jtricerolph
d7898ba897
Each of Newbook, Resos, SambaPOS, SMTP, and Nextcloud now has a checkbox at the top of its credentials block. When enabled, the app reads auth credentials from the central stack settings service (SETTINGS_URL + STACK_INTERNAL_SECRET) and the local auth fields are grayed out. App-specific fields (base path, GL codes, keywords, sync intervals, etc.) remain editable regardless. Backend: new use_global_* columns on kitchen_settings, migration, global_settings_service with apply_global_overrides() for in-memory credential injection, GET /api/settings/global-status endpoint, and apply_global_overrides() called in test-connection endpoints and FileArchivalService. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
97 lines
4.4 KiB
Python
97 lines
4.4 KiB
Python
"""
|
|
Fetch integration credentials from the central stack settings service.
|
|
|
|
When a kitchen setting has use_global_<slug>=True, the backend reads credentials
|
|
from the settings service (SETTINGS_URL) instead of the local kitchen_settings row.
|
|
apply_global_overrides() modifies the KitchenSettings object IN MEMORY only — it does
|
|
not commit anything to the DB.
|
|
"""
|
|
import os
|
|
import logging
|
|
import httpx
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
SETTINGS_URL = os.getenv("SETTINGS_URL", "").rstrip("/")
|
|
STACK_INTERNAL_SECRET = os.getenv("STACK_INTERNAL_SECRET", "")
|
|
|
|
|
|
async def get_global_integration(slug: str) -> dict | None:
|
|
"""Fetch unmasked credentials for an integration from the central settings service."""
|
|
if not SETTINGS_URL or not STACK_INTERNAL_SECRET:
|
|
return None
|
|
try:
|
|
async with httpx.AsyncClient(timeout=5.0) as client:
|
|
resp = await client.get(
|
|
f"{SETTINGS_URL}/api/internal/integration/{slug}",
|
|
headers={"Authorization": f"Bearer {STACK_INTERNAL_SECRET}"},
|
|
)
|
|
if resp.status_code == 200:
|
|
return resp.json()
|
|
logger.warning("Global settings fetch for %s returned %s", slug, resp.status_code)
|
|
except Exception as exc:
|
|
logger.warning("Global settings fetch for %s failed: %s", slug, exc)
|
|
return None
|
|
|
|
|
|
async def check_global_status() -> dict[str, bool]:
|
|
"""Return whether each integration is configured in the central settings service."""
|
|
# slug → list of secret fields that must be non-empty to count as "configured"
|
|
required = {
|
|
"smtp": ["pass"],
|
|
"nextcloud": ["password"],
|
|
"newbook": ["api_key"],
|
|
"resos": ["api_key"],
|
|
"sambapos": ["password"],
|
|
}
|
|
results: dict[str, bool] = {}
|
|
for slug, fields in required.items():
|
|
creds = await get_global_integration(slug)
|
|
results[slug] = bool(creds and all(creds.get(f) for f in fields))
|
|
return results
|
|
|
|
|
|
async def apply_global_overrides(settings) -> None:
|
|
"""
|
|
In-memory only: override credential fields on a KitchenSettings instance
|
|
where the corresponding use_global_* flag is True.
|
|
|
|
Attribute assignments do NOT persist to the DB — the session is never committed
|
|
as a result of this call.
|
|
"""
|
|
if getattr(settings, "use_global_smtp", False):
|
|
creds = await get_global_integration("smtp")
|
|
if creds:
|
|
settings.smtp_host = creds.get("host") or settings.smtp_host
|
|
settings.smtp_port = int(creds.get("port") or settings.smtp_port or 587)
|
|
settings.smtp_username = creds.get("user") or settings.smtp_username
|
|
settings.smtp_password = creds.get("pass") or settings.smtp_password
|
|
|
|
if getattr(settings, "use_global_nextcloud", False):
|
|
creds = await get_global_integration("nextcloud")
|
|
if creds:
|
|
settings.nextcloud_host = creds.get("base_url") or settings.nextcloud_host
|
|
settings.nextcloud_username = creds.get("username") or settings.nextcloud_username
|
|
settings.nextcloud_password = creds.get("password") or settings.nextcloud_password
|
|
|
|
if getattr(settings, "use_global_newbook", False):
|
|
creds = await get_global_integration("newbook")
|
|
if creds:
|
|
settings.newbook_api_username = creds.get("username") or settings.newbook_api_username
|
|
settings.newbook_api_password = creds.get("password") or settings.newbook_api_password
|
|
settings.newbook_api_key = creds.get("api_key") or settings.newbook_api_key
|
|
settings.newbook_api_region = creds.get("region") or settings.newbook_api_region
|
|
|
|
if getattr(settings, "use_global_resos", False):
|
|
creds = await get_global_integration("resos")
|
|
if creds:
|
|
settings.resos_api_key = creds.get("api_key") or settings.resos_api_key
|
|
|
|
if getattr(settings, "use_global_sambapos", False):
|
|
creds = await get_global_integration("sambapos")
|
|
if creds:
|
|
settings.sambapos_db_host = creds.get("host") or settings.sambapos_db_host
|
|
settings.sambapos_db_port = creds.get("port") or settings.sambapos_db_port
|
|
settings.sambapos_db_name = creds.get("database") or settings.sambapos_db_name
|
|
settings.sambapos_db_username = creds.get("username") or settings.sambapos_db_username
|
|
settings.sambapos_db_password = creds.get("password") or settings.sambapos_db_password
|