1673 lines
60 KiB
Python
1673 lines
60 KiB
Python
"""REST API routes and SSE endpoint.
|
||
|
||
Multi-user rules enforced here:
|
||
- Every data route operates on `current_user_id()` (session user).
|
||
- User management (/api/admin/*) is Root-only and requires re-authentication
|
||
(TOTP first, Passkey fallback) for register/edit/delete.
|
||
- Temp accounts log in with a server-held temp TOTP; they are forced through
|
||
the MFA setup page until they configure (and verify) one real login method,
|
||
at which point the temp TOTP is invalidated.
|
||
"""
|
||
import json
|
||
import os
|
||
import queue
|
||
import io
|
||
import time as _time
|
||
import secrets
|
||
from datetime import datetime
|
||
from flask import (
|
||
Blueprint, request, jsonify, Response,
|
||
render_template, current_app, stream_with_context,
|
||
session, redirect, url_for,
|
||
)
|
||
from backend import calendar_mgr, weather_mgr, alarm_mgr, pomodoro_mgr, countdown_mgr
|
||
from backend.auth import (
|
||
login_required, login_or_temp_required, display_login_required, admin_required,
|
||
is_authenticated, is_temp_pending, is_admin, current_user_id,
|
||
set_authenticated, set_temp_pending, clear_session,
|
||
verify_login, verify_totp, verify_recovery_code,
|
||
check_rate_limit, record_failure, record_success,
|
||
require_reauth, mark_reauth, generate_recovery_codes, generate_temp_password,
|
||
)
|
||
from backend.models import (
|
||
get_auth_config, update_auth_config, set_temp_password, clear_temp_password,
|
||
set_recovery_codes, get_recovery_codes, has_mfa_configured,
|
||
get_display_config, set_display_mode, set_custom_html,
|
||
set_custom_html_template, apply_custom_html,
|
||
get_users, get_user, create_user, update_user, delete_user,
|
||
is_temp_account, is_admin_user, finalize_temp_account,
|
||
find_user_by_credential_id, bump_all_session_versions,
|
||
)
|
||
from backend.webauthn_mgr import (
|
||
begin_registration, complete_registration,
|
||
begin_authentication, complete_authentication,
|
||
)
|
||
|
||
|
||
api = Blueprint("api", __name__)
|
||
|
||
|
||
def _cur() -> int:
|
||
"""Current session user id (0 = Root default)."""
|
||
return current_user_id() or 0
|
||
|
||
|
||
# ════════════════════════════════════════════
|
||
# CSRF / Origin Check
|
||
# ════════════════════════════════════════════
|
||
|
||
@api.before_request
|
||
def _check_origin():
|
||
"""Protect state-changing requests against CSRF by verifying Origin/Referer.
|
||
Allows same-origin requests, extension-internal calls, and GET/HEAD/OPTIONS.
|
||
"""
|
||
if request.method in ("GET", "HEAD", "OPTIONS"):
|
||
return None
|
||
|
||
# Login / logout endpoints are exempt (they set/clear the cookie itself)
|
||
if request.path in ("/api/auth/login", "/api/auth/logout", "/api/auth/login/recovery",
|
||
"/api/auth/webauthn/login/begin", "/api/auth/webauthn/login/complete",
|
||
"/login", "/mfa-setup"):
|
||
return None
|
||
|
||
origin = request.headers.get("Origin", "")
|
||
referer = request.headers.get("Referer", "")
|
||
|
||
# Build expected origin from the request itself
|
||
expected = f"{request.scheme}://{request.host}"
|
||
|
||
if origin and origin != expected:
|
||
return jsonify({"error": "CSRF: Origin mismatch"}), 403
|
||
if referer and not referer.startswith(expected):
|
||
# Referer may include path, so we only check the prefix
|
||
return jsonify({"error": "CSRF: Referer mismatch"}), 403
|
||
|
||
return None
|
||
|
||
|
||
# ════════════════════════════════════════════
|
||
# AUTH
|
||
# ════════════════════════════════════════════
|
||
|
||
@api.route("/login")
|
||
def login_page():
|
||
"""Render login page. Control gets a full-input page; display gets a numpad."""
|
||
next_url = request.args.get("next", "/")
|
||
view = request.args.get("view", "display")
|
||
if view == "control" or "control" in next_url:
|
||
return render_template("login_control.html", next=next_url)
|
||
return render_template("login.html", next=next_url)
|
||
|
||
|
||
@api.route("/register-request")
|
||
def register_request_page():
|
||
"""Public page where a prospective user fills in their info (admin approves later)."""
|
||
return render_template("register_request.html")
|
||
|
||
|
||
@api.route("/passkey")
|
||
def passkey_page():
|
||
"""Passkey bridge page: loaded inside the ASWebAuthenticationSession sheet
|
||
(Safari environment supports WebAuthn/passkeys WITHOUT app associated
|
||
domains). It fetches the stashed {op, options}, runs the standard
|
||
WebAuthn ceremony, then redirects back via dashboard://passkey."""
|
||
return render_template("passkey.html")
|
||
|
||
|
||
# ─── 一次性 Passkey 参数暂存（小窗是独立 ephemeral 会话，读不到主容器 storage）───
|
||
_PASSKEY_STASH: dict = {} # sid -> {"op": str, "options": dict, "expires": float, "result": dict}
|
||
_PASSKEY_STASH_TTL = 300 # 秒（用户在小窗 Passkey 面板操作需要时间）
|
||
|
||
|
||
def _clean_passkey_stash():
|
||
now = _time.time()
|
||
expired = [k for k, v in _PASSKEY_STASH.items() if v["expires"] < now]
|
||
for k in expired:
|
||
_PASSKEY_STASH.pop(k, None)
|
||
|
||
|
||
@api.route("/api/passkey/stash", methods=["POST"])
|
||
def passkey_stash():
|
||
"""Store passkey ceremony parameters once, return a short-lived random id.
|
||
Called by the Passkey bridge middleware from the main WKWebView; the
|
||
ceremony itself runs inside the ephemeral sheet page which consumes the id."""
|
||
data = request.get_json(silent=True) or {}
|
||
op = data.get("op")
|
||
options = data.get("options")
|
||
if op not in ("creation", "assertion") or not isinstance(options, dict):
|
||
return jsonify({"error": "无效的 Passkey 请求"}), 400
|
||
_clean_passkey_stash()
|
||
sid = secrets.token_urlsafe(16)
|
||
_PASSKEY_STASH[sid] = {"op": op, "options": options, "expires": _time.time() + _PASSKEY_STASH_TTL}
|
||
return jsonify({"sid": sid}), 201
|
||
|
||
|
||
@api.route("/api/passkey/stash/<sid>", methods=["GET"])
|
||
def passkey_stash_get(sid):
|
||
"""Read the stashed parameters. 只读不删——entry 必须存活到小窗存回结果
|
||
（result 接口），真正的"一次性"由 result GET 取走即删保证。"""
|
||
entry = _PASSKEY_STASH.get(sid)
|
||
if not entry or entry["expires"] < _time.time():
|
||
return jsonify({"error": "参数已过期，请重试"}), 410
|
||
return jsonify({"op": entry["op"], "options": entry["options"]})
|
||
|
||
|
||
@api.route("/api/passkey/stash/<sid>/result", methods=["POST"])
|
||
def passkey_stash_result(sid):
|
||
"""小窗页面完成 WebAuthn 后把结果存回服务端。
|
||
credential 较大，走 POST body（回调 URL 只带短 sid，避免截断）。"""
|
||
entry = _PASSKEY_STASH.get(sid)
|
||
if not entry or entry["expires"] < _time.time():
|
||
return jsonify({"error": "参数已过期，请重试"}), 410
|
||
data = request.get_json(silent=True) or {}
|
||
credential = data.get("credential")
|
||
if not isinstance(credential, dict):
|
||
return jsonify({"error": "缺少 credential"}), 400
|
||
entry["result"] = {
|
||
"credential": credential,
|
||
"user_name": data.get("user_name", ""),
|
||
}
|
||
return jsonify({"ok": True})
|
||
|
||
|
||
@api.route("/api/passkey/stash/<sid>/result", methods=["GET"])
|
||
def passkey_stash_result_get(sid):
|
||
"""App 取回小窗完成的结果（一次性，取走即删）。"""
|
||
entry = _PASSKEY_STASH.get(sid)
|
||
if not entry or entry["expires"] < _time.time():
|
||
return jsonify({"error": "结果已过期或不存在"}), 410
|
||
result = entry.pop("result", None)
|
||
_PASSKEY_STASH.pop(sid, None) # 结果取走即清，防重放
|
||
if not result:
|
||
return jsonify({"error": "结果不存在"}), 410
|
||
return jsonify(result)
|
||
|
||
|
||
# ─── Unified Login (TOTP + Temp Password) ────
|
||
|
||
@api.route("/api/auth/login", methods=["POST"])
|
||
def api_login():
|
||
"""Unified login: accepts 6-digit code.
