alientim/tesm
0
0 Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 116 Wiki Activity

Version 2.5.0: englische Adressen entlang der Navigation, sparsameres Protokoll

Browse Source
This commit is contained in:
alientim committed 2026-09-11 18:57:22 +02:00
1 parent bec74e6936
commit 61a47debdc
44 files changed
+741 -303
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

apps/tesm/pyproject.toml
+1 -1
View File
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
[project]
name = "tesm"
version = "2.4.1"
version = "2.5.0"
description = "TESM -- Verwaltung und Ueberwachung von PoE-Endgeraeten und Aruba-Switchen"
requires-python = ">=3.11"
dependencies = [
apps/tesm/src/tesm/blueprints/backup.py
+4 -4
View File
@@ -13,7 +13,7 @@ from tesm_core.licensing_client import LicenseError
from ..services import transfer
bp = Blueprint("backup", __name__, url_prefix="/sicherung")
bp = Blueprint("backup", __name__, url_prefix="/administration/backup")
MAX_IMPORT_BYTES = 64 * 1024 * 1024
PREVIEW_SESSION_KEY = "_import_token"
@@ -129,7 +129,7 @@ def export():
)
@bp.post("/import/vorschau")
@bp.post("/import/preview")
@permission_required("backup.execute")
@reauth_required
def import_preview():
@@ -161,7 +161,7 @@ def import_preview():
return redirect(url_for("backup.overview"))
@bp.post("/import/uebernehmen")
@bp.post("/import/apply")
@permission_required("backup.execute")
@reauth_required
def import_apply():
@@ -225,7 +225,7 @@ def import_apply():
return redirect(url_for("backup.overview"))
@bp.post("/import/verwerfen")
@bp.post("/import/discard")
@permission_required("backup.execute")
def import_discard():
token = session.pop(PREVIEW_SESSION_KEY, "")
apps/tesm/src/tesm/blueprints/credentials.py
+4 -4
View File
@@ -12,7 +12,7 @@ from tesm_core.extension import core, db, transaction
from ..services import inventory
bp = Blueprint("credentials", __name__, url_prefix="/zugangsdaten")
bp = Blueprint("credentials", __name__, url_prefix="/monitoring/credentials")
def _audit(conn: Any, action: str, target: str, detail: str = "", severity: str = "info") -> None:
@@ -39,7 +39,7 @@ def overview():
)
@bp.post("/neu")
@bp.post("/new")
@permission_required("credentials.create")
def create():
try:
@@ -91,7 +91,7 @@ def update(credential_id: int):
return redirect(url_for("credentials.overview"))
@bp.post("/<int:credential_id>/loeschen")
@bp.post("/<int:credential_id>/delete")
@permission_required("credentials.delete")
def delete(credential_id: int):
try:
@@ -109,7 +109,7 @@ def delete(credential_id: int):
return redirect(url_for("credentials.overview"))
@bp.post("/<int:credential_id>/anzeigen")
@bp.post("/<int:credential_id>/reveal")
@permission_required("credentials.secrets")
# Die frische Bestaetigung verlangt das Recht selbst (SENSITIVE_ACTIONS).
def reveal(credential_id: int):
apps/tesm/src/tesm/blueprints/dashboard.py
+2 -2
View File
@@ -121,7 +121,7 @@ def _tiles(*, authenticated: bool) -> dict[str, Any]:
}
@bp.get("/uebersicht")
@bp.get("/overview")
def index():
from tesm_core.auth.models import current_user
@@ -138,7 +138,7 @@ def index_view():
return index()
@bp.get("/uebersicht/kacheln")
@bp.get("/overview/tiles")
@fragment
def tiles():
"""Teilbereich fuer die automatische Aktualisierung -- liefert nur HTML-Fragment."""
apps/tesm/src/tesm/blueprints/devices.py
+9 -9
View File
@@ -20,7 +20,7 @@ from tesm_core.extension import core, db, transaction
from ..services import inventory, monitor, restart, ssh
bp = Blueprint("devices", __name__, url_prefix="/clients")
bp = Blueprint("devices", __name__, url_prefix="/monitoring/clients")
def _audit(conn: Any, action: str, target: str, detail: str = "", severity: str = "info") -> None:
@@ -113,7 +113,7 @@ def _credential_from_form(conn: Any) -> int | None:
)
@bp.post("/neu")
@bp.post("/new")
@permission_required("devices.create")
def create():
try:
@@ -161,7 +161,7 @@ def update(device_id: int):
return redirect(url_for("devices.overview"))
@bp.post("/<int:device_id>/aktiv")
@bp.post("/<int:device_id>/active")
@permission_required("devices.edit")
def toggle_active(device_id: int):
active = request.form.get("active") == "1"
@@ -180,7 +180,7 @@ def toggle_active(device_id: int):
return redirect(request.referrer or url_for("devices.overview"))
@bp.post("/<int:device_id>/loeschen")
@bp.post("/<int:device_id>/delete")
@permission_required("devices.delete")
def delete(device_id: int):
with transaction() as conn:
@@ -193,7 +193,7 @@ def delete(device_id: int):
return redirect(url_for("devices.overview"))
@bp.post("/<int:device_id>/neustart")
@bp.post("/<int:device_id>/restart")
@permission_required("devices.execute")
def restart_device(device_id: int):
"""Startet ein Geraet neu -- ueber den Weg, der dafuer gewaehlt wurde.
