680 lines
26 KiB
Python
680 lines
26 KiB
Python
"""
|
|
Administrative CRUD-API: User, Benutzergruppen, Hostgruppen, Hosts,
|
|
Rollenvergabe (an User UND an Benutzergruppen), SSH-Keys, API-Tokens.
|
|
|
|
Zustandsaendernde/-lesende Endpunkte sind entweder auf eine eingeloggte
|
|
Admin-Session ODER ein API-Token mit passendem Scope beschraenkt
|
|
(`require_admin_or_scope`, siehe app/auth/deps.py) und schreiben einen
|
|
Audit-Log-Eintrag (Konzept 4.7). Die Token-Verwaltung selbst
|
|
(/admin/tokens/*) laeuft bewusst ausschliesslich ueber `require_global_admin`
|
|
(reine Session-Aktion, kein Token-Bypass -- Privilege-Escalation-Schutz).
|
|
|
|
Eine feingranulare, auf `admin_hostgroup` beschraenkte Admin-Rolle ist im
|
|
Datenmodell vorbereitet, wird hier aus Uebersichtlichkeitsgruenden aber nicht
|
|
vollstaendig verdrahtet -- siehe TODO-Markierungen fuer den naechsten Ausbauschritt.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import json
|
|
|
|
from fastapi import APIRouter, Depends, HTTPException, Request, status
|
|
|
|
from app.auth.deps import CurrentUser, require_admin_or_scope, require_global_admin
|
|
from app.db import get_db
|
|
from app.models.schemas import (
|
|
ApiTokenCreateRequest,
|
|
GroupMemberRequest,
|
|
GroupRoleGrantRequest,
|
|
HostCreateRequest,
|
|
HostGroupCreateRequest,
|
|
RdpCredentialsRequest,
|
|
RoleGrantRequest,
|
|
SshKeyCreateRequest,
|
|
UserCreateRequest,
|
|
UserGroupCreateRequest,
|
|
)
|
|
from app.security.api_tokens import (
|
|
VALID_SCOPES,
|
|
generate_token,
|
|
hash_token,
|
|
token_prefix_for_display,
|
|
validate_scopes,
|
|
)
|
|
from app.security.audit import verify_chain, write_audit_event
|
|
from app.security.crypto import encrypt_secret
|
|
from app.security.passwords import hash_password
|
|
from app.ssh_proxy.proxy import discover_and_store_host_key
|
|
|
|
router = APIRouter(prefix="/admin", tags=["admin"])
|
|
|
|
|
|
def _client_ip(request: Request) -> str:
|
|
return request.client.host if request.client else "unknown"
|
|
|
|
|
|
# --- Users -----------------------------------------------------------------
|
|
|
|
@router.post("/users", status_code=status.HTTP_201_CREATED)
|
|
async def create_user(
|
|
payload: UserCreateRequest, request: Request,
|
|
admin: CurrentUser = Depends(require_admin_or_scope("users", "write")),
|
|
):
|
|
conn = get_db()
|
|
cursor = await conn.execute("SELECT 1 FROM users WHERE username = ?", (payload.username,))
|
|
if await cursor.fetchone() is not None:
|
|
raise HTTPException(status.HTTP_409_CONFLICT, "Benutzername existiert bereits")
|
|
|
|
pw_hash = hash_password(payload.initial_password)
|
|
cursor = await conn.execute(
|
|
"INSERT INTO users (username, password_hash, is_admin, must_change_password) "
|
|
"VALUES (?, ?, ?, 1)",
|
|
(payload.username, pw_hash, int(payload.is_admin)),
|
|
)
|
|
new_id = cursor.lastrowid
|
|
await write_audit_event(
|
|
conn, event_type="user_created", user_id=admin.id, client_ip=_client_ip(request),
|
|
details={"new_user_id": new_id, "username": payload.username, "is_admin": payload.is_admin},
|
|
)
|
|
await conn.commit()
|
|
return {"id": new_id, "username": payload.username}
|
|
|
|
|
|
@router.get("/users")
|
|
async def list_users(admin: CurrentUser = Depends(require_admin_or_scope("users", "read"))):
