fix: Restore all files lost during destructive rebase
A previous `git pull --rebase origin main` dropped 177 local commits,
losing 3400+ files across admin-v2, backend, studio-v2, website,
klausur-service, and many other services. The partial restore attempt
(660295e2) only recovered some files.
This commit restores all missing files from pre-rebase ref 98933f5e
while preserving post-rebase additions (night-scheduler, night-mode UI,
NightModeWidget dashboard integration).
Restored features include:
- AI Module Sidebar (FAB), OCR Labeling, OCR Compare
- GPU Dashboard, RAG Pipeline, Magic Help
- Klausur-Korrektur (8 files), Abitur-Archiv (5+ files)
- Companion, Zeugnisse-Crawler, Screen Flow
- Full backend, studio-v2, website, klausur-service
- All compliance SDKs, agent-core, voice-service
- CI/CD configs, documentation, scripts
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Benjamin Admin
535
backend/middleware_admin_api.py
Normal file
535
backend/middleware_admin_api.py
Normal file
@@ -0,0 +1,535 @@
|
||||
"""
|
||||
Middleware Admin API Endpoints for BreakPilot
|
||||
|
||||
Provides admin functionality for managing middleware configurations:
|
||||
- View and update middleware settings
|
||||
- Rate limiting IP whitelist/blacklist
|
||||
- View middleware events/statistics
|
||||
"""
|
||||
|
||||
import os
|
||||
from datetime import datetime, timedelta
|
||||
from typing import Any, Dict, List, Optional
|
||||
|
||||
from fastapi import APIRouter, Depends, HTTPException, Query
|
||||
from pydantic import BaseModel, Field
|
||||
|
||||
# Database connection
|
||||
import asyncpg
|
||||
|
||||
# Session middleware for authentication
|
||||
from session import require_permission, Session
|
||||
|
||||
|
||||
router = APIRouter(prefix="/api/admin/middleware", tags=["middleware-admin"])
|
||||
|
||||
# Database URL
|
||||
DATABASE_URL = os.getenv(
|
||||
"DATABASE_URL",
|
||||
"postgresql://breakpilot:breakpilot@localhost:5432/breakpilot_dev"
|
||||
)
|
||||
|
||||
# Lazy database pool
|
||||
_db_pool: Optional[asyncpg.Pool] = None
|
||||
|
||||
|
||||
async def get_db_pool() -> asyncpg.Pool:
|
||||
"""Get or create database connection pool."""
|
||||
global _db_pool
|
||||
if _db_pool is None:
|
||||
_db_pool = await asyncpg.create_pool(DATABASE_URL, min_size=2, max_size=10)
|
||||
return _db_pool
|
||||
|
||||
|
||||
# ==============================================
|
||||
# Request/Response Models
|
||||
# ==============================================
|
||||
|
||||
|
||||
class MiddlewareConfigResponse(BaseModel):
|
||||
"""Response model for middleware configuration."""
|
||||
id: str
|
||||
middleware_name: str
|
||||
enabled: bool
|
||||
config: Dict[str, Any]
|
||||
updated_at: Optional[datetime] = None
|
||||
|
||||
|
||||
class MiddlewareConfigUpdateRequest(BaseModel):
|
||||
"""Request model for updating middleware configuration."""
|
||||
enabled: Optional[bool] = None
|
||||
config: Optional[Dict[str, Any]] = None
|
||||
|
||||
|
||||
class RateLimitIPRequest(BaseModel):
|
||||
"""Request model for adding IP to whitelist/blacklist."""
|
||||
ip_address: str
|
||||
list_type: str = Field(..., pattern="^(whitelist|blacklist)$")
|
||||
reason: Optional[str] = None
|
||||
expires_at: Optional[datetime] = None
|
||||
|
||||
|
||||
class RateLimitIPResponse(BaseModel):
|
||||
"""Response model for rate limit IP entry."""
|
||||
id: str
|
||||
ip_address: str
|
||||
list_type: str
|
||||
reason: Optional[str] = None
|
||||
expires_at: Optional[datetime] = None
|
||||
created_at: datetime
|
||||
|
||||
|
||||
class MiddlewareEventResponse(BaseModel):
|
||||
"""Response model for middleware event."""
