Add admin official account connection UI and persistent session secrets
This commit is contained in:
Pigway
@@ -20,6 +20,11 @@ from pigway_frame_flow.core.registry import DeviceRegistry
|
||||
from pigway_frame_flow.display.service import DisplayService
|
||||
from pigway_frame_flow.errors import ErrorCode as E
|
||||
from pigway_frame_flow.errors import FlowError
|
||||
from pigway_frame_flow.integrations.kokonna_official.connection import (
|
||||
ConnectionState,
|
||||
LoginRequest,
|
||||
SelectRequest,
|
||||
)
|
||||
from pigway_frame_flow.models import (
|
||||
Accepted,
|
||||
Asset,
|
||||
@@ -753,6 +758,48 @@ def create_app(settings=None, start_worker=True):
|
||||
weather_provider=weather.config().provider,
|
||||
)
|
||||
|
||||
def official_connection(device_id):
|
||||
registry.get(device_id)
|
||||
return registry.official[device_id]
|
||||
|
||||
@app.get(
|
||||
"/api/v1/devices/{device_id}/official/connection",
|
||||
response_model=ConnectionState,
|
||||
tags=["Official"],
|
||||
dependencies=[Depends(require("admin"))],
|
||||
)
|
||||
def connection_state(device_id: str, discover: bool = False):
|
||||
return official_connection(device_id).state(discover)
|
||||
|
||||
@app.post(
|
||||
"/api/v1/devices/{device_id}/official/connection",
|
||||
response_model=ConnectionState,
|
||||
tags=["Official"],
|
||||
dependencies=[Depends(require("admin"))],
|
||||
)
|
||||
def connection_login(device_id: str, body: LoginRequest):
|
||||
return official_connection(device_id).login(
|
||||
body.username, body.password.get_secret_value()
|
||||
)
|
||||
|
||||
@app.put(
|
||||
"/api/v1/devices/{device_id}/official/connection",
|
||||
response_model=ConnectionState,
|
||||
tags=["Official"],
|
||||
dependencies=[Depends(require("admin"))],
|
||||
)
|
||||
def connection_select(device_id: str, body: SelectRequest):
|
||||
return official_connection(device_id).select(body.robot_id)
|
||||
|
||||
@app.delete(
|
||||
"/api/v1/devices/{device_id}/official/connection",
|
||||
response_model=ConnectionState,
|
||||
tags=["Official"],
|
||||
dependencies=[Depends(require("admin"))],
|
||||
)
|
||||
def connection_disconnect(device_id: str):
|
||||
return official_connection(device_id).disconnect()
|
||||
|
||||
@app.get(
|
||||
"/api/v1/devices/{device_id}/widgets",
|
||||
response_model=__import__(
|
||||
|
||||
@@ -6,6 +6,7 @@ from pigway_frame_flow.drivers.kokonna.driver import KokonnaDriver
|
||||
from pigway_frame_flow.drivers.kokonna.mock import MockClient
|
||||
from pigway_frame_flow.errors import ErrorCode as E
|
||||
from pigway_frame_flow.errors import FlowError
|
||||
from pigway_frame_flow.integrations.kokonna_official.connection import Connection
|
||||
from pigway_frame_flow.integrations.kokonna_official.widgets import WidgetReader
|
||||
from pigway_frame_flow.settings import secret
|
||||
|
||||
@@ -26,7 +27,7 @@ class DeviceRegistry:
|
||||
}
|
||||
)
|
||||
self.drivers: dict[str, FrameDeviceDriver] = {}
|
||||
self.official: dict[str, WidgetReader] = {}
|
||||
self.official: dict[str, Connection] = {}
|
||||
self.keys = []
|
||||
for id, entry in devices.items():
|
||||
if not entry.get("enabled", True):
|
||||
@@ -56,7 +57,11 @@ class DeviceRegistry:
|
||||
widgets = WidgetReader(
|
||||
widget_token, entry.get("widget_robot_id"), settings.mock
|
||||
)
|
||||
self.official[id] = widgets
|
||||
self.official[id] = Connection(
|
||||
widgets,
|
||||
settings.config_dir / f"official-{id}.secret",
|
||||
settings.additional_secrets,
|
||||
)
|
||||
self.drivers[id] = KokonnaDriver(client, id, settings.sanitize)
|
||||
|
||||
def get(self, id: str) -> FrameDeviceDriver:
|
||||
@@ -66,4 +71,4 @@ class DeviceRegistry:
|
||||
|
||||
def official_widgets(self, id: str):
|
||||
self.get(id)
|
||||
return self.official[id].read()
|
||||
return self.official[id].widgets()
|
||||
|
||||
@@ -13,11 +13,19 @@ FrameDeviceDriver protocol does not depend on account login or widgets.
