-space: pre-wrap; word-break: break-word; margin: 0; } + +header.top { background: var(--card); border-bottom: 1px solid var(--line); } +header.top .inner { max-width: 1200px; margin: 0 auto; display: flex; align-items: center; + gap: var(--gap); padding: 8px 16px; flex-wrap: wrap; } +header.top .brand { font-weight: 700; text-decoration: none; color: var(--fg); margin-right: 8px; } +nav.main { display: flex; gap: 4px; flex-wrap: wrap; flex: 1; } +nav.main a { padding: 6px 10px; border-radius: var(--radius); text-decoration: none; color: var(--fg); } +nav.main a.active, nav.main a:hover { background: var(--bg); } +main { max-width: 1200px; margin: 0 auto; padding: 16px; } +h1 { font-size: 1.4rem; margin: 4px 0 16px; } +h2 { font-size: 1.1rem; margin: 24px 0 8px; } +.muted { color: var(--muted); } +.small { font-size: .85em; } + +.card { background: var(--card); border: 1px solid var(--line); border-radius: var(--radius); padding: 14px; } +.grid { display: grid; gap: var(--gap); grid-template-columns: repeat(auto-fill, minmax(260px, 1fr)); } +.row { display: flex; gap: 8px; align-items: center; flex-wrap: wrap; } +.spread { justify-content: space-between; } +.stack > * + * { margin-top: 8px; } + +.badge { display: inline-block; padding: 1px 8px; border-radius: 99px; font-size: .8em; font-weight: 600; + background: var(--bg); border: 1px solid var(--line); white-space: nowrap; } +.badge.ok { background: var(--ok-bg); color: var(--ok); border-color: transparent; } +.badge.warn { background: var(--warn-bg); color: var(--warn); border-color: transparent; } +.badge.err { background: var(--err-bg); color: var(--err); border-color: transparent; } + +.msg { padding: 8px 12px; border-radius: var(--radius); margin: 0 0 10px; } +.msg.ok { background: var(--ok-bg); } .msg.error { background: var(--err-bg); } +.msg.info { background: var(--info-bg); } .msg.warn { background: var(--warn-bg); } + + +table { width: 100%; border-collapse: collapse; background: var(--card); border: 1px solid var(--line); + border-radius: var(--radius); overflow: hidden; } +th, td { text-align: left; padding: 7px 10px; border-bottom: 1px solid var(--line); vertical-align: top; } +th { font-size: .8em; text-transform: uppercase; letter-spacing: .03em; color: var(--muted); background: var(--bg); } +tr:last-child td { border-bottom: 0; } +tr.warn td { background: var(--warn-bg); } +tr.err td { background: var(--err-bg); } +.table-wrap { overflow-x: auto; } +td.num, th.num { text-align: right; font-variant-numeric: tabular-nums; } + +button, .btn { font: inherit; padding: 6px 12px; border-radius: var(--radius); border: 1px solid var(--line); + background: var(--card); color: var(--fg); cursor: pointer; text-decoration: none; display: inline-block; } +button.primary, .btn.primary { background: var(--accent); color: var(--accent-fg); border-color: var(--accent); } +button.danger { color: var(--err); } +button.small, .btn.small { padding: 3px 9px; font-size: .85em; } +button:disabled { opacity: .5; } +form.inline { display: inline; margin: 0; } + +form.form { max-width: 760px; } +fieldset { border: 1px solid var(--line); border-radius: var(--radius); margin: 0 0 14px; padding: 10px 14px 14px; background: var(--card); } +legend { font-weight: 600; padding: 0 6px; } +.fields { display: grid; gap: 10px 14px; grid-template-columns: repeat(auto-fill, minmax(200px, 1fr)); } +.field { display: flex; flex-direction: column; gap: 3px; } +.field.wide { grid-column: 1 / -1; } +.field label { font-size: .85em; font-weight: 600; } +.field .hint { font-size: .8em; color: var(--muted); } +.field .error { font-size: .85em; color: var(--err); } +input[type=text], input[type=password], input[type=number], input[type=url], select, textarea { + font: inherit; padding: 6px 8px; border-radius: 6px; border: 1px solid var(--line); + background: var(--bg); color: var(--fg); width: 100%; } +textarea { min-height: 70px; } +.check { flex-direction: row; align-items: center; gap: 6px; } +.has-error input, .has-error select, .has-error textarea { border-color: var(--err); } + +.steps { list-style: none; padding: 0; margin: 0; } +.steps li { padding: 3px 0; } +.steps .ico { display: inline-block; width: 1.4em; font-weight: 700; } +.steps .ok { color: var(--ok); } .steps .fail { color: var(--err); } .steps .skip { color: var(--muted); } + +details > summary { cursor: pointer; } +.htmx-indicator { display: none; } +.htmx-request .htmx-indicator, .htmx-request.htmx-indicator { display: inline; } +.login { max-width: 380px; margin: 10vh auto; } +[hidden] { display: none !important; } + +@media (max-width: 640px) { + main { padding: 10px; } + th, td { padding: 6px; } + table.responsive thead { display: none; } + table.responsive tr { display: block; border-bottom: 1px solid var(--line); padding: 6px 0; } + table.responsive td { display: flex; justify-content: space-between; gap: 10px; border: 0; padding: 3px 8px; } + table.responsive td::before { content: attr(data-label); color: var(--muted); font-size: .85em; } + table.responsive td.num { text-align: left; } +} + +.text-err { color: var(--err); } .text-warn { color: var(--warn); } .text-ok { color: var(--ok); } +pre.text-err { margin-top: 6px; } +ul.tight { margin: 4px 0 0; padding-left: 20px; } +.foot { text-align: center; padding: 16px; } +meter.fill { width: 100%; height: 8px; margin: 6px 0 2px; display: block; } diff --git a/src/netmover/web/static/app.js b/src/netmover/web/static/app.js new file mode 100644 index 0000000..15daa15 --- /dev/null +++ b/src/netmover/web/static/app.js @@ -0,0 +1,45 @@ +// NetMover – kleine Helfer. Keine Inline-Skripte (CSP: script-src 'self'). +(function () { + "use strict"; + var meta = document.querySelector('meta[name="csrf-token"]'); + var csrf = meta ? meta.getAttribute("content") : ""; + + // CSRF-Token für alle HTMX-Anfragen + document.addEventListener("htmx:configRequest", function (e) { + e.detail.headers["X-CSRF-Token"] = csrf; + }); + + // Rückfrage vor gefährlichen Aktionen:
+ document.addEventListener("submit", function (e) { + var msg = e.target.getAttribute && e.target.getAttribute("data-confirm"); + if (msg && !window.confirm(msg)) { e.preventDefault(); } + }, true); + + // Felder je nach Auswahl ein-/ausblenden: data-show-for="select-name:wert1 wert2" + function refresh(form) { + form.querySelectorAll("[data-show-for]").forEach(function (el) { + var spec = el.getAttribute("data-show-for").split(":"); + var ctl = form.querySelector('[name="' + spec[0] + '"]:checked') || + form.querySelector('select[name="' + spec[0] + '"]'); + var value = ctl ? ctl.value : ""; + var show = spec[1].split(" ").indexOf(value) !== -1; + el.hidden = !show; + }); + } + document.querySelectorAll("form[data-dynamic]").forEach(function (form) { + form.addEventListener("change", function () { refresh(form); }); + refresh(form); + }); + + // Öffentlichen Schlüssel kopieren + document.addEventListener("click", function (e) { + var btn = e.target.closest && e.target.closest("[data-copy]"); + if (!btn) return; + var src = document.getElementById(btn.getAttribute("data-copy")); + if (src && navigator.clipboard) { + navigator.clipboard.writeText(src.textContent.trim()).then(function () { + btn.textContent = "kopiert ✓"; + }); + } + }); +})(); diff --git a/src/netmover/web/static/htmx.min.js b/src/netmover/web/static/htmx.min.js new file mode 100644 index 0000000..59937d7 --- /dev/null +++ b/src/netmover/web/static/htmx.min.js @@ -0,0 +1 @@ +var htmx=function(){"use strict";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||"post");return n.values},remove:null,addClass:null,removeClass:null,toggleClass:null,takeClass:null,swap:null,defineExtension:null,removeExtension:null,logAll:null,logNone:null,logger:null,config:{historyEnabled:true,historyCacheSize:10,refreshOnHistoryMiss:false,defaultSwapStyle:"innerHTML",defaultSwapDelay:0,defaultSettleDelay:20,includeIndicatorStyles:true,indicatorClass:"htmx-indicator",requestClass:"htmx-request",addedClass:"htmx-added",settlingClass:"htmx-settling",swappingClass:"htmx-swapping",allowEval:true,allowScriptTags:true,inlineScriptNonce:"",inlineStyleNonce:"",attributesToSettle:["class","style","width","height"],withCredentials:false,timeout:0,wsReconnectDelay:"full-jitter",wsBinaryType:"blob",disableSelector:"[hx-disable], [data-hx-disable]",scrollBehavior:"instant",defaultFocusScroll:false,getCacheBusterParam:false,globalViewTransitions:false,methodsThatUseUrlParams:["get","delete"],selfRequestsOnly:true,ignoreTitle:false,scrollIntoViewOnBoost:true,triggerSpecsCache:null,disableInheritance:false,responseHandling:[{code:"204",swap:false},{code:"[23]..",swap:true},{code:"[45]..",swap:false,error:true}],allowNestedOobSwaps:true},parseInterval:null,_:null,version:"2.0.4"};Q.onLoad=j;Q.process=kt;Q.on=ye;Q.off=be;Q.trigger=he;Q.ajax=Rn;Q.find=u;Q.findAll=x;Q.closest=g;Q.remove=z;Q.addClass=K;Q.removeClass=G;Q.toggleClass=W;Q.takeClass=Z;Q.swap=$e;Q.defineExtension=Fn;Q.removeExtension=Bn;Q.logAll=V;Q.logNone=_;Q.parseInterval=d;Q._=e;const n={addTriggerHandler:St,bodyContains:le,canAccessLocalStorage:B,findThisElement:Se,filterValues:hn,swap:$e,hasAttribute:s,getAttributeValue:te,getClosestAttributeValue:re,getClosestMatch:o,getExpressionVars:En,getHeaders:fn,getInputValues:cn,getInternalData:ie,getSwapSpecification:gn,getTriggerSpecs:st,getTarget:Ee,makeFragment:P,mergeObjects:ce,makeSettleInfo:xn,oobSwap:He,querySelectorExt:ae,settleImmediately:Kt,shouldCancel:ht,triggerEvent:he,triggerErrorEvent:fe,withExtensions:Ft};const r=["get","post","put","delete","patch"];const H=r.map(function(e){return"[hx-"+e+"], [data-hx-"+e+"]"}).join(", ");function d(e){if(e==undefined){return undefined}let t=NaN;if(e.slice(-2)=="ms"){t=parseFloat(e.slice(0,-2))}else if(e.slice(-1)=="s"){t=parseFloat(e.slice(0,-1))*1e3}else if(e.slice(-1)=="m"){t=parseFloat(e.slice(0,-1))*1e3*60}else{t=parseFloat(e)}return isNaN(t)?undefined:t}function ee(e,t){return e instanceof Element&&e.getAttribute(t)}function s(e,t){return!!e.hasAttribute&&(e.hasAttribute(t)||e.hasAttribute("data-"+t))}function te(e,t){return ee(e,t)||ee(e,"data-"+t)}function c(e){const t=e.parentElement;if(!t&&e.parentNode instanceof ShadowRoot)return e.parentNode;return t}function ne(){return document}function m(e,t){return e.getRootNode?e.getRootNode({composed:t}):ne()}function o(e,t){while(e&&!t(e)){e=c(e)}return e||null}function i(e,t,n){const r=te(t,n);const o=te(t,"hx-disinherit");var i=te(t,"hx-inherit");if(e!==t){if(Q.config.disableInheritance){if(i&&(i==="*"||i.split(" ").indexOf(n)>=0)){return r}else{return null}}if(o&&(o==="*"||o.split(" ").indexOf(n)>=0)){return"unset"}}return r}function re(t,n){let r=null;o(t,function(e){return!!(r=i(t,ue(e),n))});if(r!