v2.3
This commit is contained in:
Luftmensch
@@ -0,0 +1,301 @@
|
||||
import os
|
||||
import time
|
||||
import datetime
|
||||
from pathlib import Path
|
||||
from fastapi import FastAPI, Request, Depends, HTTPException, status
|
||||
from sqlalchemy.orm import Session
|
||||
from fastapi.middleware.cors import CORSMiddleware
|
||||
from fastapi.openapi.utils import get_openapi
|
||||
from dotenv import load_dotenv
|
||||
from .utils import decode_access_token, set_current_user_ctx
|
||||
from .database import get_db
|
||||
from . import models
|
||||
from typing import Dict, Any, List, Optional
|
||||
|
||||
load_dotenv()
|
||||
|
||||
from .database import engine, Base
|
||||
from .routers import auth, users, roles, posts, month, security_index
|
||||
from .routers import hardening
|
||||
from .routers import files
|
||||
from app.routers import system_groups as system_groups_router
|
||||
from app.routers import systems as systems_router
|
||||
|
||||
app = FastAPI(
|
||||
title="ANTT Portal API",
|
||||
swagger_ui_parameters={"persistAuthorization": True},
|
||||
)
|
||||
|
||||
app.add_middleware(
|
||||
CORSMiddleware,
|
||||
allow_origins=["*"],
|
||||
allow_credentials=True,
|
||||
allow_methods=["*"],
|
||||
allow_headers=["*"],
|
||||
)
|
||||
|
||||
# @app.middleware("http")
|
||||
# async def docs_ip_whitelist(request: Request, call_next):
|
||||
# path = request.url.path
|
||||
# if path.startswith("/docs") or path.startswith("/redoc") or path.startswith("/openapi.json"):
|
||||
# wl = [x.strip() for x in (os.getenv("DOCS_WHITELIST_IPS") or "").split(",") if x.strip()]
|
||||
# client_ip = request.client.host if request.client else ""
|
||||
# if wl and client_ip not in wl:
|
||||
# raise HTTPException(status_code=403, detail="IP not allowed")
|
||||
# return await call_next(request)
|
||||
|
||||
def get_real_ip(request: Request) -> str:
|
||||
xff = request.headers.get("x-forwarded-for")
|
||||
if xff:
|
||||
# Lấy IP đầu tiên (client thật)
|
||||
return xff.split(",")[0].strip()
|
||||
|
||||
x_real_ip = request.headers.get("x-real-ip")
|
||||
if x_real_ip:
|
||||
return x_real_ip.strip()
|
||||
|
||||
if request.client:
|
||||
return request.client.host
|
||||
|
||||
return ""
|
||||
|
||||
@app.middleware("http")
|
||||
async def docs_ip_whitelist(request: Request, call_next):
|
||||
path = request.url.path
|
||||
|
||||
if path.startswith(("/docs", "/redoc", "/openapi.json")):
|
||||
wl = [
|
||||
ip.strip()
|
||||
for ip in (os.getenv("DOCS_WHITELIST_IPS") or "").split(",")
|
||||
if ip.strip()
|
||||
]
|
||||
|
||||
client_ip = get_real_ip(request)
|
||||
|
||||
if wl and client_ip not in wl:
|
||||
raise HTTPException(
|
||||
status_code=403,
|
||||
detail=f"IP {client_ip} not allowed"
|
||||
)
|
||||
|
||||
return await call_next(request)
|
||||
|
||||
def _activity_log_dir() -> Path:
|
||||
base = os.getenv("ACTIVITY_LOG_DIR", "logs")
|
||||
p = Path(base).resolve()
|
||||
p.mkdir(parents=True, exist_ok=True)
|
||||
return p
|
||||
|
||||
def _activity_log_path() -> Path:
|
||||
now = datetime.datetime.utcnow()
|
||||
month_dir = _activity_log_dir() / now.strftime("%Y%m")
|
||||
month_dir.mkdir(parents=True, exist_ok=True)
|
||||
return month_dir / f"{now.strftime('%Y-%m-%d')}.txt"
|
||||
|
||||
@app.middleware("http")
|
||||
async def activity_logger(request: Request, call_next):
|
||||
path = request.url.path
|
||||
if path.startswith("/auth/login"):
|
||||
return await call_next(request)
|
||||
if path.startswith("/auth/login_sso"):
|
||||
return await call_next(request)
|
||||
method = request.method.upper()
|
||||
qs = request.url.query or ""
|
||||
ip = request.client.host if request.client else "-"
|
||||
start = time.time()
|
||||
status_code = 500
|
||||
user_payload = None
|
||||
auth_header = request.headers.get("Authorization") or ""