|
|
conn = get_db()
|
|
cursor = await conn.execute(
|
|
"SELECT id, username, is_admin, is_active, totp_enrolled, created_at FROM users ORDER BY id"
|
|
)
|
|
rows = await cursor.fetchall()
|
|
return [
|
|
{
|
|
"id": r[0], "username": r[1], "is_admin": bool(r[2]), "is_active": bool(r[3]),
|
|
"totp_enrolled": bool(r[4]), "created_at": r[5],
|
|
}
|
|
for r in rows
|
|
]
|
|
|
|
|
|
@router.post("/users/{user_id}/deactivate")
|
|
async def deactivate_user(
|
|
user_id: int, request: Request,
|
|
admin: CurrentUser = Depends(require_admin_or_scope("users", "write")),
|
|
):
|
|
conn = get_db()
|
|
await conn.execute(
|
|
"UPDATE users SET is_active = 0, session_version = session_version + 1 WHERE id = ?",
|
|
(user_id,),
|
|
)
|
|
await write_audit_event(
|
|
conn, event_type="user_deactivated", user_id=admin.id, client_ip=_client_ip(request),
|
|
details={"target_user_id": user_id},
|
|
)
|
|
await conn.commit()
|
|
return {"status": "ok"}
|
|
|
|
|
|
# --- Benutzergruppen (Teams) -------------------------------------------------
|
|
#
|
|
# "Verbindungen mit einer Gruppe teilen" = einer Benutzergruppe ueber
|
|
# /admin/group-roles/grant eine Rolle auf einer Hostgruppe geben -- jedes
|
|
# aktuelle und zukuenftige Mitglied erbt diese Rolle vollstaendig (siehe
|
|
# app/rbac.py: user_has_role() vereinigt direkte und Gruppen-Grants).
|
|
|
|
@router.post("/user-groups", status_code=status.HTTP_201_CREATED)
|
|
async def create_user_group(
|
|
payload: UserGroupCreateRequest, request: Request,
|
|
admin: CurrentUser = Depends(require_admin_or_scope("user_groups", "write")),
|
|
):
|
|
conn = get_db()
|
|
cursor = await conn.execute(
|
|
"SELECT 1 FROM user_groups WHERE name = ?", (payload.name,)
|
|
)
|
|
if await cursor.fetchone() is not None:
|
|
raise HTTPException(status.HTTP_409_CONFLICT, "Gruppenname existiert bereits")
|
|
cursor = await conn.execute(
|
|
"INSERT INTO user_groups (name, description) VALUES (?, ?)",
|
|
(payload.name, payload.description),
|
|
)
|
|
new_id = cursor.lastrowid
|
|
await write_audit_event(
|
|
conn, event_type="user_group_created", user_id=admin.id, client_ip=_client_ip(request),
|
|
details={"id": new_id, "name": payload.name},
|
|
)
|
|
await conn.commit()
|
|
return {"id": new_id, "name": payload.name}
|
|
|
|
|
|
@router.get("/user-groups")
|
|
async def list_user_groups(admin: CurrentUser = Depends(require_admin_or_scope("user_groups", "read"))):
|
|
conn = get_db()
|
|
cursor = await conn.execute(
|
|
"SELECT ug.id, ug.name, ug.description, ug.created_at, COUNT(ugm.user_id) "
|
|
"FROM user_groups ug LEFT JOIN user_group_members ugm ON ugm.user_group_id = ug.id "
|
|
"GROUP BY ug.id ORDER BY ug.name"
|
|
)
|
|
rows = await cursor.fetchall()
|
|
return [
|
|
{"id": r[0], "name": r[1], "description": r[2], "created_at": r[3], "member_count": r[4]}
|
|
for r in rows
|
|
]
|
|
|
|
|
|
@router.get("/user-groups/{group_id}/members")
|
|
async def list_group_members(
|
|
group_id: int, admin: CurrentUser = Depends(require_admin_or_scope("user_groups", "read"))
|
|
):
|
|
conn = get_db()
|
|
cursor = await conn.execute(
|
|
"SELECT u.id, u.username, ugm.added_at FROM user_group_members ugm "
|
|