=="unset"){return r}}function h(e,t){const n=e instanceof Element&&(e.matches||e.matchesSelector||e.msMatchesSelector||e.mozMatchesSelector||e.webkitMatchesSelector||e.oMatchesSelector);return!!n&&n.call(e,t)}function T(e){const t=/<([a-z][^\/\0>\x20\t\r\n\f]*)/i;const n=t.exec(e);if(n){return n[1].toLowerCase()}else{return""}}function q(e){const t=new DOMParser;return t.parseFromString(e,"text/html")}function L(e,t){while(t.childNodes.length>0){e.append(t.childNodes[0])}}function A(e){const t=ne().createElement("script");se(e.attributes,function(e){t.setAttribute(e.name,e.value)});t.textContent=e.textContent;t.async=false;if(Q.config.inlineScriptNonce){t.nonce=Q.config.inlineScriptNonce}return t}function N(e){return e.matches("script")&&(e.type==="text/javascript"||e.type==="module"||e.type==="")}function I(e){Array.from(e.querySelectorAll("script")).forEach(e=>{if(N(e)){const t=A(e);const n=e.parentNode;try{n.insertBefore(t,e)}catch(e){O(e)}finally{e.remove()}}})}function P(e){const t=e.replace(/]*)?>[\s\S]*?<\/head>/i,"");const n=T(t);let r;if(n==="html"){r=new DocumentFragment;const i=q(e);L(r,i.body);r.title=i.title}else if(n==="body"){r=new DocumentFragment;const i=q(t);L(r,i.body);r.title=i.title}else{const i=q('");r=i.querySelector("template").content;r.title=i.title;var o=r.querySelector("title");if(o&&o.parentNode===r){o.remove();r.title=o.innerText}}if(r){if(Q.config.allowScriptTags){I(r)}else{r.querySelectorAll("script").forEach(e=>e.remove())}}return r}function oe(e){if(e){e()}}function t(e,t){return Object.prototype.toString.call(e)==="[object "+t+"]"}function k(e){return typeof e==="function"}function D(e){return t(e,"Object")}function ie(e){const t="htmx-internal-data";let n=e[t];if(!n){n=e[t]={}}return n}function M(t){const n=[];if(t){for(let e=0;e=0}function le(e){return e.getRootNode({composed:true})===document}function F(e){return e.trim().split(/\s+/)}function ce(e,t){for(const n in t){if(t.hasOwnProperty(n)){e[n]=t[n]}}return e}function S(e){try{return JSON.parse(e)}catch(e){O(e);return null}}function B(){const e="htmx:localStorageTest";try{localStorage.setItem(e,e);localStorage.removeItem(e);return true}catch(e){return false}}function U(t){try{const e=new URL(t);if(e){t=e.pathname+e.search}if(!/^\/$/.test(t)){t=t.replace(/\/+$/,"")}return t}catch(e){return t}}function e(e){return vn(ne().body,function(){return eval(e)})}function j(t){const e=Q.on("htmx:load",function(e){t(e.detail.elt)});return e}function V(){Q.logger=function(e,t,n){if(console){console.log(t,e,n)}}}function _(){Q.logger=null}function u(e,t){if(typeof e!=="string"){return e.querySelector(t)}else{return u(ne(),e)}}function x(e,t){if(typeof e!=="string"){return e.querySelectorAll(t)}else{return x(ne(),e)}}function E(){return window}function z(e,t){e=y(e);if(t){E().setTimeout(function(){z(e);e=null},t)}else{c(e).removeChild(e)}}function ue(e){return e instanceof Element?e:null}function $(e){return e instanceof HTMLElement?e:null}function J(e){return typeof e==="string"?e:null}function f(e){return e instanceof Element||e instanceof Document||e instanceof DocumentFragment?e:null}function K(e,t,n){e=ue(y(e));if(!e){return}if(n){E().setTimeout(function(){K(e,t);e=null},n)}else{e.classList&&e.classList.add(t)}}function G(e,t,n){let r=ue(y(e));if(!r){return}if(n){E().setTimeout(function(){G(r,t);r=null},n)}else{if(r.classList){r.classList.remove(t);if(r.classList.length===0){r.removeAttribute("class")}}}}function W(e,t){e=y(e);e.classList.toggle(t)}function Z(e,t){e=y(e);se(e.parentElement.children,function(e){G(e,t)});K(ue(e),t)}function g(e,t){e=ue(y(e));if(e&&e.closest){return e.closest(t)}else{do{if(e==null||h(e,t)){return e}}while(e=e&&ue(c(e)));return null}}function l(e,t){return e.substring(0,t.length)===t}function Y(e,t){return e.substring(e.length-t.length)===t}function ge(e){const t=e.trim();if(l(t,"<")&&Y(t,"/>")){return t.substring(1,t.length-2)}else{return t}}function p(t,r,n){if(r.indexOf("global ")===0){return p(t,r.slice(7),true)}t=y(t);const o=[];{let t=0;let n=0;for(let e=0;e"){t--}}if(n0){const r=ge(o.shift());let e;if(r.indexOf("closest ")===0){e=g(ue(t),ge(r.substr(8)))}else if(r.indexOf("find ")===0){e=u(f(t),ge(r.substr(5)))}else if(r==="next"||r==="nextElementSibling"){e=ue(t).nextElementSibling}else if(r.indexOf("next ")===0){e=pe(t,ge(r.substr(5)),!!n)}else if(r==="previous"||r==="previousElementSibling"){e=ue(t).previousElementSibling}else if(r.indexOf("previous ")===0){e=me(t,ge(r.substr(9)),!!n)}else if(r==="document"){e=document}else if(r==="window"){e=window}else if(r==="body"){e=document.body}else if(r==="root"){e=m(t,!!n)}else if(r==="host"){e=t.getRootNode().host}else{s.push(r)}if(e){i.push(e)}}if(s.length>0){const e=s.join(",");const c=f(m(t,!!n));i.push(...M(c.querySelectorAll(e)))}return i}var pe=function(t,e,n){const r=f(m(t,n)).querySelectorAll(e);for(let e=0;e=0;e--){const o=r[e];if(o.compareDocumentPosition(t)===Node.DOCUMENT_POSITION_FOLLOWING){return o}}};function ae(e,t){if(typeof e!=="string"){return p(e,t)[0]}else{return p(ne().body,e)[0]}}function y(e,t){if(typeof e==="string"){return u(f(t)||document,e)}else{return e}}function xe(e,t,n,r){if(k(t)){return{target:ne().body,event:J(e),listener:t,options:n}}else{return{target:y(e),event:J(t),listener:n,options:r}}}function ye(t,n,r,o){Vn(function(){const e=xe(t,n,r,o);e.target.addEventListener(e.event,e.listener,e.options)});const e=k(n);return e?n:r}function be(t,n,r){Vn(function(){const e=xe(t,n,r);e.target.removeEventListener(e.event,e.listener)});return k(n)?n:r}const ve=ne().createElement("output");function we(e,t){const n=re(e,t);if(n){if(n==="this"){return[Se(e,t)]}else{const r=p(e,n);if(r.length===0){O('The selector "'+n+'" on '+t+" returned no matches!");return[ve]}else{return r}}}}function Se(e,t){return ue(o(e,function(e){return te(ue(e),t)!=null}))}function Ee(e){const t=re(e,"hx-target");if(t){if(t==="this"){return Se(e,"hx-target")}else{return ae(e,t)}}else{const n=ie(e);if(n.boosted){return ne().body}else{return e}}}function Ce(t){const n=Q.config.attributesToSettle;for(let e=0;e0){s=e.substring(0,e.indexOf(":"));n=e.substring(e.indexOf(":")+1)}else{s=e}o.removeAttribute("hx-swap-oob");o.removeAttribute("data-hx-swap-oob");const r=p(t,n,false);if(r){se(r,function(e){let t;const n=o.cloneNode(true);t=ne().createDocumentFragment();t.appendChild(n);if(!Re(s,e)){t=f(n)}const r={shouldSwap:true,target:e,fragment:t};if(!he(e,"htmx:oobBeforeSwap",r))return;e=r.target;if(r.shouldSwap){qe(t);_e(s,e,e,t,i);Te()}se(i.elts,function(e){he(e,"htmx:oobAfterSwap",r)})});o.parentNode.removeChild(o)}else{o.parentNode.removeChild(o);fe(ne().body,"htmx:oobErrorNoTarget",{content:o})}return e}function Te(){const e=u("#--htmx-preserve-pantry--");if(e){for(const t of[...e.children]){const n=u("#"+t.id);n.parentNode.moveBefore(t,n);n.remove()}e.remove()}}function qe(e){se(x(e,"[hx-preserve], [data-hx-preserve]"),function(e){const t=te(e,"id");const n=ne().getElementById(t);if(n!=null){if(e.moveBefore){let e=u("#--htmx-preserve-pantry--");if(e==null){ne().body.insertAdjacentHTML("afterend","
");e=u("#--htmx-preserve-pantry--")}e.moveBefore(n,null)}else{e.parentNode.replaceChild(n,e)}}})}function Le(l,e,c){se(e.querySelectorAll("[id]"),function(t){const n=ee(t,"id");if(n&&n.length>0){const r=n.replace("'","\\'");const o=t.tagName.replace(":","\\:");const e=f(l);const i=e&&e.querySelector(o+"[id='"+r+"']");if(i&&i!==e){const s=t.cloneNode();Oe(t,i);c.tasks.push(function(){Oe(t,s)})}}})}function Ae(e){return function(){G(e,Q.config.addedClass);kt(ue(e));Ne(f(e));he(e,"htmx:load")}}function Ne(e){const t="[autofocus]";const n=$(h(e,t)?e:e.querySelector(t));if(n!=null){n.focus()}}function a(e,t,n,r){Le(e,n,r);while(n.childNodes.length>0){const o=n.firstChild;K(ue(o),Q.config.addedClass);e.insertBefore(o,t);if(o.nodeType!==Node.TEXT_NODE&&o.nodeType!==Node.COMMENT_NODE){r.tasks.push(Ae(o))}}}function Ie(e,t){let n=0;while(n0}function $e(e,t,r,o){if(!o){o={}}e=y(e);const i=o.contextElement?m(o.contextElement,false):ne();const n=document.activeElement;let s={};try{s={elt:n,start:n?n.selectionStart:null,end:n?n.selectionEnd:null}}catch(e){}const l=xn(e);if(r.swapStyle==="textContent"){e.textContent=t}else{let n=P(t);l.title=n.title;if(o.selectOOB){const u=o.selectOOB.split(",");for(let t=0;t0){E().setTimeout(c,r.settleDelay)}else{c()}}function Je(e,t,n){const r=e.getResponseHeader(t);if(r.indexOf("{")===0){const o=S(r);for(const i in o){if(o.hasOwnProperty(i)){let e=o[i];if(D(e)){n=e.target!==undefined?e.target:n}else{e={value:e}}he(n,i,e)}}}else{const s=r.split(",");for(let e=0;e0){const s=o[0];if(s==="]"){e--;if(e===0){if(n===null){t=t+"true"}o.shift();t+=")})";try{const l=vn(r,function(){return Function(t)()},function(){return true});l.source=t;return l}catch(e){fe(ne().body,"htmx:syntax:error",{error:e,source:t});return null}}}else if(s==="["){e++}if(tt(s,n,i)){t+="(("+i+"."+s+") ? ("+i+"."+s+") : (window."+s+"))"}else{t=t+s}n=o.shift()}}}function C(e,t){let n="";while(e.length>0&&!t.test(e[0])){n+=e.shift()}return n}function rt(e){let t;if(e.length>0&&Ye.test(e[0])){e.shift();t=C(e,Qe).trim();e.shift()}else{t=C(e,v)}return t}const ot="input, textarea, select";function it(e,t,n){const r=[];const o=et(t);do{C(o,w);const l=o.length;const c=C(o,/[,\[\s]/);if(c!==""){if(c==="every"){const u={trigger:"every"};C(o,w);u.pollInterval=d(C(o,/[,\[\s]/));C(o,w);var i=nt(e,o,"event");if(i){u.eventFilter=i}r.push(u)}else{const a={trigger:c};var i=nt(e,o,"event");if(i){a.eventFilter=i}C(o,w);while(o.length>0&&o[0]!==","){const f=o.shift();if(f==="changed"){a.changed=true}else if(f==="once"){a.once=true}else if(f==="consume"){a.consume=true}else if(f==="delay"&&o[0]===":"){o.shift();a.delay=d(C(o,v))}else if(f==="from"&&o[0]===":"){o.shift();if(Ye.test(o[0])){var s=rt(o)}else{var s=C(o,v);if(s==="closest"||s==="find"||s==="next"||s==="previous"){o.shift();const h=rt(o);if(h.length>0){s+=" "+h}}}a.from=s}else if(f==="target"&&o[0]===":"){o.shift();a.target=rt(o)}else if(f==="throttle"&&o[0]===":"){o.shift();a.throttle=d(C(o,v))}else if(f==="queue"&&o[0]===":"){o.shift();a.queue=C(o,v)}else if(f==="root"&&o[0]===":"){o.shift();a[f]=rt(o)}else if(f==="threshold"&&o[0]===":"){o.shift();a[f]=C(o,v)}else{fe(e,"htmx:syntax:error",{token:o.shift()})}C(o,w)}r.push(a)}}if(o.length===l){fe(e,"htmx:syntax:error",{token:o.shift()})}C(o,w)}while(o[0]===","&&o.shift());if(n){n[t]=r}return r}function st(e){const t=te(e,"hx-trigger");let n=[];if(t){const r=Q.config.triggerSpecsCache;n=r&&r[t]||it(e,t,r)}if(n.length>0){return n}else if(h(e,"form")){return[{trigger:"submit"}]}else if(h(e,'input[type="button"], input[type="submit"]')){return[{trigger:"click"}]}else if(h(e,ot)){return[{trigger:"change"}]}else{return[{trigger:"click"}]}}function lt(e){ie(e).cancelled=true}function ct(e,t,n){const r=ie(e);r.timeout=E().setTimeout(function(){if(le(e)&&r.cancelled!==true){if(!gt(n,e,Mt("hx:poll:trigger",{triggerSpec:n,target:e}))){t(e)}ct(e,t,n)}},n.pollInterval)}function ut(e){return location.hostname===e.hostname&&ee(e,"href")&&ee(e,"href").indexOf("#")!==0}function at(e){return g(e,Q.config.disableSelector)}function ft(t,n,e){if(t instanceof HTMLAnchorElement&&ut(t)&&(t.target===""||t.target==="_self")||t.tagName==="FORM"&&String(ee(t,"method")).toLowerCase()!