Archived
507 lines
21 KiB
Python
507 lines
21 KiB
Python
from __future__ import annotations
|
|
|
|
import secrets
|
|
import sqlite3
|
|
import time
|
|
from datetime import UTC, datetime, timedelta
|
|
from pathlib import Path
|
|
|
|
from .ddns_models import UpdateResult
|
|
from .ddns_security import hash_lookup_token, hash_secret, verify_secret
|
|
|
|
|
|
class DdnsStore:
|
|
def __init__(self, database_path: Path) -> None:
|
|
self.database_path = database_path
|
|
self.database_path.parent.mkdir(parents=True, exist_ok=True)
|
|
self._init_db()
|
|
|
|
def connect(self) -> sqlite3.Connection:
|
|
conn = sqlite3.connect(self.database_path)
|
|
conn.execute("PRAGMA foreign_keys = ON")
|
|
conn.execute("PRAGMA busy_timeout = 5000")
|
|
return conn
|
|
|
|
def upsert(
|
|
self,
|
|
hostname: str,
|
|
ipv4: str | None,
|
|
ipv6: str | None,
|
|
update_ipv4: bool = True,
|
|
update_ipv6: bool = True,
|
|
) -> UpdateResult:
|
|
now = datetime.now(UTC).isoformat()
|
|
with self.connect() as conn:
|
|
conn.row_factory = sqlite3.Row
|
|
existing = conn.execute("SELECT ipv4, ipv6 FROM records WHERE hostname = ?", (hostname,)).fetchone()
|
|
current_ipv4 = existing["ipv4"] if existing else None
|
|
current_ipv6 = existing["ipv6"] if existing else None
|
|
effective_ipv4 = ipv4 if update_ipv4 else current_ipv4
|
|
effective_ipv6 = ipv6 if update_ipv6 else current_ipv6
|
|
changed = existing is None or current_ipv4 != effective_ipv4 or current_ipv6 != effective_ipv6
|
|
conn.execute(
|
|
"""
|
|
INSERT INTO records(hostname, ipv4, ipv6, updated_at)
|
|
VALUES (?, ?, ?, ?)
|
|
ON CONFLICT(hostname) DO UPDATE SET
|
|
ipv4=excluded.ipv4,
|
|
ipv6=excluded.ipv6,
|
|
updated_at=excluded.updated_at
|
|
""",
|
|
(hostname, effective_ipv4, effective_ipv6, now),
|
|
)
|
|
return UpdateResult(
|
|
hostname=hostname,
|
|
ipv4=effective_ipv4,
|
|
ipv6=effective_ipv6,
|
|
changed=changed,
|
|
update_ipv4=update_ipv4,
|
|
update_ipv6=update_ipv6,
|
|
)
|
|
|
|
def preview_update(
|
|
self,
|
|
hostname: str,
|
|
ipv4: str | None,
|
|
ipv6: str | None,
|
|
update_ipv4: bool = True,
|
|
update_ipv6: bool = True,
|
|
) -> UpdateResult:
|
|
with self.connect() as conn:
|
|
conn.row_factory = sqlite3.Row
|
|
existing = conn.execute("SELECT ipv4, ipv6 FROM records WHERE hostname = ?", (hostname,)).fetchone()
|
|
current_ipv4 = existing["ipv4"] if existing else None
|
|
current_ipv6 = existing["ipv6"] if existing else None
|
|
effective_ipv4 = ipv4 if update_ipv4 else current_ipv4
|
|
effective_ipv6 = ipv6 if update_ipv6 else current_ipv6
|
|
changed = existing is None or current_ipv4 != effective_ipv4 or current_ipv6 != effective_ipv6
|
|
return UpdateResult(
|
|
hostname=hostname,
|
|
ipv4=effective_ipv4,
|
|
ipv6=effective_ipv6,
|
|
changed=changed,
|
|
update_ipv4=update_ipv4,
|
|
update_ipv6=update_ipv6,
|
|
)
|
|
|
|
def create_account(
|
|
self,
|
|
hostname: str,
|
|
username: str | None = None,
|
|
