Node / ReticulumProjects / MeshChatX.git / files / meshchatx / src / backend / websocket_config_guard.py

Displaying Raw • Download

T8b949e# SPDX-License-Identifier: 0BSD

T8b949e"""WebSocket guards for config updates and authenticated mutators.

Settings that change the HTTP security boundary must go through CSRF-protected

HTTP endpoints, not the unauthenticated config.set WebSocket message.

"""

Tff7b72from T7ee787__future__ Tff7b72import Te6edf3annotations

Tff7b72import T7ee787logging

Te6edf3logger Tff7b72= Te6edf3loggingTff7b72.Td2a8ffgetLoggerTb4b4b4(Tff7b72__name__Tb4b4b4)

Te6edf3WEBSOCKET_CONFIG_DENYLIST Tff7b72= Tffa657frozensetTb4b4b4(

Tb4b4b4{

Ta5d6ff"Ta5d6ffauth_enabledTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffauth_password_hashTa5d6ff"Tb4b4b4,

Tb4b4b4}Tb4b4b4,

Tb4b4b4)

Te6edf3WEBSOCKET_PUBLIC_TYPES Tff7b72= Tffa657frozensetTb4b4b4(

Tb4b4b4{

Ta5d6ff"Ta5d6ffpingTa5d6ff"Tb4b4b4,

Tb4b4b4}Tb4b4b4,

Tb4b4b4)

Te6edf3WEBSOCKET_READ_TYPES Tff7b72= Tffa657frozensetTb4b4b4(

Tb4b4b4{

Ta5d6ff"Ta5d6ffnomadnet.page.archives.getTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffnomadnet.page.archive.loadTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6fflxmf.forwarding.rules.getTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffkeyboard_shortcuts.getTa5d6ff"Tb4b4b4,

Tb4b4b4}Tb4b4b4,

Tb4b4b4)

Te6edf3WEBSOCKET_MUTATOR_TYPES Tff7b72= Tffa657frozensetTb4b4b4(

Tb4b4b4{

Ta5d6ff"Ta5d6ffconfig.setTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffkeyboard_shortcuts.deleteTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffkeyboard_shortcuts.setTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6fflxm.generate_paper_uriTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6fflxm.ingest_uriTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6fflxmf.forwarding.rule.addTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6fflxmf.forwarding.rule.deleteTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6fflxmf.forwarding.rule.toggleTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffnomadnet.download.cancelTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffnomadnet.file.downloadTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffnomadnet.page.archive.addTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffnomadnet.page.archive.flushTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffnomadnet.page.downloadTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffrns.link.closeTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffrns.link.identifyTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffrns.link.openTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffrns.link.requestTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffrns.link.sendTa5d6ff"Tb4b4b4,

Tb4b4b4}Tb4b4b4,

Tb4b4b4)

Tff7b72def Td2a8ffwebsocket_type_requires_authTb4b4b4(Te6edf3msg_typeTb4b4b4: Tffa657strTb4b4b4) Tff7b72-Tff7b72> Tffa657boolTb4b4b4:

Tff7b72if Te6edf3msg_type Tff7b72in Te6edf3WEBSOCKET_PUBLIC_TYPES Tff7b72or Te6edf3msg_type Tff7b72in Te6edf3WEBSOCKET_READ_TYPESTb4b4b4:

Tff7b72return Tff7b72False

Tff7b72if Te6edf3msg_type Tff7b72in Te6edf3WEBSOCKET_MUTATOR_TYPESTb4b4b4:

Tff7b72return Tff7b72True

Tff7b72return Tff7b72False

Tff7b72def Td2a8ffsanitize_websocket_config_updateTb4b4b4(Te6edf3configTb4b4b4: Tffa657objectTb4b4b4) Tff7b72-Tff7b72> Tffa657dictTb4b4b4:

T8b949e"""Return a copy of *config* with security-sensitive keys removed."""

Tff7b72if Tff7b72not Tffa657isinstanceTb4b4b4(Te6edf3configTb4b4b4, Tffa657dictTb4b4b4)Tb4b4b4:

Tff7b72return Tb4b4b4{Tb4b4b4}

Te6edf3sanitized Tff7b72= Tffa657dictTb4b4b4(Te6edf3configTb4b4b4)

Te6edf3removed Tff7b72= Tb4b4b4[Te6edf3key Tff7b72for Te6edf3key Tff7b72in Te6edf3WEBSOCKET_CONFIG_DENYLIST Tff7b72if Te6edf3key Tff7b72in Te6edf3sanitizedTb4b4b4]

Tff7b72for Te6edf3key Tff7b72in Te6edf3removedTb4b4b4:

Tff7b72del Te6edf3sanitizedTb4b4b4[Te6edf3keyTb4b4b4]

Tff7b72if Te6edf3removedTb4b4b4:

Te6edf3loggerTff7b72.Td2a8ffwarningTb4b4b4(

Ta5d6ff"Ta5d6ffIgnored security-sensitive config keys over WebSocket: Tffd700%sTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ff, Ta5d6ff"Tff7b72.Td2a8ffjoinTb4b4b4(Tffa657sortedTb4b4b4(Te6edf3removedTb4b4b4)Tb4b4b4)Tb4b4b4,

Tb4b4b4)

Tff7b72return Te6edf3sanitized