|
||||
|
||||
The public `/api/v1/devices/{device_id}/widgets` endpoint is unchanged. The old
|
||||
`drivers.kokonna.widgets.WidgetReader` import remains a compatibility re-export.
|
||||
No raw RPC proxy or public password-login endpoint is introduced. Future admin
|
||||
account connection UI must use this module and keep credentials server-side.
|
||||
No account or session secret is automatically persisted by this module.
|
||||
No raw RPC proxy is exposed. The admin-only `/official/connection` endpoint
|
||||
provides login (POST), state/discovery (GET), local frame association (PUT), and
|
||||
local disconnect (DELETE), under `/api/v1/devices/{device_id}`. Browser requests
|
||||
use the existing Frame Flow session and CSRF protection; API clients require admin.
|
||||
|
||||
`connection.py` persists the official session and selected robot in
|
||||
`/config/official-{device_id}.secret`, atomically with mode 0600. Passwords are
|
||||
transient and never stored. These files must not be committed or exposed to users.
|
||||
Disconnect clears the local secret, including on restart; it does not revoke
|
||||
remote official account sessions. Expired sessions require logging in again.
|
||||
No login refresh or stored-password automatic retry is performed.
|
||||
|
||||
设备 API Key 仍负责现有设备、图片和图库接口。官方账号功能集中在本目录，
|
||||
不进入 DisplayService、Renderer、Scheduler 或 FrameDeviceDriver。
|
||||
账号登录已提供内部客户端能力；页面连接入口、写操作和会话持久化尚未实现。
|
||||
账号连接页面与会话持久化已实现；额外写操作尚未实现。
|
||||
所有已发现但未启用的 RPC 方法均拒绝执行，不复用 API Key 的写入开关。
|
||||
|
||||
@@ -0,0 +1,162 @@
|
||||
"""Admin account connection; password transient, session persisted as a secret."""
|
||||
|
||||
import json
|
||||
import os
|
||||
import tempfile
|
||||
import threading
|
||||
from pathlib import Path
|
||||
|
||||
from pydantic import Field, SecretStr
|
||||
|
||||
from pigway_frame_flow.errors import ErrorCode as E
|
||||
from pigway_frame_flow.errors import FlowError
|
||||
from pigway_frame_flow.integrations.kokonna_official.rpc import OfficialRPC
|
||||
from pigway_frame_flow.models import StrictModel
|
||||
|
||||
|
||||
class LoginRequest(StrictModel):
|
||||
username: str = Field(min_length=1, max_length=120)
|
||||
password: SecretStr = Field(min_length=1, max_length=256)
|
||||
|
||||
|
||||
class SelectRequest(StrictModel):
|
||||
robot_id: int = Field(gt=0)
|
||||
|
||||
|
||||
class OfficialDevice(StrictModel):
|
||||
id: int
|
||||
name: str
|
||||
model: str | None = None
|
||||
model_code: str | None = None
|
||||
online: bool = False
|
||||
|
||||
|
||||
class ConnectionState(StrictModel):
|
||||
authorized: bool
|
||||
username: str
|
||||
robot_id: int | None
|
||||
mock: bool
|
||||
devices: list[OfficialDevice] = Field(default_factory=list)
|
||||
|
||||
|
||||
class Connection:
|
||||
def __init__(self, reader, path: Path, secrets: list):
|
||||
self.reader, self.path, self.secrets = reader, path, secrets
|
||||
self.username = ""
|
||||
self.lock = threading.RLock()
|
||||
if path.exists():
|
||||
data = json.loads(path.read_text())
|
||||
reader.rpc = OfficialRPC(data["token"])
|
||||
reader._robot_id = data["robot_id"]
|
||||
self.username = data["username"]
|
||||
self.secrets.append(data["token"])
|
||||
|
||||
