tvid/tvid/server.py

#!/usr/bin/env python3

# this is a quick hack, to be improved later. trying to do the simplest
# thing that will possibly work.

## # TODO
##
## * put page content into templates/static files
## * clean up FIXME

import bottle
from bottle import route, run, request, response, redirect
from bottle import HTTPError, template
from sqlalchemy.ext.declarative import declarative_base
from bottle.ext import sqlalchemy
from pprint import pprint
from sqlalchemy import create_engine
import urllib.parse
import os
import random
import string
from datetime import datetime, timedelta

VERSION = '1.0.0'
PORT = os.environ.get('PORT', 8080)
DEBUG = os.environ.get('DEBUG', False)
SQLITE_FILENAME = os.environ.get('SQLITE_FILENAME','/data/db.sqlite')
DATABASE_URL = os.environ.get('DATABASE_URL','sqlite:///' + SQLITE_FILENAME)
ADMIN_PSK = os.environ.get('ADMIN_PSK','hunter2')

# sorry for global
SQLBASE = declarative_base()

# FIXME make this skip letters not in base58
def randomUpper(count):
    return ''.join(random.choice(string.ascii_uppercase) for _ in range(count))

# FIXME maybe make the IDs longer
def genRandomTVID():
    tvid = str(randomUpper(3) + "-" + randomUpper(3))
    return tvid

def serve():
    app = bottle.Bottle()

    # pull in models
    from .db import TV

    engine = create_engine(DATABASE_URL, echo=False)

    plugin = sqlalchemy.Plugin(
        engine,
        SQLBASE.metadata,
        keyword='db',
        create=True,
        commit=True,
        use_kwargs=False
    )

    app.install(plugin)

    # here we cookie them if they have no cookie, then redirect them to the
    # cookie'd value (whether preexisting or new).
    @app.get('/')
    def indexpage():
        c = request.get_cookie("displayid")
        if c:
            # redirect
            return redirect('/tv/' + c)
        else:
            newid = genRandomTVID()
            response.set_cookie("displayid", newid)
            return redirect('/tv/' + newid)

    @app.get('/style.css')
    def stylesheet():
        response.content_type = 'text/css'
        return template('style')

    # here we check to see if they have a redirect URL in the db. if they do
    # we send them there. if they don't, we display their ID really big,
    # reloading the page once per hour.
    @app.get('/tv/<displayid>')
    def tvpage(db, displayid=None):
        # FIXME check for cookie, this is broken
        if displayid is None:
            return template('nocookie')

        # check db for tv id
        tv = db.query(TV).filter_by(displayid=displayid).first()
        if tv:
            tv.lastSeen = datetime.now()
            db.add(tv)
            if tv.target:
                return redirect(tv.target)
            else:
                return template('displayid', id=displayid, version=VERSION)
        else:
            # otherwise, just show their display ID bigly and keep them
            # bouncing periodically until some admin configures them
            # a target:
            # update lastseen here:
            newtv = TV(displayid=displayid,lastSeen=datetime.now())
            db.add(newtv)
            return template('displayid', id=displayid, version=VERSION)


    @app.get('/admin/edit/<displayid>')
    def displayeditform(db, displayid=None):
        c = request.get_cookie("psk")
        if not c:
            return redirect('/login')
        if c != ADMIN_PSK:
            return redirect('/logout')
        if not displayid:
            return redirect('/admin')
        tv = db.query(TV).filter_by(displayid=displayid).first()
        if tv is None:
            return redirect('/admin')
        return template('displayeditform', tv=tv, version=VERSION)

    @app.post('/admin/edit')
    def displayedithandler(db):
        # FIXME SECURITY csrf issue
        c = request.get_cookie("psk")
        if not c:
            return redirect('/login')
        if c != ADMIN_PSK:
            return redirect('/logout')
        displayid = request.forms.get('displayid')
        tv = db.query(TV).filter_by(displayid=displayid).first()
        if tv is None:
            return redirect('/admin')
        # FIXME make sure this is a valid URL
        tv.target = request.forms.get('target')
        tv.memo = request.forms.get('formmemo')
        db.add(tv)
        db.commit()
        return redirect('/admin')

    # here we display the administration list of TVs if logged in
    # if logged out then redirect to /login
    # FIXME make this use sessions instead of just storing PSK in a cookie
    # https://bottlepy.org/docs/dev/recipes.html
    @app.get('/admin')
    def adminpage(db):
        c = request.get_cookie("psk")
        if not c:
            return redirect('/login')
        if c != ADMIN_PSK:
            return redirect('/logout')

        # first, cleanup db of old entries:
        week_ago = datetime.now() - timedelta(days=7)
        db.query(TV).filter(TV.lastSeen < week_ago).delete()
        db.commit()

        tvs = db.query(TV).order_by(TV.lastSeen.desc())
        response.headers['Cache-Control'] = 'no-cache'
        return template('adminpanel', tvs=tvs, version=VERSION)


    # here we ask for a password:
    @app.get('/login')
    def loginform():
        msg = request.GET.msg
        return template('loginform', version=VERSION, msg=msg)

    @app.post('/checklogin')
    def checklogin():
        attemptedPass = request.forms.get('password')
        if not attemptedPass:
            return redirect(
                '/login?msg=' +
                urllib.parse.quote_plus(u"Incorrect password.")
            )
        if attemptedPass != ADMIN_PSK:
            return redirect(
                '/login?msg=' +
                urllib.parse.quote_plus(u"Incorrect password.")
            )
        # password is right, cookie them:
        response.set_cookie("psk", attemptedPass)
        return redirect('/admin')

    @app.get('/logout')
    def logout():
        response.set_cookie("psk", "")
        return redirect('/login')

    app.run(host='0.0.0.0', port=PORT, debug=DEBUG)