|
||||
id: str
|
||||
middleware_name: str
|
||||
event_type: str
|
||||
ip_address: Optional[str] = None
|
||||
user_id: Optional[str] = None
|
||||
request_path: Optional[str] = None
|
||||
request_method: Optional[str] = None
|
||||
details: Optional[Dict[str, Any]] = None
|
||||
created_at: datetime
|
||||
|
||||
|
||||
class MiddlewareStatsResponse(BaseModel):
|
||||
"""Response model for middleware statistics."""
|
||||
middleware_name: str
|
||||
total_events: int
|
||||
events_last_hour: int
|
||||
events_last_24h: int
|
||||
top_event_types: List[Dict[str, Any]]
|
||||
top_ips: List[Dict[str, Any]]
|
||||
|
||||
|
||||
# ==============================================
|
||||
# Middleware Configuration Endpoints
|
||||
# ==============================================
|
||||
|
||||
|
||||
@router.get("", response_model=List[MiddlewareConfigResponse])
|
||||
async def list_middleware_configs(
|
||||
session: Session = Depends(require_permission("settings:read")),
|
||||
):
|
||||
"""
|
||||
List all middleware configurations.
|
||||
|
||||
Requires: settings:read permission
|
||||
"""
|
||||
pool = await get_db_pool()
|
||||
|
||||
rows = await pool.fetch("""
|
||||
SELECT id, middleware_name, enabled, config, updated_at
|
||||
FROM middleware_config
|
||||
ORDER BY middleware_name
|
||||
""")
|
||||
|
||||
return [
|
||||
MiddlewareConfigResponse(
|
||||
id=str(row["id"]),
|
||||
middleware_name=row["middleware_name"],
|
||||
enabled=row["enabled"],
|
||||
config=row["config"] or {},
|
||||
updated_at=row["updated_at"],
|
||||
)
|
||||
for row in rows
|
||||
]
|
||||
|
||||
|
||||
@router.get("/{name}", response_model=MiddlewareConfigResponse)
|
||||
async def get_middleware_config(
|
||||
name: str,
|
||||
session: Session = Depends(require_permission("settings:read")),
|
||||
):
|
||||
"""
|
||||
Get configuration for a specific middleware.
|
||||
|
||||
Requires: settings:read permission
|
||||
"""
|
||||
pool = await get_db_pool()
|
||||
|
||||
row = await pool.fetchrow("""
|
||||
SELECT id, middleware_name, enabled, config, updated_at
|
||||
FROM middleware_config
|
||||
WHERE middleware_name = $1
|
||||
""", name)
|
||||
|
||||
if not row:
|
||||
raise HTTPException(status_code=404, detail=f"Middleware '{name}' not found")
|
||||
|
||||
return MiddlewareConfigResponse(
|
||||
id=str(row["id"]),
|
||||
middleware_name=row["middleware_name"],
|
||||
enabled=row["enabled"],
|
||||
config=row["config"] or {},
|
||||
updated_at=row["updated_at"],
|
||||
)
|
||||
|
||||
|
||||
@router.put("/{name}", response_model=MiddlewareConfigResponse)
|
||||
async def update_middleware_config(
|
||||
name: str,
|
||||
data: MiddlewareConfigUpdateRequest,
|
||||
session: Session = Depends(require_permission("settings:write")),
|
||||
):
|
||||
"""
|
||||
Update configuration for a specific middleware.
|
||||
|
||||
Requires: settings:write permission
|
||||
"""
|
||||
pool = await get_db_pool()
|
||||
|
||||
# Build update query dynamically
|
||||
updates = []
|
||||
params = [name]
|
||||
param_idx = 2
|
||||
|
||||
if data.enabled is not None:
|
||||
updates.append(f"enabled = ${param_idx}")
|
||||
params.append(data.enabled)
|
||||
param_idx += 1
|
||||
|
||||
if data.config is not None:
|
||||
updates.append(f"config = ${param_idx}")
|
||||
params.append(data.config)
|
||||
param_idx += 1
|
||||
|
||||
if not updates:
|
||||
raise HTTPException(status_code=400, detail="No fields to update")
|
||||
|
||||
updates.append("updated_at = NOW()")
|
||||
updates.append(f"updated_by = ${param_idx}")
|
||||
params.append(session.user_id)
|
||||
|
||||
query = f"""
|
||||
UPDATE middleware_config
|
||||
SET {", ".join(updates)}
|
||||
WHERE middleware_name = $1
|
||||
RETURNING id, middleware_name, enabled, config, updated_at
|
||||
"""
|
||||
|
||||
row = await pool.fetchrow(query, *params)
|
||||
|
||||
if not row:
|
||||
raise HTTPException(status_code=404, detail=f"Middleware '{name}' not found")
|
||||
|
||||
# Log the configuration change
|
||||
await pool.execute("""
|
||||
INSERT INTO middleware_events (middleware_name, event_type, user_id, details)
|
||||
VALUES ($1, 'config_changed', $2, $3)
|
||||
""", name, session.user_id, {"changes": data.dict(exclude_none=True)})
|
||||
|
||||
return MiddlewareConfigResponse(
|
||||
id=str(row["id"]),
|
||||
middleware_name=row["middleware_name"],
|
||||
enabled=row["enabled"],
|
||||
config=row["config"] or {},
|
||||
updated_at=row["updated_at"],
|
||||
)
|
||||
|
||||
|
||||
# ==============================================
|
||||
# Rate Limiting IP Management
|
||||
# ==============================================
|
||||
|
||||
|
||||
@router.get("/rate-limit/ip-list", response_model=List[RateLimitIPResponse])
|
||||
async def list_rate_limit_ips(
|
||||
list_type: Optional[str] = Query(None, pattern="^(whitelist|blacklist)$"),
|
||||
session: Session = Depends(require_permission("settings:read")),
|
||||
):
|
||||
"""
|
||||
List all IPs in whitelist/blacklist.