@@ -351,7 +351,7 @@ def detail(device_id: int):
categories=inventory.DEVICE_CATEGORIES,
host_keys=host_keys,
method_labels=monitor.METHOD_LABELS,
terminal_enabled=bool(extension.settings.get(conn, "terminal_enabled")),
terminal_enabled=bool(extension.settings.get(conn, "terminal_clients_enabled")),
)
@@ -360,7 +360,7 @@ def detail(device_id: int):
# --------------------------------------------------------------------------- #
@bp.post("/<int:device_id>/hostkey/pruefen")
@bp.post("/<int:device_id>/host-key/probe")
@permission_required("devices.edit")
def probe_host_key(device_id: int):
"""Liest den Host-Schluessel des Clients, ohne sich anzumelden.
@@ -390,7 +390,7 @@ def probe_host_key(device_id: int):
)
@bp.post("/<int:device_id>/hostkey/freigeben")
@bp.post("/<int:device_id>/host-key/trust")
@permission_required("devices.edit")
@reauth_required
def trust_host_key(device_id: int):
@@ -424,7 +424,7 @@ def trust_host_key(device_id: int):
return redirect(url_for("devices.detail", device_id=device_id))
@bp.post("/<int:device_id>/hostkey/verwerfen")
@bp.post("/<int:device_id>/host-key/forget")
@permission_required("devices.edit")
def forget_host_key(device_id: int):
conn = db()
apps/tesm/src/tesm/blueprints/dhcp.py
+12 -12
View File
@@ -105,7 +105,7 @@ def overview():
# --------------------------------------------------------------------------- #
@bp.post("/einstellungen")
@bp.post("/settings")
@permission_required("dhcp.edit")
def save_settings():
extension = core()
@@ -122,7 +122,7 @@ def save_settings():
return _write_and_redirect()
@bp.post("/subnetz")
@bp.post("/subnet")
@permission_required("dhcp.edit")
def add_subnet():
extension = core()
@@ -158,7 +158,7 @@ def add_subnet():
return _write_and_redirect()
@bp.post("/subnetz/<int:subnet_id>")
@bp.post("/subnet/<int:subnet_id>")
@permission_required("dhcp.edit")
def update_subnet(subnet_id: int):
extension = core()
@@ -194,7 +194,7 @@ def update_subnet(subnet_id: int):
return _write_and_redirect()
@bp.post("/subnetz/<int:subnet_id>/loeschen")
@bp.post("/subnet/<int:subnet_id>/delete")
@permission_required("dhcp.edit")
def delete_subnet(subnet_id: int):
with transaction() as conn:
@@ -209,7 +209,7 @@ def delete_subnet(subnet_id: int):
# --------------------------------------------------------------------------- #
@bp.post("/option/wert")
@bp.post("/option/value")
@permission_required("dhcp.edit")
def set_option_value():
conn = db()
@@ -248,7 +248,7 @@ def _device_option_values(conn) -> dict[int, list[dict[str, Any]]]: # type: ign
return gruppen
@bp.post("/option/geraet")
@bp.post("/option/device")
@permission_required("dhcp.edit")
def set_device_option_value():
"""Setzt eine Option fuer ein einzelnes Geraet.
