This fixes critical IndieAuth authentication by implementing PKCE (Proof Key for Code Exchange) as required by IndieLogin.com API specification. Added: - PKCE code_verifier and code_challenge generation (RFC 7636) - Database column: auth_state.code_verifier for PKCE support - Issuer validation for authentication callbacks - Comprehensive PKCE unit tests (6 tests, all passing) - Database migration script for code_verifier column Changed: - Corrected IndieLogin.com API endpoints (/authorize and /token) - State token validation now returns code_verifier for token exchange - Authentication flow follows IndieLogin.com API specification exactly - Enhanced logging with code_verifier redaction Removed: - OAuth metadata endpoint (/.well-known/oauth-authorization-server) Added in v0.7.0 but not required by IndieLogin.com - h-app microformats markup from templates Modified in v0.7.1 but not used by IndieLogin.com - indieauth-metadata link from HTML head Security: - PKCE prevents authorization code interception attacks - Issuer validation prevents token substitution attacks - Code verifier securely stored, redacted in logs, and single-use Documentation: - Version: 0.8.0 - CHANGELOG updated with v0.8.0 entry and v0.7.x notes - ADR-016 and ADR-017 marked as superseded by ADR-019 - Implementation report created in docs/reports/ - Test update guide created in TODO_TEST_UPDATES.md Breaking Changes: - Users mid-authentication will need to restart login after upgrade - Database migration required before deployment Related: ADR-019 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
158 lines
4.3 KiB
Python
158 lines
4.3 KiB
Python
"""
|
|
StarPunk package initialization
|
|
Creates and configures the Flask application
|
|
"""
|
|
|
|
import logging
|
|
from flask import Flask
|
|
|
|
|
|
def configure_logging(app):
|
|
"""
|
|
Configure application logging based on LOG_LEVEL
|
|
|
|
Args:
|
|
app: Flask application instance
|
|
"""
|
|
log_level = app.config.get("LOG_LEVEL", "INFO").upper()
|
|
|
|
# Set Flask logger level
|
|
app.logger.setLevel(getattr(logging, log_level, logging.INFO))
|
|
|
|
# Configure handler with detailed format for DEBUG
|
|
handler = logging.StreamHandler()
|
|
|
|
if log_level == "DEBUG":
|
|
formatter = logging.Formatter(
|
|
"[%(asctime)s] %(levelname)s - %(name)s: %(message)s",
|
|
datefmt="%Y-%m-%d %H:%M:%S",
|
|
)
|
|
|
|
# Warn if DEBUG enabled in production
|
|
if not app.debug and app.config.get("ENV") != "development":
|
|
app.logger.warning(
|
|
"=" * 70
|
|
+ "\n"
|
|
+ "WARNING: DEBUG logging enabled in production!\n"
|
|
+ "This logs detailed HTTP requests/responses.\n"
|
|
+ "Sensitive data is redacted, but consider using INFO level.\n"
|
|
+ "Set LOG_LEVEL=INFO in production for normal operation.\n"
|
|
+ "=" * 70
|
|
)
|
|
else:
|
|
formatter = logging.Formatter(
|
|
"[%(asctime)s] %(levelname)s: %(message)s", datefmt="%Y-%m-%d %H:%M:%S"
|
|
)
|
|
|
|
handler.setFormatter(formatter)
|
|
|
|
# Remove existing handlers and add our configured handler
|
|
app.logger.handlers.clear()
|
|
app.logger.addHandler(handler)
|
|
|
|
|
|
def create_app(config=None):
|
|
"""
|
|
Application factory for StarPunk
|
|
|
|
Args:
|
|
config: Optional configuration dict to override defaults
|
|
|
|
Returns:
|
|
Configured Flask application instance
|
|
"""
|
|
app = Flask(__name__, static_folder="../static", template_folder="../templates")
|
|
|
|
# Load configuration
|
|
from starpunk.config import load_config
|
|
|
|
load_config(app, config)
|
|
|
|
# Configure logging
|
|
configure_logging(app)
|
|
|
|
# Initialize database
|
|
from starpunk.database import init_db
|
|
|
|
init_db(app)
|
|
|
|
# Register blueprints
|
|
from starpunk.routes import register_routes
|
|
|
|
register_routes(app)
|
|
|
|
# Error handlers
|
|
@app.errorhandler(404)
|
|
def not_found(error):
|
|
from flask import render_template, request
|
|
|
|
# Return HTML for browser requests, JSON for API requests
|
|
if request.path.startswith("/api/"):
|
|
return {"error": "Not found"}, 404
|
|
return render_template("404.html"), 404
|
|
|
|
@app.errorhandler(500)
|
|
def server_error(error):
|
|
from flask import render_template, request
|
|
|
|
# Return HTML for browser requests, JSON for API requests
|
|
if request.path.startswith("/api/"):
|
|
return {"error": "Internal server error"}, 500
|
|
return render_template("500.html"), 500
|
|
|
|
# Health check endpoint for containers and monitoring
|
|
@app.route("/health")
|
|
def health_check():
|
|
"""
|
|
Health check endpoint for containers and monitoring
|
|
|
|
Returns:
|
|
JSON with status and basic info
|
|
|
|
Response codes:
|
|
200: Application healthy
|
|
500: Application unhealthy
|
|
|
|
Checks:
|
|
- Database connectivity
|
|
- File system access
|
|
- Basic application state
|
|
"""
|
|
from flask import jsonify
|
|
import os
|
|
|
|
try:
|
|
# Check database connectivity
|
|
from starpunk.database import get_db
|
|
|
|
db = get_db(app)
|
|
db.execute("SELECT 1").fetchone()
|
|
db.close()
|
|
|
|
# Check filesystem access
|
|
data_path = app.config.get("DATA_PATH", "data")
|
|
if not os.path.exists(data_path):
|
|
raise Exception("Data path not accessible")
|
|
|
|
return (
|
|
jsonify(
|
|
{
|
|
"status": "healthy",
|
|
"version": app.config.get("VERSION", __version__),
|
|
"environment": app.config.get("ENV", "unknown"),
|
|
}
|
|
),
|
|
200,
|
|
)
|
|
|
|
except Exception as e:
|
|
return jsonify({"status": "unhealthy", "error": str(e)}), 500
|
|
|
|
return app
|
|
|
|
|
|
# Package version (Semantic Versioning 2.0.0)
|
|
# See docs/standards/versioning-strategy.md for details
|
|
__version__ = "0.8.0"
|
|
__version_info__ = (0, 8, 0)
|