"JOIN users u ON u.id = ugm.user_id WHERE ugm.user_group_id = ? ORDER BY u.username",
|
|
(group_id,),
|
|
)
|
|
rows = await cursor.fetchall()
|
|
return [{"user_id": r[0], "username": r[1], "added_at": r[2]} for r in rows]
|
|
|
|
|
|
@router.post("/user-groups/{group_id}/members", status_code=status.HTTP_201_CREATED)
|
|
async def add_group_member(
|
|
group_id: int, payload: GroupMemberRequest, request: Request,
|
|
admin: CurrentUser = Depends(require_admin_or_scope("user_groups", "write")),
|
|
):
|
|
conn = get_db()
|
|
group_cursor = await conn.execute("SELECT 1 FROM user_groups WHERE id = ?", (group_id,))
|
|
if await group_cursor.fetchone() is None:
|
|
raise HTTPException(status.HTTP_404_NOT_FOUND, "Gruppe nicht gefunden")
|
|
user_cursor = await conn.execute("SELECT 1 FROM users WHERE id = ?", (payload.user_id,))
|
|
if await user_cursor.fetchone() is None:
|
|
raise HTTPException(status.HTTP_404_NOT_FOUND, "Benutzer nicht gefunden")
|
|
|
|
await conn.execute(
|
|
"INSERT OR IGNORE INTO user_group_members (user_group_id, user_id, added_by) VALUES (?, ?, ?)",
|
|
(group_id, payload.user_id, admin.id),
|
|
)
|
|
await write_audit_event(
|
|
conn, event_type="user_group_member_added", user_id=admin.id, client_ip=_client_ip(request),
|
|
details={"user_group_id": group_id, "target_user_id": payload.user_id},
|
|
)
|
|
await conn.commit()
|
|
return {"status": "ok"}
|
|
|
|
|
|
@router.delete("/user-groups/{group_id}/members/{user_id}")
|
|
async def remove_group_member(
|
|
group_id: int, user_id: int, request: Request,
|
|
admin: CurrentUser = Depends(require_admin_or_scope("user_groups", "write")),
|
|
):
|
|
conn = get_db()
|
|
await conn.execute(
|
|
"DELETE FROM user_group_members WHERE user_group_id = ? AND user_id = ?",
|
|
(group_id, user_id),
|
|
)
|
|
await write_audit_event(
|
|
conn, event_type="user_group_member_removed", user_id=admin.id, client_ip=_client_ip(request),
|
|
details={"user_group_id": group_id, "target_user_id": user_id},
|
|
)
|
|
await conn.commit()
|
|
return {"status": "ok"}
|
|
|
|
|
|
# --- Hostgruppen -------------------------------------------------------------
|
|
|
|
@router.post("/host-groups", status_code=status.HTTP_201_CREATED)
|
|
async def create_host_group(
|
|
payload: HostGroupCreateRequest, request: Request,
|
|
admin: CurrentUser = Depends(require_admin_or_scope("host_groups", "write")),
|
|
):
|
|
conn = get_db()
|
|
cursor = await conn.execute(
|
|
"INSERT INTO host_groups (name, description) VALUES (?, ?)",
|
|
(payload.name, payload.description),
|
|
)
|
|
new_id = cursor.lastrowid
|
|
await write_audit_event(
|
|
conn, event_type="host_group_created", user_id=admin.id, client_ip=_client_ip(request),
|
|
details={"id": new_id, "name": payload.name},
|
|
)
|
|
await conn.commit()
|
|
return {"id": new_id, "name": payload.name}
|
|
|
|
|
|
@router.get("/host-groups")
|
|
async def list_host_groups(admin: CurrentUser = Depends(require_admin_or_scope("host_groups", "read"))):
|
|
conn = get_db()
|
|
cursor = await conn.execute("SELECT id, name, description FROM host_groups ORDER BY id")
|
|
rows = await cursor.fetchall()
|
|
return [{"id": r[0], "name": r[1], "description": r[2]} for r in rows]
|
|
|
|
|
|
# --- Hosts -------------------------------------------------------------------
|
|
|
