Upload 7 files

pyrunner/asgi.py

@@ -0,0 +1,16 @@
+"""
+ASGI config for pyrunner project.
+
+It exposes the ASGI callable as a module-level variable named ``application``.
+
+For more information on this file, see
+https://docs.djangoproject.com/en/6.0/howto/deployment/asgi/
+"""
+
+import os
+
+from django.core.asgi import get_asgi_application
+
+os.environ.setdefault("DJANGO_SETTINGS_MODULE", "pyrunner.settings")
+
+application = get_asgi_application()

pyrunner/middleware.py

@@ -0,0 +1,24 @@
+"""Custom middleware for PyRunner."""
+
+
+class NoCacheMiddleware:
+    """Prevent browser caching of HTML responses.
+
+    This ensures users always see fresh data when navigating the dashboard,
+    without needing to hard-refresh the browser.
+    """
+
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        response = self.get_response(request)
+
+        # Only add no-cache headers to HTML responses
+        content_type = response.get("Content-Type", "")
+        if "text/html" in content_type:
+            response["Cache-Control"] = "no-cache, no-store, must-revalidate"
+            response["Pragma"] = "no-cache"
+            response["Expires"] = "0"
+
+        return response

pyrunner/settings.py

@@ -0,0 +1,388 @@
+"""
+Django settings for pyrunner project.
+
+Generated by 'django-admin startproject' using Django 6.0.1.
+
+For more information on this file, see
+https://docs.djangoproject.com/en/6.0/topics/settings/
+
+For the full list of settings and their values, see
+https://docs.djangoproject.com/en/6.0/ref/settings/
+"""
+
+import os
+import shutil
+from pathlib import Path
+
+from django.core.exceptions import ImproperlyConfigured
+from dotenv import load_dotenv
+
+# Build paths inside the project like this: BASE_DIR / 'subdir'.
+BASE_DIR = Path(__file__).resolve().parent.parent
+
+# Load environment variables from .env file
+load_dotenv(BASE_DIR / ".env")
+
+
+# Quick-start development settings - unsuitable for production
+# See https://docs.djangoproject.com/en/6.0/howto/deployment/checklist/
+
+# SECURITY WARNING: keep the secret key used in production secret!
+# SECRET_KEY is required - generate one with: python -c "from django.core.management.utils import get_random_secret_key; print(get_random_secret_key())"
+SECRET_KEY = os.environ["SECRET_KEY"]
+
+# SECURITY WARNING: don't run with debug turned on in production!
+# Defaults to False for security - set DEBUG=True explicitly for development
+DEBUG = os.environ.get("DEBUG", "False").lower() == "true"
+
+ALLOWED_HOSTS = os.environ.get("ALLOWED_HOSTS", "localhost,127.0.0.1").split(",")
+
+
+# Application definition
+
+INSTALLED_APPS = [
+    "django.contrib.admin",
+    "django.contrib.auth",
+    "django.contrib.contenttypes",
+    "django.contrib.sessions",
+    "django.contrib.messages",
+    "django.contrib.staticfiles",
+    # Third party
+    "django_q",
+    "tailwind",
+    "theme",
+    "axes",
+    # Local apps
+    "core",
+]
+
+# Tailwind CSS
+TAILWIND_APP_NAME = "theme"
+INTERNAL_IPS = ["127.0.0.1"]
+NPM_BIN_PATH = os.environ.get("NPM_BIN_PATH", shutil.which("npm") or "npm")
+
+MIDDLEWARE = [
+    "django.middleware.security.SecurityMiddleware",
+    "whitenoise.middleware.WhiteNoiseMiddleware",
+    "pyrunner.middleware.NoCacheMiddleware",
+    "django.contrib.sessions.middleware.SessionMiddleware",
+    "django.middleware.common.CommonMiddleware",
+    "django.middleware.csrf.CsrfViewMiddleware",
+    "django.contrib.auth.middleware.AuthenticationMiddleware",
+    "axes.middleware.AxesMiddleware",
+    "django.contrib.messages.middleware.MessageMiddleware",
+    "django.middleware.clickjacking.XFrameOptionsMiddleware",
+    "core.middleware.SetupWizardMiddleware",
+]
+
+ROOT_URLCONF = "pyrunner.urls"
+
+TEMPLATES = [
+    {
+        "BACKEND": "django.template.backends.django.DjangoTemplates",
+        "DIRS": [BASE_DIR / "templates"],
+        "APP_DIRS": True,
+        "OPTIONS": {
+            "context_processors": [
+                "django.template.context_processors.request",
+                "django.contrib.auth.context_processors.auth",
+                "django.contrib.messages.context_processors.messages",
+                "core.context_processors.pyrunner_version",
+            ],
+        },
+    },
+]
+
+WSGI_APPLICATION = "pyrunner.wsgi.application"
+
+
+# Database
+# https://docs.djangoproject.com/en/6.0/ref/settings/#databases
+
+DATABASES = {
+    "default": {
+        "ENGINE": "django.db.backends.sqlite3",
+        "NAME": BASE_DIR / "data" / "db.sqlite3",