owner_user_id: int | None = None,
|
|
) -> dict[str, str]:
|
|
now = datetime.now(UTC).isoformat()
|
|
token = secrets.token_urlsafe(24)
|
|
update_slug = secrets.token_urlsafe(32)
|
|
management_slug = secrets.token_urlsafe(32)
|
|
username = username or _default_username(hostname)
|
|
token_hash = hash_secret(token)
|
|
management_hash = hash_lookup_token(management_slug)
|
|
with self.connect() as conn:
|
|
conn.execute(
|
|
"""
|
|
INSERT INTO accounts(hostname, username, token_hash, update_slug, management_hash, owner_user_id, created_at, disabled)
|
|
VALUES (?, ?, ?, ?, ?, ?, ?, 0)
|
|
""",
|
|
(hostname, username, token_hash, update_slug, management_hash, owner_user_id, now),
|
|
)
|
|
return {
|
|
"hostname": hostname,
|
|
"username": username,
|
|
"password": token,
|
|
"update_slug": update_slug,
|
|
"management_slug": management_slug,
|
|
}
|
|
|
|
def list_accounts(self, owner_user_id: int | None = None) -> list[dict[str, str | int | None]]:
|
|
with self.connect() as conn:
|
|
conn.row_factory = sqlite3.Row
|
|
sql = """
|
|
SELECT accounts.hostname, accounts.username, accounts.update_slug, accounts.owner_user_id,
|
|
accounts.created_at, accounts.disabled, records.ipv4, records.ipv6, records.updated_at
|
|
FROM accounts
|
|
LEFT JOIN records ON records.hostname = accounts.hostname
|
|
"""
|
|
params: tuple[int, ...] = ()
|
|
if owner_user_id is not None:
|
|
sql += " WHERE accounts.owner_user_id = ?"
|
|
params = (owner_user_id,)
|
|
sql += " ORDER BY accounts.hostname"
|
|
rows = conn.execute(sql, params).fetchall()
|
|
return [dict(row) for row in rows]
|
|
|
|
def get_account_by_slug(self, update_slug: str) -> dict[str, str | int | None] | None:
|
|
with self.connect() as conn:
|
|
conn.row_factory = sqlite3.Row
|
|
account = conn.execute(
|
|
"""
|
|
SELECT hostname, username, token_hash, update_slug, disabled FROM accounts
|
|
WHERE update_slug = ?
|
|
""",
|
|
(update_slug,),
|
|
).fetchone()
|
|
return dict(account) if account else None
|
|
|
|
def get_account_by_management_slug(self, management_slug: str) -> dict[str, str | int | None] | None:
|
|
with self.connect() as conn:
|
|
conn.row_factory = sqlite3.Row
|
|
account = conn.execute(
|
|
"""
|
|
SELECT accounts.hostname, accounts.username, accounts.update_slug, accounts.owner_user_id,
|
|
accounts.created_at, accounts.disabled, records.ipv4, records.ipv6, records.updated_at
|
|
FROM accounts
|
|
LEFT JOIN records ON records.hostname = accounts.hostname
|
|
WHERE accounts.management_hash = ?
|
|
""",
|
|
(hash_lookup_token(management_slug),),
|
|
).fetchone()
|
|
return dict(account) if account else None
|
|
|
|
def verify_account(self, hostname: str, username: str | None, token: str | None) -> bool:
|
|
if not username or not token:
|
|
return False
|
|
with self.connect() as conn:
|
|
conn.row_factory = sqlite3.Row
|
|
account = conn.execute(
|
|
"""
|
|
SELECT token_hash, disabled FROM accounts
|
|
WHERE hostname = ? AND username = ?