|
@router.post("/hosts", status_code=status.HTTP_201_CREATED)
|
|
async def create_host(
|
|
payload: HostCreateRequest, request: Request,
|
|
admin: CurrentUser = Depends(require_admin_or_scope("hosts", "write")),
|
|
):
|
|
conn = get_db()
|
|
cursor = await conn.execute(
|
|
"""
|
|
INSERT INTO hosts (
|
|
host_group_id, hostname, address, protocol, port, os_type,
|
|
ssh_host_key_fingerprint, ssh_username, rdp_username, rdp_domain,
|
|
rdp_require_nla, clipboard_enabled, file_transfer_enabled
|
|
) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
|
|
""",
|
|
(
|
|
payload.host_group_id, payload.hostname, payload.address, payload.protocol,
|
|
payload.port, payload.os_type, payload.ssh_host_key_fingerprint,
|
|
payload.ssh_username, payload.rdp_username, payload.rdp_domain,
|
|
int(payload.rdp_require_nla), int(payload.clipboard_enabled),
|
|
int(payload.file_transfer_enabled),
|
|
),
|
|
)
|
|
new_id = cursor.lastrowid
|
|
await write_audit_event(
|
|
conn, event_type="host_created", user_id=admin.id, client_ip=_client_ip(request),
|
|
details={"id": new_id, "hostname": payload.hostname, "protocol": payload.protocol},
|
|
)
|
|
await conn.commit()
|
|
return {"id": new_id}
|
|
|
|
|
|
@router.get("/hosts")
|
|
async def list_hosts(
|
|
host_group_id: int | None = None,
|
|
admin: CurrentUser = Depends(require_admin_or_scope("hosts", "read")),
|
|
):
|
|
conn = get_db()
|
|
if host_group_id is not None:
|
|
cursor = await conn.execute(
|
|
"SELECT id, hostname, address, protocol, port, os_type, host_group_id "
|
|
"FROM hosts WHERE host_group_id = ? ORDER BY id",
|
|
(host_group_id,),
|
|
)
|
|
else:
|
|
cursor = await conn.execute(
|
|
"SELECT id, hostname, address, protocol, port, os_type, host_group_id FROM hosts ORDER BY id"
|
|
)
|
|
rows = await cursor.fetchall()
|
|
return [
|
|
{
|
|
"id": r[0], "hostname": r[1], "address": r[2], "protocol": r[3],
|
|
"port": r[4], "os_type": r[5], "host_group_id": r[6],
|
|
}
|
|
for r in rows
|
|
]
|
|
|
|
|
|
@router.post("/hosts/{host_id}/discover-host-key")
|
|
async def discover_host_key(
|
|
host_id: int, request: Request,
|
|
admin: CurrentUser = Depends(require_admin_or_scope("hosts", "write")),
|
|
):
|
|
"""ACHTUNG: Verbindet einmalig OHNE Host-Key-Pruefung, um den Fingerprint zu
|
|
erfassen (bewusste Trust-Entscheidung, siehe Konzept 4.2). Danach gilt fuer
|
|
alle regulaeren Verbindungen wieder striktes Pinning. Jeder Aufruf wird
|
|
prominent im Audit-Log vermerkt."""
|
|
conn = get_db()
|
|
fingerprint = await discover_and_store_host_key(conn, host_id, admin_user_id=admin.id)
|
|
await write_audit_event(
|
|
conn, event_type="host_key_discovered_trust_decision", user_id=admin.id,
|
|
client_ip=_client_ip(request), details={"host_id": host_id, "fingerprint": fingerprint},
|
|
)
|
|
await conn.commit()
|
|
return {"host_id": host_id, "fingerprint": fingerprint}
|
|
|
|
|
|
@router.put("/hosts/{host_id}/rdp-credentials")
|
|
async def set_rdp_credentials(
|
|
host_id: int, payload: RdpCredentialsRequest, request: Request,
|
|
admin: CurrentUser = Depends(require_admin_or_scope("hosts", "write")),
|
|
):
|
|
"""Speichert/rotiert das RDP-Passwort fuer einen Host, verschluesselt mit
|
|
dem KEK (eigener AAD-Kontext, siehe app/security/crypto.py)."""