+        "OPTIONS": {
+            "timeout": 30,  # Wait up to 30 seconds for database lock
+        },
+    }
+}
+
+
+# Enable SQLite WAL mode for better concurrency in multi-process environments
+def _enable_sqlite_wal(sender, connection, **kwargs):
+    if connection.vendor == "sqlite":
+        cursor = connection.cursor()
+        cursor.execute("PRAGMA journal_mode=WAL;")
+        cursor.execute("PRAGMA busy_timeout=30000;")
+
+
+from django.db.backends.signals import connection_created
+
+connection_created.connect(_enable_sqlite_wal)
+
+
+# Custom User Model
+AUTH_USER_MODEL = "core.User"
+
+# Auth URLs
+LOGIN_URL = "auth:login"
+LOGIN_REDIRECT_URL = "cpanel:dashboard"
+
+
+# Password validation
+# https://docs.djangoproject.com/en/6.0/ref/settings/#auth-password-validators
+
+AUTH_PASSWORD_VALIDATORS = [
+    {
+        "NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator",
+    },
+    {
+        "NAME": "django.contrib.auth.password_validation.MinimumLengthValidator",
+    },
+    {
+        "NAME": "django.contrib.auth.password_validation.CommonPasswordValidator",
+    },
+    {
+        "NAME": "django.contrib.auth.password_validation.NumericPasswordValidator",
+    },
+]
+
+# Authentication backends (django-axes for brute force protection)
+AUTHENTICATION_BACKENDS = [
+    "axes.backends.AxesStandaloneBackend",
+    "django.contrib.auth.backends.ModelBackend",
+]
+
+# Django Axes Configuration (login rate limiting)
+AXES_FAILURE_LIMIT = int(os.environ.get("AXES_FAILURE_LIMIT", "5"))  # Lock after 5 failed attempts
+AXES_COOLOFF_TIME = 0.25  # 15 minutes lockout (in hours)
+AXES_RESET_ON_SUCCESS = True  # Reset failed attempts after successful login
+AXES_LOCKOUT_PARAMETERS = [["username", "ip_address"]]  # Combined lockout by username AND IP
+AXES_ENABLE_ACCESS_FAILURE_LOG = True  # Log failed attempts
+AXES_VERBOSE = False  # Don't log every access attempt
+
+
+# Internationalization
+# https://docs.djangoproject.com/en/6.0/topics/i18n/
+
+LANGUAGE_CODE = "en-us"
+
+TIME_ZONE = "UTC"
+
+USE_I18N = True
+
+USE_TZ = True
+
+
+# Static files (CSS, JavaScript, Images)
+# https://docs.djangoproject.com/en/6.0/howto/static-files/
+
+STATIC_URL = "static/"
+STATICFILES_DIRS = [BASE_DIR / "static"]
+STATIC_ROOT = BASE_DIR / "staticfiles"
+
+# WhiteNoise for serving static files in production
+STORAGES = {
+    "default": {
+        "BACKEND": "django.core.files.storage.FileSystemStorage",
+    },
+    "staticfiles": {
+        "BACKEND": "whitenoise.storage.CompressedManifestStaticFilesStorage",
+    },
+}
+
+
+# Default primary key field type
+# https://docs.djangoproject.com/en/6.0/ref/settings/#default-auto-field
+
+DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField"
+
+
+# Email Configuration
+# Console backend for development, configure SMTP in production
+EMAIL_BACKEND = os.environ.get(
+    "EMAIL_BACKEND",
+    "django.core.mail.backends.console.EmailBackend",
+)
+DEFAULT_FROM_EMAIL = os.environ.get("DEFAULT_FROM_EMAIL", "noreply@pyrunner.local")
+
+# Resend API Configuration (Production)
+RESEND_API_KEY = os.environ.get("RESEND_API_KEY", "")
+USE_RESEND = os.environ.get("USE_RESEND", "False").lower() == "true"
+
+
+# django-q2 Configuration
+def _get_q_cluster_config():
+    """
+    Get Q_CLUSTER configuration from database with environment fallbacks.
+
+    This is called at module load time. Database values take precedence
+    over environment variables when available.
+    """
+    # Default values (from env vars or hardcoded defaults)
+    config = {
+        "name": "PyRunner",
+        "workers": int(os.environ.get("Q_WORKERS", 2)),
+        "timeout": 600 if os.name != "nt" else 0,
+        "retry": 660,
+        "queue_limit": 20,
+        "bulk": 5,
+        "orm": "default",
+        "catch_up": False,
+    }
+
+    # Try to load from database (only if apps are ready to avoid initialization warnings)
+    try:
+        from django.apps import apps
+
+        if not apps.ready:
+            return config  # Return defaults during app initialization
+
+        from django.db import connection
+        from django.db.utils import OperationalError, ProgrammingError
+
+        with connection.cursor() as cursor:
+            cursor.execute(
+                "SELECT q_workers, q_timeout, q_retry, q_queue_limit "
+                "FROM global_settings WHERE id = 1"
+            )
+            row = cursor.fetchone()
+            if row:
+                config["workers"] = row[0] or config["workers"]
