mirror of
https://github.com/Donkie/Spoolman.git
synced 2026-10-22 01:52:17 -05:00
Donkie
7d4728ae9b
Tasks 1-3 of the backend security audit all need to answer "is this browser
origin someone we trust". Build it once, driven entirely by the existing
SPOOLMAN_CORS_ORIGIN rather than a new env var.
- Unset means same-origin only, which is right for nearly every deployment.
Non-browser clients (Moonraker, OctoPrint) send no Origin and are unaffected.
- A list means those origins plus our own.
- "*" and debug mode mean "I do not want origin checks" and are honoured as
such, with a loud startup warning. An operator who writes "*" is opting out;
reinterpreting it as something narrower would leave them no way to say so.
Also accept X-Forwarded-Host, so a reverse proxy that rewrites Host (nginx
without proxy_set_header Host $host, Apache without ProxyPreserveHost On) does
not see the guard reject its own web UI. A malicious page cannot set that
header on any of the vectors the guard exists to stop: forms cannot set request
headers, nor can the browser WebSocket API, and a fetch that adds one needs a
CORS preflight it will not get.
get_cors_origin() now normalizes its entries -- it was a bare split(","), so
"https://a, https://b" yielded " https://b", which no Origin header can match.
CORS itself benefits from the same fix. The raw value is kept in the startup
log so a typo stays visible.
Adds tests/ for backend unit tests, runnable with `poe test` and wired into the
lefthook ci group. Nothing enforces this helper yet; that is tasks 1-3.
112 lines
2.8 KiB
TOML
112 lines
2.8 KiB
TOML
[project]
|
|
name = "spoolman"
|
|
version = "0.24.0"
|
|
description = "A web service that keeps track of 3D printing spools."
|
|
license = "MIT"
|
|
readme = "README.md"
|
|
authors = [{ name = "Donkie", email = "daniel.cf.hultgren@gmail.com" }]
|
|
dependencies = [
|
|
"uvicorn~=0.34",
|
|
"httptools>=0.6.4; platform_machine != \"armv7l\"",
|
|
"uvloop!=0.15.0,!=0.15.1,>=0.21.0; platform_machine != \"armv7l\" and sys_platform != \"win32\" and (sys_platform != \"cygwin\" and platform_python_implementation != \"PyPy\")",
|
|
"fastapi~=0.115",
|
|
"SQLAlchemy[aiomysql,aiosqlite,asyncio,postgresql_asyncpg]~=2.0",
|
|
"pydantic~=2.10",
|
|
"platformdirs~=4.3",
|
|
"alembic~=1.15",
|
|
"scheduler~=0.8",
|
|
"sqlalchemy-cockroachdb~=2.0",
|
|
"asyncpg~=0.30",
|
|
"psycopg2-binary~=2.9",
|
|
"setuptools~=78.1",
|
|
"WebSockets~=15.0",
|
|
"prometheus-client~=0.21",
|
|
"httpx~=0.28",
|
|
"hishel~=0.1",
|
|
"aiomysql[rsa]~=0.3",
|
|
]
|
|
requires-python = ">=3.10"
|
|
|
|
[dependency-groups]
|
|
dev = [
|
|
"ruff==0.14.10",
|
|
"pytest~=9.1.1",
|
|
"pytest-asyncio~=1.4.0",
|
|
"httpx~=0.28.1",
|
|
"poethepoet>=0.40.0",
|
|
]
|
|
|
|
[tool.poe.tasks.generate-docs]
|
|
script = "spoolman.docs:generate_docs"
|
|
help = "Generate API documentation for Spoolman."
|
|
|
|
[tool.poe.tasks.bump]
|
|
script = "spoolman.bump:bump"
|
|
help = "Bump Spoolman version."
|
|
|
|
[tool.poe.tasks.run]
|
|
cmd = "uvicorn spoolman.main:app"
|
|
help = "Start Spoolman."
|
|
|
|
[tool.poe.tasks.test]
|
|
cmd = "pytest tests"
|
|
help = "Runs the backend unit tests. These need no database or running server."
|
|
|
|
[tool.poe.tasks.itest]
|
|
cmd = "python tests_integration/run.py"
|
|
help = "Builds Spoolman and runs integration tests on the backend against all supported databases."
|
|
|
|
[tool.poe.tasks.itest-frontend]
|
|
cmd = "python tests_frontend/run.py"
|
|
help = "Builds Spoolman and runs Playwright frontend integration tests against a real deployment."
|
|
|
|
[tool.bumpversion]
|
|
current_version = "0.22.1"
|
|
parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<patch>\\d+)"
|
|
serialize = ["{major}.{minor}.{patch}"]
|
|
allow_dirty = false
|
|
|
|
[[tool.bumpversion.files]]
|
|
filename = "pyproject.toml"
|
|
search = 'version = "{current_version}"'
|
|
replace = 'version = "{new_version}"'
|
|
|
|
[tool.pytest.ini_options]
|
|
# Only the unit tests. tests_integration needs a live server and is run via `poe itest`.
|
|
testpaths = ["tests"]
|
|
|
|
[tool.ruff]
|
|
line-length = 120
|
|
target-version = "py310"
|
|
extend-exclude = ["client_v2"]
|
|
|
|
[tool.ruff.lint]
|
|
select = ["ALL"]
|
|
ignore = [
|
|
"A003",
|
|
"COM812",
|
|
"D101",
|
|
"D104",
|
|
"D203",
|
|
"D213",
|
|
"D406",
|
|
"D407",
|
|
"DTZ003",
|
|
"EM101",
|
|
"EM102",
|
|
"FA100",
|
|
"FIX002",
|
|
"PLR0913",
|
|
"S104",
|
|
"S603",
|
|
"SIM108",
|
|
"TD002",
|
|
"TD003",
|
|
"TRY003",
|
|
"TRY201",
|
|
]
|
|
|
|
[tool.ruff.lint.per-file-ignores]
|
|
"tests*/*" = ["ANN201", "ASYNC210", "S101", "PLR2004", "D103", "TID252"]
|
|
"migrations/versions/*" = ["N999"]
|