|
|
conn = get_db()
|
|
encrypted = encrypt_secret(payload.password.encode(), associated_data=b"rdp_password")
|
|
await conn.execute(
|
|
"INSERT INTO rdp_credentials (host_id, password_enc, updated_at) "
|
|
"VALUES (?, ?, strftime('%Y-%m-%dT%H:%M:%fZ','now')) "
|
|
"ON CONFLICT(host_id) DO UPDATE SET password_enc = excluded.password_enc, "
|
|
"updated_at = excluded.updated_at",
|
|
(host_id, encrypted),
|
|
)
|
|
await write_audit_event(
|
|
conn, event_type="rdp_credentials_set", user_id=admin.id, client_ip=_client_ip(request),
|
|
details={"host_id": host_id},
|
|
)
|
|
await conn.commit()
|
|
return {"status": "ok"}
|
|
|
|
|
|
# --- Rollenvergabe (an einzelne User) -----------------------------------------
|
|
|
|
@router.post("/roles/grant")
|
|
async def grant_role(
|
|
payload: RoleGrantRequest, request: Request,
|
|
admin: CurrentUser = Depends(require_admin_or_scope("roles", "write")),
|
|
):
|
|
conn = get_db()
|
|
role_cursor = await conn.execute("SELECT id FROM roles WHERE name = ?", (payload.role_name,))
|
|
role_row = await role_cursor.fetchone()
|
|
if role_row is None:
|
|
raise HTTPException(status.HTTP_400_BAD_REQUEST, "Unbekannte Rolle")
|
|
|
|
await conn.execute(
|
|
"INSERT OR REPLACE INTO user_hostgroup_roles "
|
|
"(user_id, host_group_id, role_id, granted_by, expires_at) VALUES (?, ?, ?, ?, ?)",
|
|
(payload.user_id, payload.host_group_id, role_row[0], admin.id, payload.expires_at),
|
|
)
|
|
await write_audit_event(
|
|
conn, event_type="role_granted", user_id=admin.id, client_ip=_client_ip(request),
|
|
details={
|
|
"target_user_id": payload.user_id, "host_group_id": payload.host_group_id,
|
|
"role": payload.role_name, "expires_at": payload.expires_at,
|
|
},
|
|
)
|
|
await conn.commit()
|
|
return {"status": "ok"}
|
|
|
|
|
|
@router.post("/roles/revoke")
|
|
async def revoke_role(
|
|
payload: RoleGrantRequest, request: Request,
|
|
admin: CurrentUser = Depends(require_admin_or_scope("roles", "write")),
|
|
):
|
|
conn = get_db()
|
|
role_cursor = await conn.execute("SELECT id FROM roles WHERE name = ?", (payload.role_name,))
|
|
role_row = await role_cursor.fetchone()
|
|
if role_row is None:
|
|
raise HTTPException(status.HTTP_400_BAD_REQUEST, "Unbekannte Rolle")
|
|
|
|
await conn.execute(
|
|
"DELETE FROM user_hostgroup_roles WHERE user_id = ? AND host_group_id = ? AND role_id = ?",
|
|
(payload.user_id, payload.host_group_id, role_row[0]),
|
|
)
|
|
await write_audit_event(
|
|
conn, event_type="role_revoked", user_id=admin.id, client_ip=_client_ip(request),
|
|
details={
|
|
"target_user_id": payload.user_id, "host_group_id": payload.host_group_id,
|
|
"role": payload.role_name,
|
|
},
|
|
)
|
|
await conn.commit()
|
|
return {"status": "ok"}
|
|
|
|
|
|
@router.get("/roles")
|
|
async def list_role_grants(admin: CurrentUser = Depends(require_admin_or_scope("roles", "read"))):
|
|
conn = get_db()
|
|
cursor = await conn.execute(
|
|
"""
|
|
SELECT u.id, u.username, hg.id, hg.name, r.name, uhr.granted_by, uhr.granted_at, uhr.expires_at
|
|
FROM user_hostgroup_roles uhr
|
|
JOIN users u ON u.id = uhr.user_id
|
|
JOIN host_groups hg ON hg.id = uhr.host_group_id
|
|
JOIN roles r ON r.id = uhr.role_id
|
|
ORDER BY u.username, hg.name, r.name
|
|
"""
|
|
)
|
|
rows = await cursor.fetchall()
|
|
return [
|
|
{
|
|
"user_id": r[0], "username": r[1], "host_group_id": r[2], "host_group_name": r[3],
|
|
"role_name": r[4], "granted_by": r[5], "granted_at": r[6], "expires_at": r[7],
|
|
}
|
|
for r in rows
|
|
]
|
|
|
|
|
|
