ske087
2af04e1db3
- Content model: add url column + is_weblink() for web page content items - Player model: add deployment tracking fields (status, timestamps, message) - Content blueprint: add add_weblink and add_weblink_to_playlist routes; weblinks auto-deleted when removed from playlist - Players blueprint: add SSH deploy mode in add_player; weblink-aware playlist - API blueprint: weblink URL served directly in playlist response; add /api/deploy/test-ssh and /api/deploy/player endpoints - Admin blueprint: add build-player page (clone from Gitea, write base config); replace nginx status card with Caddy status on HTTPS config page - caddy_manager: rewritten to generate proper HTTPS/internal-CA Caddyfiles and reload Caddy via admin API (/load) for live config updates - ssh_deploy, background_tasks, player_build: new utils for SSH deployment - background_tasks: push Flask app context into background thread so DB updates after deployment complete correctly - ssh_deploy: robust install script detection with passwordless sudo injection (uses SSH credentials, cleaned up after install) - Dockerfile: add git, sshpass, openssh-client, rsync - docker-compose: switch nginx to Caddy on ports 80/443; add port 5000 for dev - Templates: add_player deploy mode UI, weblink form in playlist/upload pages, build_player admin page, Caddy status on HTTPS config page - Migrations: add_url_to_content, add_deployment_fields_to_player - app.py: call db.create_all() on startup for schema bootstrap - config.py: add PLAYER_CODE_DIR and PLAYER_REPO_URL settings
53 lines
1.6 KiB
Python
53 lines
1.6 KiB
Python
"""
|
|
Portal SSO middleware for DigiServer v2.
|
|
|
|
When the umbrella nginx verifies the portal JWT it sets two headers:
|
|
X-Auth-Username — the portal username
|
|
X-Auth-Role — 'admin' or 'user'
|
|
|
|
This before_request handler reads those headers and auto-logs in the
|
|
corresponding local DigiServer user, creating them on first access if
|
|
needed. The local session is then maintained normally by Flask-Login.
|
|
"""
|
|
import secrets
|
|
from flask import request
|
|
from flask_login import login_user, current_user
|
|
|
|
|
|
def init_portal_sso(app):
|
|
"""Register the SSO before_request handler on the given Flask app."""
|
|
|
|
@app.before_request
|
|
def _portal_sso():
|
|
if current_user.is_authenticated:
|
|
return
|
|
|
|
username = request.headers.get('X-Auth-Username', '').strip()
|
|
if not username:
|
|
return
|
|
|
|
role = request.headers.get('X-Auth-Role', 'user').strip()
|
|
user = _get_or_create_user(username, role)
|
|
if user:
|
|
login_user(user, remember=False)
|
|
|
|
|
|
def _get_or_create_user(username, role):
|
|
from app.models.user import User
|
|
from app.extensions import db, bcrypt
|
|
|
|
try:
|
|
user = User.query.filter_by(username=username).first()
|
|
if not user:
|
|
hashed_pw = bcrypt.generate_password_hash(secrets.token_hex(32)).decode('utf-8')
|
|
user = User(
|
|
username=username,
|
|
password=hashed_pw,
|
|
role='admin' if role == 'admin' else 'user',
|
|
)
|
|
db.session.add(user)
|
|
db.session.commit()
|
|
return user
|
|
except Exception:
|
|
return None
|