uploader-bot/app/api/routes/admin.py

602 lines
20 KiB
Python

from __future__ import annotations
import os
import platform as py_platform
import shutil
from collections import defaultdict
from datetime import datetime
from pathlib import Path
from typing import Any, Dict, List, Optional
from base58 import b58encode
from sanic import response
from sqlalchemy import func, select
from app.api.routes._system import get_git_info
from app.core._blockchain.ton.platform import platform
from app.core._config import (
BACKEND_DATA_DIR_HOST,
BACKEND_LOGS_DIR_HOST,
LOG_DIR,
PROJECT_HOST,
UPLOADS_DIR,
)
from app.core._secrets import hot_pubkey, service_wallet
from app.core.ipfs_client import bitswap_stat, id_info, repo_stat
from app.core.logger import make_log
from app.core.models._config import ServiceConfig, ServiceConfigValue
from app.core.models.content_v3 import (
ContentDerivative,
ContentIndexItem,
EncryptedContent,
IpfsSync,
UploadSession,
)
from app.core.models.my_network import KnownNode
from app.core.models.tasks import BlockchainTask
ADMIN_COOKIE_NAME = os.getenv('ADMIN_COOKIE_NAME', 'admin_session')
ADMIN_COOKIE_MAX_AGE = int(os.getenv('ADMIN_COOKIE_MAX_AGE', '172800')) # 48h default
ADMIN_COOKIE_SAMESITE = os.getenv('ADMIN_COOKIE_SAMESITE', 'Lax')
ADMIN_COOKIE_SECURE_MODE = os.getenv('ADMIN_COOKIE_SECURE', 'auto').lower()
ADMIN_HEADER_NAME = os.getenv('ADMIN_HEADER_NAME', 'X-Admin-Token')
def _cookie_secure_flag(request) -> bool:
if ADMIN_COOKIE_SECURE_MODE == 'true':
return True
if ADMIN_COOKIE_SECURE_MODE == 'false':
return False
# auto mode: follow request scheme
return getattr(request, 'scheme', 'http') == 'https'
def _set_admin_cookie(resp, request, value: str, max_age: Optional[int] = None):
resp.cookies[ADMIN_COOKIE_NAME] = value
cookie = resp.cookies[ADMIN_COOKIE_NAME]
cookie['path'] = '/'
cookie['httponly'] = True
cookie['samesite'] = ADMIN_COOKIE_SAMESITE
cookie['secure'] = _cookie_secure_flag(request)
if max_age is not None:
cookie['max-age'] = max_age
def _clear_admin_cookie(resp, request):
_set_admin_cookie(resp, request, '', max_age=0)
def _get_admin_header(request) -> Optional[str]:
target = ADMIN_HEADER_NAME.lower()
for key, value in request.headers.items():
if key.lower() == target:
return value
return None
def _auth_ok(request) -> bool:
token = os.getenv('ADMIN_API_TOKEN')
if not token:
return False
cookie_value = request.cookies.get(ADMIN_COOKIE_NAME)
if cookie_value == token:
return True
header_value = _get_admin_header(request)
if not header_value:
return False
if header_value.startswith('Bearer '):
header_value = header_value.split(' ', 1)[1].strip()
return header_value == token
def _unauthorized():
return response.json({"error": "UNAUTHORIZED"}, status=401)
def _ensure_admin(request):
if not _auth_ok(request):
return _unauthorized()
return None
def _dir_stats(label: str, path: str) -> Dict[str, Any]:
target = Path(path)
exists = target.exists()
size = 0
files = 0
if exists:
if target.is_file():
try:
stat = target.stat()
size = stat.st_size
files = 1
except OSError:
pass
else:
for child in target.rglob('*'):
try:
if child.is_file():
files += 1
size += child.stat().st_size
except OSError:
continue
return {
'label': label,
'path': str(target),
'exists': exists,
'file_count': files,
'size_bytes': size,
}
def _service_states(request) -> List[Dict[str, Any]]:
now = datetime.utcnow()
items: List[Dict[str, Any]] = []
