mirror of
https://github.com/jhd3197/ServerKit.git
synced 2026-11-02 18:17:11 +09:00
Juan DenisandClaude Opus 5
fe02ce8eeb
Plan 76 milestone A, drift/bug row 2 — scheduled as a fix, not a refactor,
because it is a behaviour difference shipping today.
rbac.get_current_user() is the only lookup that knows about both auth
mechanisms: it returns g.api_key_user for an X-API-Key request and falls back
to the JWT. 73 call sites answered "who is calling" with
`User.query.get(get_jwt_identity())` instead, behind 19 near-identical private
helpers (12 named get_current_user(), shadowing the real door).
The audit that scheduled this row predicted those return None for API-key
callers. Measured, it is worse: auth_required() deliberately skips
verify_jwt_in_request() once the key middleware has authenticated, so there is
no JWT context and get_jwt_identity() *raises*. Nine handlers reached through
an API-key-capable policy decorator therefore returned 500 to every API-key
caller:
bandwidth.get_app_bandwidth @viewer_required
servers.set_server_workspace @developer_required
servers.create_server @developer_required
sso.get_sso_config / update_provider_config / update_general_settings
source_connections.update_{github,gitlab,bitbucket}_admin_config
source_connections.complete_github_app_manifest
databases.execute_{mysql,pg,sqlite,docker}_query (see below)
Three service helpers had the same lookup inside a blanket `except Exception`,
which converted the raise into a silent user_id=None — the write landed and
the audit trail lost the actor (shared_resource_service, cf_ops_change_service,
secrets_webhooks).
The four databases.execute_*_query sites were a second admin check *inside* an
already-@admin_required route: dead code that always passed for JWT callers and
crashed for API-key ones. They now call require_admin_user() rather than
re-deriving the answer.
Also folds in a sixth _require_admin() found in the cloudflare-ops extension
source (29 gates, the same inverted contract as jobs.py), and fixes
serverkit-gui's blueprint at its sibling-repo source rather than in this repo's
live copy.
Ratchet (second-wave rule 1 — a migration without one regrows):
tests/identity_door_census.py counts both bypass shapes by AST, direct and the
two-line `uid = get_jwt_identity(); User.query.get(uid)` variant. The ceiling is
87, all of them on @jwt_required()-only routes where reading the JWT is correct
today; the ratchet's third assertion holds the API-key-capable population at
exactly zero, so migrating one of those routes to a policy decorator without
fixing its lookup now fails. Verified non-vacuous: an injected bypass fails both
assertions and passes again on revert.
The first wave's controller-boundary baseline is regenerated — this removes 74
persistence crossings (593 -> 519), a debt reduction with no new entries.
Gate: tests/test_api_key_identity.py (7, each red before the fix),
test_identity_door_ratchet.py (10), test_api_controller_boundaries.py (4), plus
the 65 test files covering every touched module: 1024 passed, 10 skipped.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
78 lines
3.0 KiB
Python
78 lines
3.0 KiB
Python
# Bucket: PER-APP read (plan 29 #9). Per-app history gates via _access →
|
|
# can_access_app. See docs/WORKSPACE_SCOPING.md.
|
|
"""Unified deployment surface (§3 unification).
|
|
|
|
One read namespace over the deploy records that today live in three places:
|
|
versioned build ``Deployment`` rows, webhook-triggered ``GitDeployment`` rows,
|
|
and the canonical ``DeploymentJob`` execution records (mounted here under
|
|
``/jobs``). The per-system blueprints (/builds, /deploy, /git, /deployment-jobs)
|
|
are unchanged; this is an additive, federated view so the frontend can read one
|
|
history instead of merging two sources.
|
|
"""
|
|
from flask import Blueprint, request, jsonify
|
|
from flask_jwt_extended import jwt_required
|
|
|
|
from app.models import Application
|
|
from app.models.deployment import Deployment
|
|
from app.models.webhook import GitDeployment
|
|
from app.middleware.rbac import get_current_user
|
|
|
|
deployments_bp = Blueprint('deployments', __name__)
|
|
|
|
|
|
def _access(app_id):
|
|
from app.services.resource_grant_service import ResourceGrantService
|
|
user = get_current_user()
|
|
app = Application.query_active().filter_by(id=app_id).first()
|
|
if not app:
|
|
return None, (jsonify({'error': 'Application not found'}), 404)
|
|
if not ResourceGrantService.can_access_app(user, app):
|
|
return None, (jsonify({'error': 'Access denied'}), 403)
|
|
return app, None
|
|
|
|
|
|
@deployments_bp.route('/apps/<int:app_id>/history', methods=['GET'])
|
|
@jwt_required()
|
|
def app_history(app_id):
|
|
"""Federated deploy history for an app: versioned build Deployments +
|
|
webhook GitDeployments, each tagged with ``source``, newest first.
|
|
Query: ?source=build|webhook|all (default all), ?limit= (<=500)."""
|
|
app, err = _access(app_id)
|
|
if err:
|
|
return err
|
|
source = (request.args.get('source') or 'all').lower()
|
|
try:
|
|
limit = min(int(request.args.get('limit', 100)), 500)
|
|
except (TypeError, ValueError):
|
|
limit = 100
|
|
|
|
items = []
|
|
if source in ('all', 'build'):
|
|
for d in (Deployment.query.filter_by(app_id=app_id)
|
|
.order_by(Deployment.created_at.desc()).limit(limit).all()):
|
|
row = d.to_dict()
|
|
row['source'] = 'build'
|
|
items.append(row)
|
|
if source in ('all', 'webhook'):
|
|
for g in (GitDeployment.query.filter_by(app_id=app_id)
|
|
.order_by(GitDeployment.created_at.desc()).limit(limit).all()):
|
|
row = g.to_dict()
|
|
row['source'] = 'webhook'
|
|
items.append(row)
|
|
items.sort(key=lambda r: r.get('created_at') or '', reverse=True)
|
|
items = items[:limit]
|
|
return jsonify({'deployments': items, 'count': len(items)}), 200
|
|
|
|
|
|
@deployments_bp.route('/<int:deployment_id>', methods=['GET'])
|
|
@jwt_required()
|
|
def get_deployment(deployment_id):
|
|
"""A versioned build Deployment by id (the release ledger detail)."""
|
|
d = Deployment.query.get(deployment_id)
|
|
if not d:
|
|
return jsonify({'error': 'Deployment not found'}), 404
|
|
_, err = _access(d.app_id)
|
|
if err:
|
|
return err
|
|
return jsonify({'deployment': d.to_dict(include_logs=True)}), 200
|