+                # On Windows, force timeout to 0 regardless of DB value
+                if os.name == "nt":
+                    config["timeout"] = 0
+                else:
+                    config["timeout"] = row[1] if row[1] is not None else config["timeout"]
+                config["retry"] = row[2] or config["retry"]
+                config["queue_limit"] = row[3] or config["queue_limit"]
+    except (OperationalError, ProgrammingError, Exception):
+        # Database not ready yet (migrations not run), use defaults
+        pass
+
+    return config
+
+
+Q_CLUSTER = _get_q_cluster_config()
+
+
+# PyRunner Configuration
+DATA_DIR = BASE_DIR / "data"
+ENVIRONMENTS_ROOT = DATA_DIR / "environments"
+SCRIPTS_WORKDIR = DATA_DIR / "workdir"
+
+# Ensure directories exist
+DATA_DIR.mkdir(exist_ok=True)
+ENVIRONMENTS_ROOT.mkdir(exist_ok=True)
+SCRIPTS_WORKDIR.mkdir(exist_ok=True)
+
+
+# Secrets Encryption
+# Generate a key with: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
+ENCRYPTION_KEY = os.environ.get("ENCRYPTION_KEY", "")
+
+# Validate ENCRYPTION_KEY
+if not ENCRYPTION_KEY:
+    if not DEBUG:
+        raise ImproperlyConfigured(
+            "ENCRYPTION_KEY is required in production. "
+            "Generate one with: python -c \"from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())\""
+        )
+else:
+    # Validate key format
+    try:
+        from cryptography.fernet import Fernet
+        Fernet(ENCRYPTION_KEY.encode() if isinstance(ENCRYPTION_KEY, str) else ENCRYPTION_KEY)
+    except Exception:
+        raise ImproperlyConfigured("ENCRYPTION_KEY is invalid. Must be a valid Fernet key.")
+
+
+# Logging Configuration
+LOGS_DIR = DATA_DIR / "logs"
+LOGS_DIR.mkdir(exist_ok=True)
+
+LOGGING = {
+    "version": 1,
+    "disable_existing_loggers": False,
+    "formatters": {
+        "verbose": {
+            "format": "[{asctime}] {levelname} {name} {message}",
+            "style": "{",
+            "datefmt": "%Y-%m-%d %H:%M:%S",
+        },
+        "json": {
+            "()": "core.logging.JsonFormatter",
+        },
+    },
+    "handlers": {
+        "console": {
+            "class": "logging.StreamHandler",
+            "formatter": "verbose",
+        },
+        "file": {
+            "class": "logging.handlers.RotatingFileHandler",
+            "filename": LOGS_DIR / "pyrunner.log",
+            "maxBytes": 10 * 1024 * 1024,  # 10 MB
+            "backupCount": 5,
+            "formatter": "json",
+            "encoding": "utf-8",
+        },
+    },
+    "root": {
+        "handlers": ["console", "file"],
+        "level": "INFO",
+    },
+    "loggers": {
+        "django": {
+            "handlers": ["console", "file"],
+            "level": "WARNING",
+            "propagate": False,
+        },
+        "core": {
+            "handlers": ["console", "file"],
+            "level": "INFO",
+            "propagate": False,
+        },
+    },
+}
+
+
+# Security Settings
+# These settings are applied when DEBUG=False (production)
+if not DEBUG:
+    # HTTPS/SSL Settings
+    SECURE_SSL_REDIRECT = os.environ.get("SECURE_SSL_REDIRECT", "True").lower() == "true"
+    SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
+
+    # HSTS - HTTP Strict Transport Security
+    # Start with a shorter duration, increase to 31536000 (1 year) once confirmed working
+    SECURE_HSTS_SECONDS = int(os.environ.get("SECURE_HSTS_SECONDS", "2592000"))  # 30 days default
+    SECURE_HSTS_INCLUDE_SUBDOMAINS = os.environ.get("SECURE_HSTS_INCLUDE_SUBDOMAINS", "True").lower() == "true"
+    SECURE_HSTS_PRELOAD = os.environ.get("SECURE_HSTS_PRELOAD", "False").lower() == "true"
+
+    # Cookie Security
+    SESSION_COOKIE_SECURE = True
+    CSRF_COOKIE_SECURE = True
+
+# Always-on security settings (regardless of DEBUG)
+SECURE_CONTENT_TYPE_NOSNIFF = True
+X_FRAME_OPTIONS = "DENY"
+
+# Note: For Content Security Policy (CSP), install django-csp and add to middleware:
+# pip install django-csp
+# Add 'csp.middleware.CSPMiddleware' to MIDDLEWARE
+# Then configure CSP_* settings as needed
+
+
+# =============================================================================
+# API Settings
+# =============================================================================
+
+# Rate limiting for API requests (requests per minute per token)
+API_RATE_LIMIT = int(os.environ.get("API_RATE_LIMIT", "60"))
+
+# CORS settings for API endpoints
+# Set to "*" to allow all origins (suitable for self-hosted), or comma-separated origins
+API_CORS_ORIGINS = os.environ.get("API_CORS_ORIGINS", "*")

