Upload 5 files

src/api/admin.py

@@ -1,22 +1,26 @@
-"""
-admin.py — LibBee v3.8
-Admin dashboard: session management, config store, RAG rebuild, metrics, system status.
-
-Changes over v3.2:
-- Login lockout: 5 failed attempts → 15 minute lockout per IP
-- Remaining attempts shown in error message
-- secure=True on session cookie
-- Login page JS shows server error message (lockout, remaining attempts)
-"""
+"""
+admin.py — LibBee v4.1
+Admin dashboard: session management, config store, RAG rebuild, metrics, system status.
+
+Security features:
+- Login lockout: 5 failed attempts → 15 minute lockout per IP
+- Remaining attempts shown in error message
+- secure=True on session cookie
+- Login page JS shows server error message (lockout, remaining attempts)
+- Short-lived read-only browser tokens for Worker analytics
+"""
 
 # ── Imports ────────────────────────────────────────────────────────────────────
 
-import json
-import os
-import secrets
-import secrets
-import time
-from typing import Any, Dict, Optional
+import base64
+import hashlib
+import hmac
+import json
+import os
+import secrets
+import time
+from typing import Any, Dict, Optional
+from urllib.parse import urlsplit
 
 from fastapi import APIRouter, HTTPException, Request, Response
 from fastapi.responses import HTMLResponse, RedirectResponse
@@ -138,6 +142,39 @@ def _escape_untrusted_json(value: Any) -> Any:
     if isinstance(value, dict):
         return {key: _escape_untrusted_json(item) for key, item in value.items()}
     return value
+
+
+def _clean_worker_url(raw: str) -> str:
+    """Return a browser-safe HTTPS Worker base URL or an empty string."""
+    value = str(raw or "").strip().strip('"').strip("'").rstrip("/")
+    try:
+        parsed = urlsplit(value)
+    except ValueError:
+        return ""
+    if parsed.scheme != "https" or not parsed.netloc or parsed.username or parsed.password:
+        return ""
+    if parsed.path not in {"", "/"} or parsed.query or parsed.fragment:
+        return ""
+    return value
+
+
+def _make_worker_browser_token(secret: str, now: Optional[int] = None) -> tuple[str, int]:
+    """Create a 90-second read-only token accepted by the v4.1 Worker."""
+    issued_at = int(time.time() if now is None else now)
+    expires_at = issued_at + 90
+    payload = {
+        "aud": "libbee-worker-admin",
+        "scope": "analytics:read",
+        "iat": issued_at,
+        "exp": expires_at,
+        "nonce": secrets.token_urlsafe(12),
+    }
+    raw_payload = json.dumps(payload, separators=(",", ":"), sort_keys=True).encode("utf-8")
+    encoded_payload = base64.urlsafe_b64encode(raw_payload).decode("ascii").rstrip("=")
+    signing_input = f"lb1.{encoded_payload}"
+    signature = hmac.new(secret.encode("utf-8"), signing_input.encode("ascii"), hashlib.sha256).digest()
+    encoded_signature = base64.urlsafe_b64encode(signature).decode("ascii").rstrip("=")
+    return f"{signing_input}.{encoded_signature}", expires_at
 
 
 # ── Pydantic Models ────────────────────────────────────────────────────────────
@@ -395,13 +432,65 @@ tr:last-child td{{border-bottom:none}}
 
