patrick
62c4e742ab
CRITICAL: - C-1: LDAP tls_verify Default False → True (MITM-Schutz) - C-2: TOTP-Secret Fernet-verschlüsselt in DB (statt Plaintext) - core/crypto.py: encrypt_value() / decrypt_value() helper - Migration 0026: totp_secret VARCHAR(64→500), ldap tls_verify default=true - _totp_plain() helper mit Legacy-Fallback für bestehende Werte HIGH: - H-1: Kiosk Nonce-Cache asyncio.Lock (Race Condition behoben) - H-2: File-Upload-Limit 10 MB (import_kimai.py + users.py CSV-Import) - H-3: CORS allow_methods/allow_headers explizit eingeschränkt (war *) - H-4: TrustedHostMiddleware aktiviert wenn ALLOWED_HOSTS gesetzt MEDIUM: - M-1: IP-Logging nutzt X-Forwarded-For hinter nginx-Proxy - M-4: Audit-Log für password_changed, totp_enabled, totp_disabled - M-5: CalDAV verify_ssl in Production erzwungen (_effective_verify_ssl) 152/152 Tests grün Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
87 lines
3.4 KiB
Python
87 lines
3.4 KiB
Python
from contextlib import asynccontextmanager
|
|
|
|
from fastapi import FastAPI
|
|
from fastapi.middleware.cors import CORSMiddleware
|
|
from fastapi.middleware.trustedhost import TrustedHostMiddleware
|
|
from slowapi import _rate_limit_exceeded_handler
|
|
from slowapi.errors import RateLimitExceeded
|
|
|
|
from app.core.config import settings
|
|
from app.core.database import engine, Base
|
|
from app.core.limiter import limiter
|
|
from app.routers import auth, users, companies
|
|
from app.routers import time_entries, absences, reports, ldap, smtp, caldav
|
|
from app.routers import import_kimai
|
|
from app.routers import kiosk
|
|
from app.routers import busylight
|
|
from app.routers import audit
|
|
|
|
|
|
@asynccontextmanager
|
|
async def lifespan(app: FastAPI):
|
|
# Startup: Tabellen anlegen falls noch nicht vorhanden (Alembic übernimmt das in Prod)
|
|
async with engine.begin() as conn:
|
|
await conn.run_sync(Base.metadata.create_all)
|
|
yield
|
|
# Shutdown
|
|
await engine.dispose()
|
|
|
|
|
|
app = FastAPI(
|
|
title=settings.app_name,
|
|
version="0.1.0",
|
|
docs_url="/docs" if not settings.is_production else None,
|
|
redoc_url="/redoc" if not settings.is_production else None,
|
|
lifespan=lifespan,
|
|
)
|
|
|
|
app.state.limiter = limiter
|
|
app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)
|
|
|
|
# ── Middleware ────────────────────────────────────────────────────────────────
|
|
|
|
app.add_middleware(
|
|
CORSMiddleware,
|
|
allow_origins=[settings.frontend_url],
|
|
allow_credentials=True,
|
|
allow_methods=["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"],
|
|
allow_headers=[
|
|
"Content-Type",
|
|
"Authorization",
|
|
"X-Kiosk-Key-Id",
|
|
"X-Kiosk-Timestamp",
|
|
"X-Kiosk-Nonce",
|
|
"X-Kiosk-Signature",
|
|
],
|
|
)
|
|
|
|
# TrustedHostMiddleware: aktiv sobald ALLOWED_HOSTS gesetzt (Development: leer = deaktiviert)
|
|
# Production: ALLOWED_HOSTS=timemaster.example.com in .env setzen
|
|
if settings.allowed_hosts:
|
|
app.add_middleware(TrustedHostMiddleware, allowed_hosts=settings.allowed_hosts)
|
|
|
|
# ── Routers ───────────────────────────────────────────────────────────────────
|
|
|
|
API_PREFIX = "/api/v1"
|
|
|
|
app.include_router(auth.router, prefix=API_PREFIX)
|
|
app.include_router(users.router, prefix=API_PREFIX)
|
|
app.include_router(companies.router, prefix=API_PREFIX)
|
|
app.include_router(time_entries.router, prefix=API_PREFIX)
|
|
app.include_router(absences.router, prefix=API_PREFIX)
|
|
app.include_router(reports.router, prefix=API_PREFIX)
|
|
app.include_router(ldap.router, prefix=API_PREFIX)
|
|
app.include_router(smtp.router, prefix=API_PREFIX)
|
|
app.include_router(caldav.router, prefix=API_PREFIX)
|
|
app.include_router(import_kimai.router, prefix=API_PREFIX)
|
|
app.include_router(kiosk.router, prefix=API_PREFIX)
|
|
app.include_router(busylight.router, prefix=API_PREFIX)
|
|
app.include_router(audit.router, prefix=API_PREFIX)
|
|
|
|
|
|
# ── Health ────────────────────────────────────────────────────────────────────
|
|
|
|
@app.get("/health", tags=["System"])
|
|
async def health():
|
|
return {"status": "ok", "app": settings.app_name, "env": settings.app_env}
|