bruno
f8df0e13b5
Moteur d'automatisation complet : declencheurs (evenement / cron / bouton),
conditions combinables (eq, neq, contains, is_empty, is_not_empty, changed)
et actions (webhook, set_property, create_page, notify).
- Migration v5 : tables `automations` + `automation_runs` (avec index).
- Service `app/services/automations.py` : fire_event, cron_due (`*/N`,
minute fixe, @hourly/@daily), scheduler de fond dans le lifespan.
- Router `app/routers/automations.py` : CRUD `/workspace/automations`,
historique des executions, run manuel + run bouton `/api/automations/{id}/run`
(exempt CSRF, comme `/api/agent`).
- Hooks d'evenements dans collections.py / board.py / workspace.py
(collection.* et page.* : created/updated/deleted/moved).
- Bloc `button` dans l'editeur (menu slash) : declenche une regle au clic,
picker d'automation inline, serialisation automations_id/name.
- Panneau Automations dans le Settings (creer/editer/activer/desactiver/
lancer/supprimer + historique), collection scope + JSON conditions/actions.
- 11 tests `tests/test_automations.py` ; suite complete pytest 289 verte.
- Version bump 5.2.0 (VERSION, app/main.py, CHANGELOG).
51 lines
2.1 KiB
Python
51 lines
2.1 KiB
Python
"""FlowDeck — CSRF protection middleware."""
|
|
from __future__ import annotations
|
|
|
|
import secrets
|
|
|
|
from starlette.middleware.base import BaseHTTPMiddleware
|
|
from starlette.responses import JSONResponse
|
|
from starlette.requests import Request
|
|
|
|
|
|
class CSRFMiddleware(BaseHTTPMiddleware):
|
|
"""Lightweight CSRF protection for state-changing requests.
|
|
|
|
All POST/PUT/PATCH/DELETE requests must include X-CSRF-Token
|
|
header matching the csrf_token cookie.
|
|
"""
|
|
|
|
SAFE_METHODS = {"GET", "HEAD", "OPTIONS"}
|
|
EXCLUDED_PATHS = {"/api/webhook", "/api/v1", "/auth/callback", "/auth/register", "/auth/local-login", "/api/user", "/board/api/pages", "/board/api/favorites", "/api/workspace", "/api/local-workspace", "/api/settings", "/db/", "/workspace", "/api/frontend-error", "/api/admin", "/api/gitea", "/api/github", "/api/pages", "/api/recents", "/api/csrf-token", "/api/notifications", "/api/comments", "/api/agent", "/api/automations", "/workspace/automations"}
|
|
|
|
async def dispatch(self, request: Request, call_next):
|
|
# Webhook receiver, OAuth callback, and internal API are exempt
|
|
if any(request.url.path.startswith(p) for p in self.EXCLUDED_PATHS):
|
|
return await call_next(request)
|
|
|
|
if request.method in self.SAFE_METHODS:
|
|
response = await call_next(request)
|
|
# Set CSRF cookie if not present
|
|
if "csrf_token" not in request.cookies:
|
|
response.set_cookie(
|
|
"csrf_token",
|
|
secrets.token_hex(32),
|
|
httponly=False, # Must be readable by JS
|
|
samesite="lax",
|
|
max_age=86400,
|
|
path="/",
|
|
)
|
|
return response
|
|
|
|
# Validate CSRF for state-changing methods
|
|
csrf_cookie = request.cookies.get("csrf_token", "")
|
|
csrf_header = request.headers.get("X-CSRF-Token", "")
|
|
|
|
if not csrf_cookie or not csrf_header or not secrets.compare_digest(csrf_cookie, csrf_header):
|
|
return JSONResponse(
|
|
{"detail": "CSRF validation failed"},
|
|
status_code=403,
|
|
)
|
|
|
|
return await call_next(request)
|