|
||||
|
||||
Requires: settings:read permission
|
||||
"""
|
||||
pool = await get_db_pool()
|
||||
|
||||
if list_type:
|
||||
rows = await pool.fetch("""
|
||||
SELECT id, ip_address::text, list_type, reason, expires_at, created_at
|
||||
FROM rate_limit_ip_list
|
||||
WHERE list_type = $1
|
||||
ORDER BY created_at DESC
|
||||
""", list_type)
|
||||
else:
|
||||
rows = await pool.fetch("""
|
||||
SELECT id, ip_address::text, list_type, reason, expires_at, created_at
|
||||
FROM rate_limit_ip_list
|
||||
ORDER BY list_type, created_at DESC
|
||||
""")
|
||||
|
||||
return [
|
||||
RateLimitIPResponse(
|
||||
id=str(row["id"]),
|
||||
ip_address=row["ip_address"],
|
||||
list_type=row["list_type"],
|
||||
reason=row["reason"],
|
||||
expires_at=row["expires_at"],
|
||||
created_at=row["created_at"],
|
||||
)
|
||||
for row in rows
|
||||
]
|
||||
|
||||
|
||||
@router.post("/rate-limit/ip-list", response_model=RateLimitIPResponse, status_code=201)
|
||||
async def add_rate_limit_ip(
|
||||
data: RateLimitIPRequest,
|
||||
session: Session = Depends(require_permission("settings:write")),
|
||||
):
|
||||
"""
|
||||
Add IP to whitelist or blacklist.
|
||||
|
||||
Requires: settings:write permission
|
||||
"""
|
||||
pool = await get_db_pool()
|
||||
|
||||
try:
|
||||
row = await pool.fetchrow("""
|
||||
INSERT INTO rate_limit_ip_list (ip_address, list_type, reason, expires_at, created_by)
|
||||
VALUES ($1::inet, $2, $3, $4, $5)
|
||||
RETURNING id, ip_address::text, list_type, reason, expires_at, created_at
|
||||
""", data.ip_address, data.list_type, data.reason, data.expires_at, session.user_id)
|
||||
except asyncpg.UniqueViolationError:
|
||||
raise HTTPException(
|
||||
status_code=409,
|
||||
detail=f"IP {data.ip_address} already exists in {data.list_type}"
|
||||
)
|
||||
|
||||
# Log the event
|
||||
await pool.execute("""
|
||||
INSERT INTO middleware_events (middleware_name, event_type, ip_address, user_id, details)
|
||||
VALUES ('rate_limiter', $1, $2::inet, $3, $4)
|
||||
""", f"ip_{data.list_type}_add", data.ip_address, session.user_id,
|
||||
{"reason": data.reason})
|
||||
|
||||
return RateLimitIPResponse(
|
||||
id=str(row["id"]),
|
||||
ip_address=row["ip_address"],
|
||||
list_type=row["list_type"],
|
||||
reason=row["reason"],
|
||||
expires_at=row["expires_at"],
|
||||
created_at=row["created_at"],
|
||||
)
|
||||
|
||||
|
||||
@router.delete("/rate-limit/ip-list/{ip_id}")
|
||||
async def remove_rate_limit_ip(
|
||||
ip_id: str,
|
||||
session: Session = Depends(require_permission("settings:write")),
|
||||
):
|
||||
"""
|
||||
Remove IP from whitelist/blacklist.