|
||
Backend auto-detects whether it's a user TOTP, a temp-account TOTP, or
|
||
Root's temp password. Rate-limited (progressive ban: 5→5min, 10→15min, 15+→24hr).
|
||
"""
|
||
# Check rate limit before anything else
|
||
rl = check_rate_limit()
|
||
if not rl["ok"]:
|
||
return jsonify({"error": rl["message"], "retry_after": rl["retry_after"]}), 429
|
||
|
||
data = request.get_json() or {}
|
||
code = data.get("code", "")
|
||
view = data.get("view", "control")
|
||
|
||
result = verify_login(code)
|
||
if result is None:
|
||
record_failure()
|
||
return jsonify({"error": "验证码错误"}), 401
|
||
|
||
resp = {"ok": True, "method": result["method"]}
|
||
uid = result["user_id"]
|
||
temp_account = result["temp_account"]
|
||
|
||
if result["method"] == "totp":
|
||
if temp_account:
|
||
# Temp account: server-held temp TOTP matched → force registration flow.
|
||
record_success()
|
||
set_temp_pending(view, uid)
|
||
resp["must_configure_mfa"] = True
|
||
else:
|
||
cfg = get_auth_config(user_id=uid)
|
||
if not cfg.get("totp_enabled"):
|
||
return jsonify({"error": "TOTP 尚未启用"}), 403
|
||
record_success()
|
||
set_authenticated(view, uid)
|
||
|
||
else: # temp_password (Root initial bootstrap)
|
||
record_success()
|
||
set_temp_pending(view, uid)
|
||
resp["must_configure_mfa"] = True
|
||
|
||
return jsonify(resp)
|
||
|
||
|
||
# ─── Recovery Code Login ─────────────────────
|
||
|
||
@api.route("/api/auth/login/recovery", methods=["POST"])
|
||
def api_login_recovery():
|
||
"""Login with a recovery code (one-time use). Rate-limited (same pool as TOTP)."""
|
||
rl = check_rate_limit()
|
||
if not rl["ok"]:
|
||
return jsonify({"error": rl["message"], "retry_after": rl["retry_after"]}), 429
|
||
|
||
data = request.get_json() or {}
|
||
code = data.get("code", "")
|
||
view = data.get("view", "control")
|
||
|
||
uid = verify_recovery_code(code)
|
||
if uid is not None:
|
||
record_success()
|
||
set_authenticated(view, uid)
|
||
return jsonify({"ok": True})
|
||
|
||
record_failure()
|
||
return jsonify({"error": "恢复码错误或已使用"}), 401
|
||
|
||
|
||
# ─── Re-authentication ───────────────────────
|
||
# High-risk operations (user management, MFA changes) require re-confirming the
|
||
# identity of the CURRENT user. TOTP is primary; a Passkey ceremony is the
|
||
# fallback when the user has no TOTP configured.
|
||
|
||
@api.route("/api/auth/reauth", methods=["POST"])
|
||
def api_reauth():
|
||
"""Re-authenticate before sensitive operations. Requires TOTP code.
|
||
Only callable from an authenticated (or temp-pending) session — otherwise
|
||
this endpoint would be a public TOTP oracle. Rate-limited like login.
|
||
"""
|
||
if not is_authenticated() and not is_temp_pending():
|
||
return jsonify({"error": "Unauthorized", "login_required": True}), 401
|
||
|
||
rl = check_rate_limit()
|
||
if not rl["ok"]:
|
||
return jsonify({"error": rl["message"], "retry_after": rl["retry_after"]}), 429
|
||
|
||
data = request.get_json() or {}
|
||
code = data.get("code", "")
|
||
|
||
cfg = get_auth_config(user_id=_cur())
|
||
if cfg.get("totp_enabled"):
|
||
if verify_totp(code, user_id=_cur()):
|
||
record_success()
|
||
mark_reauth()
|
||
return jsonify({"ok": True})
|
||
record_failure()
|
||
return jsonify({"error": "验证码错误"}), 401
|
||
|
||
# No TOTP configured: temp-pending sessions pass without a code;
|
||
# passkey-only users must use the Passkey re-auth ceremony instead.
|
||
if is_temp_pending():
|
||
mark_reauth()
|
||
return jsonify({"ok": True})
|
||
return jsonify({"error": "未配置 TOTP，请使用 Passkey 重验证"}), 400
|
||
|
||
|
||
@api.route("/api/auth/reauth/webauthn/begin", methods=["POST"])
|
||
@login_required
|
||
def api_reauth_webauthn_begin():
|
||
"""Start a Passkey re-authentication ceremony (fallback when no TOTP)."""
|
||
cfg = get_auth_config(user_id=_cur())
|
||
stored_id = cfg.get("passkey_credential_id", "")
|
||
if not stored_id:
|
||
return jsonify({"error": "未注册 Passkey"}), 400
|
||
try:
|
||
options = begin_authentication(request, allow_credential_ids=[stored_id])
|
||
return jsonify(options)
|
||
except Exception as e:
|
||
return jsonify({"error": str(e)}), 500
|
||
|
||
|
||
@api.route("/api/auth/reauth/webauthn/complete", methods=["POST"])
|
||
@login_required
|
||
def api_reauth_webauthn_complete():
|
||
"""Complete a Passkey re-authentication ceremony."""
|
||
data = request.get_json() or {}
|
||
credential = data.get("credential", {})
|
||
|
||
cfg = get_auth_config(user_id=_cur())
|
||
stored_id = cfg.get("passkey_credential_id", "")
|
||
stored_key = cfg.get("passkey_public_key", "")
|
||
if not stored_id or not stored_key:
|
||
return jsonify({"error": "未注册 Passkey"}), 400
|
||
|
||
try:
|
||
result = complete_authentication(
|
||
request, credential,
|
||
stored_credential_id=stored_id,
|
||
stored_public_key=stored_key,
|
||
)
|
||
if result.get("credential_id") != stored_id:
|
||
return jsonify({"error": "Passkey 凭证不匹配"}), 401
|
||
mark_reauth()
|
||
return jsonify({"ok": True})
|
||
except ValueError as e:
|
||
return jsonify({"error": str(e)}), 401
|
||
except Exception as e:
|
||
return jsonify({"error": f"Passkey 验证失败: {e}"}), 500
|
||
|
||
|
||
# ─── Passkey (WebAuthn) Login ────────────────
|
||
|
||
@api.route("/api/auth/webauthn/login/begin", methods=["POST"])
|
||
def api_webauthn_login_begin():
|
||
"""Start WebAuthn authentication. Returns challenge options for the frontend."""
|
||
try:
|
||
options = begin_authentication(request)
|
||
return jsonify(options)
|
||
except Exception as e:
|
||
return jsonify({"error": str(e)}), 500
|
||
|
||
|
||
@api.route("/api/auth/webauthn/login/complete", methods=["POST"])
|
||
def api_webauthn_login_complete():
|
||
"""Complete WebAuthn authentication. Finds the owning user by credential id."""
|
||
rl = check_rate_limit()
|
||
if not rl["ok"]:
|
||
return jsonify({"error": rl["message"], "retry_after": rl["retry_after"]}), 429
|
||
|
||
data = request.get_json() or {}
|
||
view = data.get("view", "control")
|
||
credential = data.get("credential", {})
|
||
credential_b64 = credential.get("id", "")
|
||
|
||
# Locate the user that owns this credential (frontend sends base64url id).
|
||
uid = None
|
||
if credential_b64:
|
||
try:
|
||
import base64
|
||
padded = credential_b64 + "=" * ((4 - len(credential_b64) % 4) % 4)
|
||
raw = base64.urlsafe_b64decode(padded.encode("ascii"))
|
||
uid = find_user_by_credential_id(raw.hex())
|
||
except Exception:
|
||
uid = None
|
||
|
||
if uid is None:
|
||
record_failure()
|
||
return jsonify({"error": "未注册 Passkey"}), 400
|
||
|
||
cfg = get_auth_config(user_id=uid)
|
||
stored_id_hex = cfg.get("passkey_credential_id", "")
|
||
stored_public_key = cfg.get("passkey_public_key", "")
|
||
if not stored_id_hex or not stored_public_key:
|
||
record_failure()
|
||
return jsonify({"error": "未注册 Passkey"}), 400
|
||
|
||
try:
|
||
result = complete_authentication(
|
||
request, credential,
|
||
stored_credential_id=credential_b64,
|
||
stored_public_key=stored_public_key,
|
||
)
|
||
# complete_authentication returns the credential id in hex.
|
||
if result.get("credential_id") != stored_id_hex:
|
||
record_failure()
|
||
return jsonify({"error": "Passkey 凭证不匹配"}), 401
|
||
record_success()
|
||
set_authenticated(view, uid)
|
||
return jsonify({"ok": True})
|
||
except ValueError as e:
|
||
record_failure()
|
||
return jsonify({"error": str(e)}), 401
|
||
except Exception as e:
|
||
return jsonify({"error": f"Passkey 验证失败: {e}"}), 500
|
||
|
||
|
||
# ─── Logout ──────────────────────────────────
|
||
|
||
@api.route("/api/auth/logout", methods=["POST"])
|
||
def api_logout():
|
||
clear_session()
|
||
return jsonify({"ok": True})
|
||
|
||
|
||
# ─── Auth Status ─────────────────────────────
|
||
|
||
def _user_payload(uid: int) -> dict:
|
||
u = get_user(uid) or {}
|
||
return {
|
||
"id": uid,
|
||
"remark": u.get("remark", "") or "",
|
||
"is_admin": is_admin_user(uid),
|
||
"is_temp": bool(u.get("is_temp", 0)),
|
||
}
|
||
|
||
|
||
@api.route("/api/auth/status", methods=["GET"])
|
||
def api_auth_status():
|
||
"""Return current auth status. Used by frontend to decide login flow."""