=="dialog"){n.boosted=true;let r,o;if(t.tagName==="A"){r="get";o=ee(t,"href")}else{const i=ee(t,"method");r=i?i.toLowerCase():"get";o=ee(t,"action");if(o==null||o===""){o=ne().location.href}if(r==="get"&&o.includes("?")){o=o.replace(/\?[^#]+/,"")}}e.forEach(function(e){pt(t,function(e,t){const n=ue(e);if(at(n)){b(n);return}de(r,o,n,t)},n,e,true)})}}function ht(e,t){const n=ue(t);if(!n){return false}if(e.type==="submit"||e.type==="click"){if(n.tagName==="FORM"){return true}if(h(n,'input[type="submit"], button')&&(h(n,"[form]")||g(n,"form")!==null)){return true}if(n instanceof HTMLAnchorElement&&n.href&&(n.getAttribute("href")==="#"||n.getAttribute("href").indexOf("#")!==0)){return true}}return false}function dt(e,t){return ie(e).boosted&&e instanceof HTMLAnchorElement&&t.type==="click"&&(t.ctrlKey||t.metaKey)}function gt(e,t,n){const r=e.eventFilter;if(r){try{return r.call(t,n)!==true}catch(e){const o=r.source;fe(ne().body,"htmx:eventFilter:error",{error:e,source:o});return true}}return false}function pt(l,c,e,u,a){const f=ie(l);let t;if(u.from){t=p(l,u.from)}else{t=[l]}if(u.changed){if(!("lastValue"in f)){f.lastValue=new WeakMap}t.forEach(function(e){if(!f.lastValue.has(u)){f.lastValue.set(u,new WeakMap)}f.lastValue.get(u).set(e,e.value)})}se(t,function(i){const s=function(e){if(!le(l)){i.removeEventListener(u.trigger,s);return}if(dt(l,e)){return}if(a||ht(e,l)){e.preventDefault()}if(gt(u,l,e)){return}const t=ie(e);t.triggerSpec=u;if(t.handledFor==null){t.handledFor=[]}if(t.handledFor.indexOf(l)<0){t.handledFor.push(l);if(u.consume){e.stopPropagation()}if(u.target&&e.target){if(!h(ue(e.target),u.target)){return}}if(u.once){if(f.triggeredOnce){return}else{f.triggeredOnce=true}}if(u.changed){const n=event.target;const r=n.value;const o=f.lastValue.get(u);if(o.has(n)&&o.get(n)===r){return}o.set(n,r)}if(f.delayed){clearTimeout(f.delayed)}if(f.throttle){return}if(u.throttle>0){if(!f.throttle){he(l,"htmx:trigger");c(l,e);f.throttle=E().setTimeout(function(){f.throttle=null},u.throttle)}}else if(u.delay>0){f.delayed=E().setTimeout(function(){he(l,"htmx:trigger");c(l,e)},u.delay)}else{he(l,"htmx:trigger");c(l,e)}}};if(e.listenerInfos==null){e.listenerInfos=[]}e.listenerInfos.push({trigger:u.trigger,listener:s,on:i});i.addEventListener(u.trigger,s)})}let mt=false;let xt=null;function yt(){if(!xt){xt=function(){mt=true};window.addEventListener("scroll",xt);window.addEventListener("resize",xt);setInterval(function(){if(mt){mt=false;se(ne().querySelectorAll("[hx-trigger*='revealed'],[data-hx-trigger*='revealed']"),function(e){bt(e)})}},200)}}function bt(e){if(!s(e,"data-hx-revealed")&&X(e)){e.setAttribute("data-hx-revealed","true");const t=ie(e);if(t.initHash){he(e,"revealed")}else{e.addEventListener("htmx:afterProcessNode",function(){he(e,"revealed")},{once:true})}}}function vt(e,t,n,r){const o=function(){if(!n.loaded){n.loaded=true;he(e,"htmx:trigger");t(e)}};if(r>0){E().setTimeout(o,r)}else{o()}}function wt(t,n,e){let i=false;se(r,function(r){if(s(t,"hx-"+r)){const o=te(t,"hx-"+r);i=true;n.path=o;n.verb=r;e.forEach(function(e){St(t,e,n,function(e,t){const n=ue(e);if(g(n,Q.config.disableSelector)){b(n);return}de(r,o,n,t)})})}});return i}function St(r,e,t,n){if(e.trigger==="revealed"){yt();pt(r,n,t,e);bt(ue(r))}else if(e.trigger==="intersect"){const o={};if(e.root){o.root=ae(r,e.root)}if(e.threshold){o.threshold=parseFloat(e.threshold)}const i=new IntersectionObserver(function(t){for(let e=0;e0){t.polling=true;ct(ue(r),n,e)}else{pt(r,n,t,e)}}function Et(e){const t=ue(e);if(!t){return false}const n=t.attributes;for(let e=0;e", "+e).join(""));return o}else{return[]}}function Tt(e){const t=g(ue(e.target),"button, input[type='submit']");const n=Lt(e);if(n){n.lastButtonClicked=t}}function qt(e){const t=Lt(e);if(t){t.lastButtonClicked=null}}function Lt(e){const t=g(ue(e.target),"button, input[type='submit']");if(!t){return}const n=y("#"+ee(t,"form"),t.getRootNode())||g(t,"form");if(!n){return}return ie(n)}function At(e){e.addEventListener("click",Tt);e.addEventListener("focusin",Tt);e.addEventListener("focusout",qt)}function Nt(t,e,n){const r=ie(t);if(!Array.isArray(r.onHandlers)){r.onHandlers=[]}let o;const i=function(e){vn(t,function(){if(at(t)){return}if(!o){o=new Function("event",n)}o.call(t,e)})};t.addEventListener(e,i);r.onHandlers.push({event:e,listener:i})}function It(t){ke(t);for(let e=0;eQ.config.historyCacheSize){i.shift()}while(i.length>0){try{localStorage.setItem("htmx-history-cache",JSON.stringify(i));break}catch(e){fe(ne().body,"htmx:historyCacheError",{cause:e,cache:i});i.shift()}}}function Vt(t){if(!B()){return null}t=U(t);const n=S(localStorage.getItem("htmx-history-cache"))||[];for(let e=0;e=200&&this.status<400){he(ne().body,"htmx:historyCacheMissLoad",i);const e=P(this.response);const t=e.querySelector("[hx-history-elt],[data-hx-history-elt]")||e;const n=Ut();const r=xn(n);kn(e.title);qe(e);Ve(n,t,r);Te();Kt(r.tasks);Bt=o;he(ne().body,"htmx:historyRestore",{path:o,cacheMiss:true,serverResponse:this.response})}else{fe(ne().body,"htmx:historyCacheMissLoadError",i)}};e.send()}function Wt(e){zt();e=e||location.pathname+location.search;const t=Vt(e);if(t){const n=P(t.content);const r=Ut();const o=xn(r);kn(t.title);qe(n);Ve(r,n,o);Te();Kt(o.tasks);E().setTimeout(function(){window.scrollTo(0,t.scroll)},0);Bt=e;he(ne().body,"htmx:historyRestore",{path:e,item:t})}else{if(Q.config.refreshOnHistoryMiss){window.location.reload(true)}else{Gt(e)}}}function Zt(e){let t=we(e,"hx-indicator");if(t==null){t=[e]}se(t,function(e){const t=ie(e);t.requestCount=(t.requestCount||0)+1;e.classList.add.call(e.classList,Q.config.requestClass)});return t}function Yt(e){let t=we(e,"hx-disabled-elt");if(t==null){t=[]}se(t,function(e){const t=ie(e);t.requestCount=(t.requestCount||0)+1;e.setAttribute("disabled","");e.setAttribute("data-disabled-by-htmx","")});return t}function Qt(e,t){se(e.concat(t),function(e){const t=ie(e);t.requestCount=(t.requestCount||1)-1});se(e,function(e){const t=ie(e);if(t.requestCount===0){e.classList.remove.call(e.classList,Q.config.requestClass)}});se(t,function(e){const t=ie(e);if(t.requestCount===0){e.removeAttribute("disabled");e.removeAttribute("data-disabled-by-htmx")}})}function en(t,n){for(let e=0;en.indexOf(e)<0)}else{e=e.filter(e=>e!==n)}r.delete(t);se(e,e=>r.append(t,e))}}function on(t,n,r,o,i){if(o==null||en(t,o)){return}else{t.push(o)}if(tn(o)){const s=ee(o,"name");let e=o.value;if(o instanceof HTMLSelectElement&&o.multiple){e=M(o.querySelectorAll("option:checked")).map(function(e){return e.value})}if(o instanceof HTMLInputElement&&o.files){e=M(o.files)}nn(s,e,n);if(i){sn(o,r)}}if(o instanceof HTMLFormElement){se(o.elements,function(e){if(t.indexOf(e)>=0){rn(e.name,e.value,n)}else{t.push(e)}if(i){sn(e,r)}});new FormData(o).forEach(function(e,t){if(e instanceof File&&e.name===""){return}nn(t,e,n)})}}function sn(e,t){const n=e;if(n.willValidate){he(n,"htmx:validation:validate");if(!n.checkValidity()){t.push({elt:n,message:n.validationMessage,validity:n.validity});he(n,"htmx:validation:failed",{message:n.validationMessage,validity:n.validity})}}}function ln(n,e){for(const t of e.keys()){n.delete(t)}e.forEach(function(e,t){n.append(t,e)});return n}function cn(e,t){const n=[];const r=new FormData;const o=new FormData;const i=[];const s=ie(e);if(s.lastButtonClicked&&!le(s.lastButtonClicked)){s.lastButtonClicked=null}let l=e instanceof HTMLFormElement&&e.noValidate!==true||te(e,"hx-validate")==="true";if(s.lastButtonClicked){l=l&&s.lastButtonClicked.formNoValidate!==true}if(t!=="get"){on(n,o,i,g(e,"form"),l)}on(n,r,i,e,l);if(s.lastButtonClicked||e.tagName==="BUTTON"||e.tagName==="INPUT"&&ee(e,"type")==="submit"){const u=s.lastButtonClicked||e;const a=ee(u,"name");nn(a,u.value,o)}const c=we(e,"hx-include");se(c,function(e){on(n,r,i,ue(e),l);if(!h(e,"form")){se(f(e).querySelectorAll(ot),function(e){on(n,r,i,e,l)})}});ln(r,o);return{errors:i,formData:r,values:An(r)}}function un(e,t,n){if(e!==""){e+="&"}if(String(n)==="[object Object]"){n=JSON.stringify(n)}const r=encodeURIComponent(n);e+=encodeURIComponent(t)+"="+r;return e}function an(e){e=qn(e);let n="";e.forEach(function(e,t){n=un(n,t,e)});return n}function fn(e,t,n){const r={"HX-Request":"true","HX-Trigger":ee(e,"id"),"HX-Trigger-Name":ee(e,"name"),"HX-Target":te(t,"id"),"HX-Current-URL":ne().location.href};bn(e,"hx-headers",false,r);if(n!==undefined){r["HX-Prompt"]=n}if(ie(e).boosted){r["HX-Boosted"]="true"}return r}function hn(n,e){const t=re(e,"hx-params");if(t){if(t==="none"){return new FormData}else if(t==="*"){return n}else if(t.indexOf("not ")===0){se(t.slice(4).split(","),function(e){e=e.trim();n.delete(e)});return n}else{const r=new FormData;se(t.split(","),function(t){t=t.trim();if(n.has(t)){n.getAll(t).forEach(function(e){r.append(t,e)})}});return r}}else{return n}}function dn(e){return!!ee(e,"href")&&ee(e,"href").indexOf("#")>=0}function gn(e,t){const n=t||re(e,"hx-swap");const r={swapStyle:ie(e).boosted?"innerHTML":Q.config.defaultSwapStyle,swapDelay:Q.config.defaultSwapDelay,settleDelay:Q.config.defaultSettleDelay};if(Q.config.scrollIntoViewOnBoost&&ie(e).boosted&&!dn(e)){r.show="top"}if(n){const s=F(n);if(s.length>0){for(let e=0;e0?o.join(":"):null;r.scroll=u;r.scrollTarget=i}else if(l.indexOf("show:")===0){const a=l.slice(5);var o=a.split(":");const f=o.pop();var i=o.length>0?o.join(":"):null;r.show=f;r.showTarget=i}else if(l.indexOf("focus-scroll:")===0){const h=l.slice("focus-scroll:".length);r.focusScroll=h=="true"}else if(e==0){r.swapStyle=l}else{O("Unknown modifier in hx-swap: "+l)}}}}return r}function pn(e){return re(e,"hx-encoding")==="multipart/form-data"||h(e,"form")&&ee(e,"enctype")==="multipart/form-data"}function mn(t,n,r){let o=null;Ft(n,function(e){if(o==null){o=e.encodeParameters(t,r,n)}});if(o!=null){return o}else{if(pn(n)){return ln(new FormData,qn(r))}else{return an(r)}}}function xn(e){return{tasks:[],elts:[e]}}function yn(e,t){const n=e[0];const r=e[e.length-1];if(t.scroll){var o=null;if(t.scrollTarget){o=ue(ae(n,t.scrollTarget))}if(t.scroll==="top"&&(n||o)){o=o||n;o.scrollTop=0}if(t.scroll==="bottom"&&(r||o)){o=o||r;o.scrollTop=o.scrollHeight}}if(t.show){var o=null;if(t.showTarget){let e=t.showTarget;if(t.showTarget==="window"){e="body"}o=ue(ae(n,e))}if(t.show==="top"&&(n||o)){o=o||n;o.scrollIntoView({block:"start",behavior:Q.config.scrollBehavior})}if(t.show==="bottom"&&(r||o)){o=o||r;o.scrollIntoView({block:"end",behavior:Q.config.scrollBehavior})}}}function bn(r,e,o,i){if(i==null){i={}}if(r==null){return i}const s=te(r,e);if(s){let e=s.trim();let t=o;if(e==="unset"){return null}if(e.indexOf("javascript:")===0){e=e.slice(11);t=true}else if(e.indexOf("js:")===0){e=e.slice(3);t=true}if(e.indexOf("{")!==0){e="{"+e+"}"}let n;if(t){n=vn(r,function(){return Function("return ("+e+")")()},{})}else{n=S(e)}for(const l in n){if(n.hasOwnProperty(l)){if(i[l]==null){i[l]=n[l]}}}}return bn(ue(c(r)),e,o,i)}function vn(e,t,n){if(Q.config.allowEval){return t()}else{fe(e,"htmx:evalDisallowedError");return n}}function wn(e,t){return bn(e,"hx-vars",true,t)}function Sn(e,t){return bn(e,"hx-vals",false,t)}function En(e){return ce(wn(e),Sn(e))}function Cn(t,n,r){if(r!