first commit

backend/app/api/routes_routers.py

@@ -0,0 +1,93 @@
+import json
+from fastapi import APIRouter, Depends, HTTPException, Request
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy import select, delete
+
+from app.api.deps import db_session, get_current_user, require_admin
+from app.core.security import encrypt_secret, CSRF_COOKIE
+from app.models.user import User
+from app.models.router import Router, RouterCredential, CredentialMethod
+from app.models.dashboard import Permission
+from app.schemas.router import RouterCreate, RouterOut, CredentialCreate
+
+router = APIRouter()
+
+def require_csrf(request: Request):
+    # minimalny CSRF: nagłówek X-CSRF-Token musi równać się cookie mt_csrf
+    cookie = request.cookies.get(CSRF_COOKIE)
+    header = request.headers.get("X-CSRF-Token")
+    if not cookie or not header or cookie != header:
+        raise HTTPException(status_code=403, detail="CSRF check failed")
+
+@router.get("", response_model=list[RouterOut])
+async def list_routers(user: User = Depends(get_current_user), session: AsyncSession = Depends(db_session)):
+    if user.role == "admin":
+        res = await session.execute(select(Router))
+        rows = res.scalars().all()
+    else:
+        res = await session.execute(
+            select(Router).join(Permission, Permission.router_id == Router.id)
+            .where(Permission.user_id == user.id, Permission.can_view == True)  # noqa
+        )
+        rows = res.scalars().all()
+    return [RouterOut(
+        id=r.id, name=r.name, host=r.host,
+        port_rest=r.port_rest, port_ssh=r.port_ssh, port_api=r.port_api,
+        verify_ssl=r.verify_ssl, preferred_method=r.preferred_method,
+        tags=r.tags
+    ) for r in rows]
+
+@router.post("", response_model=RouterOut)
+async def create_router(payload: RouterCreate, request: Request, user: User = Depends(get_current_user), session: AsyncSession = Depends(db_session)):
+    require_admin(user)
+    require_csrf(request)
+    r = Router(**payload.model_dump())
+    session.add(r)
+    await session.commit()
+    await session.refresh(r)
+    return RouterOut(
+        id=r.id, name=r.name, host=r.host,
+        port_rest=r.port_rest, port_ssh=r.port_ssh, port_api=r.port_api,
+        verify_ssl=r.verify_ssl, preferred_method=r.preferred_method, tags=r.tags
+    )
+
+@router.post("/{router_id}/credentials")
+async def add_credential(router_id: int, payload: CredentialCreate, request: Request, user: User = Depends(get_current_user), session: AsyncSession = Depends(db_session)):
+    require_admin(user)
+    require_csrf(request)
+    res = await session.execute(select(Router).where(Router.id == router_id))
+    r = res.scalar_one_or_none()
+    if not r:
+        raise HTTPException(status_code=404, detail="Router not found")
+
+    method = payload.method.lower()
+    if method not in ("rest", "ssh", "api"):
+        raise HTTPException(status_code=400, detail="Bad method")
+
+    c = RouterCredential(
+        router_id=router_id,
+        method=CredentialMethod(method),
+        username=payload.username,
+        secret_encrypted=encrypt_secret(payload.secret),
+        extra_json=json.dumps(payload.extra_json or {}),
+    )
+    session.add(c)
+    await session.commit()
+    return {"ok": True}
+
+@router.post("/{router_id}/grant")
+async def grant_router(router_id: int, target_user_id: int, can_edit: bool = False, request: Request = None,
+                      user: User = Depends(get_current_user), session: AsyncSession = Depends(db_session)):
+    require_admin(user)
+    require_csrf(request)
+    # upsert permission
+    res = await session.execute(select(Permission).where(Permission.user_id == target_user_id, Permission.router_id == router_id))
+    p = res.scalar_one_or_none()
+    if not p:
+        p = Permission(user_id=target_user_id, router_id=router_id, can_view=True, can_edit=can_edit)
+        session.add(p)
+    else:
+        p.can_view = True
+        p.can_edit = bool(can_edit)
+    await session.commit()
+    return {"ok": True}