def _save(self):
|
||||
self.path.parent.mkdir(parents=True, exist_ok=True)
|
||||
with tempfile.NamedTemporaryFile(
|
||||
mode="w", dir=self.path.parent, delete=False
|
||||
) as f:
|
||||
temp = Path(f.name)
|
||||
try:
|
||||
json.dump(
|
||||
{
|
||||
"token": self.reader.rpc._token,
|
||||
"username": self.username,
|
||||
"robot_id": self.reader._robot_id,
|
||||
},
|
||||
f,
|
||||
)
|
||||
f.flush()
|
||||
os.fsync(f.fileno())
|
||||
temp.chmod(0o600)
|
||||
os.replace(temp, self.path)
|
||||
finally:
|
||||
temp.unlink(missing_ok=True)
|
||||
|
||||
def _devices(self, rpc):
|
||||
if self.reader.mock:
|
||||
return [
|
||||
OfficialDevice(
|
||||
id=1,
|
||||
name="Mock Frame",
|
||||
model="13.3-inch",
|
||||
model_code="B101",
|
||||
online=True,
|
||||
)
|
||||
]
|
||||
try:
|
||||
data = rpc.devices()["data"]
|
||||
return [
|
||||
OfficialDevice(
|
||||
id=row["id"],
|
||||
name=row.get("robotNickname") or "Frame",
|
||||
model=(row.get("model") or {}).get("name"),
|
||||
model_code=(row.get("model") or {}).get("code"),
|
||||
online=bool(row.get("online")),
|
||||
)
|
||||
for row in data
|
||||
]
|
||||
except (KeyError, TypeError, ValueError, AttributeError):
|
||||
raise FlowError(
|
||||
E.CLOUD_UNAVAILABLE, "Official device list unavailable", 502
|
||||
) from None
|
||||
|
||||
def state(self, discovery=False):
|
||||
with self.lock:
|
||||
return ConnectionState(
|
||||
authorized=self.reader.rpc.authorized,
|
||||
username=self.username,
|
||||
robot_id=self.reader._robot_id,
|
||||
mock=self.reader.mock,
|
||||
devices=self._devices(self.reader.rpc)
|
||||
if discovery and self.reader.rpc.authorized
|
||||
else [],
|
||||
)
|
||||
|
||||
def login(self, username, password):
|
||||
with self.lock:
|
||||
rpc = OfficialRPC("mock-session" if self.reader.mock else "")
|
||||
if not self.reader.mock:
|
||||
rpc.login(username, password)
|
||||
devices = self._devices(rpc)
|
||||
self.reader.rpc = rpc
|
||||
self.reader._robot_id = None
|
||||
self.reader._cached = None
|
||||
self.username = username
|
||||
self.secrets.append(rpc._token)
|
||||
self._save()
|
||||
return ConnectionState(
|
||||
authorized=True,
|
||||
username=username,
|
||||
robot_id=None,
|
||||
mock=self.reader.mock,
|
||||
devices=devices,
|
||||
)
|
||||
|
||||
def select(self, robot_id):
|
||||
with self.lock:
|
||||
if not self.reader.rpc.authorized:
|
||||
raise FlowError(
|
||||
E.CONFIG_REQUIRED, "Official account authorization required", 503
|
||||
)
|
||||
if not any(d.id == robot_id for d in self._devices(self.reader.rpc)):
|
||||
raise FlowError(
|
||||
E.DEVICE_NOT_FOUND, "Official device not in this account", 404
|
||||
)
|
||||
self.reader._robot_id = robot_id
|
||||
self.reader._cached = None
|
||||
self._save()
|
||||
return self.state()
|
||||
|
||||
def disconnect(self):
|
||||
with self.lock:
|
||||
self.reader.rpc.disconnect()
|
||||
self.reader._robot_id = None
|
||||
self.reader._cached = None
|
||||
self.username = ""
|
||||
self._save()
|
||||
return self.state()
|
||||
|
||||
def widgets(self):
|
||||
with self.lock:
|
||||
return self.reader.read()
|
||||
@@ -46,7 +46,7 @@ class WidgetReader:
|
||||
configured=False,
|
||||
catalog=catalog,
|
||||
observed_at=snapshot["observed_at"],