==null){try{t.setRequestHeader(n,r)}catch(e){t.setRequestHeader(n,encodeURIComponent(r));t.setRequestHeader(n+"-URI-AutoEncoded","true")}}}function On(t){if(t.responseURL&&typeof URL!=="undefined"){try{const e=new URL(t.responseURL);return e.pathname+e.search}catch(e){fe(ne().body,"htmx:badResponseUrl",{url:t.responseURL})}}}function R(e,t){return t.test(e.getAllResponseHeaders())}function Rn(t,n,r){t=t.toLowerCase();if(r){if(r instanceof Element||typeof r==="string"){return de(t,n,null,null,{targetOverride:y(r)||ve,returnPromise:true})}else{let e=y(r.target);if(r.target&&!e||r.source&&!e&&!y(r.source)){e=ve}return de(t,n,y(r.source),r.event,{handler:r.handler,headers:r.headers,values:r.values,targetOverride:e,swapOverride:r.swap,select:r.select,returnPromise:true})}}else{return de(t,n,null,null,{returnPromise:true})}}function Hn(e){const t=[];while(e){t.push(e);e=e.parentElement}return t}function Tn(e,t,n){let r;let o;if(typeof URL==="function"){o=new URL(t,document.location.href);const i=document.location.origin;r=i===o.origin}else{o=t;r=l(t,document.location.origin)}if(Q.config.selfRequestsOnly){if(!r){return false}}return he(e,"htmx:validateUrl",ce({url:o,sameHost:r},n))}function qn(e){if(e instanceof FormData)return e;const t=new FormData;for(const n in e){if(e.hasOwnProperty(n)){if(e[n]&&typeof e[n].forEach==="function"){e[n].forEach(function(e){t.append(n,e)})}else if(typeof e[n]==="object"&&!(e[n]instanceof Blob)){t.append(n,JSON.stringify(e[n]))}else{t.append(n,e[n])}}}return t}function Ln(r,o,e){return new Proxy(e,{get:function(t,e){if(typeof e==="number")return t[e];if(e==="length")return t.length;if(e==="push"){return function(e){t.push(e);r.append(o,e)}}if(typeof t[e]==="function"){return function(){t[e].apply(t,arguments);r.delete(o);t.forEach(function(e){r.append(o,e)})}}if(t[e]&&t[e].length===1){return t[e][0]}else{return t[e]}},set:function(e,t,n){e[t]=n;r.delete(o);e.forEach(function(e){r.append(o,e)});return true}})}function An(o){return new Proxy(o,{get:function(e,t){if(typeof t==="symbol"){const r=Reflect.get(e,t);if(typeof r==="function"){return function(){return r.apply(o,arguments)}}else{return r}}if(t==="toJSON"){return()=>Object.fromEntries(o)}if(t in e){if(typeof e[t]==="function"){return function(){return o[t].apply(o,arguments)}}else{return e[t]}}const n=o.getAll(t);if(n.length===0){return undefined}else if(n.length===1){return n[0]}else{return Ln(e,t,n)}},set:function(t,n,e){if(typeof n!=="string"){return false}t.delete(n);if(e&&typeof e.forEach==="function"){e.forEach(function(e){t.append(n,e)})}else if(typeof e==="object"&&!(e instanceof Blob)){t.append(n,JSON.stringify(e))}else{t.append(n,e)}return true},deleteProperty:function(e,t){if(typeof t==="string"){e.delete(t)}return true},ownKeys:function(e){return Reflect.ownKeys(Object.fromEntries(e))},getOwnPropertyDescriptor:function(e,t){return Reflect.getOwnPropertyDescriptor(Object.fromEntries(e),t)}})}function de(t,n,r,o,i,D){let s=null;let l=null;i=i!=null?i:{};if(i.returnPromise&&typeof Promise!=="undefined"){var e=new Promise(function(e,t){s=e;l=t})}if(r==null){r=ne().body}const M=i.handler||Dn;const X=i.select||null;if(!le(r)){oe(s);return e}const c=i.targetOverride||ue(Ee(r));if(c==null||c==ve){fe(r,"htmx:targetError",{target:te(r,"hx-target")});oe(l);return e}let u=ie(r);const a=u.lastButtonClicked;if(a){const L=ee(a,"formaction");if(L!=null){n=L}const A=ee(a,"formmethod");if(A!=null){if(A.toLowerCase()!=="dialog"){t=A}}}const f=re(r,"hx-confirm");if(D===undefined){const K=function(e){return de(t,n,r,o,i,!!e)};const G={target:c,elt:r,path:n,verb:t,triggeringEvent:o,etc:i,issueRequest:K,question:f};if(he(r,"htmx:confirm",G)===false){oe(s);return e}}let h=r;let d=re(r,"hx-sync");let g=null;let F=false;if(d){const N=d.split(":");const I=N[0].trim();if(I==="this"){h=Se(r,"hx-sync")}else{h=ue(ae(r,I))}d=(N[1]||"drop").trim();u=ie(h);if(d==="drop"&&u.xhr&&u.abortable!==true){oe(s);return e}else if(d==="abort"){if(u.xhr){oe(s);return e}else{F=true}}else if(d==="replace"){he(h,"htmx:abort")}else if(d.indexOf("queue")===0){const W=d.split(" ");g=(W[1]||"last").trim()}}if(u.xhr){if(u.abortable){he(h,"htmx:abort")}else{if(g==null){if(o){const P=ie(o);if(P&&P.triggerSpec&&P.triggerSpec.queue){g=P.triggerSpec.queue}}if(g==null){g="last"}}if(u.queuedRequests==null){u.queuedRequests=[]}if(g==="first"&&u.queuedRequests.length===0){u.queuedRequests.push(function(){de(t,n,r,o,i)})}else if(g==="all"){u.queuedRequests.push(function(){de(t,n,r,o,i)})}else if(g==="last"){u.queuedRequests=[];u.queuedRequests.push(function(){de(t,n,r,o,i)})}oe(s);return e}}const p=new XMLHttpRequest;u.xhr=p;u.abortable=F;const m=function(){u.xhr=null;u.abortable=false;if(u.queuedRequests!=null&&u.queuedRequests.length>0){const e=u.queuedRequests.shift();e()}};const B=re(r,"hx-prompt");if(B){var x=prompt(B);if(x===null||!he(r,"htmx:prompt",{prompt:x,target:c})){oe(s);m();return e}}if(f&&!D){if(!confirm(f)){oe(s);m();return e}}let y=fn(r,c,x);if(t!=="get"&&!pn(r)){y["Content-Type"]="application/x-www-form-urlencoded"}if(i.headers){y=ce(y,i.headers)}const U=cn(r,t);let b=U.errors;const j=U.formData;if(i.values){ln(j,qn(i.values))}const V=qn(En(r));const v=ln(j,V);let w=hn(v,r);if(Q.config.getCacheBusterParam&&t==="get"){w.set("org.htmx.cache-buster",ee(c,"id")||"true")}if(n==null||n===""){n=ne().location.href}const S=bn(r,"hx-request");const _=ie(r).boosted;let E=Q.config.methodsThatUseUrlParams.indexOf(t)>=0;const C={boosted:_,useUrlParams:E,formData:w,parameters:An(w),unfilteredFormData:v,unfilteredParameters:An(v),headers:y,target:c,verb:t,errors:b,withCredentials:i.credentials||S.credentials||Q.config.withCredentials,timeout:i.timeout||S.timeout||Q.config.timeout,path:n,triggeringEvent:o};if(!he(r,"htmx:configRequest",C)){oe(s);m();return e}n=C.path;t=C.verb;y=C.headers;w=qn(C.parameters);b=C.errors;E=C.useUrlParams;if(b&&b.length>0){he(r,"htmx:validation:halted",C);oe(s);m();return e}const z=n.split("#");const $=z[0];const O=z[1];let R=n;if(E){R=$;const Z=!w.keys().next().done;if(Z){if(R.indexOf("?")<0){R+="?"}else{R+="&"}R+=an(w);if(O){R+="#"+O}}}if(!Tn(r,R,C)){fe(r,"htmx:invalidPath",C);oe(l);return e}p.open(t.toUpperCase(),R,true);p.overrideMimeType("text/html");p.withCredentials=C.withCredentials;p.timeout=C.timeout;if(S.noHeaders){}else{for(const k in y){if(y.hasOwnProperty(k)){const Y=y[k];Cn(p,k,Y)}}}const H={xhr:p,target:c,requestConfig:C,etc:i,boosted:_,select:X,pathInfo:{requestPath:n,finalRequestPath:R,responsePath:null,anchor:O}};p.onload=function(){try{const t=Hn(r);H.pathInfo.responsePath=On(p);M(r,H);if(H.keepIndicators!==true){Qt(T,q)}he(r,"htmx:afterRequest",H);he(r,"htmx:afterOnLoad",H);if(!le(r)){let e=null;while(t.length>0&&e==null){const n=t.shift();if(le(n)){e=n}}if(e){he(e,"htmx:afterRequest",H);he(e,"htmx:afterOnLoad",H)}}oe(s);m()}catch(e){fe(r,"htmx:onLoadError",ce({error:e},H));throw e}};p.onerror=function(){Qt(T,q);fe(r,"htmx:afterRequest",H);fe(r,"htmx:sendError",H);oe(l);m()};p.onabort=function(){Qt(T,q);fe(r,"htmx:afterRequest",H);fe(r,"htmx:sendAbort",H);oe(l);m()};p.ontimeout=function(){Qt(T,q);fe(r,"htmx:afterRequest",H);fe(r,"htmx:timeout",H);oe(l);m()};if(!he(r,"htmx:beforeRequest",H)){oe(s);m();return e}var T=Zt(r);var q=Yt(r);se(["loadstart","loadend","progress","abort"],function(t){se([p,p.upload],function(e){e.addEventListener(t,function(e){he(r,"htmx:xhr:"+t,{lengthComputable:e.lengthComputable,loaded:e.loaded,total:e.total})})})});he(r,"htmx:beforeSend",H);const J=E?null:mn(p,r,w);p.send(J);return e}function Nn(e,t){const n=t.xhr;let r=null;let o=null;if(R(n,/HX-Push:/i)){r=n.getResponseHeader("HX-Push");o="push"}else if(R(n,/HX-Push-Url:/i)){r=n.getResponseHeader("HX-Push-Url");o="push"}else if(R(n,/HX-Replace-Url:/i)){r=n.getResponseHeader("HX-Replace-Url");o="replace"}if(r){if(r==="false"){return{}}else{return{type:o,path:r}}}const i=t.pathInfo.finalRequestPath;const s=t.pathInfo.responsePath;const l=re(e,"hx-push-url");const c=re(e,"hx-replace-url");const u=ie(e).boosted;let a=null;let f=null;if(l){a="push";f=l}else if(c){a="replace";f=c}else if(u){a="push";f=s||i}if(f){if(f==="false"){return{}}if(f==="true"){f=s||i}if(t.pathInfo.anchor&&f.indexOf("#")===-1){f=f+"#"+t.pathInfo.anchor}return{type:a,path:f}}else{return{}}}function In(e,t){var n=new RegExp(e.code);return n.test(t.toString(10))}function Pn(e){for(var t=0;t0){E().setTimeout(e,x.swapDelay)}else{e()}}if(f){fe(o,"htmx:responseError",ce({error:"Response Status Error Code "+s.status+" from "+i.pathInfo.requestPath},i))}}const Mn={};function Xn(){return{init:function(e){return null},getSelectors:function(){return null},onEvent:function(e,t){return true},transformResponse:function(e,t,n){return e},isInlineSwap:function(e){return false},handleSwap:function(e,t,n,r){return false},encodeParameters:function(e,t,n){return null}}}function Fn(e,t){if(t.init){t.init(n)}Mn[e]=ce(Xn(),t)}function Bn(e){delete Mn[e]}function Un(e,n,r){if(n==undefined){n=[]}if(e==undefined){return n}if(r==undefined){r=[]}const t=te(e,"hx-ext");if(t){se(t.split(","),function(e){e=e.replace(/ /g,"");if(e.slice(0,7)=="ignore:"){r.push(e.slice(7));return}if(r.indexOf(e)<0){const t=Mn[e];if(t&&n.indexOf(t)<0){n.push(t)}}})}return Un(ue(c(e)),n,r)}var jn=false;ne().addEventListener("DOMContentLoaded",function(){jn=true});function Vn(e){if(jn||ne().readyState==="complete"){e()}else{ne().addEventListener("DOMContentLoaded",e)}}function _n(){if(Q.config.includeIndicatorStyles!==false){const e=Q.config.inlineStyleNonce?` nonce="${Q.config.inlineStyleNonce}"`:"";ne().head.insertAdjacentHTML("beforeend"," ."+Q.config.indicatorClass+"{opacity:0} ."+Q.config.requestClass+" ."+Q.config.indicatorClass+"{opacity:1; transition: opacity 200ms ease-in;} ."+Q.config.requestClass+"."+Q.config.indicatorClass+"{opacity:1; transition: opacity 200ms ease-in;} ")}}function zn(){const e=ne().querySelector('meta[name="htmx-config"]');if(e){return S(e.content)}else{return null}}function $n(){const e=zn();if(e){Q.config=ce(Q.config,e)}}Vn(function(){$n();_n();let e=ne().body;kt(e);const t=ne().querySelectorAll("[hx-trigger='restored'],[data-hx-trigger='restored']");e.addEventListener("htmx:abort",function(e){const t=e.target;const n=ie(t);if(n&&n.xhr){n.xhr.abort()}});const n=window.onpopstate?window.onpopstate.bind(window):null;window.onpopstate=function(e){if(e.state&&e.state.htmx){Wt();se(t,function(e){he(e,"htmx:restored",{document:ne(),triggerEvent:he})})}else{if(n){n(e)}}};E().setTimeout(function(){he(e,"htmx:load",{});e=null},0)});return Q}(); \ No newline at end of file diff --git a/src/netmover/web/templates/base.html b/src/netmover/web/templates/base.html new file mode 100644 index 0000000..2c2d950 --- /dev/null +++ b/src/netmover/web/templates/base.html @@ -0,0 +1,36 @@ + + + + + + + + {% block title %}NetMover{% endblock %} · NetMover + + + + + +{% if logged_in %} +
+ NetMover + + + + + +
+{% endif %} +
+ {% for kind, text in flashes %}

