| # Overview |
|
|
| This is an Attestation Store application built with Flask that provides a secure system for storing, managing, and retrieving attestation evidence. The system supports multiple storage backends, RFC 5424 compliant logging, and provides both REST API endpoints and a web interface for managing attestations and system logs. |
|
|
| # User Preferences |
|
|
| Preferred communication style: Simple, everyday language. |
|
|
| # System Architecture |
|
|
| ## Backend Framework |
| - **Flask** as the core web framework with SQLAlchemy for database operations |
| - **Flask-JWT-Extended** for API authentication and authorization |
| - **Werkzeug** for password hashing and security utilities |
|
|
| ## Database Design |
| - Uses SQLAlchemy ORM with a declarative base model approach |
| - Core entities: |
| - **Users**: Authentication and user management |
| - **Attestations**: Storage metadata for evidence files with deduplication support |
| - **SystemLog**: RFC 5424 compliant logging entries |
| - **UploadSession**: Temporary upload session tracking |
| - Supports both SQLite (development) and PostgreSQL (production) through configurable DATABASE_URL |
| |
| ## Authentication & Authorization |
| - JWT-based authentication for API endpoints |
| - Session-based authentication for web interface |
| - Custom decorators (`jwt_required_with_logging`, `optional_jwt_with_logging`) that combine authentication with automatic audit logging |
| - Default admin user creation on first run |
| |
| ## Storage Architecture |
| - **Pluggable storage backends** through abstract `StorageBackend` interface |
| - **File Storage Backend**: Local filesystem storage with direct file serving |
| - **Cloud Storage Support**: Designed for AWS S3 and MinIO integration |
| - **Presigned URLs**: For secure direct uploads and downloads |
| - **Upload Session Management**: Temporary sessions for handling multi-part uploads |
| |
| ## Logging System |
| - **RFC 5424 compliant** structured logging |
| - Centralized logging through `logging_utils.py` |
| - Database storage of all system events |
| - Severity-based filtering (Emergency to Debug levels) |
| - Automatic user activity tracking and audit trails |
|
|
| ## API Structure |
| - **RESTful API design** with blueprint-based organization |
| - **Evidence API** (`/api/evidence`): Upload, retrieve, and manage attestations |
| - **Authentication API** (`/api/login`): User authentication endpoints |
| - **Syslog API** (`/api/syslog`): RFC 5424 log ingestion endpoint |
| - **Consistent error handling** with structured JSON responses |
|
|
| ## Web Interface |
| - **Bootstrap-based responsive design** with dark theme support |
| - **Template inheritance** using Jinja2 |
| - **Dashboard views** for attestations, logs, and system status |
| - **Real-time filtering and search** capabilities |
| - **File upload interface** with progress tracking |
|
|
| ## Configuration Management |
| - **Environment-based configuration** through the `Config` class |
| - **Storage backend selection** via STORAGE_TYPE environment variable |
| - **Flexible deployment options** supporting both development and production environments |
| - **Default credential setup** for initial deployment |
| |
| # External Dependencies |
| |
| ## Core Framework Dependencies |
| - **Flask**: Web framework and request handling |
| - **SQLAlchemy**: Database ORM and migrations |
| - **Flask-JWT-Extended**: JWT token management |
| - **Werkzeug**: WSGI utilities and security functions |
| |
| ## Storage Integration |
| - **boto3**: AWS S3 integration for cloud storage |
| - **minio**: MinIO client for self-hosted object storage |
| - **Local filesystem**: Default file storage backend |
| |
| ## Frontend Libraries |
| - **Bootstrap 5**: UI components and responsive design |
| - **Feather Icons**: Icon library for consistent UI elements |
| - **Axios**: HTTP client for API communication |
| |
| ## Database Support |
| - **SQLite**: Development and lightweight deployments |
| - **PostgreSQL**: Production database backend (configurable) |
| |
| ## Development Tools |
| - **Python logging**: Built-in logging with custom RFC 5424 formatting |
| - **Flask development server**: Built-in development environment |
