3c39344069
Continues the routes/ package split — four more clean extractions, all
following the same absolute-import pattern documented in the 1.0.0-34
gotcha note.
* routes/history.py (184 LoC) — /history, /history/{id}, and the
/history/{id}/print view that MUST register before the {id} int route
to avoid FastAPI's int("print") 422. Helpers _PAGE_SIZE,
_ALL_STATES, _HISTORY_QUERY, _state_where moved with the endpoints.
B608 nosec annotated on the count_sql f-string (it's two hardcoded
literals; user input goes through bound params).
* routes/audit.py (53 LoC) — /audit page only. Owns _AUDIT_QUERY +
_AUDIT_EVENT_COLORS.
* routes/stats.py (111 LoC) — /stats analytics page. Pure aggregation
queries against burnin_jobs/drives, no shared helpers beyond
stale_context.
* routes/report.py (24 LoC) — POST /api/v1/report/send. Now requires
admin (was open to any authenticated user; sending mail is a side
effect non-admins shouldn't be able to fire — same principle as the
settings mutation gates added in 1.0.0-28).
routes/__init__.py shrank from 1261 -> 960 LoC. Remaining work:
drives, burnin, settings, dashboard — same pattern. Each future slice
will use the `import app.routes.X as _Y` absolute-import gotcha
workaround from 1.0.0-34.
Verification: 59/59 tests pass; /login 200 (public); /history /audit
/stats 401 (correctly auth-gated by middleware); container boots
clean at 1.0.0-35.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
53 lines
1.3 KiB
Python
53 lines
1.3 KiB
Python
"""Audit log page — shows the last 200 entries from `audit_events`."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import aiosqlite
|
|
from fastapi import APIRouter, Depends, Request
|
|
from fastapi.responses import HTMLResponse
|
|
|
|
from app import poller
|
|
from app.database import get_db
|
|
from app.renderer import templates
|
|
|
|
from ._helpers import stale_context
|
|
|
|
router = APIRouter()
|
|
|
|
|
|
_AUDIT_QUERY = """
|
|
SELECT
|
|
ae.id, ae.event_type, ae.operator, ae.message, ae.created_at,
|
|
d.devname, d.serial
|
|
FROM audit_events ae
|
|
LEFT JOIN drives d ON d.id = ae.drive_id
|
|
ORDER BY ae.id DESC
|
|
LIMIT 200
|
|
"""
|
|
|
|
_AUDIT_EVENT_COLORS = {
|
|
"burnin_queued": "yellow",
|
|
"burnin_started": "blue",
|
|
"burnin_passed": "passed",
|
|
"burnin_failed": "failed",
|
|
"burnin_cancelled": "cancelled",
|
|
"burnin_stuck": "failed",
|
|
"burnin_unknown": "unknown",
|
|
}
|
|
|
|
|
|
@router.get("/audit", response_class=HTMLResponse)
|
|
async def audit_log(
|
|
request: Request,
|
|
db: aiosqlite.Connection = Depends(get_db),
|
|
):
|
|
cur = await db.execute(_AUDIT_QUERY)
|
|
rows = [dict(r) for r in await cur.fetchall()]
|
|
ps = poller.get_state()
|
|
return templates.TemplateResponse(request, "audit.html", {
|
|
"request": request,
|
|
"events": rows,
|
|
"event_colors": _AUDIT_EVENT_COLORS,
|
|
"poller": ps,
|
|
**stale_context(ps),
|
|
})
|