|
||
uid = current_user_id()
|
||
if is_authenticated():
|
||
return jsonify({
|
||
"authenticated": True,
|
||
"mfa_configured": has_mfa_configured(user_id=uid or 0),
|
||
"user": _user_payload(uid or 0),
|
||
})
|
||
if is_temp_pending():
|
||
return jsonify({
|
||
"authenticated": False,
|
||
"temp_pending": True,
|
||
"mfa_configured": has_mfa_configured(user_id=uid or 0),
|
||
"user": _user_payload(uid or 0),
|
||
})
|
||
return jsonify({
|
||
"authenticated": False,
|
||
"temp_pending": False,
|
||
"mfa_configured": False,
|
||
})
|
||
|
||
|
||
# ════════════════════════════════════════════
|
||
# USER SELF-SERVICE REQUEST
|
||
# ════════════════════════════════════════════
|
||
# The user fills in their info; the admin confirms it and a temp account
|
||
# (with a server-held temp TOTP) is generated automatically.
|
||
|
||
_REG_REQ_LIMIT: dict[str, list] = {} # ip -> [timestamps]
|
||
|
||
|
||
@api.route("/api/auth/register-request", methods=["POST"])
|
||
def api_register_request():
|
||
"""Public: a prospective user submits their remark for admin approval.
|
||
Rate-limited per IP (5 requests per 10 minutes)."""
|
||
ip = request.remote_addr or "unknown"
|
||
now = _time.time()
|
||
stamps = [t for t in _REG_REQ_LIMIT.get(ip, []) if now - t < 600]
|
||
if len(stamps) >= 5:
|
||
_REG_REQ_LIMIT[ip] = stamps
|
||
return jsonify({"error": "申请过于频繁，请稍后再试"}), 429
|
||
stamps.append(now)
|
||
_REG_REQ_LIMIT[ip] = stamps
|
||
|
||
data = request.get_json() or {}
|
||
remark = (data.get("remark") or "").strip()
|
||
if not remark:
|
||
return jsonify({"error": "请填写你的称呼/备注"}), 400
|
||
if len(remark) > 64:
|
||
return jsonify({"error": "备注过长"}), 400
|
||
|
||
create_user(remark=remark, role="user", is_temp=0, status="pending")
|
||
return jsonify({"ok": True, "message": "已提交申请，请等待管理员确认"}), 201
|
||
|
||
|
||
# ════════════════════════════════════════════
|
||
# MFA CONFIGURATION
|
||
# ════════════════════════════════════════════
|
||
|
||
@api.route("/mfa-setup")
|
||
def mfa_setup_page():
|
||
"""MFA configuration page. Shown after temp-password / temp-account login."""
|
||
if not is_temp_pending() and not is_authenticated():
|
||
return redirect(url_for("api.login_page", next="/mfa-setup"))
|
||
return render_template("mfa_setup.html")
|
||
|
||
|
||
# ─── WebAuthn Registration ───────────────────
|
||
|
||
@api.route("/api/auth/webauthn/register/begin", methods=["POST"])
|
||
@login_or_temp_required
|
||
def api_webauthn_register_begin():
|
||
"""Start WebAuthn registration for the current user."""
|
||
if not require_reauth():
|
||
return jsonify({"error": "需要重新验证身份", "reauth_required": True}), 403
|
||
uid = _cur()
|
||
cfg = get_auth_config(user_id=uid)
|
||
existing_id = cfg.get("passkey_credential_id", "")
|
||
user = get_user(uid) or {}
|
||
try:
|
||
options = begin_registration(request, uid, display_name=user.get("remark", ""), existing_credential_id=existing_id)
|
||
return jsonify(options)
|
||
except Exception as e:
|
||
return jsonify({"error": str(e)}), 500
|
||
|
||
|
||
@api.route("/api/auth/webauthn/register/complete", methods=["POST"])
|
||
@login_or_temp_required
|
||
def api_webauthn_register_complete():
|
||
"""Complete WebAuthn registration. Saves credential for the current user.
|
||
If the account is a temp account, finalizing it invalidates the temp TOTP.
|
||
"""
|
||
data = request.get_json() or {}
|
||
credential = data.get("credential", {})
|
||
uid = _cur()
|
||
|
||
try:
|
||
result = complete_registration(request, credential)
|
||
if result.get("user_id") != uid:
|
||
return jsonify({"error": "注册上下文不匹配，请重试"}), 400
|
||
update_auth_config(
|
||
uid,
|
||
passkey_credential_id=result["credential_id"],
|
||
passkey_public_key=result["public_key"],
|
||
)
|
||
finalized = False
|
||
if is_temp_account(uid):
|
||
finalize_temp_account(uid)
|
||
finalized = True
|
||
# The user proved access to the account — mark the session authenticated.
|
||
set_authenticated(session.get("mfa_view", "control"), uid)
|
||
return jsonify({"ok": True, "finalized": finalized})
|
||
except ValueError as e:
|
||
return jsonify({"error": str(e)}), 400
|
||
except Exception as e:
|
||
return jsonify({"error": f"Passkey 注册失败: {e}"}), 500
|
||
|
||
|
||
# ─── TOTP Setup ──────────────────────────────
|
||
|
||
@api.route("/api/auth/totp/setup", methods=["POST"])
|
||
@login_or_temp_required
|
||
def api_totp_setup_begin():
|
||
"""Generate a TOTP secret for the current user."""
|
||
if not require_reauth():
|
||
return jsonify({"error": "需要重新验证身份", "reauth_required": True}), 403
|
||
import pyotp
|
||
import qrcode
|
||
import base64
|
||
|
||
uid = _cur()
|
||
user = get_user(uid) or {}
|
||
|
||
# Generate a new secret
|
||
secret = pyotp.random_base32()
|
||
|
||
# Store temporarily (will be enabled after verification)
|
||
update_auth_config(uid, totp_secret=secret, totp_enabled=0)
|
||
|
||
# Build provisioning URI
|
||
issuer = "Cal Display"
|
||
name = (user.get("remark") or f"user_{uid}")[:64]
|
||
uri = pyotp.totp.TOTP(secret).provisioning_uri(name=name, issuer_name=issuer)
|
||
|
||
# Generate QR code as base64 PNG
|
||
qr = qrcode.make(uri)
|
||
buf = io.BytesIO()
|
||
qr.save(buf, format="PNG")
|
||
qr_b64 = base64.b64encode(buf.getvalue()).decode("utf-8")
|
||
|
||
return jsonify({
|
||
"secret": secret,
|
||
"uri": uri,
|
||
"qr_base64": qr_b64,
|
||
})
|
||
|
||
|
||
@api.route("/api/auth/totp/verify", methods=["POST"])
|
||
@login_or_temp_required
|
||
def api_totp_verify():
|
||
"""Verify a TOTP code to enable TOTP MFA for the current user.
|
||
For temp accounts this also converts the account (temp TOTP is discarded).
|
||
"""
|
||
data = request.get_json() or {}
|
||
code = data.get("code", "")
|
||
uid = _cur()
|
||
|
||
if verify_totp(code, user_id=uid):
|
||
update_auth_config(uid, totp_enabled=1)
|
||
# Generate recovery codes on first TOTP enable
|
||
cfg = get_auth_config(user_id=uid)
|
||
if not cfg.get("recovery_codes"):
|
||
codes = generate_recovery_codes()
|
||
set_recovery_codes(codes, user_id=uid)
|
||
|
||
finalized = False
|
||
if is_temp_account(uid):
|
||
finalize_temp_account(uid)
|
||
finalized = True
|
||
set_authenticated(session.get("mfa_view", "control"), uid)
|
||
|
||
return jsonify({
|
||
"ok": True,
|
||
"recovery_codes": get_recovery_codes(user_id=uid),
|
||
"finalized": finalized,
|
||
})
|
||
|
||
return jsonify({"error": "验证码错误，请重试"}), 400
|
||
|
||
|
||
# ─── MFA Complete / Skip Temp Password ─────
|
||
|
||
@api.route("/api/auth/mfa/complete", methods=["POST"])
|
||
def api_mfa_complete():
|
||
"""Called after user has configured at least one MFA method.