|
||||
token = None
|
||||
try:
|
||||
scheme, token = auth_header.split()
|
||||
if scheme.lower() != "bearer":
|
||||
token = None
|
||||
except Exception:
|
||||
token = None
|
||||
if token:
|
||||
try:
|
||||
user_payload = decode_access_token(token)
|
||||
except Exception:
|
||||
user_payload = None
|
||||
try:
|
||||
set_current_user_ctx(user_payload)
|
||||
except Exception:
|
||||
pass
|
||||
try:
|
||||
response = await call_next(request)
|
||||
status_code = response.status_code
|
||||
return response
|
||||
finally:
|
||||
try:
|
||||
set_current_user_ctx(None)
|
||||
except Exception:
|
||||
pass
|
||||
try:
|
||||
user_id = "-"
|
||||
user_email = "-"
|
||||
if user_payload:
|
||||
try:
|
||||
user_id = str(user_payload.get("sub") or "-")
|
||||
user_email = user_payload.get("email") or "-"
|
||||
except Exception:
|
||||
pass
|
||||
duration_ms = int((time.time() - start) * 1000)
|
||||
line = f"{datetime.datetime.utcnow().isoformat()} | {ip} | {user_id} | {user_email} | {method} {path}{('?' + qs) if qs else ''} | {status_code} | {duration_ms}ms\n"
|
||||
with open(_activity_log_path(), "a", encoding="utf-8") as f:
|
||||
f.write(line)
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
|
||||
@app.on_event("startup")
|
||||
def on_startup():
|
||||
# create tables if AUTO_CREATE_DB is enabled (convenience for dev only)
|
||||
if os.getenv("AUTO_CREATE_DB", "0") == "1":
|
||||
Base.metadata.create_all(bind=engine)
|
||||
|
||||
|
||||
app.include_router(auth.router)
|
||||
app.include_router(roles.router, prefix="/roles", tags=["roles"])
|
||||
app.include_router(users.router, prefix="/users", tags=["users"])
|
||||
app.include_router(posts.router, prefix="/posts", tags=["posts"])
|
||||
app.include_router(month.router, prefix="/months", tags=["months"])
|
||||
app.include_router(security_index.router)
|
||||
app.include_router(hardening.router)
|
||||
# Đăng ký categories
|
||||
from .routers import categories
|
||||
app.include_router(categories.router, prefix="/categories", tags=["categories"])
|
||||
app.include_router(files.router, prefix="/files", tags=["files"])
|
||||
from .routers import pentest
|
||||
from .routers import pentest_service
|
||||
from .routers import jira
|
||||
from .routers import units
|
||||
from .routers import overview
|
||||
from .routers import scorecard
|
||||
from .routers import email as email_router
|
||||
from .routers import documents as documents_router
|
||||
from .routers import soc_ticket
|
||||
from .routers import logsource
|
||||
app.include_router(pentest.router, prefix="/pentest", tags=["pentest"])
|
||||
app.include_router(pentest_service.router)
|
||||
app.include_router(soc_ticket.router)
|
||||
app.include_router(logsource.router)
|
||||
from .routers import mail_history
|
||||
app.include_router(mail_history.router, prefix="/mail-history", tags=["mail-history"])
|
||||
from .routers import import_history as import_history_router
|
||||
app.include_router(import_history_router.router, prefix="/import-history", tags=["import-history"])
|
||||
from .routers import manage_systems as manage_systems_router
|
||||
app.include_router(manage_systems_router.router)
|
||||
# app.include_router(system_groups_router.router)
|
||||
app.include_router(systems_router.router)
|
||||
app.include_router(jira.router, prefix="/jira", tags=["jira"])
|
||||
app.include_router(units.router)
|
||||
app.include_router(overview.router)
|
||||
app.include_router(scorecard.router)
|
||||
app.include_router(email_router.email_roles_router)
|
||||
app.include_router(email_router.email_users_router)
|
||||
app.include_router(documents_router.router)
|
||||
|
||||
def custom_openapi():
|
||||
if app.openapi_schema:
|
||||
return app.openapi_schema
|
||||
|
||||
openapi_schema = get_openapi(
|
||||