{{ text }}

{% endfor %} + {% block content %}{% endblock %} +
+
NetMover {{ version }}
+ + diff --git a/src/netmover/web/templates/log.html b/src/netmover/web/templates/log.html new file mode 100644 index 0000000..3b0fba3 --- /dev/null +++ b/src/netmover/web/templates/log.html @@ -0,0 +1,51 @@ +{% extends "base.html" %} +{% from "macros.html" import run_badge %} +{% block title %}Protokoll{% endblock %} +{% block content %} +

Protokoll

+
+ + + + + {{ total }} Läufe +
+
+ + + {% for run, rule_name in rows %} + + + + + + + + + + + {% if run.message or run.moved or run.skipped or run.failed %} + + {% endif %} + {% else %} + + {% endfor %} +
ZeitpunktRegelStatusDauergesehenübertragenübersprungenFehler
{{ run.started_at|localdt }}{% if run.dry_run %} Probe{% endif %}{% if run.trigger.value == 'manual' %} manuell{% endif %}{{ rule_name }}{{ run_badge(run.status) }}{{ duration(run.started_at, run.finished_at) }}{{ run.seen }}{{ run.moved }}{{ run.skipped }}{{ run.failed }}
+ {% if run.message %}
{{ run.message }}
{% endif %} + {% if run.moved or run.skipped or run.failed %} +
+ Einzeldateien
lädt …
+ {% endif %} +
Keine Läufe.
+{% if pages > 1 %} +
+ {% set base = '?rule=' ~ (rule_id or '') ~ '&status=' ~ status ~ ('&all=1' if not active_only else '') %} + {% if page > 1 %}← neuer{% endif %} + Seite {{ page }} / {{ pages }} + {% if page < pages %}älter →{% endif %} +
+{% endif %} +{% endblock %} diff --git a/src/netmover/web/templates/login.html b/src/netmover/web/templates/login.html new file mode 100644 index 0000000..17419f6 --- /dev/null +++ b/src/netmover/web/templates/login.html @@ -0,0 +1,16 @@ +{% extends "base.html" %} +{% block title %}Anmelden{% endblock %} +{% block content %} + +{% endblock %} diff --git a/src/netmover/web/templates/macros.html b/src/netmover/web/templates/macros.html new file mode 100644 index 0000000..edc0766 --- /dev/null +++ b/src/netmover/web/templates/macros.html @@ -0,0 +1,43 @@ +{% macro field(name, label, value='', type='text', errors={}, hint='', wide=false, placeholder='', attrs='') -%} +
+ + + {% if errors.get(name) %}{{ errors[name] }}{% endif %} + {% if hint %}{{ hint }}{% endif %} +
+{%- endmacro %} + +{% macro select(name, label, options, current, errors={}, hint='') -%} +
+ + + {% if errors.get(name) %}{{ errors[name] }}{% endif %} + {% if hint %}{{ hint }}{% endif %} +
+{%- endmacro %} + +{% macro check(name, label, checked, hint='') -%} +
+ + + {% if hint %}{{ hint }}{% endif %} +
+{%- endmacro %} + +{% macro csrf_field(csrf) %}{% endmacro %} + +{% macro state_badge(m) -%} +{% set labels = SFTP_STATE_LABELS if m.type == MountType.SFTP else STATE_LABELS %} +{% set cls = {'mounted': 'ok', 'degraded': 'warn', 'error': 'err'}.get(m.state.value, '') %} +{{ labels[m.state] }} +{%- endmacro %} + +{% macro run_badge(status) -%} +{% set cls = {'ok': 'ok', 'partial': 'warn', 'error': 'err'}.get(status.value, '') %} +{{ RUN_LABELS[status] }} +{%- endmacro %} diff --git a/src/netmover/web/templates/mount_form.html b/src/netmover/web/templates/mount_form.html new file mode 100644 index 0000000..ca6115d --- /dev/null +++ b/src/netmover/web/templates/mount_form.html @@ -0,0 +1,61 @@ +{% extends "base.html" %} +{% from "macros.html" import field, select, check %} +{% block title %}{{ 'Anbindung bearbeiten' if mount else 'Neue Anbindung' }}{% endblock %} +{% block content %} +

{{ 'Anbindung „' ~ mount.name ~ '“ bearbeiten' if mount else 'Neue Anbindung' }}

+{% if errors.get('_') %}

{{ errors['_'] }}

{% endif %} +
+ + {% if mount %}{% endif %} +
Verbindung
+ {{ field('name', 'Name', d.name, errors=errors, attrs='required maxlength="100"', hint=('Verzeichnis: ' ~ mount.mountpoint if mount and mount.mountpoint else 'Bestimmt das Verzeichnis unter /mnt/netmover')) }} + {{ select('type', 'Typ', [('cifs', 'SMB/CIFS'), ('nfs4', 'NFS 4'), ('nfs3', 'NFS 3'), ('sftp', 'SFTP (nur Ziel)')], d.type.value, errors=errors) }} + {{ field('server', 'Server', d.server, errors=errors, placeholder='192.168.1.10 oder nas.lan', attrs='required') }} +
+ + + {% if errors.get('share') %}{{ errors['share'] }}{% endif %} + Freigabename, z. B. scans + Exportpfad, z. B. /volume1/scans + Absoluter Basisordner, z. B. /opt/paperless/consume +
+
{{ field('port', 'SSH-Port', d.port or '', type='number', errors=errors, placeholder='22') }}
+
+ +
Anmeldung
+
{{ select('auth', 'Anmeldeart', [('ssh_key', 'SSH-Schlüssel (NetMover erzeugt ihn)'), ('password', 'Passwort')], d.auth.value, errors=errors) }}
+ {{ field('username', 'Benutzername', d.username, errors=errors, attrs='autocomplete="off"', hint='Bei CIFS leer lassen für Gastzugang') }} +
{{ field('domain', 'Domäne (optional)', d.domain, errors=errors) }}
+
+ + + {% if errors.get('password') %}{{ errors['password'] }}{% endif %} + {{ 'Leer lassen = unverändert. ' if has_secret }}Bei SFTP mit Schlüssel leer lassen. +
+
+ {% if public_key %}
+ 
{{ public_key }}
{% endif %} +
+ +
Eigentümer und Rechte (CIFS)
+ {{ field('uid', 'uid', d.uid, type='number', errors=errors, hint='Eigentümer aller Dateien im Mount') }} + {{ field('gid', 'gid', d.gid, type='number', errors=errors) }} + {{ field('file_mode', 'file_mode', d.file_mode, errors=errors, placeholder='0644') }} + {{ field('dir_mode', 'dir_mode', d.dir_mode, errors=errors, placeholder='0755') }} +
+ +
Erweitert
+ {{ field('extra_options', 'Zusatzoptionen', d.extra_options, errors=errors, wide=true, placeholder='vers=3.0,noserverino', hint='Kommagetrennt; nur erlaubte Optionen. Zugangsdaten setzt NetMover selbst.') }} + {{ check('auto_mount', 'Beim Start automatisch einhängen', d.auto_mount) }} +
+ {{ check('enabled', 'Aktiv', d.enabled) }} + +
+ + + Abbrechen +
+
+
+{% endblock %} diff --git a/src/netmover/web/templates/mounts.html b/src/netmover/web/templates/mounts.html new file mode 100644 index 0000000..4381ac3 --- /dev/null +++ b/src/netmover/web/templates/mounts.html @@ -0,0 +1,48 @@ +{% extends "base.html" %} +{% from "macros.html" import state_badge, csrf_field %} +{% block title %}Anbindungen{% endblock %} +{% block content %} +

Anbindungen

+ Neue Anbindung
+{% if not mounts %}

Noch keine Anbindungen.