# --- Rollenvergabe (an Benutzergruppen) ---------------------------------------
|
|
|
|
@router.post("/group-roles/grant")
|
|
async def grant_group_role(
|
|
payload: GroupRoleGrantRequest, request: Request,
|
|
admin: CurrentUser = Depends(require_admin_or_scope("roles", "write")),
|
|
):
|
|
conn = get_db()
|
|
role_cursor = await conn.execute("SELECT id FROM roles WHERE name = ?", (payload.role_name,))
|
|
role_row = await role_cursor.fetchone()
|
|
if role_row is None:
|
|
raise HTTPException(status.HTTP_400_BAD_REQUEST, "Unbekannte Rolle")
|
|
|
|
await conn.execute(
|
|
"INSERT OR REPLACE INTO group_hostgroup_roles "
|
|
"(user_group_id, host_group_id, role_id, granted_by, expires_at) VALUES (?, ?, ?, ?, ?)",
|
|
(payload.user_group_id, payload.host_group_id, role_row[0], admin.id, payload.expires_at),
|
|
)
|
|
await write_audit_event(
|
|
conn, event_type="group_role_granted", user_id=admin.id, client_ip=_client_ip(request),
|
|
details={
|
|
"user_group_id": payload.user_group_id, "host_group_id": payload.host_group_id,
|
|
"role": payload.role_name, "expires_at": payload.expires_at,
|
|
},
|
|
)
|
|
await conn.commit()
|
|
return {"status": "ok"}
|
|
|
|
|
|
@router.post("/group-roles/revoke")
|
|
async def revoke_group_role(
|
|
payload: GroupRoleGrantRequest, request: Request,
|
|
admin: CurrentUser = Depends(require_admin_or_scope("roles", "write")),
|
|
):
|
|
conn = get_db()
|
|
role_cursor = await conn.execute("SELECT id FROM roles WHERE name = ?", (payload.role_name,))
|
|
role_row = await role_cursor.fetchone()
|
|
if role_row is None:
|
|
raise HTTPException(status.HTTP_400_BAD_REQUEST, "Unbekannte Rolle")
|
|
|
|
await conn.execute(
|
|
"DELETE FROM group_hostgroup_roles WHERE user_group_id = ? AND host_group_id = ? AND role_id = ?",
|
|
(payload.user_group_id, payload.host_group_id, role_row[0]),
|
|
)
|
|
await write_audit_event(
|
|
conn, event_type="group_role_revoked", user_id=admin.id, client_ip=_client_ip(request),
|
|
details={
|
|
"user_group_id": payload.user_group_id, "host_group_id": payload.host_group_id,
|
|
"role": payload.role_name,
|
|
},
|
|
)
|
|
await conn.commit()
|
|
return {"status": "ok"}
|
|
|
|
|
|
@router.get("/group-roles")
|
|
async def list_group_role_grants(admin: CurrentUser = Depends(require_admin_or_scope("roles", "read"))):
|
|
conn = get_db()
|
|
cursor = await conn.execute(
|
|
"""
|
|
SELECT ug.id, ug.name, hg.id, hg.name, r.name, ghr.granted_by, ghr.granted_at, ghr.expires_at
|
|
FROM group_hostgroup_roles ghr
|
|
JOIN user_groups ug ON ug.id = ghr.user_group_id
|
|
JOIN host_groups hg ON hg.id = ghr.host_group_id
|
|
JOIN roles r ON r.id = ghr.role_id
|
|
ORDER BY ug.name, hg.name, r.name
|
|
"""
|
|
)
|
|
rows = await cursor.fetchall()
|
|
return [
|
|
{
|
|
"user_group_id": r[0], "user_group_name": r[1], "host_group_id": r[2],
|
|
"host_group_name": r[3], "role_name": r[4], "granted_by": r[5],
|
|
"granted_at": r[6], "expires_at": r[7],
|
|
}
|
|
for r in rows
|
|
]
|
|
|
|
|
|
# --- SSH-Keyverwaltung ---------------------------------------------------------
|
|
|
|
@router.post("/ssh-keys", status_code=status.HTTP_201_CREATED)
|
|
async def create_ssh_key(
|
|
payload: SshKeyCreateRequest, request: Request,
|
|
admin: CurrentUser = Depends(require_admin_or_scope("ssh_keys", "write")),
|
|
):
|
|
"""Nimmt einen privaten Schluessel entgegen, verschluesselt ihn sofort mit
|
|
dem KEK (AES-256-GCM) und haelt den Klartext nur fuer die Dauer dieses
|
|
Requests im Prozessspeicher (siehe Konzept 6.4: Key verlaesst den Server nie)."""