title="ANTT Portal API",
|
||||
version="1.0.0",
|
||||
description="API Gateway for ANTT Portal",
|
||||
routes=app.routes,
|
||||
)
|
||||
|
||||
openapi_schema["components"]["securitySchemes"] = {
|
||||
"Bearer": {
|
||||
"type": "http",
|
||||
"scheme": "bearer",
|
||||
"bearerFormat": "JWT",
|
||||
"description": "Enter JWT token (no 'Bearer' prefix needed)",
|
||||
}
|
||||
}
|
||||
# Áp dụng security toàn cục để UI biết cần Bearer
|
||||
openapi_schema["security"] = [{"Bearer": []}]
|
||||
|
||||
# Add security requirement to all paths except /auth/login
|
||||
if "paths" in openapi_schema:
|
||||
for path, path_item in openapi_schema["paths"].items():
|
||||
# Bỏ qua các endpoint auth
|
||||
if "/auth/" in path:
|
||||
continue
|
||||
# Thêm security cho từng operation nếu chưa có
|
||||
for method in ["get", "post", "put", "delete", "patch"]:
|
||||
if method in path_item:
|
||||
operation = path_item[method]
|
||||
if "security" not in operation:
|
||||
operation["security"] = [{"Bearer": []}]
|
||||
|
||||
app.openapi_schema = openapi_schema
|
||||
return app.openapi_schema
|
||||
|
||||
|
||||
app.openapi = custom_openapi
|
||||
|
||||
# Public API: system groups tree via ManageSystem (levels 0/1/2), API key + IP whitelist
|
||||
@app.post("/sync/system-groups", tags=["system_groups"])
|
||||
def system_groups_tree(
|
||||
request: Request,
|
||||
payload: Dict[str, Any],
|
||||
db: Session = Depends(get_db),
|
||||
):
|
||||
cfg_key = os.getenv("SYSTEM_GROUPS_API_KEY")
|
||||
if not cfg_key:
|
||||
raise HTTPException(status_code=500, detail="SYSTEM_GROUPS_API_KEY is not configured")
|
||||
use_key = str(payload.get("api_key") or "")
|
||||
if (use_key or "").strip() != cfg_key.strip():
|
||||
raise HTTPException(
|
||||
status_code=status.HTTP_401_UNAUTHORIZED,
|
||||
detail="Invalid API key",
|
||||
headers={"WWW-Authenticate": "ApiKey"},
|
||||
)
|
||||
wl = [x.strip() for x in (os.getenv("SYSTEM_GROUPS_WHITELIST_IPS") or "").split(",") if x.strip()]
|
||||
client_ip = request.client.host if request.client else ""
|
||||
if wl and client_ip not in wl:
|
||||
raise HTTPException(status_code=403, detail="IP not allowed")
|
||||
|
||||
items: List[models.ManageSystem] = db.query(models.ManageSystem).order_by(models.ManageSystem.level.asc(), models.ManageSystem.id.asc()).all()
|
||||
type_map = {
|
||||
0: "Web quản trị",
|
||||
1: "Web dịch vụ",
|
||||
2: "API",
|
||||
3: "Mobile app",
|
||||
4: "Khác",
|
||||
5: "CNTT",
|
||||
6: "ATTT",
|
||||
}
|
||||
nodes: Dict[int, Dict[str, Any]] = {}
|
||||
for it in items:
|
||||
tval = int(it.type) if getattr(it, "type", None) is not None else None
|
||||
nodes[int(it.id)] = {
|
||||
"id": int(it.id),
|
||||
"name": it.name,
|
||||
"level": int(it.level),
|
||||
"parent_id": int(it.parent_id) if getattr(it, "parent_id", None) is not None else None,
|
||||
"url_ip": getattr(it, "url_ip", None),
|
||||
"unit_id": int(it.unit_id) if getattr(it, "unit_id", None) is not None else None,
|
||||
"type": tval,
|
||||
"type_name": type_map.get(tval) if tval is not None else None,
|
||||
"private": bool(it.private) if getattr(it, "private", None) is not None else None,
|
||||
"priority_level": int(it.priority_level) if getattr(it, "priority_level", None) is not None else None,
|
||||
"status": bool(it.status) if getattr(it, "status", None) is not None else None,
|
||||
"children": [],
|
||||
}
|
||||
roots: List[Dict[str, Any]] = []
|
||||
for it in items:
|
||||
node = nodes[int(it.id)]
|
||||
pid = getattr(it, "parent_id", None)
|
||||
if pid is None:
|
||||
roots.append(node)
|
||||
else:
|
||||
parent = nodes.get(int(pid))
|
||||
if parent:
|
||||
parent["children"].append(node)
|
||||
else:
|
||||
roots.append(node)
|
||||
return {"message": "success", "data": roots}
|
||||
Reference in New Issue
Block a user