 </div>
 <script>
-// Keep Worker credentials server-side. No admin token is serialized here.
-async function cfFetch(path){{
-  const response = await fetch('/admin'+path, {{credentials:'same-origin'}});
-  const data = await response.json();
-  if(!response.ok||data.detail) throw new Error('HTTP '+response.status+' '+(data.detail||''));
-  if(data.error) throw new Error(data.error.message||JSON.stringify(data.error));
-  return {{data, via:'server proxy'}};
+// The permanent Worker secret stays server-side. A logged-in administrator
+// receives only a read-only token that expires after 90 seconds.
+let CF_BROWSER_AUTH={{token:'',workerUrl:'',expiresAt:0}};
+
+function cfEscape(value){{
+  return String(value==null?'':value).replace(/[&<>"']/g, character=>({{
+    '&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'
+  }})[character]);
+}}
+
+function cfEscapeData(value){{
+  if(typeof value==='string') return cfEscape(value);
+  if(Array.isArray(value)) return value.map(cfEscapeData);
+  if(value&&typeof value==='object'){{
+    const out={{}};
+    Object.keys(value).forEach(key=>{{out[key]=cfEscapeData(value[key]);}});
+    return out;
+  }}
+  return value;
+}}
+
+async function cfBrowserAuth(forceRefresh){{
+  const now=Math.floor(Date.now()/1000);
+  if(!forceRefresh&&CF_BROWSER_AUTH.token&&CF_BROWSER_AUTH.expiresAt>now+10) return CF_BROWSER_AUTH;
+  const response=await fetch('/admin/worker-browser-token',{{
+    credentials:'same-origin',cache:'no-store',headers:{{'Accept':'application/json'}}
+  }});
+  const data=await response.json();
+  if(!response.ok||!data.token||!data.worker_url){{
+    throw new Error('HTTP '+response.status+' '+cfEscape(data.detail||'Worker authorization unavailable'));
+  }}
+  const target=new URL(data.worker_url);
+  if(target.protocol!=='https:'||target.pathname!=='/') throw new Error('Invalid Worker URL');
+  CF_BROWSER_AUTH={{token:data.token,workerUrl:data.worker_url.replace(/\\/$/,''),expiresAt:Number(data.expires_at||0)}};
+  return CF_BROWSER_AUTH;
+}}
+
+async function cfFetch(path,retried){{
+  if(!/^\\/(?:analytics|reports|canary)(?:\\/|\\?|$)/.test(path)) throw new Error('Unsupported Worker path');
+  const auth=await cfBrowserAuth(Boolean(retried));
+  let response;
+  try{{
+    response=await fetch(auth.workerUrl+path,{{
+      method:'GET',credentials:'omit',cache:'no-store',
+      headers:{{'Accept':'application/json','Authorization':'Bearer '+auth.token}}
+    }});
+  }}catch(error){{
+    throw new Error('Browser could not reach the Worker. Check ALLOWED_ORIGINS and CORS.');
+  }}
+  if(response.status===401&&!retried){{
+    CF_BROWSER_AUTH={{token:'',workerUrl:'',expiresAt:0}};
+    return cfFetch(path,true);
+  }}
+  const text=await response.text();
+  let data={{}};
+  try{{data=JSON.parse(text);}}catch(error){{throw new Error('Worker returned invalid JSON');}}
+  if(!response.ok||data.detail) throw new Error('HTTP '+response.status+' '+cfEscape(data.detail||data.error?.message||''));
+  if(data.error) throw new Error(cfEscape(data.error.message||JSON.stringify(data.error)));
+  return {{data:cfEscapeData(data),via:'short-lived browser token'}};
 }}
 
 async function loadStats(){{
@@ -814,8 +903,8 @@ setInterval(loadRecentQueries,60000);
 
 # ── API Endpoints ──────────────────────────────────────────────────────────────
 
-@router.get("/public-config")
-async def public_config():
+@router.get("/public-config")
+async def public_config():
     """No auth — returns public fields for the chat frontend."""
     try:
         cfg = _load_config()
@@ -826,7 +915,26 @@ async def public_config():
         "announcement": cfg.get("announcement", ""),
         "maintenance_mode": cfg.get("maintenance_mode", False),
         "maintenance_message": cfg.get("maintenance_message", ""),
-    }
+    }
+
+
+@router.get("/worker-browser-token")
+async def worker_browser_token(request: Request):
+    """Issue a short-lived read-only Worker token to a logged-in administrator."""
+    _require_session(request)
+    settings = get_settings()
+    worker_url = _clean_worker_url(settings.cloudflare_worker_url)
+    if not worker_url:
+        raise HTTPException(status_code=503, detail="CLOUDFLARE_WORKER_URL is missing or invalid")
+    if not settings.cloudflare_admin_token:
+        raise HTTPException(status_code=503, detail="CLOUDFLARE_ADMIN_TOKEN is not configured")
+    token, expires_at = _make_worker_browser_token(settings.cloudflare_admin_token)
+    return {
+        "worker_url": worker_url,
+        "token": token,
+        "expires_at": expires_at,
+        "scope": "analytics:read",
+    }
 
 
 @router.get("/config")
@@ -1110,17 +1218,14 @@ async def admin_worker_health(request: Request):
     # Interpretation
     if "error_type" in ver and "error_type" in out["probes"]["hours"]:
         et = ver.get("error_type")
-        if et in ("ConnectTimeout", "ConnectError", "ReadTimeout"):
-            out["verdict"] = (
-                f"{et}: the Space cannot open a connection to workers.dev, even "
-                f"on unauthenticated routes. Other outbound calls (OpenAI, "
-                f"OpenAlex) work, so this is host-specific - typically an "
-                f"unroutable IPv6 path or Cloudflare throttling shared "
-                f"workers.dev addresses from datacentre IPs. IPv4 is now forced; "
-                f"if this persists, put the Worker behind a custom domain "
-                f"(Worker > Settings > Domains & Routes > Add custom domain) and "
-                f"point CLOUDFLARE_WORKER_URL at that instead."
-            )
+        if et in ("ConnectTimeout", "ConnectError", "ReadTimeout"):
+            out["verdict"] = (
+                f"{et}: the HF server cannot open a connection to workers.dev. "
+                f"In v4.1 this legacy probe may continue to fail: the logged-in "
+                f"admin browser reads D1 with a 90-second token instead, and HF "
+                f"calls LibCal directly. Verify the dashboard rather than using "
+                f"this server-to-server probe as the acceptance test."
+            )
         else:
             out["verdict"] = (
                 f"No HTTP response from the Worker ({et}). Check that "