|
|
conn = get_db()
|
|
encrypted = encrypt_secret(payload.private_key_pem.encode(), associated_data=b"ssh_private_key")
|
|
cursor = await conn.execute(
|
|
"INSERT INTO ssh_keys (label, owner_user_id, private_key_enc, public_key, key_type) "
|
|
"VALUES (?, ?, ?, ?, ?)",
|
|
(payload.label, payload.owner_user_id, encrypted, payload.public_key, payload.key_type),
|
|
)
|
|
new_id = cursor.lastrowid
|
|
await write_audit_event(
|
|
conn, event_type="ssh_key_created", user_id=admin.id, client_ip=_client_ip(request),
|
|
details={"id": new_id, "label": payload.label, "key_type": payload.key_type},
|
|
)
|
|
await conn.commit()
|
|
return {"id": new_id, "label": payload.label}
|
|
|
|
|
|
@router.get("/ssh-keys")
|
|
async def list_ssh_keys(admin: CurrentUser = Depends(require_admin_or_scope("ssh_keys", "read"))):
|
|
conn = get_db()
|
|
cursor = await conn.execute(
|
|
"SELECT id, label, owner_user_id, key_type, created_at, rotated_at, expires_at "
|
|
"FROM ssh_keys ORDER BY id"
|
|
)
|
|
rows = await cursor.fetchall()
|
|
return [
|
|
{
|
|
"id": r[0], "label": r[1], "owner_user_id": r[2], "key_type": r[3],
|
|
"created_at": r[4], "rotated_at": r[5], "expires_at": r[6],
|
|
}
|
|
for r in rows
|
|
]
|
|
|
|
|
|
@router.post("/hosts/{host_id}/ssh-keys/{key_id}")
|
|
async def map_ssh_key_to_host(
|
|
host_id: int, key_id: int, request: Request,
|
|
admin: CurrentUser = Depends(require_admin_or_scope("ssh_keys", "write")),
|
|
):
|
|
conn = get_db()
|
|
await conn.execute(
|
|
"INSERT OR IGNORE INTO host_ssh_key_map (host_id, ssh_key_id) VALUES (?, ?)",
|
|
(host_id, key_id),
|
|
)
|
|
await write_audit_event(
|
|
conn, event_type="ssh_key_mapped", user_id=admin.id, client_ip=_client_ip(request),
|
|
details={"host_id": host_id, "ssh_key_id": key_id},
|
|
)
|
|
await conn.commit()
|
|
return {"status": "ok"}
|
|
|
|
|
|
# --- API-Tokens ------------------------------------------------------------
|
|
#
|
|
# Bewusst ausschliesslich ueber require_global_admin (Session), NIE ueber
|
|
# require_admin_or_scope -- ein geleaktes Token darf sich damit nicht selbst
|
|
# weitere/staerkere Tokens ausstellen (Privilege-Escalation-Schutz).
|
|
|
|
@router.get("/scopes")
|
|
async def list_valid_scopes(admin: CurrentUser = Depends(require_global_admin)):
|
|
return {"scopes": sorted(VALID_SCOPES)}
|
|
|
|
|
|
@router.post("/tokens", status_code=status.HTTP_201_CREATED)
|
|
async def create_api_token(
|
|
payload: ApiTokenCreateRequest, request: Request, admin: CurrentUser = Depends(require_global_admin)
|
|
):
|
|
try:
|
|
scopes = validate_scopes(payload.scopes)
|
|
except ValueError as exc:
|
|
raise HTTPException(status.HTTP_400_BAD_REQUEST, str(exc)) from exc
|
|
|
|
conn = get_db()
|
|
user_cursor = await conn.execute("SELECT 1 FROM users WHERE id = ?", (payload.user_id,))
|
|
if await user_cursor.fetchone() is None:
|
|
raise HTTPException(status.HTTP_404_NOT_FOUND, "Benutzer nicht gefunden")
|
|
|
|
token = generate_token()
|
|
cursor = await conn.execute(
|
|
"INSERT INTO api_tokens (user_id, label, token_hash, token_prefix, scopes_json, "
|
|
"created_by, expires_at) VALUES (?, ?, ?, ?, ?, ?, ?)",
|
|
(
|
|
payload.user_id, payload.label, hash_token(token), token_prefix_for_display(token),
|
|
json.dumps(scopes), admin.id, payload.expires_at,
|
|
),
|
|
)
|
|
new_id = cursor.lastrowid
|
|
await write_audit_event(
|
|
conn, event_type="api_token_created", user_id=admin.id, client_ip=_client_ip(request),
|
|
details={
|
|
"token_id": new_id, "target_user_id": payload.user_id, "label": payload.label,
|
|
"scopes": scopes, "expires_at": payload.expires_at,
|
|
},
|
|
)
|
|
await conn.commit()