{% endif %} +
+{% for m in mounts %} +
+
+
{{ m.name }} {{ state_badge(m) }} + {% if not m.enabled %}deaktiviert{% endif %} + {% if m.auto_mount %}auto{% endif %}
+
+ + {% if m.type != MountType.SFTP %} + {% if m.state == MountState.MOUNTED or m.state == MountState.DEGRADED %} +
{{ csrf_field(csrf) }}
+ {% else %} +
{{ csrf_field(csrf) }}
+ {% endif %} + {% endif %} + Bearbeiten +
{{ csrf_field(csrf) }}
+
+
+
{{ m.type.value }} · {% if m.type == MountType.CIFS %}//{{ m.server }}/{{ m.share }}{% elif m.type == MountType.SFTP %}{{ m.server }}:{{ m.port or 22 }}{{ m.share }}{% else %}{{ m.server }}:{{ m.share }}{% endif %} + {% if m.mountpoint %} → {{ m.mountpoint }}{% endif %}
+ {% if m.last_error %}
{{ m.last_error }}
{% endif %} + {% if m.type == MountType.SFTP %} +
Hostschlüssel: {% if m.host_key %}{{ m.host_key.split()[0] }} festgehalten +
{{ csrf_field(csrf) }}
+ {% else %}noch nicht bestätigt – bitte „Testen“{% endif %}
+ {% if pubkeys.get(m.id) %} +
Öffentlicher Schlüssel für authorized_keys + 
{{ pubkeys[m.id] }}
+
+ {% endif %} + {% endif %} +
+ {% if reports.get(m.id) %}
Letzter Test {{ m.last_test_at|ago }} + {% with report = reports[m.id], errors = {} %}{% include "partials/check_result.html" %}{% endwith %}
{% endif %} +
+
+{% endfor %} +
+{% endblock %} diff --git a/src/netmover/web/templates/partials/check_result.html b/src/netmover/web/templates/partials/check_result.html new file mode 100644 index 0000000..2fb4d9a --- /dev/null +++ b/src/netmover/web/templates/partials/check_result.html @@ -0,0 +1,20 @@ +{% set step_names = {'mount': 'Einhängen', 'read': 'Lesen', 'write': 'Schreiben', 'connect': 'Verbinden'} %} +
+{% if errors %} +

Eingaben unvollständig:

+
    {% for k, v in errors.items() %}
  • {{ k }}: {{ v }}
    • {% endfor %}
+{% elif report %} +
    + {% for st in report.steps %} +
  • {{ '✓' if st.ok else '–' if st.ok is none else '✗' }} + {{ step_names.get(st.name, st.name) }}{% if st.message %}: {{ st.message }}{% endif %}
    • + {% endfor %} +
+
Geeignet als: + {% for role in report.roles %}{{ role.value }} {% else %}nichts{% endfor %}
+ {% if report.owner %}
Testdatei gehörte {{ report.owner }}{% if report.root_squash %} (Root-Squash){% endif %}
{% endif %} + {% if report.free_bytes is not none %}
{{ report.free_bytes|bytes }} frei von {{ report.total_bytes|bytes }}
{% endif %} + {% if report.host_key_fingerprint %}
Hostschlüssel: {{ report.host_key_fingerprint }}
{% endif %} + {% for h in report.hints %}

{{ h }}

{% endfor %} +{% endif %} +
diff --git a/src/netmover/web/templates/partials/dryrun.html b/src/netmover/web/templates/partials/dryrun.html new file mode 100644 index 0000000..38f5233 --- /dev/null +++ b/src/netmover/web/templates/partials/dryrun.html @@ -0,0 +1,18 @@ +{% from "macros.html" import run_badge %} +
+{% if not run %}

Probelauf nicht möglich (Regel gelöscht?).

+{% else %} +
Probelauf {{ run_badge(run.status) }} + {{ run.seen }} gefunden · {{ run.moved }} würden übertragen · {{ run.skipped }} übersprungen
+ {% if run.message %}

{{ run.message }}

{% endif %} + {% if items %} +
+ + {% for i in items %} + + + {% endfor %}
DateiZielErgebnis
{{ i.src }}{{ i.dst or '–' }}{{ i.message or i.status.value }}
+ {% elif run.status != RunStatus.ERROR %}

Keine passenden Dateien.

{% endif %} +

Es wurde nichts verändert.

+{% endif %} +
diff --git a/src/netmover/web/templates/partials/run_items.html b/src/netmover/web/templates/partials/run_items.html new file mode 100644 index 0000000..bc69478 --- /dev/null +++ b/src/netmover/web/templates/partials/run_items.html @@ -0,0 +1,11 @@ +{% set cls = {'moved': 'ok', 'copied': 'ok', 'planned': 'ok', 'failed': 'err', 'quarantined': 'warn'} %} +{% set labels = {'moved': 'verschoben', 'copied': 'kopiert', 'skipped': 'übersprungen', 'failed': 'Fehler', 'quarantined': 'Quarantäne', 'planned': 'geplant'} %} + + + {% for i in items %} + + + + {% else %}{% endfor %} +
DateiZielGrößeErgebnis
{{ i.src }}{{ i.dst or '–' }}{{ i.size|bytes }}{{ labels[i.status.value] }} + {% if i.message %}{{ i.message }}{% endif %}
Keine Einzeldateien protokolliert.
diff --git a/src/netmover/web/templates/partials/status_body.html b/src/netmover/web/templates/partials/status_body.html new file mode 100644 index 0000000..8b0310c --- /dev/null +++ b/src/netmover/web/templates/partials/status_body.html @@ -0,0 +1,54 @@ +{% from "macros.html" import state_badge, run_badge %} +{% if not health.ok %} +
Achtung: +
    {% for p in health.problems %}
  • {{ p }}
    • {% endfor %}
+{% else %} +

Alles in Ordnung.

+{% endif %} + +

Anbindungen

+{% if not mounts %}

Noch keine Anbindungen – jetzt anlegen.

{% endif %} +
+{% for v in mounts %}{% set m = v.m %} +
+
{{ m.name }}{{ state_badge(m) }}
+
{{ m.type.value }} · {{ m.server }}{{ ':' if m.type != MountType.CIFS else '/' }}{{ m.share }}
+ {% if m.state == MountState.MOUNTED and m.last_mounted_at and m.type != MountType.SFTP %} +
eingehängt seit {{ m.last_mounted_at|localdt }}
+ {% elif m.state in (MountState.DEGRADED, MountState.ERROR) %} +
{{ 'gestört' if m.state == MountState.DEGRADED else 'Fehler' }} seit {{ m.state_since|localdt }} ({{ m.state_since|ago }})
+ {% endif %} + {% if v.usage %}{% set used = (v.usage[0] - v.usage[1]) %}{% set pct = (100 * used / v.usage[0]) if v.usage[0] else 0 %} + {{ pct|round(0)|int }} % +
{{ v.usage[1]|bytes }} frei von {{ v.usage[0]|bytes }} ({{ pct|round(0)|int }} % belegt)
+ {% endif %} + {% if m.last_error %}
{{ m.last_error }}
{% endif %} +
+{% endfor %} +
+ +

Regeln

+{% if not rules %}

Noch keine Regeln – jetzt anlegen.

{% else %} +
+ + + {% for v in rules %}{% set r = v.r %} + + + + + + + + {% endfor %} +
RegelLetztes ErgebnisLetzter ErfolgNächster Lauf
{{ r.name }}{% if not r.enabled %} aus{% endif %}{% if r.dry_run %} Probelauf{% endif %} +
{{ v.target }}
 + {% if v.running_since %}läuft seit {{ v.running_since|ago|replace('vor ', '') }} + {% elif v.last_run %}{{ run_badge(v.last_run.status) }} + {{ v.last_run.finished_at|ago }}{% if v.last_run.seen %} · {{ v.last_run.moved }}/{{ v.last_run.seen }}{% endif %} + {% if v.last_run.status in (RunStatus.ERROR, RunStatus.PARTIAL) and v.last_run.message %}
{{ v.last_run.message }}
{% endif %} + {% else %}–{% endif %}		{{ r.last_success_at|ago }}{% if v.stale %}
länger als 3 × Intervall!
{% endif %} + {% if r.consecutive_failures %}
{{ r.consecutive_failures }} Fehler in Folge
{% endif %}		{{ v.next_run|ago if v.next_run else '–' }}
+ +
+{% endif %} diff --git a/src/netmover/web/templates/rule_form.html b/src/netmover/web/templates/rule_form.html new file mode 100644 index 0000000..eece0cd --- /dev/null +++ b/src/netmover/web/templates/rule_form.html @@ -0,0 +1,49 @@ +{% extends "base.html" %} +{% from "macros.html" import field, select, check %} +{% block title %}{{ 'Regel bearbeiten' if rule_id else 'Neue Regel' }}{% endblock %} +{% block content %} +

{{ 'Regel bearbeiten' if rule_id else 'Neue Regel' }}

+{% if errors.get('_') %}

{{ errors['_'] }}

{% endif %} +{% if not src_mounts %}

Zuerst eine SMB- oder NFS-Anbindung als Quelle anlegen.

{% endif %} +
+ +
Allgemein
+ {{ field('name', 'Name', d.name, errors=errors, attrs='required maxlength="100"') }} + {{ field('interval_seconds', 'Intervall (Sekunden)', d.interval_seconds, type='number', errors=errors, attrs='min="10" required', hint='mindestens 10') }} + {{ check('enabled', 'Aktiv', d.enabled) }} + {{ check('dry_run', 'Nur Probelauf (nichts verändern)', d.dry_run) }} +
+ +
Quelle
+ {{ select('src_mount_id', 'Anbindung', src_options, d.src_mount_id or '', errors=errors) }} + {{ field('src_subpath', 'Unterordner', d.src_subpath, errors=errors, placeholder='z. B. Scans/Max', hint='relativ zur Freigabe; leer = Wurzel') }} + {{ select('pattern_type', 'Filterart', [('glob', 'Glob'), ('regex', 'Regulärer Ausdruck')], d.pattern_type.value, errors=errors) }} + {{ field('pattern', 'Filter', d.pattern, errors=errors, hint='Glob: *.pdf;*.jpg (Dateiname, ohne Groß/klein). Regex: gegen relativen Pfad.') }} + {{ check('recursive', 'Unterordner einbeziehen (Struktur bleibt erhalten)', d.recursive) }} +
+ +
Ziel
+ {{ select('dst_kind', 'Zielart', [('mount', 'Anbindung'), ('local', 'Lokaler Pfad')], d.dst_kind, errors=errors) }} +
{{ select('dst_mount_id', 'Anbindung', dst_options, d.dst_mount_id or '', errors=errors) }}
+ {{ field('dst_path', 'Zielordner', d.dst_path, errors=errors, hint='Anbindung: relativer Unterordner (wird angelegt). Lokal: absoluter Pfad, muss existieren.') }} + {{ select('action', 'Aktion', [('move', 'verschieben'), ('copy', 'kopieren (Quelle bleibt)')], d.action.value, errors=errors) }} + {{ select('on_collision', 'Wenn Datei existiert', [('rename', 'umbenennen (scan-1.pdf)'), ('skip', 'überspringen'), ('overwrite', 'überschreiben')], d.on_collision.value, errors=errors) }} +
+ +
Sicherheit und Grenzen
+ {{ field('stability_seconds', 'Stabilitätsfenster (s)', d.stability_seconds, type='number', errors=errors, attrs='min="0"', hint='Größe und Zeit müssen so lange gleich bleiben') }} + {{ field('min_age_seconds', 'Mindestalter (s)', d.min_age_seconds, type='number', errors=errors, attrs='min="0"') }} + {{ field('max_size_mb', 'Max. Größe (MB)', d.max_size_mb or '', type='number', errors=errors, hint='leer = unbegrenzt') }} + {{ field('op_timeout_seconds', 'Zeitlimit ohne Fortschritt (s)', d.op_timeout_seconds, type='number', errors=errors, attrs='min="10"') }} +
+ +
Rechte und Quarantäne
+ {{ field('set_owner', 'Eigentümer setzen', d.set_owner, errors=errors, placeholder='1000:1000', hint='leer = unverändert; auf CIFS wirkungslos') }} + {{ field('set_mode', 'Modus setzen', d.set_mode, errors=errors, placeholder='0644', hint='leer = wie Quelle') }} + {{ field('quarantine_path', 'Quarantäneordner', d.quarantine_path, errors=errors, placeholder='_quarantaene', hint='relativ zur Quell-Anbindung; leer = keine Quarantäne') }} + {{ field('quarantine_after', 'nach Fehlversuchen', d.quarantine_after, type='number', errors=errors, attrs='min="1"') }} +
+ +
Abbrechen
+
+{% endblock %} diff --git a/src/netmover/web/templates/rules.html b/src/netmover/web/templates/rules.html new file mode 100644 index 0000000..6c91ebc --- /dev/null +++ b/src/netmover/web/templates/rules.html @@ -0,0 +1,32 @@ +{% extends "base.html" %} +{% from "macros.html" import run_badge, csrf_field %} +{% block title %}Regeln{% endblock %} +{% block content %} +

Regeln

+ Neue Regel
+{% if not rules %}

Noch keine Regeln.