pyrunner/urls.py

@@ -0,0 +1,47 @@
+"""
+URL configuration for pyrunner project.
+
+The `urlpatterns` list routes URLs to views. For more information please see:
+    https://docs.djangoproject.com/en/6.0/topics/http/urls/
+Examples:
+Function views
+    1. Add an import:  from my_app import views
+    2. Add a URL to urlpatterns:  path('', views.home, name='home')
+Class-based views
+    1. Add an import:  from other_app.views import Home
+    2. Add a URL to urlpatterns:  path('', Home.as_view(), name='home')
+Including another URLconf
+    1. Import the include() function: from django.urls import include, path
+    2. Add a URL to urlpatterns:  path('blog/', include('blog.urls'))
+"""
+
+from django.contrib import admin
+from django.urls import path, include
+from django.shortcuts import redirect
+
+from core.views.webhooks import webhook_trigger_view
+
+
+def get_admin_url_slug():
+    """
+    Get admin URL slug from settings.
+    Called at startup - changes require app restart.
+    """
+    try:
+        from core.models import GlobalSettings
+        return GlobalSettings.get_settings().admin_url_slug or "django-admin"
+    except Exception:
+        return "django-admin"
+
+
+urlpatterns = [
+    path(f"{get_admin_url_slug()}/", admin.site.urls),
+    path("setup/", include("core.urls.setup")),
+    path("auth/", include("core.urls.auth")),
+    path("cpanel/", include("core.urls.cpanel")),
+    # REST API endpoints (token auth required)
+    path("api/v1/", include("core.urls.api")),
+    # Public webhook endpoint (no auth required)
+    path("webhook/<str:token>/", webhook_trigger_view, name="webhook_trigger"),
+    path("", lambda request: redirect("auth:login")),
+]

pyrunner/version.py

@@ -0,0 +1,11 @@
+"""
+PyRunner version information.
+"""
+
+__version__ = "1.8.2"
+VERSION = __version__
+
+
+def get_version():
+    """Return the current PyRunner version."""
+    return __version__

pyrunner/wsgi.py

@@ -0,0 +1,16 @@
+"""
+WSGI config for pyrunner project.
+
+It exposes the WSGI callable as a module-level variable named ``application``.
+
+For more information on this file, see
+https://docs.djangoproject.com/en/6.0/howto/deployment/wsgi/
+"""
+
+import os
+
+from django.core.wsgi import get_wsgi_application
+
+os.environ.setdefault("DJANGO_SETTINGS_MODULE", "pyrunner.settings")
+
+application = get_wsgi_application()