|
||||
|
||||
Requires: settings:write permission
|
||||
"""
|
||||
pool = await get_db_pool()
|
||||
|
||||
# Get the entry first for logging
|
||||
row = await pool.fetchrow("""
|
||||
SELECT ip_address::text, list_type FROM rate_limit_ip_list WHERE id = $1
|
||||
""", ip_id)
|
||||
|
||||
if not row:
|
||||
raise HTTPException(status_code=404, detail="IP entry not found")
|
||||
|
||||
await pool.execute("""
|
||||
DELETE FROM rate_limit_ip_list WHERE id = $1
|
||||
""", ip_id)
|
||||
|
||||
# Log the event
|
||||
await pool.execute("""
|
||||
INSERT INTO middleware_events (middleware_name, event_type, ip_address, user_id, details)
|
||||
VALUES ('rate_limiter', $1, $2::inet, $3, $4)
|
||||
""", f"ip_{row['list_type']}_remove", row["ip_address"], session.user_id, {})
|
||||
|
||||
return {"message": "IP removed successfully"}
|
||||
|
||||
|
||||
# ==============================================
|
||||
# Middleware Events & Statistics
|
||||
# ==============================================
|
||||
|
||||
|
||||
@router.get("/events", response_model=List[MiddlewareEventResponse])
|
||||
async def list_middleware_events(
|
||||
middleware_name: Optional[str] = None,
|
||||
event_type: Optional[str] = None,
|
||||
limit: int = Query(100, le=1000),
|
||||
offset: int = 0,
|
||||
session: Session = Depends(require_permission("audit:read")),
|
||||
):
|
||||
"""
|
||||
List middleware events (rate limit triggers, config changes, etc.).
|
||||
|
||||
Requires: audit:read permission
|
||||
"""
|
||||
pool = await get_db_pool()
|
||||
|
||||
conditions = []
|
||||
params = []
|
||||
param_idx = 1
|
||||
|
||||
if middleware_name:
|
||||
conditions.append(f"middleware_name = ${param_idx}")
|
||||
params.append(middleware_name)
|
||||
param_idx += 1
|
||||
|
||||
if event_type:
|
||||
conditions.append(f"event_type = ${param_idx}")
|
||||
params.append(event_type)
|
||||
param_idx += 1
|
||||
|
||||
where_clause = f"WHERE {' AND '.join(conditions)}" if conditions else ""
|
||||
|
||||
params.extend([limit, offset])
|
||||
query = f"""
|
||||
SELECT id, middleware_name, event_type, ip_address::text, user_id::text,
|
||||
request_path, request_method, details, created_at
|
||||
FROM middleware_events
|
||||
{where_clause}
|
||||
ORDER BY created_at DESC
|
||||
LIMIT ${param_idx} OFFSET ${param_idx + 1}
|
||||
"""
|
||||
|
||||
rows = await pool.fetch(query, *params)
|
||||
|
||||
return [
|
||||
MiddlewareEventResponse(
|
||||
id=str(row["id"]),
|
||||
middleware_name=row["middleware_name"],
|
||||
event_type=row["event_type"],
|
||||
ip_address=row["ip_address"],
|
||||
user_id=row["user_id"],
|
||||
request_path=row["request_path"],
|
||||
request_method=row["request_method"],
|
||||
details=row["details"],
|
||||
created_at=row["created_at"],
|
||||
)
|
||||
for row in rows
|
||||
]
|
||||
|
||||
|
||||
@router.get("/stats", response_model=List[MiddlewareStatsResponse])
|
||||
async def get_middleware_stats(
|
||||
session: Session = Depends(require_permission("settings:read")),
|
||||
):
|
||||
"""
|
||||
Get statistics for all middlewares.