memory = getattr(request.app.ctx, 'memory', None)
known_states = getattr(memory, 'known_states', {}) if memory else {}
if isinstance(known_states, dict):
for name, payload in known_states.items():
ts: Optional[datetime] = payload.get('timestamp') if isinstance(payload, dict) else None
delay = (now - ts).total_seconds() if ts else None
healthy = delay is not None and delay < 120
items.append({
'name': name,
'status': payload.get('status') if healthy else 'not working: timeout',
'last_reported_seconds': delay,
})
items.sort(key=lambda item: item['name'])
return items
async def s_api_v1_admin_login(request):
token = os.getenv('ADMIN_API_TOKEN')
if not token:
make_log('Admin', 'ADMIN_API_TOKEN is not configured', level='error')
return response.json({"error": "ADMIN_TOKEN_NOT_CONFIGURED"}, status=500)
payload = request.json or {}
provided = (payload.get('secret') or '').strip()
if provided != token:
resp = response.json({"error": "UNAUTHORIZED"}, status=401)
_clear_admin_cookie(resp, request)
return resp
resp = response.json({
"ok": True,
"cookie_name": ADMIN_COOKIE_NAME,
"header_name": ADMIN_HEADER_NAME,
"max_age": ADMIN_COOKIE_MAX_AGE,
})
_set_admin_cookie(resp, request, token, ADMIN_COOKIE_MAX_AGE)
return resp
async def s_api_v1_admin_logout(request):
resp = response.json({"ok": True})
_clear_admin_cookie(resp, request)
return resp
async def s_api_v1_admin_overview(request):
if (unauth := _ensure_admin(request)):
return unauth
session = request.ctx.db_session
branch, commit = get_git_info()
try:
ipfs_identity = await id_info()
except Exception as exc: # pragma: no cover - network failure path
ipfs_identity = {"error": str(exc)}
try:
bitswap = await bitswap_stat()
except Exception as exc: # pragma: no cover - network failure path
bitswap = {"error": str(exc)}
try:
repo = await repo_stat()
except Exception as exc: # pragma: no cover - network failure path
repo = {"error": str(exc)}
# Database counters
encrypted_total = (await session.execute(select(func.count()).select_from(EncryptedContent))).scalar_one()
upload_total = (await session.execute(select(func.count()).select_from(UploadSession))).scalar_one()
derivative_ready = (await session.execute(
select(func.count()).select_from(ContentDerivative).where(ContentDerivative.status == 'ready')
)).scalar_one()
node_id = b58encode(hot_pubkey).decode()
overview_payload = {
'project': {
'host': PROJECT_HOST,
'name': os.getenv('PROJECT_NAME', 'unknown'),
'privacy': os.getenv('NODE_PRIVACY', 'public'),
},
'codebase': {
'branch': branch,
'commit': commit,
},
'node': {
'id': node_id,
'service_wallet': service_wallet.address.to_string(1, 1, 1),
'ton_master': platform.address.to_string(1, 1, 1),
},
'runtime': {
'python': py_platform.python_version(),
'implementation': py_platform.python_implementation(),
'platform': py_platform.platform(),
'utc_now': datetime.utcnow().isoformat() + 'Z',
},
'ipfs': {
'identity': ipfs_identity,
'bitswap': bitswap,
'repo': repo,
},
'content': {
'encrypted_total': int(encrypted_total or 0),
'upload_sessions_total': int(upload_total or 0),
'derivatives_ready': int(derivative_ready or 0),
},
'ton': {
'host': os.getenv('TONCENTER_HOST'),
'api_key_configured': bool(os.getenv('TONCENTER_API_KEY')),
'testnet': bool(int(os.getenv('TESTNET', '0'))),
},
'services': _service_states(request),
}
return response.json(overview_payload)
async def s_api_v1_admin_storage(request):
if (unauth := _ensure_admin(request)):
