justin
c5631d3eab
Provenance had no system-level owner: ownership was only per-tree (TreeMembership), so a self-hosted instance had no operator account and no instance-admin surface. This adds one, declared by environment per the project's twelve-factor rule. - OWNER_EMAIL (comma-separated): the account(s) named here are instance owners. Derived at request time — no DB column, no migration, can't drift from the env, survives DB resets. is_instance_owner()/InstanceOwner dependency in api/deps.py. - Ownership requires a VERIFIED email (independent of REQUIRE_EMAIL_VERIFICATION). Registration is open, so without this an attacker could seize the role by registering the owner address first; verification ties it to inbox control. - GET /api/v1/admin/instance (owner-only): operational status — version, env, user/tree counts, configured AI providers. Deliberately exposes no tree data or PII: instance ownership is an operator role, NOT a privacy-engine bypass. - /users/me reports is_instance_owner; frontend gains an owner-only /admin page and a conditional sidebar link (server-enforced, not just client-hidden). Found-and-fixed by an adversarial security review before merge: the verified-email land-grab (above) and a frontend null-deref where the admin page crashed on 401/5xx instead of failing closed. Docs: .env.example + ARCHITECTURE (notes the not-a-privacy-bypass boundary and the verified-email requirement). Tests: owner matching, the land-grab guard, /users/me, and owner-only /admin. Suite 96 passing. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Justin Paul <justin@jpaul.me>
64 lines
2.1 KiB
Python
64 lines
2.1 KiB
Python
from fastapi import APIRouter, File, Form, Response, UploadFile
|
|
|
|
from app.api.deps import CurrentUser, ObjectStoreDep, SessionDep, is_instance_owner
|
|
from app.schemas.user import UserRead, UserSelfPersonUpdate
|
|
from app.services import account_service, user_service
|
|
|
|
router = APIRouter(prefix="/users", tags=["users"])
|
|
|
|
|
|
def _me(user) -> UserRead:
|
|
out = UserRead.model_validate(user)
|
|
out.is_instance_owner = is_instance_owner(user)
|
|
return out
|
|
|
|
|
|
@router.get("/me", response_model=UserRead)
|
|
async def read_me(current: CurrentUser) -> UserRead:
|
|
return _me(current)
|
|
|
|
|
|
@router.patch("/me/self-person", response_model=UserRead)
|
|
async def set_self_person(
|
|
data: UserSelfPersonUpdate, session: SessionDep, current: CurrentUser
|
|
) -> UserRead:
|
|
"""Link (or unlink) the Person record that represents this account."""
|
|
user = await user_service.set_self_person(
|
|
session, user=current, person_id=data.self_person_id
|
|
)
|
|
return _me(user)
|
|
|
|
|
|
@router.get("/me/export")
|
|
async def export_account(
|
|
session: SessionDep, current: CurrentUser, store: ObjectStoreDep
|
|
) -> Response:
|
|
"""Download a full backup (JSON + media) of every tree the user owns."""
|
|
data = await account_service.export_account(session, store, user=current)
|
|
return Response(
|
|
content=data,
|
|
media_type="application/zip",
|
|
headers={"Content-Disposition": 'attachment; filename="provenance-export.zip"'},
|
|
)
|
|
|
|
|
|
@router.post("/me/import")
|
|
async def import_account(
|
|
session: SessionDep,
|
|
current: CurrentUser,
|
|
store: ObjectStoreDep,
|
|
file: UploadFile = File(...),
|
|
) -> dict:
|
|
"""Restore a previously-exported backup into new trees (non-destructive)."""
|
|
raw = await file.read()
|
|
return await account_service.import_account(session, store, user=current, raw_zip=raw)
|
|
|
|
|
|
@router.delete("/me", status_code=204)
|
|
async def delete_account(
|
|
session: SessionDep, current: CurrentUser, confirm_email: str = Form(...)
|
|
) -> None:
|
|
"""Delete the account: the user, their owned trees, and their sessions.
|
|
Requires retyping the account email as a guard."""
|
|
await account_service.delete_account(session, user=current, confirm_email=confirm_email)
|