|
||
Works for temp-password (Root bootstrap) and temp-account sessions.
|
||
"""
|
||
if not is_temp_pending() and not is_authenticated():
|
||
return jsonify({"error": "请先登录"}), 401
|
||
uid = _cur()
|
||
cfg = get_auth_config(user_id=uid)
|
||
if not cfg.get("passkey_credential_id") and not cfg.get("totp_enabled"):
|
||
return jsonify({"error": "请至少配置一种 MFA 方式"}), 400
|
||
|
||
if is_temp_account(uid):
|
||
finalize_temp_account(uid)
|
||
clear_temp_password(user_id=uid)
|
||
update_auth_config(uid, must_configure_mfa=0)
|
||
set_authenticated(session.get("mfa_view", "control"), uid)
|
||
return jsonify({"ok": True})
|
||
|
||
|
||
# ─── Recovery Codes ──────────────────────────
|
||
|
||
@api.route("/api/auth/recovery-codes", methods=["GET"])
|
||
@login_or_temp_required
|
||
def api_get_recovery_codes():
|
||
"""Get remaining recovery codes for the current user."""
|
||
uid = _cur()
|
||
cfg = get_auth_config(user_id=uid)
|
||
if not cfg.get("recovery_codes"):
|
||
return jsonify({"codes": [], "remaining": 0})
|
||
codes = get_recovery_codes(user_id=uid)
|
||
return jsonify({"codes": codes, "remaining": len(codes)})
|
||
|
||
|
||
@api.route("/api/auth/recovery-codes/regenerate", methods=["POST"])
|
||
@login_or_temp_required
|
||
def api_regenerate_recovery_codes():
|
||
"""Regenerate recovery codes. Requires recent re-authentication."""
|
||
if not require_reauth():
|
||
return jsonify({"error": "需要重新验证身份", "reauth_required": True}), 403
|
||
codes = generate_recovery_codes()
|
||
set_recovery_codes(codes, user_id=_cur())
|
||
return jsonify({"codes": codes, "remaining": len(codes)})
|
||
|
||
|
||
# ─── MFA Status (for control panel settings) ─
|
||
|
||
@api.route("/api/auth/mfa/status", methods=["GET"])
|
||
@login_required
|
||
def api_mfa_status():
|
||
"""Return what MFA methods are configured for the current user."""
|
||
uid = _cur()
|
||
cfg = get_auth_config(user_id=uid)
|
||
codes = get_recovery_codes(user_id=uid)
|
||
return jsonify({
|
||
"passkey_enabled": bool(cfg.get("passkey_credential_id")),
|
||
"totp_enabled": bool(cfg.get("totp_enabled")),
|
||
"recovery_codes_remaining": len(codes),
|
||
"is_temp_account": is_temp_account(uid),
|
||
})
|
||
|
||
|
||
# ════════════════════════════════════════════
|
||
# THEME（账户独立主题）
|
||
# ════════════════════════════════════════════
|
||
|
||
def _effective_theme(uid: int, mode: str) -> str:
|
||
"""解析主题模式为实际生效值：dark / light / auto。
|
||
auto 模式按用户天气配置的经纬度 + 本地时区计算日出日落，
|
||
白天→浅色，夜晚→深色；无位置数据时按本地 6:00-18:00 粗判。"""
|
||
if mode == "dark":
|
||
return "dark"
|
||
if mode == "light":
|
||
return "light"
|
||
try:
|
||
from backend.time_util import now as tz_now
|
||
from backend.sun_util import is_daytime
|
||
cfg = weather_mgr.get_config(user_id=uid)
|
||
lat = cfg.get("lat")
|
||
lon = cfg.get("lon")
|
||
now_local = tz_now()
|
||
if lat is not None and lon is not None:
|
||
return "light" if is_daytime(lat, lon, now_local) else "dark"
|
||
return "light" if 6 <= now_local.hour < 18 else "dark"
|
||
except Exception:
|
||
return "dark"
|
||
|
||
|
||
@api.route("/api/theme", methods=["GET"])
|
||
@login_required
|
||
def get_theme():
|
||
"""返回当前用户的主题设置：mode 为用户选择（dark/light/auto），
|
||
effective 为实际生效（auto 已解析为 dark/light）。"""
|
||
uid = _cur()
|
||
mode = (get_user(uid) or {}).get("theme") or "dark"
|
||
return jsonify({
|
||
"mode": mode,
|
||
"effective": _effective_theme(uid, mode),
|
||
})
|
||
|
||
|
||
@api.route("/api/theme", methods=["PUT"])
|
||
@login_required
|
||
def set_theme():
|
||
"""保存主题设置并广播给该用户的显示端。"""
|
||
data = request.get_json() or {}
|
||
mode = data.get("mode")
|
||
if mode not in ("dark", "light", "auto"):
|
||
return jsonify({"error": "无效的主题模式"}), 400
|
||
uid = _cur()
|
||
update_user(uid, theme=mode)
|
||
effective = _effective_theme(uid, mode)
|
||
current_app.event_bus.publish("theme_changed", {"mode": mode, "effective": effective}, user_id=uid)
|
||
return jsonify({"ok": True, "mode": mode, "effective": effective})
|
||
|
||
|
||
# ════════════════════════════════════════════
|
||
# USER MANAGEMENT (ADMIN)
|
||
# ════════════════════════════════════════════
|
||
|
||
@api.route("/api/admin/users", methods=["GET"])
|
||
@admin_required
|
||
def admin_list_users():
|
||
"""List all users (including pending requests). No secrets are exposed."""
|
||
users = []
|
||
for u in get_users():
|
||
users.append({
|
||
"id": u["id"],
|
||
"remark": u["remark"],
|
||
"role": u["role"],
|
||
"is_temp": bool(u["is_temp"]),
|
||
"status": u["status"],
|
||
"created_at": u["created_at"],
|
||
"has_mfa": has_mfa_configured(user_id=u["id"]),
|
||
})
|
||
return jsonify(users)
|
||
|
||
|
||
@api.route("/api/admin/users", methods=["POST"])
|
||
@admin_required
|
||
def admin_create_user():
|
||
"""Register a user. Only admins can do this — re-auth required.
|
||
|
||
mode='admin_fills' → formal account immediately (admin then provisions TOTP
|
||
or Passkey on the user's behalf).
|
||
mode='user_fills' → temp account with a server-held temp TOTP.
|
||
"""
|
||
if not require_reauth():
|
||
return jsonify({"error": "需要重新验证身份", "reauth_required": True}), 403
|
||
|
||
data = request.get_json() or {}
|
||
remark = (data.get("remark") or "").strip()[:64]
|
||
mode = data.get("mode", "admin_fills")
|
||
if mode not in ("admin_fills", "user_fills"):
|
||
return jsonify({"error": "无效的注册模式"}), 400
|
||
|
||
if mode == "user_fills":
|
||
import pyotp
|
||
uid = create_user(remark=remark, role="user", is_temp=1,
|
||
temp_totp_secret=pyotp.random_base32(), status="active")
|
||
return jsonify({"ok": True, "user": _user_payload(uid), "is_temp": True}), 201
|
||
|
||
uid = create_user(remark=remark, role="user", is_temp=0, status="active")
|
||
return jsonify({"ok": True, "user": _user_payload(uid)}), 201
|
||
|
||
|
||
@api.route("/api/admin/users/confirm", methods=["POST"])
|
||
@admin_required
|
||
def admin_confirm_request():
|
||
"""Confirm a pending self-service request → temp account with temp TOTP."""
|
||
if not require_reauth():
|
||
return jsonify({"error": "需要重新验证身份", "reauth_required": True}), 403
|
||
|
||
data = request.get_json() or {}
|
||
request_id = data.get("request_id")
|
||
if request_id is None:
|
||
return jsonify({"error": "request_id required"}), 400
|
||
|
||
u = get_user(request_id)
|
||
if not u:
|
||
return jsonify({"error": "申请不存在"}), 404
|
||
if u.get("status") != "pending":
|
||
return jsonify({"error": "该申请已处理"}), 400
|
||
|
||
import pyotp
|
||
secret = pyotp.random_base32()
|
||
update_user(request_id, is_temp=1, temp_totp_secret=secret, status="active")
|
||
return jsonify({"ok": True, "user": _user_payload(request_id)})
|
||
|
||
|
||
@api.route("/api/admin/users/<int:user_id>", methods=["PUT"])
|
||
@admin_required
|
||
def admin_update_user(user_id):
|
||
"""Edit a user's remark. Re-auth required."""