return unauth
session = request.ctx.db_session
directories: List[Dict[str, Any]] = []
directories.append(_dir_stats('Encrypted uploads', UPLOADS_DIR))
directories.append(_dir_stats('Backend logs', LOG_DIR))
extra_dirs = {
'Host content mount': BACKEND_DATA_DIR_HOST,
'Host logs mount': BACKEND_LOGS_DIR_HOST,
'Tus staging': os.getenv('TUSD_DATA_DIR_HOST', ''),
}
for label, path in extra_dirs.items():
if path:
directories.append(_dir_stats(label, path))
disk_snapshot: Optional[Dict[str, Any]] = None
for entry in directories:
if entry['exists']:
try:
usage = shutil.disk_usage(entry['path'])
except Exception:
continue
disk_snapshot = {
'path': entry['path'],
'total_bytes': usage.total,
'used_bytes': usage.total - usage.free,
'free_bytes': usage.free,
'percent_used': round((usage.total - usage.free) / usage.total * 100, 2) if usage.total else None,
}
break
derivatives = (await session.execute(select(ContentDerivative))).scalars().all()
derivative_stats = {
'ready': sum(1 for d in derivatives if d.status == 'ready'),
'processing': sum(1 for d in derivatives if d.status == 'processing'),
'pending': sum(1 for d in derivatives if d.status == 'pending'),
'failed': sum(1 for d in derivatives if d.status == 'failed'),
'total_bytes': sum(int(d.size_bytes or 0) for d in derivatives if d.size_bytes),
}
storage_payload = {
'directories': directories,
'disk': disk_snapshot,
'derivatives': derivative_stats,
}
return response.json(storage_payload)
async def s_api_v1_admin_uploads(request):
if (unauth := _ensure_admin(request)):
return unauth
session = request.ctx.db_session
counts_rows = (await session.execute(
select(UploadSession.state, func.count()).group_by(UploadSession.state)
)).all()
counts = {state: int(count) for state, count in counts_rows}
total = sum(counts.values())
recent_rows = (await session.execute(
select(UploadSession).order_by(UploadSession.updated_at.desc()).limit(25)
)).scalars().all()
recent = [
{
'id': row.id,
'filename': row.filename,
'size_bytes': row.size_bytes,
'state': row.state,
'encrypted_cid': row.encrypted_cid,
'error': row.error,
'updated_at': row.updated_at.isoformat() + 'Z',
'created_at': row.created_at.isoformat() + 'Z',
}
for row in recent_rows
]
payload = {
'total': total,
'states': counts,
'recent': recent,
}
return response.json(payload)
async def s_api_v1_admin_system(request):
if (unauth := _ensure_admin(request)):
return unauth
session = request.ctx.db_session
config_rows = (await session.execute(select(ServiceConfigValue).order_by(ServiceConfigValue.key))).scalars().all()
config_payload = [
{'key': row.key, 'value': row.value, 'raw': row.packed_value}
for row in config_rows
]
env_summary = {
'PROJECT_NAME': os.getenv('PROJECT_NAME'),
'PROJECT_HOST': PROJECT_HOST,
'NODE_PRIVACY': os.getenv('NODE_PRIVACY'),
'SANIC_PORT': os.getenv('SANIC_PORT'),
'LOG_LEVEL': os.getenv('LOG_LEVEL'),
'TESTNET': os.getenv('TESTNET'),
}
blockchain_counts_rows = (await session.execute(
select(BlockchainTask.status, func.count()).group_by(BlockchainTask.status)
)).all()
blockchain_counts = {status: int(count) for status, count in blockchain_counts_rows}
latest_index = (await session.execute(
select(ContentIndexItem).order_by(ContentIndexItem.updated_at.desc()).limit(5)
)).scalars().all()
index_entries = [
{
'encrypted_cid': item.encrypted_cid,
'updated_at': item.updated_at.isoformat() + 'Z',
}
for item in latest_index
]
payload = {
'env': env_summary,