|
|
# Klartext-Token wird NUR in dieser einen Response zurueckgegeben -- danach
|
|
# ist nur noch der Hash in der DB, das Token ist nicht mehr rekonstruierbar.
|
|
return {"id": new_id, "token": token, "prefix": token_prefix_for_display(token), "scopes": scopes}
|
|
|
|
|
|
@router.get("/tokens")
|
|
async def list_api_tokens(admin: CurrentUser = Depends(require_global_admin)):
|
|
conn = get_db()
|
|
cursor = await conn.execute(
|
|
"SELECT t.id, t.user_id, u.username, t.label, t.token_prefix, t.scopes_json, "
|
|
"t.created_at, t.expires_at, t.last_used_at, t.revoked_at "
|
|
"FROM api_tokens t JOIN users u ON u.id = t.user_id ORDER BY t.id DESC"
|
|
)
|
|
rows = await cursor.fetchall()
|
|
return [
|
|
{
|
|
"id": r[0], "user_id": r[1], "username": r[2], "label": r[3], "prefix": r[4],
|
|
"scopes": json.loads(r[5]), "created_at": r[6], "expires_at": r[7],
|
|
"last_used_at": r[8], "revoked_at": r[9],
|
|
}
|
|
for r in rows
|
|
]
|
|
|
|
|
|
@router.post("/tokens/{token_id}/revoke")
|
|
async def revoke_api_token(
|
|
token_id: int, request: Request, admin: CurrentUser = Depends(require_global_admin)
|
|
):
|
|
conn = get_db()
|
|
await conn.execute(
|
|
"UPDATE api_tokens SET revoked_at = strftime('%Y-%m-%dT%H:%M:%fZ','now') "
|
|
"WHERE id = ? AND revoked_at IS NULL",
|
|
(token_id,),
|
|
)
|
|
await write_audit_event(
|
|
conn, event_type="api_token_revoked", user_id=admin.id, client_ip=_client_ip(request),
|
|
details={"token_id": token_id},
|
|
)
|
|
await conn.commit()
|
|
return {"status": "ok"}
|
|
|
|
|
|
# --- Audit-Log -----------------------------------------------------------------
|
|
|
|
@router.get("/audit-log")
|
|
async def get_audit_log(
|
|
limit: int = 100, offset: int = 0,
|
|
admin: CurrentUser = Depends(require_admin_or_scope("audit", "read")),
|
|
):
|
|
limit = max(1, min(limit, 1000))
|
|
conn = get_db()
|
|
cursor = await conn.execute(
|
|
"SELECT id, ts, user_id, client_ip, event_type, details_json FROM audit_log "
|
|
"ORDER BY id DESC LIMIT ? OFFSET ?",
|
|
(limit, offset),
|
|
)
|
|
rows = await cursor.fetchall()
|
|
return [
|
|
{"id": r[0], "ts": r[1], "user_id": r[2], "client_ip": r[3], "event_type": r[4], "details": r[5]}
|
|
for r in rows
|
|
]
|
|
|
|
|
|
@router.get("/audit-log/verify")
|
|
async def verify_audit_log(admin: CurrentUser = Depends(require_admin_or_scope("audit", "read"))):
|
|
"""Prueft die Hash-Chain auf Manipulationsfreiheit (Konzept 6.1/4.7)."""
|
|
conn = get_db()
|
|
intact, broken_at = await verify_chain(conn)
|
|
return {"intact": intact, "first_broken_id": broken_at}
|