|
|
""",
|
|
(hostname, username),
|
|
).fetchone()
|
|
if not account or account["disabled"]:
|
|
return False
|
|
return verify_secret(token, account["token_hash"])
|
|
|
|
def delete_account(self, hostname: str) -> None:
|
|
with self.connect() as conn:
|
|
conn.execute("DELETE FROM accounts WHERE hostname = ?", (hostname,))
|
|
conn.execute("DELETE FROM records WHERE hostname = ?", (hostname,))
|
|
|
|
def create_domain_challenge(self, domain: str, owner_user_id: int | None = None) -> dict[str, str]:
|
|
token = f"ff-ddns-{secrets.token_urlsafe(24)}"
|
|
claim_secret = secrets.token_urlsafe(32)
|
|
claim_hash = hash_lookup_token(claim_secret)
|
|
now = datetime.now(UTC).isoformat()
|
|
with self.connect() as conn:
|
|
existing = conn.execute("SELECT owner_user_id, verified_at FROM domain_challenges WHERE domain = ?", (domain,)).fetchone()
|
|
if existing and existing[1]:
|
|
raise sqlite3.IntegrityError("domain is already verified")
|
|
if existing and owner_user_id is not None and existing[0] is not None and int(existing[0]) != owner_user_id:
|
|
raise sqlite3.IntegrityError("domain challenge belongs to another user")
|
|
conn.execute(
|
|
"""
|
|
INSERT INTO domain_challenges(domain, token, claim_hash, owner_user_id, created_at, verified_at)
|
|
VALUES (?, ?, ?, ?, ?, NULL)
|
|
ON CONFLICT(domain) DO UPDATE SET
|
|
token=excluded.token,
|
|
claim_hash=excluded.claim_hash,
|
|
owner_user_id=excluded.owner_user_id,
|
|
created_at=excluded.created_at,
|
|
verified_at=NULL
|
|
""",
|
|
(domain, token, claim_hash, owner_user_id, now),
|
|
)
|
|
return {"domain": domain, "token": token, "claim_secret": claim_secret}
|
|
|
|
def verify_domain_challenge(self, domain: str, owner_user_id: int | None = None) -> dict[str, str | None] | None:
|
|
now = datetime.now(UTC).isoformat()
|
|
with self.connect() as conn:
|
|
conn.row_factory = sqlite3.Row
|
|
sql = "SELECT domain, token, verified_at FROM domain_challenges WHERE domain = ?"
|
|
params: tuple[str, ...] | tuple[str, int] = (domain,)
|
|
if owner_user_id is not None:
|
|
sql += " AND owner_user_id = ?"
|
|
params = (domain, owner_user_id)
|
|
challenge = conn.execute(sql, params).fetchone()
|
|
if not challenge:
|
|
return None
|
|
if owner_user_id is not None:
|
|
conn.execute("UPDATE domain_challenges SET verified_at = ? WHERE domain = ? AND owner_user_id = ?", (now, domain, owner_user_id))
|
|
else:
|
|
conn.execute("UPDATE domain_challenges SET verified_at = ? WHERE domain = ?", (now, domain))
|
|
result = dict(challenge)
|
|
result["verified_at"] = now
|
|
return result
|
|
|
|
def get_domain_challenge(
|
|
self,
|
|
domain: str,
|
|
owner_user_id: int | None = None,
|
|
claim_secret: str | None = None,
|
|
) -> dict[str, str | None] | None:
|
|
with self.connect() as conn:
|
|
conn.row_factory = sqlite3.Row
|
|
sql = "SELECT domain, token, verified_at FROM domain_challenges WHERE domain = ?"
|
|
params: tuple[str, ...] | tuple[str, int] = (domain,)
|
|
if owner_user_id is not None:
|
|
sql += " AND owner_user_id = ?"
|
|
params = (domain, owner_user_id)
|
|
elif claim_secret is not None:
|
|
sql += " AND claim_hash = ?"
|
|
params = (domain, hash_lookup_token(claim_secret))
|
|
challenge = conn.execute(sql, params).fetchone()
|
|
return dict(challenge) if challenge else None
|
|
|
|
def is_domain_verified(
|
|
self,
|
|
domain: str,
|
|
owner_user_id: int | None = None,
|
|
claim_secret: str | None = None,
|
|
) -> bool:
|
|
with self.connect() as conn:
|
|
sql = "SELECT verified_at FROM domain_challenges WHERE domain = ?"
