"""Vendor related endpoints.""" import asyncio import logging from typing import Annotated from fastapi import APIRouter, Body, Depends, HTTPException, Request, WebSocket, WebSocketDisconnect from fastapi.responses import JSONResponse from sqlalchemy.ext.asyncio import AsyncSession from spoolman.api.v1.models import Message, SettingEvent, SettingResponse from spoolman.database import setting from spoolman.database.database import get_db_session from spoolman.exceptions import ItemNotFoundError from spoolman.extra_field_registry import invalidate_extra_field_cache, validate_extra_field_setting from spoolman.settings import SETTINGS, parse_setting from spoolman.ws import websocket_manager router = APIRouter( prefix="/setting", tags=["setting"], ) # ruff: noqa: D103 logger = logging.getLogger(__name__) async def require_json_content_type(request: Request) -> None: """Reject a request body that is not declared as JSON. This endpoint takes a bare ``str`` body, and FastAPI only JSON-parses ``application/*json``; anything else arrives as raw bytes that lax-mode ``str`` happily coerces. That makes a ``text/plain`` body acceptable, which is exactly what ``
`` sends -- so any website could silently rewrite settings through the visitor's browser. HTML forms can only send ``text/plain``, ``application/x-www-form-urlencoded`` or ``multipart/form-data``, so insisting on JSON here removes the whole class of form-driven writes. Note that ``Body(media_type=...)`` does *not* do this: it only annotates the OpenAPI schema and is not enforced at runtime. Args: request: The incoming request. Raises: HTTPException: 415 if the content type is not JSON. """ media_type = request.headers.get("content-type", "").split(";")[0].strip().lower() if media_type != "application/json" and not media_type.endswith("+json"): raise HTTPException( status_code=415, detail=( f"Unsupported content type {media_type!r}. The body of this endpoint must be sent as application/json." ), ) @router.websocket( "", name="Listen to setting changes", ) async def notify_any( websocket: WebSocket, ) -> None: await websocket.accept() websocket_manager.connect(("setting",), websocket) try: while True: await asyncio.sleep(0.5) if await websocket.receive_text(): await websocket.send_json({"status": "healthy"}) except WebSocketDisconnect: websocket_manager.disconnect(("setting",), websocket) @router.get( "/{key}", name="Get setting", description=( "Get a specific setting. If the setting has not been set, the default value will be returned." "A websocket is served on the same path to listen for changes to the setting. " "See the HTTP Response code 299 for the content of the websocket messages." ), response_model_exclude_none=True, response_model=SettingResponse, responses={404: {"model": Message}, 299: {"model": SettingEvent, "description": "Websocket message"}}, ) async def get( db: Annotated[AsyncSession, Depends(get_db_session)], key: str, ) -> SettingResponse | JSONResponse: try: definition = parse_setting(key) except ValueError as e: return JSONResponse(status_code=404, content=Message(message=str(e)).dict()) try: db_item = await setting.get(db, definition) value = db_item.value is_set = True except ItemNotFoundError: value = definition.default is_set = False return SettingResponse( value=value, is_set=is_set, type=definition.type, ) @router.get( "/", name="Get all settings", description=("Get all settings, set or not. If the setting has not been set, 'value' will be the default value."), response_model_exclude_none=True, response_model=dict[str, SettingResponse], ) async def find( db: Annotated[AsyncSession, Depends(get_db_session)], ) -> dict[str, SettingResponse] | JSONResponse: settings: dict[str, SettingResponse] = {} # First get all settings that have been set. db_items = await setting.get_all(db) for db_item in db_items: try: definition = parse_setting(db_item.key) except ValueError: continue # Ignore settings that have been removed. settings[db_item.key] = SettingResponse( value=db_item.value, is_set=True, type=definition.type, ) # Then get all settings that have not been set. for settingdef in SETTINGS.values(): if settingdef.key not in settings: settings[settingdef.key] = SettingResponse( value=settingdef.default, is_set=False, type=settingdef.type, ) return settings @router.websocket( "/{key}", name="Listen to setting changes", ) async def notify( websocket: WebSocket, key: str, ) -> None: try: parse_setting(key) except ValueError as e: await websocket.close(code=4040, reason=str(e)) return await websocket.accept() websocket_manager.connect(("setting", str(key)), websocket) try: while True: await asyncio.sleep(0.5) if await websocket.receive_text(): await websocket.send_json({"status": "healthy"}) except WebSocketDisconnect: websocket_manager.disconnect(("setting", str(key)), websocket) @router.post( "/{key}", name="Set setting", description=( "Set the value of a setting. The body must match the JSON type of the setting. " "An empty body or a body containing only 'null' will reset the setting to its default value. " "The new value will be returned." ), response_model_exclude_none=True, response_model=SettingResponse, responses={404: {"model": Message}, 415: {"model": Message}}, dependencies=[Depends(require_json_content_type)], ) async def update( db: Annotated[AsyncSession, Depends(get_db_session)], key: str, body: Annotated[str, Body(media_type="application/json")], ) -> SettingResponse | JSONResponse: try: definition = parse_setting(key) except ValueError as e: return JSONResponse(status_code=404, content=Message(message=str(e)).dict()) if body and body != "null": try: definition.validate_type(body) # The extra-field settings feed a registry that the /field endpoints and every entity # response depend on. Writing a malformed one through here used to be accepted and then # wedged GET /field/{entity} into a permanent 500, so validate the shape up front. validate_extra_field_setting(key, body) except ValueError as e: return JSONResponse(status_code=400, content=Message(message=str(e)).dict()) try: # Raised when the value exceeds the column limit; a client error, not a server one. await setting.update(db=db, definition=definition, value=body) except ValueError as e: return JSONResponse(status_code=400, content=Message(message=str(e)).dict()) logger.info('Setting "%s" has been set to "%s".', key, body) else: await setting.delete(db=db, definition=definition) logger.info('Setting "%s" has been unset.', key) await db.commit() # The registry caches extra fields in memory and is otherwise only refreshed by the /field # endpoints, so without this the two paths disagree until the next restart. invalidate_extra_field_cache(key) # Get the new value of the setting. try: db_item = await setting.get(db, definition) value = db_item.value is_set = True except ItemNotFoundError: value = definition.default is_set = False return SettingResponse( value=value, is_set=is_set, type=definition.type, )