|
||
if not require_reauth():
|
||
return jsonify({"error": "需要重新验证身份", "reauth_required": True}), 403
|
||
|
||
u = get_user(user_id)
|
||
if not u:
|
||
return jsonify({"error": "用户不存在"}), 404
|
||
|
||
data = request.get_json() or {}
|
||
remark = (data.get("remark") or "").strip()[:64]
|
||
if not remark:
|
||
return jsonify({"error": "备注不能为空"}), 400
|
||
update_user(user_id, remark=remark)
|
||
return jsonify({"ok": True, "user": _user_payload(user_id)})
|
||
|
||
|
||
@api.route("/api/admin/users/<int:user_id>", methods=["DELETE"])
|
||
@admin_required
|
||
def admin_delete_user(user_id):
|
||
"""Delete a user and ALL of their data. Re-auth required."""
|
||
if not require_reauth():
|
||
return jsonify({"error": "需要重新验证身份", "reauth_required": True}), 403
|
||
|
||
if user_id == 0:
|
||
return jsonify({"error": "无法删除 Root 用户"}), 400
|
||
if user_id == _cur():
|
||
return jsonify({"error": "不能删除当前登录的管理员"}), 400
|
||
|
||
u = get_user(user_id)
|
||
if not u:
|
||
return jsonify({"error": "用户不存在"}), 404
|
||
|
||
delete_user(user_id)
|
||
return jsonify({"ok": True})
|
||
|
||
|
||
@api.route("/api/admin/users/<int:user_id>/totp", methods=["GET"])
|
||
@admin_required
|
||
def admin_user_temp_totp(user_id):
|
||
"""Real-time temp TOTP code for a temp account (admin helper).
|
||
Only the live code is returned — the secret itself never leaves the server.
|
||
High-risk view: requires re-authentication.
|
||
"""
|
||
if not require_reauth():
|
||
return jsonify({"error": "需要重新验证身份", "reauth_required": True}), 403
|
||
u = get_user(user_id)
|
||
if not u:
|
||
return jsonify({"error": "用户不存在"}), 404
|
||
if not u.get("is_temp"):
|
||
return jsonify({"error": "该账户不是临时账户"}), 400
|
||
from backend.auth import current_temp_totp_code
|
||
return jsonify({
|
||
"code": current_temp_totp_code(user_id),
|
||
"remark": u.get("remark", ""),
|
||
})
|
||
|
||
|
||
@api.route("/api/admin/users/<int:user_id>/totp/begin", methods=["POST"])
|
||
@admin_required
|
||
def admin_provision_totp_begin(user_id):
|
||
"""Admin-fills mode: provision a TOTP for a formal user (secret + QR shown
|
||
to the admin, who relays it to the user)."""
|
||
if not require_reauth():
|
||
return jsonify({"error": "需要重新验证身份", "reauth_required": True}), 403
|
||
|
||
u = get_user(user_id)
|
||
if not u:
|
||
return jsonify({"error": "用户不存在"}), 404
|
||
if u.get("is_temp"):
|
||
return jsonify({"error": "临时账户由用户本人配置登录方式"}), 400
|
||
|
||
import pyotp
|
||
import qrcode
|
||
import base64
|
||
|
||
secret = pyotp.random_base32()
|
||
update_auth_config(user_id, totp_secret=secret, totp_enabled=0)
|
||
|
||
name = (u.get("remark") or f"user_{user_id}")[:64]
|
||
uri = pyotp.totp.TOTP(secret).provisioning_uri(name=name, issuer_name="Cal Display")
|
||
qr = qrcode.make(uri)
|
||
buf = io.BytesIO()
|
||
qr.save(buf, format="PNG")
|
||
qr_b64 = base64.b64encode(buf.getvalue()).decode("utf-8")
|
||
|
||
return jsonify({"secret": secret, "uri": uri, "qr_base64": qr_b64})
|
||
|
||
|
||
@api.route("/api/admin/users/<int:user_id>/totp/verify", methods=["POST"])
|
||
@admin_required
|
||
def admin_provision_totp_verify(user_id):
|
||
"""Verify the user's TOTP code (entered by the user into their app) and enable it."""
|
||
if not require_reauth():
|
||
return jsonify({"error": "需要重新验证身份", "reauth_required": True}), 403
|
||
data = request.get_json() or {}
|
||
code = data.get("code", "")
|
||
|
||
u = get_user(user_id)
|
||
if not u:
|
||
return jsonify({"error": "用户不存在"}), 404
|
||
if u.get("is_temp"):
|
||
return jsonify({"error": "临时账户由用户本人配置登录方式"}), 400
|
||
|
||
if not verify_totp(code, user_id=user_id):
|
||
return jsonify({"error": "验证码错误，请让用户重试"}), 400
|
||
|
||
update_auth_config(user_id, totp_enabled=1)
|
||
cfg = get_auth_config(user_id=user_id)
|
||
if not cfg.get("recovery_codes"):
|
||
codes = generate_recovery_codes()
|
||
set_recovery_codes(codes, user_id=user_id)
|
||
return jsonify({"ok": True, "recovery_codes": get_recovery_codes(user_id=user_id)})
|
||
|
||
|
||
@api.route("/api/admin/users/<int:user_id>/passkey/begin", methods=["POST"])
|
||
@admin_required
|
||
def admin_provision_passkey_begin(user_id):
|
||
"""Admin-fills mode: start a Passkey registration ceremony for the target
|
||
user. The ceremony completes in the admin's browser (literal interpretation
|
||
of '由管理员电脑代为注册')."""
|
||
if not require_reauth():
|
||
return jsonify({"error": "需要重新验证身份", "reauth_required": True}), 403
|
||
|
||
u = get_user(user_id)
|
||
if not u:
|
||
return jsonify({"error": "用户不存在"}), 404
|
||
if u.get("is_temp"):
|
||
return jsonify({"error": "临时账户由用户本人配置登录方式"}), 400
|
||
|
||
cfg = get_auth_config(user_id=user_id)
|
||
existing_id = cfg.get("passkey_credential_id", "")
|
||
try:
|
||
options = begin_registration(request, user_id,
|
||
display_name=u.get("remark", ""),
|
||
existing_credential_id=existing_id)
|
||
return jsonify(options)
|
||
except Exception as e:
|
||
return jsonify({"error": str(e)}), 500
|
||
|
||
|
||
@api.route("/api/admin/users/<int:user_id>/passkey/complete", methods=["POST"])
|
||
@admin_required
|
||
def admin_provision_passkey_complete(user_id):
|
||
"""Complete the passkey ceremony and store the credential for the target user."""
|
||
if not require_reauth():
|
||
return jsonify({"error": "需要重新验证身份", "reauth_required": True}), 403
|
||
data = request.get_json() or {}
|
||
credential = data.get("credential", {})
|
||
|
||
u = get_user(user_id)
|
||
if not u:
|
||
return jsonify({"error": "用户不存在"}), 404
|
||
|
||
try:
|
||
result = complete_registration(request, credential)
|
||
if result.get("user_id") != user_id:
|
||
return jsonify({"error": "注册上下文不匹配，请重试"}), 400
|
||
update_auth_config(
|
||
user_id,
|
||
passkey_credential_id=result["credential_id"],
|
||
passkey_public_key=result["public_key"],
|
||
)
|
||
return jsonify({"ok": True})
|
||
except ValueError as e:
|
||
return jsonify({"error": str(e)}), 400
|
||
except Exception as e:
|
||
return jsonify({"error": f"Passkey 注册失败: {e}"}), 500
|
||
|
||
|
||
# ════════════════════════════════════════════
|
||
# DISPLAY PAGES
|
||
# ════════════════════════════════════════════
|
||
|
||
@api.route("/")
|
||
@api.route("/index")
|
||
def display_page():
|
||
cfg = get_display_config(user_id=_cur())
|
||
if cfg.get("mode") == "custom":
|
||
return render_template("display_custom.html", custom_html=cfg.get("custom_html", ""))
|
||
if not is_authenticated() and not is_temp_pending():
|
||
return redirect(url_for("api.login_page", next=request.path))
|
||
return render_template("display.html")
|
||
|
||
|
||
# ════════════════════════════════════════════
|
||
# CONTROL PAGE
|
||
# ════════════════════════════════════════════
|
||
|
||
@api.route("/control")
|
||
@login_required
|
||
def control_page():
|
||
return render_template("control.html")
|
||
|
||
|
||
# ════════════════════════════════════════════
|
||
# DISPLAY / SSE / STATE
|
||
# ════════════════════════════════════════════
|
||
|
||
@api.route("/api/events")
|
||
def sse_stream():
|
||
"""Server-Sent Events for real-time updates (scoped to the current user)."""