|
|
params: tuple[str, ...] | tuple[str, int] = (domain,)
|
|
if owner_user_id is not None:
|
|
sql += " AND owner_user_id = ?"
|
|
params = (domain, owner_user_id)
|
|
elif claim_secret is not None:
|
|
sql += " AND claim_hash = ?"
|
|
params = (domain, hash_lookup_token(claim_secret))
|
|
verified_at = conn.execute(sql, params).fetchone()
|
|
return bool(verified_at and verified_at[0])
|
|
|
|
def count_user_accounts(self, owner_user_id: int) -> int:
|
|
with self.connect() as conn:
|
|
row = conn.execute("SELECT COUNT(*) FROM accounts WHERE owner_user_id = ? AND disabled = 0", (owner_user_id,)).fetchone()
|
|
return int(row[0])
|
|
|
|
def create_user(self, email: str, password: str, invite_code: str | None, require_invite: bool) -> dict[str, str | int]:
|
|
now = datetime.now(UTC).isoformat()
|
|
password_hash = hash_secret(password)
|
|
with self.connect() as conn:
|
|
if require_invite:
|
|
invite = conn.execute(
|
|
"SELECT code, used_at FROM invites WHERE code = ?",
|
|
(invite_code or "",),
|
|
).fetchone()
|
|
if not invite or invite[1]:
|
|
raise ValueError("invalid invite code")
|
|
cursor = conn.execute(
|
|
"""
|
|
INSERT INTO users(email, password_hash, created_at, disabled)
|
|
VALUES (?, ?, ?, 0)
|
|
""",
|
|
(email, password_hash, now),
|
|
)
|
|
user_id = int(cursor.lastrowid)
|
|
if require_invite and invite_code:
|
|
conn.execute("UPDATE invites SET used_at = ?, used_by_user_id = ? WHERE code = ?", (now, user_id, invite_code))
|
|
return {"id": user_id, "email": email}
|
|
|
|
def authenticate_user(self, email: str, password: str) -> dict[str, str | int] | None:
|
|
with self.connect() as conn:
|
|
conn.row_factory = sqlite3.Row
|
|
user = conn.execute(
|
|
"SELECT id, email, password_hash, disabled FROM users WHERE email = ?",
|
|
(email,),
|
|
).fetchone()
|
|
if not user or user["disabled"] or not verify_secret(password, user["password_hash"]):
|
|
return None
|
|
return {"id": int(user["id"]), "email": str(user["email"])}
|
|
|
|
def get_user(self, user_id: int) -> dict[str, str | int] | None:
|
|
with self.connect() as conn:
|
|
conn.row_factory = sqlite3.Row
|
|
user = conn.execute("SELECT id, email, disabled FROM users WHERE id = ?", (user_id,)).fetchone()
|
|
if not user or user["disabled"]:
|
|
return None
|
|
return {"id": int(user["id"]), "email": str(user["email"])}
|
|
|
|
def create_invite(self) -> dict[str, str]:
|
|
code = secrets.token_urlsafe(18)
|
|
now = datetime.now(UTC).isoformat()
|
|
with self.connect() as conn:
|
|
conn.execute("INSERT INTO invites(code, created_at) VALUES (?, ?)", (code, now))
|
|
return {"code": code}
|
|
|
|
def list_invites(self) -> list[dict[str, str | None]]:
|
|
with self.connect() as conn:
|
|
conn.row_factory = sqlite3.Row
|
|
rows = conn.execute(
|
|
"SELECT code, created_at, used_at FROM invites ORDER BY created_at DESC LIMIT 50"
|
|
).fetchall()
|
|
return [dict(row) for row in rows]
|
|
|
|
def list_records(self) -> list[dict[str, str | None]]:
|
|
with self.connect() as conn:
|
|
conn.row_factory = sqlite3.Row
|
|
rows = conn.execute("SELECT hostname, ipv4, ipv6, updated_at FROM records ORDER BY hostname").fetchall()
|
|
return [dict(row) for row in rows]
|
|
|
|
def log_update_event(
|
|
self,
|
|
hostname: str,
|
|
ipv4: str | None,
|
|
ipv6: str | None,
|
|
status: str,
|
|
detail: str,
|
|
source_ip: str,
|
|
) -> None:
|
|
with self.connect() as conn:
|
|
conn.execute(
|
|
"""
|
|
INSERT INTO update_events(hostname, ipv4, ipv6, status, detail, source_ip, created_at)
|
|
VALUES (?, ?, ?, ?, ?, ?, ?)