|
||||
|
||||
Requires: settings:read permission
|
||||
"""
|
||||
pool = await get_db_pool()
|
||||
|
||||
stats = []
|
||||
middlewares = ["request_id", "security_headers", "cors", "rate_limiter", "pii_redactor", "input_gate"]
|
||||
|
||||
for mw in middlewares:
|
||||
# Get event counts
|
||||
counts = await pool.fetchrow("""
|
||||
SELECT
|
||||
COUNT(*) as total,
|
||||
COUNT(*) FILTER (WHERE created_at > NOW() - INTERVAL '1 hour') as last_hour,
|
||||
COUNT(*) FILTER (WHERE created_at > NOW() - INTERVAL '24 hours') as last_24h
|
||||
FROM middleware_events
|
||||
WHERE middleware_name = $1
|
||||
""", mw)
|
||||
|
||||
# Get top event types
|
||||
top_events = await pool.fetch("""
|
||||
SELECT event_type, COUNT(*) as count
|
||||
FROM middleware_events
|
||||
WHERE middleware_name = $1 AND created_at > NOW() - INTERVAL '24 hours'
|
||||
GROUP BY event_type
|
||||
ORDER BY count DESC
|
||||
LIMIT 5
|
||||
""", mw)
|
||||
|
||||
# Get top IPs (for rate limiter)
|
||||
top_ips = await pool.fetch("""
|
||||
SELECT ip_address::text, COUNT(*) as count
|
||||
FROM middleware_events
|
||||
WHERE middleware_name = $1
|
||||
AND ip_address IS NOT NULL
|
||||
AND created_at > NOW() - INTERVAL '24 hours'
|
||||
GROUP BY ip_address
|
||||
ORDER BY count DESC
|
||||
LIMIT 5
|
||||
""", mw)
|
||||
|
||||
stats.append(MiddlewareStatsResponse(
|
||||
middleware_name=mw,
|
||||
total_events=counts["total"] or 0,
|
||||
events_last_hour=counts["last_hour"] or 0,
|
||||
events_last_24h=counts["last_24h"] or 0,
|
||||
top_event_types=[
|
||||
{"event_type": r["event_type"], "count": r["count"]}
|
||||
for r in top_events
|
||||
],
|
||||
top_ips=[
|
||||
{"ip_address": r["ip_address"], "count": r["count"]}
|
||||
for r in top_ips
|
||||
],
|
||||
))
|
||||
|
||||
return stats
|
||||
|
||||
|
||||
@router.get("/stats/{name}", response_model=MiddlewareStatsResponse)
|
||||
async def get_middleware_stats_by_name(
|
||||
name: str,
|
||||
session: Session = Depends(require_permission("settings:read")),
|
||||
):
|
||||
"""
|
||||
Get statistics for a specific middleware.
|
||||
|
||||
Requires: settings:read permission
|
||||
"""
|
||||
pool = await get_db_pool()
|
||||
|
||||
# Get event counts
|
||||
counts = await pool.fetchrow("""
|
||||
SELECT
|
||||
COUNT(*) as total,
|
||||
COUNT(*) FILTER (WHERE created_at > NOW() - INTERVAL '1 hour') as last_hour,
|
||||
COUNT(*) FILTER (WHERE created_at > NOW() - INTERVAL '24 hours') as last_24h
|
||||
FROM middleware_events
|
||||
WHERE middleware_name = $1
|
||||
""", name)
|
||||
|
||||
# Get top event types
|
||||
top_events = await pool.fetch("""
|
||||
SELECT event_type, COUNT(*) as count
|
||||
FROM middleware_events
|
||||
WHERE middleware_name = $1 AND created_at > NOW() - INTERVAL '24 hours'
|
||||
GROUP BY event_type
|
||||
ORDER BY count DESC
|
||||
LIMIT 10
|
||||
""", name)
|
||||
|
||||
# Get top IPs
|
||||
top_ips = await pool.fetch("""
|
||||
SELECT ip_address::text, COUNT(*) as count
|
||||
FROM middleware_events
|
||||
WHERE middleware_name = $1
|
||||
AND ip_address IS NOT NULL
|
||||
AND created_at > NOW() - INTERVAL '24 hours'
|
||||
GROUP BY ip_address
|
||||
ORDER BY count DESC
|
||||
LIMIT 10
|
||||
""", name)
|
||||
|
||||
return MiddlewareStatsResponse(
|
||||
middleware_name=name,
|
||||
total_events=counts["total"] or 0,
|
||||
events_last_hour=counts["last_hour"] or 0,
|
||||
events_last_24h=counts["last_24h"] or 0,
|
||||
top_event_types=[
|
||||
{"event_type": r["event_type"], "count": r["count"]}
|
||||
for r in top_events
|
||||
],
|
||||
top_ips=[
|
||||
{"ip_address": r["ip_address"], "count": r["count"]}
|
||||
for r in top_ips
|
||||
],
|
||||
)
|
||||
Reference in New Issue
Block a user