|
||||
status="AUTH_REQUIRED",
|
||||
status="DEVICE_REQUIRED" if self.rpc.authorized else "AUTH_REQUIRED",
|
||||
)
|
||||
try:
|
||||
data = self.rpc.widgets(self._robot_id)
|
||||
|
||||
@@ -81,9 +81,24 @@ async function officialContentInfo(){
|
||||
try {
|
||||
const data=await api('/api/v1/devices/'+state.device+'/widgets');
|
||||
const label=data.source==='live'?(zh?'实时目录':'Live catalog'):data.source==='mock'?'Mock':(zh?'历史目录 · '+data.observed_at:'Catalog snapshot · '+data.observed_at);
|
||||
const currentLabel=!data.configured?(zh?'尚未授权官方账号，当前状态不可读取。':'Official account not authorized; current state is unavailable.'):data.status==='NO_WIDGET'?(zh?'未使用官方小组件':'No official widget selected'):data.current_verified&&data.current?((zh?'当前小组件：':'Current widget: ')+data.current.name):(zh?'当前小组件尚未核实':'Current widget is unverified');
|
||||
const currentLabel=data.status==='DEVICE_REQUIRED'?(zh?'官方账号已连接，请先关联画框':'Official account connected; link a frame first'):!data.configured?(zh?'尚未授权官方账号，当前状态不可读取。':'Official account not authorized; current state is unavailable.'):data.status==='NO_WIDGET'?(zh?'未使用官方小组件':'No official widget selected'):data.current_verified&&data.current?((zh?'当前小组件：':'Current widget: ')+data.current.name):(zh?'当前小组件尚未核实':'Current widget is unverified');
|
||||
info.innerHTML=`<summary>${zh?'官方小组件':'Official widgets'} · ${data.catalog.length}${!data.configured?(zh?' · 需官方账号授权':' · Official account required'):''}</summary><p>${esc(label)}</p><p class="notice">${esc(currentLabel)}</p><p class="notice widget-auth-notice">${zh?'如需使用官方小组件，需要另外授权 KoKonna 官方账号登录信息。现有 API Key 接入继续用于设备状态、图片和图库，不受影响。':'Official widgets require separate KoKonna account authorization. Your existing API Key continues to support device status, images and gallery.'}</p><p>${zh?'此入口只读，不会切换或取消官方订阅。':'Read only. This does not change official subscriptions.'}</p><input type="search" aria-label="${zh?'搜索小组件':'Search widgets'}" placeholder="${zh?'搜索名称或分类':'Search name or category'}"><div class="widget-list"></div>`;
|
||||
const render=()=>{const query=info.querySelector('input').value.toLowerCase();info.querySelector('.widget-list').innerHTML=data.catalog.filter(x=>(x.name+' '+x.tags.join(' ')).toLowerCase().includes(query)).map(x=>`<article class="card"><strong>${esc(x.name)}</strong><p>${esc(x.tags.join(' · '))}</p><small>${esc(x.arg_keys.join(' · '))}</small></article>`).join('');};
|
||||
info.querySelector('input').oninput=render;render();
|
||||
info.querySelector('input').oninput=render;render();officialConnectionPanel(info);
|
||||
}catch(e){info.querySelector('p').textContent=e.message;}
|
||||
}
|
||||
|
||||
async function officialConnectionPanel(info){
|
||||
const zh=state.lang==='zh',path='/api/v1/devices/'+state.device+'/official/connection';
|
||||
const panel=document.createElement('section');panel.className='official-account-panel';info.querySelector('.widget-auth-notice').after(panel);
|
||||
const render=connection=>{
|
||||