|
|
""",
|
|
(hostname, ipv4, ipv6, status, detail[:500], source_ip, datetime.now(UTC).isoformat()),
|
|
)
|
|
|
|
def list_update_events(self, limit: int = 100) -> list[dict[str, str | None]]:
|
|
with self.connect() as conn:
|
|
conn.row_factory = sqlite3.Row
|
|
rows = conn.execute(
|
|
"""
|
|
SELECT hostname, ipv4, ipv6, status, detail, source_ip, created_at
|
|
FROM update_events
|
|
ORDER BY created_at DESC
|
|
LIMIT ?
|
|
""",
|
|
(limit,),
|
|
).fetchall()
|
|
return [dict(row) for row in rows]
|
|
|
|
def allow_rate_limit(self, key: str, limit: int) -> bool:
|
|
now = int(time.time())
|
|
window = now // 60
|
|
with self.connect() as conn:
|
|
conn.execute("DELETE FROM rate_limits WHERE window < ?", (window - 2,))
|
|
row = conn.execute(
|
|
"SELECT count FROM rate_limits WHERE key = ? AND window = ?",
|
|
(key, window),
|
|
).fetchone()
|
|
count = int(row[0]) if row else 0
|
|
if count >= limit:
|
|
return False
|
|
conn.execute(
|
|
"""
|
|
INSERT INTO rate_limits(key, window, count)
|
|
VALUES (?, ?, 1)
|
|
ON CONFLICT(key, window) DO UPDATE SET count=count + 1
|
|
""",
|
|
(key, window),
|
|
)
|
|
return True
|
|
|
|
def cleanup(self, challenge_hours: int) -> None:
|
|
cutoff = datetime.now(UTC) - timedelta(hours=challenge_hours)
|
|
with self.connect() as conn:
|
|
conn.execute(
|
|
"DELETE FROM domain_challenges WHERE verified_at IS NULL AND created_at < ?",
|
|
(cutoff.isoformat(),),
|
|
)
|
|
|
|
def _init_db(self) -> None:
|
|
with self.connect() as conn:
|
|
conn.execute("PRAGMA journal_mode = WAL")
|
|
conn.execute("PRAGMA synchronous = NORMAL")
|
|
conn.execute(
|
|
"""
|
|
CREATE TABLE IF NOT EXISTS records (
|
|
hostname TEXT PRIMARY KEY,
|
|
ipv4 TEXT,
|
|
ipv6 TEXT,
|
|
updated_at TEXT NOT NULL
|
|
)
|
|
"""
|
|
)
|
|
conn.execute(
|
|
"""
|
|
CREATE TABLE IF NOT EXISTS update_events (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
hostname TEXT NOT NULL,
|
|
ipv4 TEXT,
|
|
ipv6 TEXT,
|
|
status TEXT NOT NULL,
|
|
detail TEXT NOT NULL,
|
|
source_ip TEXT NOT NULL,
|
|
created_at TEXT NOT NULL
|
|
)
|
|
"""
|
|
)
|
|
conn.execute("CREATE INDEX IF NOT EXISTS idx_update_events_created_at ON update_events(created_at)")
|
|
conn.execute(
|
|
"""
|
|
CREATE TABLE IF NOT EXISTS rate_limits (
|
|
key TEXT NOT NULL,
|
|
window INTEGER NOT NULL,
|
|
count INTEGER NOT NULL,
|
|
PRIMARY KEY(key, window)
|
|
)
|
|
"""
|
|
)
|
|
conn.execute(
|
|
"""
|
|
CREATE TABLE IF NOT EXISTS accounts (
|
|
hostname TEXT PRIMARY KEY,
|
|
username TEXT NOT NULL,
|
|
token_hash TEXT NOT NULL,
|
|
update_slug TEXT NOT NULL UNIQUE,