|
||
if not is_authenticated() and not is_temp_pending():
|
||
return jsonify({"error": "Unauthorized", "login_required": True}), 401
|
||
uid = _cur()
|
||
|
||
def generate():
|
||
q = current_app.event_bus.subscribe(user_id=uid)
|
||
try:
|
||
yield "data: {\"type\":\"connected\"}\n\n"
|
||
while True:
|
||
try:
|
||
msg = q.get(timeout=15)
|
||
yield f"data: {msg}\n\n"
|
||
except queue.Empty:
|
||
yield "data: {\"type\":\"heartbeat\"}\n\n"
|
||
finally:
|
||
current_app.event_bus.unsubscribe(q)
|
||
|
||
return Response(
|
||
stream_with_context(generate()),
|
||
mimetype="text/event-stream",
|
||
headers={
|
||
"Cache-Control": "no-cache",
|
||
"X-Accel-Buffering": "no",
|
||
},
|
||
)
|
||
|
||
|
||
# ─── Display State (needed by display page) ─
|
||
|
||
@api.route("/api/display/state", methods=["GET"])
|
||
@display_login_required
|
||
def get_display_state():
|
||
"""Return all data needed by the display page (read-only for display, full for control)."""
|
||
uid = _cur()
|
||
events = calendar_mgr.get_events(days=7, user_id=uid)
|
||
weather = weather_mgr.get_cached_weather(user_id=uid)
|
||
alarms = alarm_mgr.get_alarms(user_id=uid)
|
||
countdowns = countdown_mgr.get_countdowns(user_id=uid)
|
||
groups = calendar_mgr.get_groups(user_id=uid)
|
||
pomodoro = pomodoro_mgr.get_state(user_id=uid)
|
||
hourly = weather_mgr.get_cached_hourly(user_id=uid)
|
||
if not hourly:
|
||
hourly = weather_mgr.fetch_hourly(user_id=uid)
|
||
update_schedule = weather_mgr.get_next_update_times(user_id=uid)
|
||
minutely = weather_mgr.get_cached_minutely(user_id=uid)
|
||
warnings = weather_mgr.get_cached_warnings(user_id=uid)
|
||
|
||
return jsonify({
|
||
"events": events,
|
||
"weather": weather,
|
||
"hourly": hourly,
|
||
"alarms": alarms,
|
||
"countdowns": countdowns,
|
||
"groups": [g for g in groups if g["enabled"]],
|
||
"pomodoro": pomodoro,
|
||
"update_schedule": update_schedule,
|
||
"minutely": minutely,
|
||
"warnings": warnings,
|
||
})
|
||
|
||
|
||
@api.route("/api/display/mode", methods=["GET"])
|
||
@login_required
|
||
def get_display_mode():
|
||
cfg = get_display_config(user_id=_cur())
|
||
return jsonify(cfg)
|
||
|
||
|
||
@api.route("/api/display/mode", methods=["PUT"])
|
||
@login_required
|
||
def update_display_mode():
|
||
data = request.get_json() or {}
|
||
mode = data.get("mode", "")
|
||
uid = _cur()
|
||
if set_display_mode(mode, user_id=uid):
|
||
current_app.event_bus.publish("display_mode_changed", {"mode": mode}, user_id=uid)
|
||
return jsonify({"ok": True})
|
||
return jsonify({"error": "Invalid mode"}), 400
|
||
|
||
|
||
@api.route("/api/display/custom_html", methods=["PUT"])
|
||
@login_required
|
||
def update_custom_html():
|
||
data = request.get_json() or {}
|
||
html = data.get("html", "")
|
||
uid = _cur()
|
||
set_custom_html(html, user_id=uid)
|
||
current_app.event_bus.publish("display_mode_changed", {"mode": "custom"}, user_id=uid)
|
||
return jsonify({"ok": True})
|
||
|
||
|
||
@api.route("/api/display/custom_html/<int:index>", methods=["PUT"])
|
||
@login_required
|
||
def update_custom_html_template(index):
|
||
data = request.get_json() or {}
|
||
html = data.get("html", "")
|
||
uid = _cur()
|
||
if index == 0:
|
||
set_custom_html(html, user_id=uid)
|
||
return jsonify({"ok": True})
|
||
if set_custom_html_template(index, html, user_id=uid):
|
||
return jsonify({"ok": True})
|
||
return jsonify({"error": "Invalid template index"}), 400
|
||
|
||
|
||
@api.route("/api/display/apply_html/<int:index>", methods=["POST"])
|
||
@login_required
|
||
def apply_html_template(index):
|
||
uid = _cur()
|
||
if apply_custom_html(index, user_id=uid):
|
||
current_app.event_bus.publish("display_mode_changed", {"mode": "custom"}, user_id=uid)
|
||
return jsonify({"ok": True})
|
||
return jsonify({"error": "Invalid template index"}), 400
|
||
|
||
|
||
@api.route("/api/display/refresh", methods=["POST"])
|
||
@login_required
|
||
def force_refresh_display():
|
||
uid = _cur()
|
||
current_app.event_bus.publish("force_refresh", {}, user_id=uid)
|
||
return jsonify({"ok": True})
|
||
|
||
|
||
@api.route("/api/display/kick_all", methods=["POST"])
|
||
@admin_required
|
||
def kick_all_displays():
|
||
"""Kick ALL sessions (including all users) by bumping every user's version.
|
||
Old session cookies become invalid immediately. Also broadcasts SSE.
|
||
"""
|
||
bump_all_session_versions()
|
||
current_app.event_bus.publish("kick_all", {})
|
||
return jsonify({"ok": True})
|
||
|
||
|
||
@api.route("/api/display/notify", methods=["POST"])
|
||
@login_required
|
||
def push_notification():
|
||
data = request.get_json() or {}
|
||
uid = _cur()
|
||
current_app.event_bus.publish("custom_notification", {
|
||
"title": data.get("title", "提醒"),
|
||
"message": data.get("message", ""),
|
||
"icon": data.get("icon", "🔔"),
|
||
"sound": data.get("sound", True),
|
||
}, user_id=uid)
|
||
return jsonify({"ok": True})
|
||
|
||
|
||
# ════════════════════════════════════════════
|
||
# CALENDAR
|
||
# ════════════════════════════════════════════
|
||
|
||
@api.route("/api/calendar/groups", methods=["GET"])
|
||
@login_required
|
||
def get_calendar_groups():
|
||
return jsonify(calendar_mgr.get_groups(user_id=_cur()))
|
||
|
||
|
||
@api.route("/api/calendar/groups", methods=["POST"])
|
||
@login_required
|
||
def create_calendar_group():
|
||
data = request.get_json() or {}
|
||
group = calendar_mgr.create_group(
|
||
name=data.get("name", "New Group"),
|
||
color=data.get("color", "#4A90D9"),
|
||
user_id=_cur(),
|
||
)
|
||
return jsonify(group), 201
|
||
|
||
|
||
@api.route("/api/calendar/groups/<int:group_id>", methods=["PUT"])
|
||
@login_required
|
||
def update_calendar_group(group_id):
|
||
data = request.get_json() or {}
|
||
ok = calendar_mgr.update_group(
|
||
group_id,
|
||
name=data.get("name"),
|
||
color=data.get("color"),
|
||
enabled=data.get("enabled"),
|
||
user_id=_cur(),
|
||
)
|
||
if not ok:
|
||
return jsonify({"error": "分组不存在或无权访问"}), 404
|
||
return jsonify({"ok": True})
|
||
|
||
|
||
@api.route("/api/calendar/groups/<int:group_id>", methods=["DELETE"])
|
||
@login_required
|
||
def delete_calendar_group(group_id):
|
||
ok = calendar_mgr.delete_group(group_id, user_id=_cur())
|
||
if not ok:
|
||
return jsonify({"error": "分组不存在或无权访问"}), 404
|
||
return jsonify({"ok": True})
|
||
|
||
|
||
@api.route("/api/calendar/groups/<int:group_id>/reminder", methods=["PUT"])
|
||
@login_required
|
||
def set_calendar_reminder(group_id):
|
||
data = request.get_json() or {}
|
||
try:
|
||
calendar_mgr.set_reminder(
|
||
group_id,
|
||
minutes_before=data.get("minutes_before", 15),
|
||
enabled=data.get("enabled", True),
|
||
user_id=_cur(),
|
||
)
|
||
except ValueError as e:
|
||
return jsonify({"error": str(e)}), 400
|
||
return jsonify({"ok": True})
|
||
|
||
|
||
@api.route("/api/calendar/sources/upload", methods=["POST"])
|
||
@login_required
|
||
def upload_source():
|
||
group_id = request.form.get("group_id", type=int)
|
||
name = request.form.get("name", "uploaded")
|
||
file = request.files.get("file")
|
||
if not group_id or not file:
|
||
return jsonify({"error": "group_id and file required"}), 400
|
||
ics_content = file.read().decode("utf-8", errors="replace")
|
||
try:
|
||
calendar_mgr.upload_ics(group_id, name, ics_content, user_id=_cur())
|
||
except ValueError as e:
|
||