'service_config': config_payload,
'services': _service_states(request),
'blockchain_tasks': blockchain_counts,
'latest_index_items': index_entries,
}
return response.json(payload)
async def s_api_v1_admin_blockchain(request):
if (unauth := _ensure_admin(request)):
return unauth
session = request.ctx.db_session
counts_rows = (await session.execute(
select(BlockchainTask.status, func.count()).group_by(BlockchainTask.status)
)).all()
counts = {status: int(count) for status, count in counts_rows}
recent_rows = (await session.execute(
select(BlockchainTask).order_by(BlockchainTask.updated.desc()).limit(20)
)).scalars().all()
recent = [
{
'id': task.id,
'destination': task.destination,
'amount': task.amount,
'status': task.status,
'epoch': task.epoch,
'seqno': task.seqno,
'transaction_hash': task.transaction_hash,
'updated': task.updated.isoformat() + 'Z',
}
for task in recent_rows
]
payload = {
'counts': counts,
'recent': recent,
}
return response.json(payload)
async def s_api_v1_admin_node_setrole(request):
if (unauth := _ensure_admin(request)):
return unauth
data = request.json or {}
role = (data.get('role') or '').strip()
if role not in ('trusted', 'read-only', 'deny'):
return response.json({"error": "BAD_ROLE"}, status=400)
pub = (data.get('public_key') or '').strip()
host = (data.get('host') or '').strip()
if not pub and not host:
return response.json({"error": "MISSING_TARGET"}, status=400)
session = request.ctx.db_session
row = None
if pub:
row = (await session.execute(select(KnownNode).where(KnownNode.public_key == pub))).scalars().first()
if not row and host:
row = (await session.execute(select(KnownNode).where(KnownNode.ip == host))).scalars().first()
if not row:
return response.json({"error": "NOT_FOUND"}, status=404)
meta = row.meta or {}
meta['role'] = role
row.meta = meta
await session.commit()
return response.json({"ok": True, "node": {"ip": row.ip, "public_key": row.public_key, "role": role}})
async def s_api_v1_admin_nodes(request):
if (unauth := _ensure_admin(request)):
return unauth
session = request.ctx.db_session
rows = (await session.execute(select(KnownNode))).scalars().all()
items = []
for r in rows:
meta = r.meta or {}
items.append({
"ip": r.ip,
"port": r.port,
"public_key": r.public_key,
"role": meta.get('role') or 'read-only',
"version": meta.get('version'),
"last_seen": (r.last_sync.isoformat() + 'Z') if r.last_sync else None,
"notes": meta.get('notes'),
})
return response.json({"items": items})
async def s_api_v1_admin_status(request):
if (unauth := _ensure_admin(request)):
return unauth
session = request.ctx.db_session
pin_counts: Dict[str, int] = defaultdict(int)
rows = (await session.execute(select(IpfsSync))).scalars().all()
for r in rows:
pin_counts[r.pin_state] += 1
deriv = (await session.execute(select(ContentDerivative))).scalars().all()
deriv_counts = {
'ready': sum(1 for d in deriv if d.status == 'ready'),
'processing': sum(1 for d in deriv if d.status == 'processing'),
'pending': sum(1 for d in deriv if d.status == 'pending'),
'failed': sum(1 for d in deriv if d.status == 'failed'),
}
total_deriv_bytes = sum(int(d.size_bytes or 0) for d in deriv)
ec = (await session.execute(select(EncryptedContent))).scalars().all()
backlog = 0
for e in ec:
if not e.preview_enabled:
continue
kinds = [d.kind for d in deriv if d.content_id == e.id and d.status == 'ready']
req = {'decrypted_low', 'decrypted_high', 'decrypted_preview'}