|
|
management_hash TEXT UNIQUE,
|
|
owner_user_id INTEGER,
|
|
created_at TEXT NOT NULL,
|
|
disabled INTEGER NOT NULL DEFAULT 0,
|
|
FOREIGN KEY(owner_user_id) REFERENCES users(id) ON DELETE SET NULL
|
|
)
|
|
"""
|
|
)
|
|
_ensure_column(conn, "accounts", "update_slug", "TEXT")
|
|
_ensure_column(conn, "accounts", "management_hash", "TEXT")
|
|
_ensure_column(conn, "accounts", "owner_user_id", "INTEGER")
|
|
for row in conn.execute("SELECT hostname FROM accounts WHERE update_slug IS NULL OR update_slug = ''"):
|
|
conn.execute("UPDATE accounts SET update_slug = ? WHERE hostname = ?", (secrets.token_urlsafe(32), row[0]))
|
|
for row in conn.execute("SELECT hostname FROM accounts WHERE management_hash IS NULL OR management_hash = ''"):
|
|
conn.execute("UPDATE accounts SET management_hash = ? WHERE hostname = ?", (hash_lookup_token(secrets.token_urlsafe(32)), row[0]))
|
|
conn.execute("CREATE UNIQUE INDEX IF NOT EXISTS idx_accounts_update_slug ON accounts(update_slug)")
|
|
conn.execute("CREATE UNIQUE INDEX IF NOT EXISTS idx_accounts_management_hash ON accounts(management_hash)")
|
|
conn.execute(
|
|
"""
|
|
CREATE TABLE IF NOT EXISTS domain_challenges (
|
|
domain TEXT PRIMARY KEY,
|
|
token TEXT NOT NULL,
|
|
claim_hash TEXT,
|
|
owner_user_id INTEGER,
|
|
created_at TEXT NOT NULL,
|
|
verified_at TEXT,
|
|
FOREIGN KEY(owner_user_id) REFERENCES users(id) ON DELETE CASCADE
|
|
)
|
|
"""
|
|
)
|
|
_ensure_column(conn, "domain_challenges", "claim_hash", "TEXT")
|
|
_ensure_column(conn, "domain_challenges", "owner_user_id", "INTEGER")
|
|
conn.execute(
|
|
"""
|
|
CREATE TABLE IF NOT EXISTS users (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
email TEXT NOT NULL UNIQUE,
|
|
password_hash TEXT NOT NULL,
|
|
created_at TEXT NOT NULL,
|
|
disabled INTEGER NOT NULL DEFAULT 0
|
|
)
|
|
"""
|
|
)
|
|
conn.execute(
|
|
"""
|
|
CREATE TABLE IF NOT EXISTS invites (
|
|
code TEXT PRIMARY KEY,
|
|
created_at TEXT NOT NULL,
|
|
used_at TEXT,
|
|
used_by_user_id INTEGER,
|
|
FOREIGN KEY(used_by_user_id) REFERENCES users(id) ON DELETE SET NULL
|
|
)
|
|
"""
|
|
)
|
|
|
|
|
|
def _default_username(hostname: str) -> str:
|
|
label = hostname.split(".", 1)[0]
|
|
import re
|
|
|
|
return re.sub(r"[^a-z0-9_.-]", "-", label.lower()) or "fritzbox"
|
|
|
|
|
|
def _ensure_column(conn: sqlite3.Connection, table: str, column: str, definition: str) -> None:
|
|
columns = {row[1] for row in conn.execute(f"PRAGMA table_info({table})")}
|
|
if column not in columns:
|
|
conn.execute(f"ALTER TABLE {table} ADD COLUMN {column} {definition}")
|