return jsonify({"error": str(e)}), 400
|
||
return jsonify({"ok": True}), 201
|
||
|
||
|
||
@api.route("/api/calendar/sources/subscribe", methods=["POST"])
|
||
@login_required
|
||
def subscribe_source():
|
||
data = request.get_json() or {}
|
||
group_id = data.get("group_id")
|
||
name = data.get("name", "Subscription")
|
||
url = data.get("url")
|
||
if not group_id or not url:
|
||
return jsonify({"error": "group_id and url required"}), 400
|
||
try:
|
||
calendar_mgr.subscribe_ics(group_id, name, url, user_id=_cur())
|
||
except ValueError as e:
|
||
return jsonify({"error": str(e)}), 400
|
||
return jsonify({"ok": True}), 201
|
||
|
||
|
||
@api.route("/api/calendar/sources/<int:source_id>", methods=["DELETE"])
|
||
@login_required
|
||
def delete_source(source_id):
|
||
ok = calendar_mgr.delete_source(source_id, user_id=_cur())
|
||
if not ok:
|
||
return jsonify({"error": "来源不存在或无权访问"}), 404
|
||
return jsonify({"ok": True})
|
||
|
||
|
||
@api.route("/api/calendar/sources/<int:source_id>/sync", methods=["POST"])
|
||
@login_required
|
||
def sync_source(source_id):
|
||
calendar_mgr.sync_subscription(source_id, user_id=_cur())
|
||
return jsonify({"ok": True})
|
||
|
||
|
||
@api.route("/api/calendar/events", methods=["GET"])
|
||
@login_required
|
||
def get_calendar_events():
|
||
group_ids = request.args.getlist("group_ids", type=int) or None
|
||
days = request.args.get("days", 7, type=int)
|
||
events = calendar_mgr.get_events(group_ids=group_ids, days=days, user_id=_cur())
|
||
return jsonify(events)
|
||
|
||
|
||
@api.route("/api/calendar/events", methods=["POST"])
|
||
@login_required
|
||
def create_event():
|
||
data = request.get_json() or {}
|
||
group_id = data.get("group_id")
|
||
if not group_id:
|
||
return jsonify({"error": "group_id required"}), 400
|
||
try:
|
||
event = calendar_mgr.add_event(
|
||
group_id=group_id,
|
||
summary=data.get("summary", ""),
|
||
dtstart=data.get("dtstart", ""),
|
||
dtend=data.get("dtend"),
|
||
description=data.get("description", ""),
|
||
location=data.get("location", ""),
|
||
is_all_day=data.get("is_all_day", False),
|
||
user_id=_cur(),
|
||
)
|
||
except ValueError as e:
|
||
return jsonify({"error": str(e)}), 400
|
||
return jsonify(event), 201
|
||
|
||
|
||
@api.route("/api/calendar/groups/<int:group_id>/events", methods=["GET"])
|
||
@login_required
|
||
def get_group_events(group_id):
|
||
days = request.args.get("days", 30, type=int)
|
||
events = calendar_mgr.get_events_by_group(group_id, days=days, user_id=_cur())
|
||
return jsonify(events)
|
||
|
||
|
||
@api.route("/api/calendar/events/<int:event_id>", methods=["PUT"])
|
||
@login_required
|
||
def update_calendar_event(event_id):
|
||
data = request.get_json() or {}
|
||
ok = calendar_mgr.update_event(
|
||
event_id,
|
||
summary=data.get("summary"),
|
||
dtstart=data.get("dtstart"),
|
||
dtend=data.get("dtend"),
|
||
description=data.get("description"),
|
||
location=data.get("location"),
|
||
user_id=_cur(),
|
||
)
|
||
if ok:
|
||
return jsonify({"ok": True})
|
||
return jsonify({"error": "日程不存在或无权访问"}), 404
|
||
|
||
|
||
@api.route("/api/calendar/events/<int:event_id>", methods=["DELETE"])
|
||
@login_required
|
||
def delete_calendar_event(event_id):
|
||
ok = calendar_mgr.delete_event(event_id, user_id=_cur())
|
||
if not ok:
|
||
return jsonify({"error": "日程不存在或无权访问"}), 404
|
||
return jsonify({"ok": True})
|
||
|
||
|
||
# ════════════════════════════════════════════
|
||
# WEATHER
|
||
# ════════════════════════════════════════════
|
||
|
||
@api.route("/api/weather/config", methods=["GET"])
|
||
@login_required
|
||
def get_weather_config():
|
||
cfg = weather_mgr.get_config(user_id=_cur())
|
||
cfg["api_key"] = "***" if cfg.get("api_key") else ""
|
||
cfg["jwt_private_key"] = "***" if cfg.get("jwt_private_key") else ""
|
||
return jsonify(cfg)
|
||
|
||
|
||
@api.route("/api/weather/config", methods=["PUT"])
|
||
@login_required
|
||
def update_weather_config():
|
||
data = request.get_json() or {}
|
||
try:
|
||
weather_mgr.update_config(
|
||
api_key=data.get("api_key"),
|
||
city=data.get("city"),
|
||
lat=data.get("lat"),
|
||
lon=data.get("lon"),
|
||
units=data.get("units"),
|
||
update_interval=data.get("update_interval"),
|
||
credential_id=data.get("credential_id"),
|
||
project_id=data.get("project_id"),
|
||
qweather_host=data.get("qweather_host"),
|
||
user_id=_cur(),
|
||
)
|
||
except ValueError as e:
|
||
return jsonify({"error": str(e)}), 400
|
||
return jsonify({"ok": True})
|
||
|
||
|
||
@api.route("/api/weather/current", methods=["GET"])
|
||
@display_login_required
|
||
def get_weather():
|
||
data = weather_mgr.get_cached_weather(user_id=_cur())
|
||
if "error" in data and "API key" not in data.get("error", ""):
|
||
data = weather_mgr.fetch_weather(user_id=_cur())
|
||
return jsonify(data)
|
||
|
||
|
||
@api.route("/api/weather/refresh", methods=["POST"])
|
||
@login_required
|
||
def refresh_weather():
|
||
data = weather_mgr.fetch_weather(force=True, user_id=_cur())
|
||
return jsonify(data)
|
||
|
||
|
||
@api.route("/api/weather/hourly", methods=["GET"])
|
||
@display_login_required
|
||
def get_hourly():
|
||
data = weather_mgr.get_cached_hourly(user_id=_cur())
|
||
if not data:
|
||
data = weather_mgr.fetch_hourly(user_id=_cur())
|
||
return jsonify(data or [])
|
||
|
||
|
||
@api.route("/api/weather/hourly", methods=["POST"])
|
||
@login_required
|
||
def refresh_hourly():
|
||
data = weather_mgr.fetch_hourly(user_id=_cur())
|
||
return jsonify(data or [])
|
||
|
||
|
||
@api.route("/api/weather/minutely", methods=["GET"])
|
||
@display_login_required
|
||
def get_minutely():
|
||
data = weather_mgr.get_cached_minutely(user_id=_cur())
|
||
return jsonify(data or {})
|
||
|
||
|
||
@api.route("/api/weather/minutely", methods=["POST"])
|
||
@login_required
|
||
def refresh_minutely():
|
||
data = weather_mgr.fetch_minutely(user_id=_cur())
|
||
return jsonify(data)
|
||
|
||
|
||
@api.route("/api/weather/warnings", methods=["GET"])
|
||
@display_login_required
|
||
def get_warnings():
|
||
data = weather_mgr.get_cached_warnings(user_id=_cur())
|
||
return jsonify(data or {})
|
||
|
||
|
||
@api.route("/api/weather/warnings", methods=["POST"])
|
||
@login_required
|
||
def refresh_warnings():
|
||
data = weather_mgr.fetch_warnings(user_id=_cur())
|
||
return jsonify(data)
|
||
|
||
|
||
@api.route("/api/weather/city_lookup", methods=["GET"])
|
||
@login_required
|
||
def weather_city_lookup():
|
||
query = request.args.get("q", "")
|
||
if not query:
|
||
return jsonify([])
|
||
results = weather_mgr.city_lookup(query)
|
||
return jsonify(results)
|
||
|
||
|
||
@api.route("/api/weather/generate_keys", methods=["POST"])
|
||
@login_required
|
||
def weather_generate_keys():
|
||
result = weather_mgr.generate_weather_keys()
|
||
return jsonify(result)
|
||
|
||
|
||
# ════════════════════════════════════════════
|
||
# TIME CONFIG
|
||
# ════════════════════════════════════════════
|
||
|
||
@api.route("/api/time/config", methods=["GET"])
|
||
@login_required
|
||
def get_time_config():
|
||
"""Return current timezone configuration."""
|
||
from backend.time_util import get_tz_str
|
||
return jsonify({
|
||
"timezone": get_tz_str(),
|
||
})
|
||
|
||
|
||
@api.route("/api/time/config", methods=["PUT"])
|
||
@login_required
|
||
def set_time_config():
|
||
"""Update timezone configuration."""
