mirror of
https://github.com/Donkie/Spoolman.git
synced 2026-10-22 01:52:17 -05:00
Donkie
5ef6401e2b
Adds GET /auth/config, POST /auth/setup, POST /auth/login, POST /auth/logout, GET /auth/session and POST /auth/password, plus the Pydantic models behind them. This is the commit that makes authentication usable. Every endpoint returns a JSON body rather than a bare 204, because the client's fetch helpers parse a body unconditionally and an empty response would surface as a parse failure. The five that bootstrap a session are allow-listed as public and check for themselves -- requiring a credential to obtain a credential would be circular. Anti-enumeration is the part worth reviewing: - Every failed sign-in returns one identical message, so "no such user" and "wrong password" are indistinguishable in the body. - Unknown, disabled and password-less accounts still spend a full scrypt verification via dummy_verify, so they are indistinguishable in timing too. Measured: an unknown username costs 47 ms, matching a real verify. Skipping it would make a missing account return in about a millisecond and hand out a list of valid usernames. - The locked-account path deliberately does NOT spend a hash. The answer is already decided, and burning 50 ms of CPU per attempt against a single-process server is a self-inflicted denial of service. Also corrects a throttling design fault found by testing it. The in-memory per-username window and the persisted failed_logins/locked_until pair were two mechanisms for the same job, and the cruder one won: five failures produced a flat 15 minute lockout from the window, making the graduated schedule on the user row unreachable dead code. The per-username window is removed. Per-account throttling is now the persisted lockout alone, which is graduated and survives a restart, and the per-address window stays for what the persisted counter cannot see -- guesses sprayed across many usernames, including ones that do not exist. Setup resolves a race on the unique username index rather than trusting its own count check, so two callers reaching an unclaimed instance together cannot both become owner. Claiming is logged at warning level with the claiming address. Verified end to end: config reports setup_required before the first account and not after; a second claim is rejected with 409; usernames are stored and matched case-insensitively; cookies come back HttpOnly, SameSite=lax, and without Secure over plain HTTP; "remember me" adds Max-Age and its absence does not; a cookie-authenticated POST without the CSRF header is refused and succeeds with it; sign-out revokes server-side; password change rejects a wrong current password and the new password works afterwards. Lockout now follows the intended 60s schedule doubling to a 900s cap, and a correct password during a lockout is still refused. The existing integration suite still passes unedited with auth off: 372 tests.
Keep track of your inventory of 3D-printer filament spools.
Spoolman is a self-hosted web service designed to help you efficiently manage your 3D printer filament spools and monitor their usage. It acts as a centralized database that seamlessly integrates with popular 3D printing software like OctoPrint and Klipper/Moonraker. When connected, it automatically updates spool weights as printing progresses, giving you real-time insights into filament usage.
Features
- Filament Management: Keep comprehensive records of filament types, manufacturers, and individual spools.
- API Integration: The REST API allows easy integration with other software, facilitating automated workflows and data exchange.
- Real-Time Updates: Stay informed with live spool updates through Websockets, providing immediate feedback during printing operations.
- Central Filament Database: A community-supported database of manufacturers and filaments simplify adding new spools to your inventory. Contribute by heading to SpoolmanDB.
- Web-Based Client: Spoolman includes a built-in web client that lets you manage data effortlessly:
- View, create, edit, and delete filament data.
- Add custom fields to tailor information to your specific needs.
- Print labels with QR codes for easy spool identification and tracking.
- Contribute to its translation into 18 languages via Weblate.
- Database Support: SQLite, PostgreSQL, MySQL, and CockroachDB.
- Multi-Printer Management: Handles spool updates from several printers simultaneously.
- Advanced Monitoring: Integrate with Prometheus for detailed historical analysis of filament usage, helping you track and optimize your printing processes. See the Wiki for instructions on how to set it up.
Spoolman integrates with:
- Moonraker and most front-ends (Fluidd, KlipperScreen, Mainsail, ...)
- OctoPrint
- OctoEverywhere
- Home Assistant
- MCP Server - Manage your filament inventory through AI assistants like Claude using the Model Context Protocol
Web client preview:
Installation
Please see the Installation page on the Wiki for details how to install Spoolman.