{% endif %} +
+{% for v in rules %}{% set r = v.r %} +
+
+
{{ r.name }} + {% if r.enabled %}aktiv{% else %}aus{% endif %} + {% if r.dry_run %}nur Probelauf{% endif %} + {{ 'kopieren' if r.action == RuleAction.COPY else 'verschieben' }} + alle {{ r.interval_seconds }} s
+
+
{{ csrf_field(csrf) }}
+ +
{{ csrf_field(csrf) }}
+ Bearbeiten +
{{ csrf_field(csrf) }}
+
+
+
{{ v.target }} · Filter {{ r.pattern }}{{ ' (rekursiv)' if r.recursive }}
+
Letzter Lauf: {% if v.running_since %}läuft seit {{ v.running_since|ago|replace('vor ', '') }}{% elif v.last_run %}{{ run_badge(v.last_run.status) }} {{ v.last_run.finished_at|ago }}{% else %}–{% endif %} + · letzter Erfolg: {{ r.last_success_at|ago }} + · nächster: {{ v.next_run|ago if v.next_run else '–' }}
+
+
+{% endfor %} +
+{% endblock %} diff --git a/src/netmover/web/templates/settings.html b/src/netmover/web/templates/settings.html new file mode 100644 index 0000000..cab8785 --- /dev/null +++ b/src/netmover/web/templates/settings.html @@ -0,0 +1,46 @@ +{% extends "base.html" %} +{% from "macros.html" import field, select, check, csrf_field %} +{% block title %}Einstellungen{% endblock %} +{% block content %} +

Einstellungen

+
+ {{ csrf_field(csrf) }} +
Protokoll
+ {{ field('retention_days', 'Aufbewahrung (Tage)', cfg.retention_days, type='number', errors=errors, attrs='min="1" max="3650"') }} +
+
Benachrichtigung (Webhook)
+ {{ select('notify_mode', 'Benachrichtigen', [('off', 'nie'), ('every', 'bei jedem fehlgeschlagenen Lauf'), ('after_n', 'nach N Fehlschlägen in Folge')], cfg.notify_mode.value, errors=errors) }} +
{{ field('notify_after', 'N', cfg.notify_after, type='number', errors=errors, attrs='min="1"') }}
+ {{ field('webhook_url', 'Webhook-URL', mask_url(cfg.webhook_url), errors=errors, wide=true, placeholder='https://ntfy.sh/mein-topic', hint='Wird nur gekürzt angezeigt; unverändert lassen = behalten, leeren = entfernen.') }} + {{ field('webhook_content_type', 'Content-Type', cfg.webhook_content_type, errors=errors) }} + {{ check('notify_recovery', 'Entwarnung senden, wenn es wieder läuft', cfg.notify_recovery) }} +
+ + Platzhalter: $event $title $message $rule $time $host – bei JSON automatisch maskiert.
+
+
+
+ +
+ +

Passwort ändern

+
+ {{ csrf_field(csrf) }} +
+
+
+
+
+ +
+ +

Export / Import

+
+

Export enthält Anbindungen, Regeln und Einstellungen – ohne Zugangsdaten und Webhook-URL. + Beim Import werden vorhandene Namen übersprungen; importierte Regeln sind zunächst deaktiviert.

+
Konfiguration exportieren
+
+ {{ csrf_field(csrf) }} +
+
+{% endblock %} diff --git a/src/netmover/web/templates/setup.html b/src/netmover/web/templates/setup.html new file mode 100644 index 0000000..4055c72 --- /dev/null +++ b/src/netmover/web/templates/setup.html @@ -0,0 +1,21 @@ +{% extends "base.html" %} +{% block title %}Einrichtung{% endblock %} +{% block content %} + +{% endblock %} diff --git a/src/netmover/web/templates/status.html b/src/netmover/web/templates/status.html new file mode 100644 index 0000000..f2fee4d --- /dev/null +++ b/src/netmover/web/templates/status.html @@ -0,0 +1,9 @@ +{% extends "base.html" %} +{% block title %}Status{% endblock %} +{% block content %} +