|
||
from backend.time_util import set_tz
|
||
data = request.get_json() or {}
|
||
tz_str = data.get("timezone", "").strip()
|
||
if not tz_str:
|
||
return jsonify({"error": "timezone is required"}), 400
|
||
if set_tz(tz_str):
|
||
return jsonify({"ok": True})
|
||
return jsonify({"error": f"时区 '{tz_str}' 无效，请使用 IANA 名称（如 Asia/Shanghai）或 UTC+X 格式"}), 400
|
||
|
||
|
||
# ════════════════════════════════════════════
|
||
# ALARMS
|
||
# ════════════════════════════════════════════
|
||
|
||
@api.route("/api/alarms", methods=["GET"])
|
||
@login_required
|
||
def get_alarms():
|
||
return jsonify(alarm_mgr.get_alarms(user_id=_cur()))
|
||
|
||
|
||
@api.route("/api/alarms", methods=["POST"])
|
||
@login_required
|
||
def add_alarm():
|
||
data = request.get_json() or {}
|
||
alarm = alarm_mgr.add_alarm(
|
||
label=data.get("label", ""),
|
||
time=data.get("time", "08:00"),
|
||
days=data.get("days", "1,2,3,4,5,6,7"),
|
||
enabled=data.get("enabled", True),
|
||
once=data.get("once", False),
|
||
user_id=_cur(),
|
||
)
|
||
return jsonify(alarm), 201
|
||
|
||
|
||
@api.route("/api/alarms/<int:alarm_id>", methods=["PUT"])
|
||
@login_required
|
||
def update_alarm(alarm_id):
|
||
data = request.get_json() or {}
|
||
ok = alarm_mgr.update_alarm(
|
||
alarm_id,
|
||
label=data.get("label"),
|
||
time=data.get("time"),
|
||
days=data.get("days"),
|
||
enabled=data.get("enabled"),
|
||
once=data.get("once"),
|
||
user_id=_cur(),
|
||
)
|
||
if not ok:
|
||
return jsonify({"error": "闹钟不存在或无权访问"}), 404
|
||
return jsonify({"ok": True})
|
||
|
||
|
||
@api.route("/api/alarms/<int:alarm_id>", methods=["DELETE"])
|
||
@login_required
|
||
def delete_alarm(alarm_id):
|
||
ok = alarm_mgr.delete_alarm(alarm_id, user_id=_cur())
|
||
if not ok:
|
||
return jsonify({"error": "闹钟不存在或无权访问"}), 404
|
||
return jsonify({"ok": True})
|
||
|
||
|
||
@api.route("/api/alarms/ringtone", methods=["POST"])
|
||
@login_required
|
||
def upload_ringtone():
|
||
"""Upload a custom ringtone. Only audio formats allowed."""
|
||
ALLOWED_EXT = {".mp3", ".wav", ".ogg", ".flac", ".m4a"}
|
||
ALLOWED_MIME = {"audio/mpeg", "audio/wav", "audio/ogg", "audio/flac", "audio/mp4", "audio/x-m4a"}
|
||
file = request.files.get("file")
|
||
if not file:
|
||
return jsonify({"error": "file required"}), 400
|
||
ext = os.path.splitext(file.filename or "")[1].lower()
|
||
if ext not in ALLOWED_EXT:
|
||
return jsonify({"error": f"文件类型 {ext} 不允许，仅支持 {', '.join(sorted(ALLOWED_EXT))}"}), 400
|
||
mime = file.content_type or ""
|
||
if mime and mime not in ALLOWED_MIME:
|
||
return jsonify({"error": f"MIME 类型 {mime} 不允许"}), 400
|
||
ringtone_dir = os.path.join(
|
||
os.path.dirname(os.path.dirname(os.path.abspath(__file__))),
|
||
"frontend", "static", "ringtones"
|
||
)
|
||
os.makedirs(ringtone_dir, exist_ok=True)
|
||
safe_name = "".join(c for c in file.filename if c.isalnum() or c in "._-")
|
||
if not safe_name:
|
||
safe_name = "ringtone" + ext
|
||
# Avoid overwriting another user's file with the same name (ringtones are shared).
|
||
filepath = os.path.join(ringtone_dir, safe_name)
|
||
if os.path.exists(filepath):
|
||
import uuid
|
||
safe_name = f"{os.path.splitext(safe_name)[0]}-{uuid.uuid4().hex[:6]}{ext}"
|
||
filepath = os.path.join(ringtone_dir, safe_name)
|
||
file.save(filepath)
|
||
return jsonify({"ok": True, "filename": safe_name}), 201
|
||
|
||
|
||
# ════════════════════════════════════════════
|
||
# COUNTDOWNS
|
||
# ════════════════════════════════════════════
|
||
|
||
@api.route("/api/countdowns", methods=["GET"])
|
||
@login_required
|
||
def get_countdowns():
|
||
return jsonify(countdown_mgr.get_countdowns(user_id=_cur()))
|
||
|
||
|
||
@api.route("/api/countdowns", methods=["POST"])
|
||
@login_required
|
||
def add_countdown():
|
||
data = request.get_json() or {}
|
||
cd = countdown_mgr.add_countdown(
|
||
label=data.get("label", ""),
|
||
duration_seconds=data.get("duration_seconds", 300),
|
||
enabled=data.get("enabled", True),
|
||
user_id=_cur(),
|
||
)
|
||
return jsonify(cd), 201
|
||
|
||
|
||
@api.route("/api/countdowns/<int:cd_id>", methods=["PUT"])
|
||
@login_required
|
||
def update_countdown(cd_id):
|
||
data = request.get_json() or {}
|
||
ok = countdown_mgr.update_countdown(
|
||
cd_id,
|
||
label=data.get("label"),
|
||
duration_seconds=data.get("duration_seconds"),
|
||
enabled=data.get("enabled"),
|
||
user_id=_cur(),
|
||
)
|
||
if not ok:
|
||
return jsonify({"error": "倒计时不存在或无权访问"}), 404
|
||
return jsonify({"ok": True})
|
||
|
||
|
||
@api.route("/api/countdowns/<int:cd_id>", methods=["DELETE"])
|
||
@login_required
|
||
def delete_countdown(cd_id):
|
||
ok = countdown_mgr.delete_countdown(cd_id, user_id=_cur())
|
||
if not ok:
|
||
return jsonify({"error": "倒计时不存在或无权访问"}), 404
|
||
return jsonify({"ok": True})
|
||
|
||
|
||
# ════════════════════════════════════════════
|
||
# POMODORO
|
||
# ════════════════════════════════════════════
|
||
|
||
@api.route("/api/pomodoro", methods=["GET"])
|
||
@login_required
|
||
def get_pomodoro():
|
||
return jsonify(pomodoro_mgr.get_state(user_id=_cur()))
|
||
|
||
|
||
@api.route("/api/pomodoro", methods=["POST"])
|
||
@login_required
|
||
def create_pomodoro():
|
||
data = request.get_json() or {}
|
||
state = pomodoro_mgr.create_or_update(
|
||
work_minutes=data.get("work_minutes"),
|
||
break_minutes=data.get("break_minutes"),
|
||
long_break_minutes=data.get("long_break_minutes"),
|
||
cycles_before_long_break=data.get("cycles_before_long_break"),
|
||
enabled=data.get("enabled"),
|
||
display_controls_enabled=data.get("display_controls_enabled"),
|
||
work_label=data.get("work_label"),
|
||
break_label=data.get("break_label"),
|
||
user_id=_cur(),
|
||
)
|
||
return jsonify(state), 201
|
||
|
||
|
||
@api.route("/api/pomodoro/start", methods=["POST"])
|
||
@login_required
|
||
def start_pomodoro():
|
||
return jsonify(pomodoro_mgr.start(user_id=_cur()))
|
||
|
||
|
||
@api.route("/api/pomodoro/pause", methods=["POST"])
|
||
@login_required
|
||
def pause_pomodoro():
|
||
return jsonify(pomodoro_mgr.pause(user_id=_cur()))
|
||
|
||
|
||
@api.route("/api/pomodoro/stop", methods=["POST"])
|
||
@login_required
|
||
def stop_pomodoro():
|
||
return jsonify(pomodoro_mgr.stop(user_id=_cur()))
|
||
|
||
|
||
@api.route("/api/pomodoro/skip", methods=["POST"])
|
||
@login_required
|
||
def skip_pomodoro():
|
||
return jsonify(pomodoro_mgr.skip(user_id=_cur()))
|
||
|
||
|
||
@api.route("/api/pomodoro/dismiss", methods=["POST"])
|
||
@login_required
|
||
def dismiss_pomodoro():
|
||
return jsonify(pomodoro_mgr.dismiss(user_id=_cur()))
|
||
|
||
|
||
# ─── Register Blueprint ──────────────────────
|
||
|
||
def register_routes(app):
|
||
app.register_blueprint(api)
|