if not req.issubset(set(kinds)):
backlog += 1
try:
bs = await bitswap_stat()
except Exception:
bs = {}
try:
rs = await repo_stat()
except Exception:
rs = {}
cfg = ServiceConfig(session)
max_gb = await cfg.get('DERIVATIVE_CACHE_MAX_GB', os.getenv('DERIVATIVE_CACHE_MAX_GB', '50'))
ttl_days = await cfg.get('DERIVATIVE_CACHE_TTL_DAYS', os.getenv('DERIVATIVE_CACHE_TTL_DAYS', '0'))
max_pins = await cfg.get('SYNC_MAX_CONCURRENT_PINS', os.getenv('SYNC_MAX_CONCURRENT_PINS', '4'))
disk_pct = await cfg.get('SYNC_DISK_LOW_WATERMARK_PCT', os.getenv('SYNC_DISK_LOW_WATERMARK_PCT', '90'))
return response.json({
'ipfs': {'bitswap': bs, 'repo': rs},
'pin_counts': dict(pin_counts),
'derivatives': {**deriv_counts, 'total_bytes': total_deriv_bytes},
'convert_backlog': backlog,
'limits': {
'DERIVATIVE_CACHE_MAX_GB': float(max_gb),
'DERIVATIVE_CACHE_TTL_DAYS': int(ttl_days),
'SYNC_MAX_CONCURRENT_PINS': int(max_pins),
'SYNC_DISK_LOW_WATERMARK_PCT': int(disk_pct),
}
})
async def s_api_v1_admin_cache_setlimits(request):
if (unauth := _ensure_admin(request)):
return unauth
data = request.json or {}
max_gb = float(data.get('max_gb'))
ttl_days = int(data.get('ttl_days'))
cfg = ServiceConfig(request.ctx.db_session)
await cfg.set('DERIVATIVE_CACHE_MAX_GB', max_gb)
await cfg.set('DERIVATIVE_CACHE_TTL_DAYS', ttl_days)
return response.json({"ok": True})
async def s_api_v1_admin_cache_cleanup(request):
if (unauth := _ensure_admin(request)):
return unauth
data = request.json or {}
mode = (data.get('mode') or 'fit')
removed = 0
from datetime import timedelta
session = request.ctx.db_session
if mode == 'ttl':
cfg = ServiceConfig(session)
ttl = int(await cfg.get('DERIVATIVE_CACHE_TTL_DAYS', os.getenv('DERIVATIVE_CACHE_TTL_DAYS', '0')))
if ttl > 0:
now = datetime.utcnow()
rows = (await session.execute(select(ContentDerivative).where(ContentDerivative.status == 'ready'))).scalars().all()
for r in rows:
la = r.last_access_at or r.created_at
if la and (now - la) > timedelta(days=ttl):
try:
if r.local_path and os.path.exists(r.local_path):
os.remove(r.local_path)
except Exception:
pass
r.status = 'pending'
r.local_path = None
r.size_bytes = None
r.last_access_at = None
removed += 1
await session.commit()
else:
target_gb = float(data.get('max_gb') or 0)
if target_gb <= 0:
return response.json({"error": "BAD_MAX_GB"}, status=400)
limit_bytes = int(target_gb * (1024 ** 3))
rows = (await session.execute(select(ContentDerivative).where(ContentDerivative.status == 'ready'))).scalars().all()
rows.sort(key=lambda r: (r.last_access_at or r.created_at or datetime.utcfromtimestamp(0)))
total = sum(int(r.size_bytes or 0) for r in rows)
for r in rows:
if total <= limit_bytes:
break
try:
if r.local_path and os.path.exists(r.local_path):
os.remove(r.local_path)
except Exception:
pass
total -= int(r.size_bytes or 0)
r.status = 'pending'
r.local_path = None
r.size_bytes = None
r.last_access_at = None
removed += 1
await session.commit()
return response.json({"ok": True, "removed": removed})
async def s_api_v1_admin_sync_setlimits(request):
if (unauth := _ensure_admin(request)):
return unauth
data = request.json or {}
max_pins = int(data.get('max_concurrent_pins'))
disk_pct = int(data.get('disk_low_watermark_pct'))
cfg = ServiceConfig(request.ctx.db_session)
await cfg.set('SYNC_MAX_CONCURRENT_PINS', max_pins)
await cfg.set('SYNC_DISK_LOW_WATERMARK_PCT', disk_pct)
return response.json({"ok": True})