panel.innerHTML=connection.authorized?`<h3>${zh?'官方账号已连接':'Official account connected'}</h3><p>${esc(connection.username)}</p><p>${connection.robot_id?(zh?'已关联画框':'Frame linked'):(zh?'请选择并关联你的画框':'Choose and link your frame')}</p><div class="actions"><button id="official-discover" type="button">${zh?'查询账号设备':'Discover devices'}</button><button id="official-disconnect" type="button">${zh?'断开连接':'Disconnect'}</button></div><div id="official-device-picker"></div>`:`<h3>${zh?'连接 KoKonna 官方账号':'Connect KoKonna official account'}</h3><p>${zh?'此处不是 Frame Flow 或 NAS 账号。密码不保存，登录会话会保存为 NAS 上受限的 secret 文件。连接仅查询，不切换小组件。':'Use your KoKonna account, not Frame Flow or NAS credentials. Passwords are not saved; the session is stored in a restricted NAS secret file. Connecting only queries data.'}</p><form id="official-login-form"><div class="field"><label for="official-username">${zh?'官方账号':'Official username'}</label><input id="official-username" required maxlength="120" autocomplete="username"></div><div class="field"><label for="official-password">${zh?'官方密码':'Official password'}</label><input id="official-password" required maxlength="256" type="password" autocomplete="off"></div><button type="submit" class="primary">${zh?'授权连接':'Authorize connection'}</button></form>`;
|
||||
if(connection.authorized){
|
||||
$('#official-disconnect').onclick=busy(async()=>{render(await api(path,{method:'DELETE'}));toast(zh?'已断开官方连接':'Official connection disconnected');});
|
||||
const picker=devices=>{const box=$('#official-device-picker');box.innerHTML=devices.length?`<form id="official-select-form"><div class="field"><label for="official-device">${zh?'官方账号下的画框':'Frames in your official account'}</label><select id="official-device">${devices.map(d=>`<option value="${d.id}" ${d.id===connection.robot_id?'selected':''}>${esc(d.name)} · ${esc(d.model_code||'')} · ${d.online?'ONLINE':'OFFLINE'}</option>`).join('')}</select></div><button type="submit" class="primary">${zh?'关联到当前 Frame Flow 设备':'Link to this Frame Flow device'}</button></form>`:`<p>${zh?'账号下没有可关联设备':'No devices found in this account'}</p>`;if(devices.length)$('#official-select-form').onsubmit=busy(async e=>{e.preventDefault();await api(path,{method:'PUT',body:{robot_id:Number($('#official-device').value)}});await navigate('templates');});};
|
||||
$('#official-discover').onclick=busy(async()=>{picker((await api(path+'?discover=true')).devices);});
|
||||
if(connection.devices.length)picker(connection.devices);
|
||||
}else $('#official-login-form').onsubmit=busy(async e=>{e.preventDefault();const username=$('#official-username').value.trim(),password=$('#official-password').value;$('#official-password').value='';render(await api(path,{method:'POST',body:{username,password}}));});
|
||||
};
|
||||
try{render(await api(path));}catch{panel.textContent=zh?'官方账号连接由管理员管理':'Official account connection is managed by an administrator';}
|
||||
}
|
||||
|
||||
@@ -44,3 +44,5 @@ details[open]>summary{margin-bottom:16px}
|
||||
/* Multiple controls in one field need their own spacing, beyond field margins. */
|
||||
.field > :is(input,select,textarea) + :is(input,select,textarea){margin-top:12px}
|
||||
input[type="file"]::file-selector-button{margin-inline-end:12px}
|
||||
|
||||
.official-account-panel{margin:20px 0;padding:20px;border:1px solid var(--border);border-radius:12px}.official-account-panel>p{margin:14px 0}#official-device-picker{margin-top:18px}
|
||||
|
||||
Reference in New Issue
Block a user