Status

+ aktualisiert sich alle 15 s
+
+ {% include "partials/status_body.html" %} +
+{% endblock %} diff --git a/tests/test_web.py b/tests/test_web.py new file mode 100644 index 0000000..8e12919 --- /dev/null +++ b/tests/test_web.py @@ -0,0 +1,557 @@ +"""Weboberfläche: Einrichtung, Anmeldung, CSRF, Seiten und Aktionen (FakeMountBackend).""" + +from __future__ import annotations + +import json +import re +from collections.abc import Iterator +from pathlib import Path + +import pytest +from fastapi.testclient import TestClient +from sqlalchemy import select + +from netmover.app_state import NetMover +from netmover.config import Settings +from netmover.db import session_scope +from netmover.models import Credential, Mount, MountState, Rule, Run, RunStatus +from netmover.mounting.fake import FakeMountBackend +from netmover.web.app import create_app + +PASSWORD = "sehr-geheim-123" + + +@pytest.fixture +def settings(tmp_path: Path) -> Settings: + return Settings( + data_dir=tmp_path / "lib", + run_dir=tmp_path / "run", + mount_base=tmp_path / "mnt", + mount_backend="fake", + ) + + +@pytest.fixture +def backend(tmp_path: Path) -> Iterator[FakeMountBackend]: + b = FakeMountBackend(tmp_path / "fake") + yield b + b.release_hangs() + + +@pytest.fixture +def state(settings: Settings, backend: FakeMountBackend) -> NetMover: + return NetMover(settings, backend=backend) + + +@pytest.fixture +def raw_client(settings: Settings, state: NetMover) -> Iterator[TestClient]: + with TestClient(create_app(settings, state), follow_redirects=False) as c: + yield c + + +def csrf_of(html: str) -> str: + m = re.search(r'name="csrf-token" content="([^"]+)"', html) + assert m, "kein CSRF-Token in der Seite" + return m.group(1) + + +def do_setup(c: TestClient) -> str: + page = c.get("/setup") + token = csrf_of(page.text) + code = c.app.state.setup_code.code # type: ignore[attr-defined] + r = c.post( + "/setup", + data={"csrf_token": token, "code": code, "password": PASSWORD, "confirm": PASSWORD}, + ) + assert r.status_code == 303, r.text + return csrf_of(c.get("/").text) + + +@pytest.fixture +def client(raw_client: TestClient) -> TestClient: + raw_client.headers["X-Test-CSRF"] = do_setup(raw_client) + return raw_client + + +def post(c: TestClient, url: str, data: dict[str, str] | None = None, **kw: object): # type: ignore[no-untyped-def] + payload = {"csrf_token": c.headers["X-Test-CSRF"], **(data or {})} + return c.post(url, data=payload, **kw) # type: ignore[arg-type] + + +# -- Einrichtung und Anmeldung -------------------------------------------------------------- + + +def test_first_start_forces_setup(raw_client: TestClient) -> None: + for url in ("/", "/mounts", "/rules", "/log", "/settings", "/login"): + r = raw_client.get(url) + assert r.status_code == 303 and r.headers["location"] == "/setup", url + + +def test_setup_requires_code_and_strong_password(raw_client: TestClient) -> None: + token = csrf_of(raw_client.get("/setup").text) + code = raw_client.app.state.setup_code.code # type: ignore[attr-defined] + bad = [ + {"code": "falsch", "password": PASSWORD, "confirm": PASSWORD}, + {"code": code, "password": "kurz", "confirm": "kurz"}, + {"code": code, "password": PASSWORD, "confirm": PASSWORD + "x"}, + ] + for data in bad: + r = raw_client.post("/setup", data={"csrf_token": token, **data}) + assert r.status_code == 400 + assert raw_client.get("/").status_code == 303 + + +def test_setup_only_once(client: TestClient) -> None: + assert client.get("/setup").headers["location"] == "/login" + + +def test_login_logout_and_cookie_flags(raw_client: TestClient) -> None: + do_setup(raw_client) + token = csrf_of(raw_client.get("/").text) + raw_client.post("/logout", data={"csrf_token": token}) + assert raw_client.get("/").status_code == 303 + page = raw_client.get("/login") + r = raw_client.post("/login", data={"csrf_token": csrf_of(page.text), "password": "falsch"}) + assert r.status_code == 401 + r = raw_client.post("/login", data={"csrf_token": csrf_of(page.text), "password": PASSWORD}) + assert r.status_code == 303 + cookie = r.headers["set-cookie"].lower() + assert "httponly" in cookie and "samesite=lax" in cookie + assert raw_client.get("/").status_code == 200 + + +def test_login_lockout(raw_client: TestClient) -> None: + do_setup(raw_client) + raw_client.cookies.clear() + token = csrf_of(raw_client.get("/login").text) + codes = [ + raw_client.post("/login", data={"csrf_token": token, "password": "x"}).status_code + for _ in range(6) + ] + assert codes[:5] == [401] * 5 and codes[5] == 429 + + +def test_csrf_required_for_post(client: TestClient) -> None: + assert client.post("/rules/1/toggle").status_code == 403 + assert client.post("/rules/1/toggle", data={"csrf_token": "falsch"}).status_code == 403 + assert post(client, "/rules/1/toggle").status_code == 303 + r = client.post("/rules/1/toggle", headers={"X-CSRF-Token": client.headers["X-Test-CSRF"]}) + assert r.status_code == 303 + + +def test_htmx_request_without_login_gets_hx_redirect(raw_client: TestClient) -> None: + do_setup(raw_client) + raw_client.cookies.clear() + r = raw_client.get("/partials/status", headers={"HX-Request": "true"}) + assert r.status_code == 204 and r.headers["HX-Redirect"].startswith("/login") + + +def test_security_headers(client: TestClient) -> None: + r = client.get("/") + assert "script-src 'self'" in r.headers["content-security-policy"] + assert r.headers["x-frame-options"] == "DENY" + assert r.headers["cache-control"] == "no-store" + + +def test_no_inline_scripts_or_styles(client: TestClient) -> None: + for url in ("/", "/mounts", "/mounts/new", "/rules", "/rules/new", "/log", "/settings"): + html = client.get(url).text + assert "style=" not in html, url + assert not re.search(r"]*\bsrc=)", html), url + + +def test_healthz(client: TestClient, state: NetMover) -> None: + r = client.get("/healthz") + assert r.status_code == 200 and r.json()["status"] == "ok" + with session_scope(state.session_factory) as s: + s.add( + Mount( + name="kaputt", + slug="kaputt", + type="cifs", + server="nas", + share="x", + mountpoint="/mnt/netmover/kaputt", + state=MountState.ERROR, + last_error="weg", + ) + ) + r = client.get("/healthz") + assert r.status_code == 503 and "kaputt" in r.json()["problems"][0] + + +# -- Anbindungen ------------------------------------------------------------------------------ + + +MOUNT_FORM = { + "name": "Synology Scans", + "type": "cifs", + "server": "nas", + "share": "scans", + "username": "scanner", + "password": "Pa$$w0rd,mit=Zeichen", + "uid": "1000", + "gid": "1000", + "file_mode": "0644", + "dir_mode": "0755", + "extra_options": "vers=3.0", + "auto_mount": "on", + "enabled": "on", +} + + +def _mount_id(state: NetMover, name: str) -> int: + with state.session_factory() as s: + mid = s.scalar(select(Mount.id).where(Mount.name == name)) + assert mid is not None + return mid + + +def test_create_mount_test_mount_unmount_delete( + client: TestClient, state: NetMover, backend: FakeMountBackend +) -> None: + backend.export("nas", "scans") + r = post(client, "/mounts/new", MOUNT_FORM) + assert r.status_code == 303, r.text + mid = _mount_id(state, "Synology Scans") + with state.session_factory() as s: + m = s.get(Mount, mid) + assert m is not None and m.slug == "synology-scans" and m.credential is not None + assert "Pa$$" not in m.credential.secret_enc + assert state.secrets.decrypt(m.credential.secret_enc) == MOUNT_FORM["password"] + + # Passwort taucht nirgends auf + for url in ("/mounts", f"/mounts/{mid}/edit"): + assert MOUNT_FORM["password"] not in client.get(url).text + + r = post(client, f"/mounts/{mid}/test") + assert r.status_code == 200 and "Quelle mit Löschen" in r.text and "✓" in r.text + + assert post(client, f"/mounts/{mid}/mount").status_code == 303 + assert backend.is_mounted(state.mounts.mountpoint_for("synology-scans")) + spec = [c for c in backend.calls if c.action == "mount"][-1].spec + assert spec is not None and spec.credentials is not None + assert spec.credentials.password == MOUNT_FORM["password"] + assert "Fehler" not in client.get("/").text + + assert post(client, f"/mounts/{mid}/unmount").status_code == 303 + assert not backend.mounted + assert post(client, f"/mounts/{mid}/delete").status_code == 303 + with state.session_factory() as s: + assert s.scalars(select(Mount)).all() == [] + assert s.scalars(select(Credential)).all() == [] + + +def test_empty_password_keeps_secret(client: TestClient, state: NetMover) -> None: + post(client, "/mounts/new", MOUNT_FORM) + mid = _mount_id(state, "Synology Scans") + r = post(client, f"/mounts/{mid}/edit", {**MOUNT_FORM, "password": "", "username": "neu"}) + assert r.status_code == 303 + with state.session_factory() as s: + m = s.get(Mount, mid) + assert m is not None and m.credential is not None + assert m.credential.username == "neu" + assert state.secrets.decrypt(m.credential.secret_enc) == MOUNT_FORM["password"] + + +def test_mount_form_validation_shows_errors(client: TestClient, state: NetMover) -> None: + bad = {**MOUNT_FORM, "server": "nas;reboot", "extra_options": "password=x"} + r = post(client, "/mounts/new", bad) + assert r.status_code == 400 + assert "Ungültiger Servername" in r.text and "gesperrt" in r.text + with state.session_factory() as s: + assert s.scalars(select(Mount)).all() == [] + + +def test_connection_change_requires_unmount( + client: TestClient, state: NetMover, backend: FakeMountBackend +) -> None: + backend.export("nas", "scans") + post(client, "/mounts/new", MOUNT_FORM) + mid = _mount_id(state, "Synology Scans") + post(client, f"/mounts/{mid}/mount") + r = post(client, f"/mounts/{mid}/edit", {**MOUNT_FORM, "share": "anders", "password": ""}) + assert r.status_code == 400 and "ausgehängt" in r.text + # Nicht-Verbindungsfelder gehen trotzdem + r = post(client, f"/mounts/{mid}/edit", {**MOUNT_FORM, "password": "", "auto_mount": ""}) + assert r.status_code == 303 + + +def test_form_test_with_unsaved_data(client: TestClient, backend: FakeMountBackend) -> None: + backend.export("nas", "scans") + r = post(client, "/mounts/test", MOUNT_FORM) + assert r.status_code == 200 and "Einhängen" in r.text and "✓" in r.text + r = post(client, "/mounts/test", {**MOUNT_FORM, "share": "fehlt"}) + assert ("✗" in r.text and "existiert auf dem Server nicht" not in r.text) or "✗" in r.text + + +def test_sftp_mount_generates_key(client: TestClient, state: NetMover) -> None: + r = post( + client, + "/mounts/new", + { + "name": "paperless", + "type": "sftp", + "server": "10.0.0.5", + "share": "/opt/consume", + "port": "22", + "auth": "ssh_key", + "username": "paperless", + "enabled": "on", + }, + ) + assert r.status_code == 303, r.text + page = client.get("/mounts").text + assert "ssh-ed25519 " in page and "BEGIN OPENSSH PRIVATE KEY" not in page + with state.session_factory() as s: + m = s.scalars(select(Mount)).one() + assert m.mountpoint is None and m.auto_mount is False + + +def test_delete_mount_used_by_rule_is_refused(client: TestClient, state: NetMover) -> None: + post(client, "/mounts/new", MOUNT_FORM) + mid = _mount_id(state, "Synology Scans") + with session_scope(state.session_factory) as s: + s.add(Rule(name="r", src_mount_id=mid, dst_path="/tmp")) + post(client, f"/mounts/{mid}/delete") + assert "Wird noch von Regeln benutzt" in client.get("/mounts").text + assert _mount_id(state, "Synology Scans") == mid + + +# -- Regeln ----------------------------------------------------------------------------------- + + +@pytest.fixture +def mounted( + client: TestClient, state: NetMover, backend: FakeMountBackend, tmp_path: Path +) -> tuple[int, Path, Path]: + remote = backend.export("nas", "scans") + post(client, "/mounts/new", MOUNT_FORM) + mid = _mount_id(state, "Synology Scans") + post(client, f"/mounts/{mid}/mount") + consume = tmp_path / "consume" + consume.mkdir() + return mid, remote, consume + + +def rule_form(mid: int, consume: Path, **kw: str) -> dict[str, str]: + data = { + "name": "Scans → Paperless", + "enabled": "on", + "src_mount_id": str(mid), + "src_subpath": "", + "dst_kind": "local", + "dst_path": str(consume), + "pattern": "*.pdf", + "pattern_type": "glob", + "interval_seconds": "30", + "stability_seconds": "0", + "min_age_seconds": "0", + "op_timeout_seconds": "120", + "action": "move", + "on_collision": "rename", + "quarantine_after": "3", + } + data.update(kw) + return data + + +def test_rule_validation(client: TestClient, mounted: tuple[int, Path, Path]) -> None: + mid, _, consume = mounted + r = post( + client, + "/rules/new", + rule_form( + mid, + consume, + interval_seconds="5", + pattern_type="regex", + pattern="([", + set_owner="root", + dst_path="relativ", + ), + ) + assert r.status_code == 400 + for msg in ("mindestens 10", "regulärer Ausdruck", "uid:gid", "absoluten Pfad"): + assert msg in r.text + + +def test_rule_create_dryrun_run( + client: TestClient, state: NetMover, mounted: tuple[int, Path, Path] +) -> None: + mid, remote, consume = mounted + (remote / "scan001.pdf").write_text("pdf") + (remote / "notiz.txt").write_text("txt") + r = post(client, "/rules/new", rule_form(mid, consume)) + assert r.status_code == 303, r.text + with state.session_factory() as s: + rid = s.scalars(select(Rule.id)).one() + assert state.scheduler.next_run(rid) is not None + + r = post(client, f"/rules/{rid}/dryrun") + assert r.status_code == 200 + assert "scan001.pdf" in r.text and str(consume / "scan001.pdf") in r.text + assert "notiz.txt" not in r.text and "nichts verändert" in r.text + assert (remote / "scan001.pdf").exists() + + result = state.runs.execute(rid) # „Jetzt ausführen“ synchron für den Test + assert result is not None + assert (consume / "scan001.pdf").exists() and not (remote / "scan001.pdf").exists() + + log = client.get("/log").text + assert "Scans → Paperless" in log + with state.session_factory() as s: + run = s.scalars(select(Run).where(Run.dry_run.is_(False))).one() + assert run.status is RunStatus.OK + items = client.get(f"/log/{run.id}/items").text + assert "scan001.pdf" in items and "verschoben" in items + + +def test_rule_run_now_button( + client: TestClient, state: NetMover, mounted: tuple[int, Path, Path] +) -> None: + mid, _, consume = mounted + post(client, "/rules/new", rule_form(mid, consume)) + with state.session_factory() as s: + rid = s.scalars(select(Rule.id)).one() + r = post(client, f"/rules/{rid}/run") + assert r.status_code == 303 + assert "Lauf gestartet" in client.get("/").text + + +def test_rule_toggle_and_delete_sync_scheduler( + client: TestClient, state: NetMover, mounted: tuple[int, Path, Path] +) -> None: + mid, _, consume = mounted + post(client, "/rules/new", rule_form(mid, consume)) + with state.session_factory() as s: + rid = s.scalars(select(Rule.id)).one() + post(client, f"/rules/{rid}/toggle") + assert state.scheduler.next_run(rid) is None + post(client, f"/rules/{rid}/toggle") + assert state.scheduler.next_run(rid) is not None + post(client, f"/rules/{rid}/delete") + assert state.scheduler.next_run(rid) is None + + +def test_status_page_shows_stale_warning( + client: TestClient, state: NetMover, mounted: tuple[int, Path, Path] +) -> None: + from datetime import timedelta + + from netmover.models import utcnow + + mid, _, consume = mounted + post(client, "/rules/new", rule_form(mid, consume)) + with session_scope(state.session_factory) as s: + r = s.scalars(select(Rule)).one() + r.created_at = utcnow() - timedelta(hours=1) + r.last_success_at = utcnow() - timedelta(minutes=10) + state.started_at = utcnow() - timedelta(hours=1) + page = client.get("/").text + assert "länger als 3 × Intervall" in page and 'class="warn"' in page + assert client.get("/healthz").status_code == 503 + + +# -- Einstellungen ------------------------------------------------------------------------------- + + +def test_settings_webhook_url_is_masked(client: TestClient, state: NetMover) -> None: + from netmover.settings_store import load_settings + + url = "https://ntfy.example/geheimes-topic-token" + r = post( + client, + "/settings", + { + "retention_days": "14", + "notify_mode": "every", + "notify_after": "3", + "webhook_url": url, + "webhook_content_type": "text/plain", + "webhook_template": "$message", + }, + ) + assert r.status_code == 303 + page = client.get("/settings").text + assert "geheimes-topic-token" not in page and "ntfy.example" in page + # Maske unverändert zurückschicken → URL bleibt + masked = re.search(r'name="webhook_url" value="([^"]*)"', page) + assert masked + post( + client, + "/settings", + { + "retention_days": "14", + "notify_mode": "every", + "notify_after": "3", + "webhook_url": masked.group(1), + "webhook_content_type": "text/plain", + "webhook_template": "$message", + }, + ) + cfg = load_settings(state.session_factory) + assert cfg.webhook_url == url and cfg.retention_days == 14 + + +def test_change_password(client: TestClient) -> None: + r = post( + client, + "/settings/password", + {"current": "falsch", "password": "neues-passwort-1", "confirm": "neues-passwort-1"}, + ) + assert "falsch" in client.get("/settings").text + r = post( + client, + "/settings/password", + {"current": PASSWORD, "password": "neues-passwort-1", "confirm": "neues-passwort-1"}, + ) + assert r.status_code == 303 + + +def test_export_excludes_secrets_and_import_roundtrip( + client: TestClient, + state: NetMover, + mounted: tuple[int, Path, Path], + tmp_path: Path, +) -> None: + mid, _, consume = mounted + post(client, "/rules/new", rule_form(mid, consume)) + r = client.get("/settings/export") + assert r.status_code == 200 and "attachment" in r.headers["content-disposition"] + text = r.text + assert MOUNT_FORM["password"] not in text and "scanner" not in text and "secret_enc" not in text + data = json.loads(text) + assert data["mounts"][0]["name"] == "Synology Scans" + assert data["rules"][0]["src_mount"] == "Synology Scans" + + # in eine frische Instanz importieren + settings2 = Settings( + data_dir=tmp_path / "lib2", + run_dir=tmp_path / "run2", + mount_base=tmp_path / "mnt2", + mount_backend="fake", + ) + state2 = NetMover(settings2, backend=FakeMountBackend(tmp_path / "fake2")) + with TestClient(create_app(settings2, state2), follow_redirects=False) as c2: + c2.headers["X-Test-CSRF"] = do_setup(c2) + r = c2.post( + "/settings/import", + data={"csrf_token": c2.headers["X-Test-CSRF"]}, + files={"file": ("export.json", text, "application/json")}, + ) + assert r.status_code == 303 and r.headers["location"] == "/settings", r.headers + page = c2.get("/settings").text + assert "Importiert" in page and "neu eingeben" in page + with state2.session_factory() as s: + m = s.scalars(select(Mount)).one() + assert m.credential is None and m.auto_mount is False + rule = s.scalars(select(Rule)).one() + assert rule.enabled is False and rule.src_mount_id == m.id + # zweiter Import überspringt vorhandene Namen + c2.post( + "/settings/import", + data={"csrf_token": c2.headers["X-Test-CSRF"]}, + files={"file": ("export.json", text, "application/json")}, + ) + assert "Übersprungen" in c2.get("/settings").text