@@ -296,7 +296,7 @@ def set_device_option_value():
return _write_and_redirect()
@bp.post("/option/neu")
@bp.post("/option/new")
@permission_required("dhcp.edit")
def add_custom_option():
conn = db()
@@ -327,7 +327,7 @@ def add_custom_option():
return redirect(url_for("dhcp.overview"))
@bp.post("/option/<int:option_id>/loeschen")
@bp.post("/option/<int:option_id>/delete")
@permission_required("dhcp.edit")
def delete_custom_option(option_id: int):
conn = db()
@@ -352,7 +352,7 @@ def delete_custom_option(option_id: int):
# --------------------------------------------------------------------------- #
@bp.post("/reservierung")
@bp.post("/reservation")
@permission_required("dhcp.edit")
def add_reservation():
conn = db()
@@ -412,7 +412,7 @@ def add_reservation():
return _write_and_redirect()
@bp.post("/reservierung/<int:reservation_id>/loeschen")
@bp.post("/reservation/<int:reservation_id>/delete")
@permission_required("dhcp.edit")
def delete_reservation(reservation_id: int):
with transaction() as conn:
@@ -480,13 +480,13 @@ def _write_and_redirect():
return redirect(url_for("dhcp.overview"))
@bp.post("/schreiben")
@bp.post("/write")
@permission_required("dhcp.edit")
def write_config():
return _write_and_redirect()
@bp.post("/dienst/<action>")
@bp.post("/service/<action>")
@permission_required("dhcp.execute")
def service_action(action: str):
allowed = {"install", "start", "stop"}
apps/tesm/src/tesm/blueprints/fileshare.py
+63 -34
View File
@@ -23,7 +23,7 @@ from tesm_core.extension import core, db, transaction
from ..services import fileshare as service
bp = Blueprint("fileshare", __name__, url_prefix="/dateifreigaben")
bp = Blueprint("fileshare", __name__, url_prefix="/fileshares")
@bp.before_request
@@ -60,8 +60,8 @@ def _mount_or_404(token: str) -> service.Mount:
def browse():
conn = db()
mounts = service.active_mounts(conn, current_user.id)
token = request.args.get("freigabe") or (mounts[0].token if mounts else "")
relative = request.args.get("pfad") or ""
token = request.args.get("share") or (mounts[0].token if mounts else "")
relative = request.args.get("path") or ""
listing = None
error = ""
if token:
@@ -85,14 +85,14 @@ def browse():
)
@bp.get("/<token>/herunterladen")
@bp.get("/<token>/download")
# Herunterladen traegt Daten aus dem System heraus -- in der Rechtematrix ist
# das "Exportieren", nicht "Ansehen". Eine Vorschau bleibt im Haus, eine
# heruntergeladene Datei nicht.
@permission_required("fileshare.export")
def download(token: str):
mount = _mount_or_404(token)
relative = request.args.get("pfad") or ""
relative = request.args.get("path") or ""
try:
path = service.resolve_path(mount, relative)
except service.FileshareError as exc:
@@ -113,11 +113,11 @@ def download(token: str):
)
@bp.get("/<token>/vorschau")
@bp.get("/<token>/preview")
@permission_required("fileshare.view")
def preview(token: str):
mount = _mount_or_404(token)
relative = request.args.get("pfad") or ""
relative = request.args.get("path") or ""
try:
path = service.resolve_path(mount, relative)
mimetype = service.preview_mime(path.name)
@@ -152,15 +152,15 @@ def preview(token: str):
)
@bp.post("/<token>/hochladen")
@bp.post("/<token>/upload")
@permission_required("fileshare.create")
def upload(token: str):
mount = _mount_or_404(token)
relative = request.form.get("pfad") or ""
relative = request.form.get("path") or ""
files = request.files.getlist("files")
if not files:
flash("Keine Datei ausgewaehlt.", "danger")
return redirect(url_for("fileshare.browse", freigabe=token, pfad=relative))
return redirect(url_for("fileshare.browse", share=token, path=relative))
limit = uploads.limit_bytes(db())
stored = 0
@@ -178,15 +178,15 @@ def upload(token: str):
stored += 1
except service.FileshareError as exc:
flash(str(exc), "danger")
return redirect(url_for("fileshare.browse", freigabe=token, pfad=relative))
return redirect(url_for("fileshare.browse", share=token, path=relative))
if stored:
_audit("fileshare.uploaded", f"{mount.label}:{relative}", f"{stored} Datei(en)")
flash(f"{stored} Datei(en) hochgeladen.", "success")
return redirect(url_for("fileshare.browse", freigabe=token, pfad=relative))
return redirect(url_for("fileshare.browse", share=token, path=relative))
@bp.post("/<token>/formular")
@bp.post("/<token>/form")
@permission_required("fileshare_pdf.create")
def save_form(token: str):
"""Nimmt ein in der Vorschau ausgefuelltes PDF und legt es daneben ab.
@@ -196,7 +196,7 @@ def save_form(token: str):
die alte Datei danach loeschen -- das ist eine bewusste Handlung.
"""
mount = _mount_or_404(token)
relative = request.form.get("pfad") or ""
relative = request.form.get("path") or ""
upload_file = request.files.get("datei")
if upload_file is None or not upload_file.filename:
return {"error": "Es kam keine Datei an."}, 400
@@ -259,47 +259,47 @@ def save_form(token: str):
wohin = ziel.relative_to(mount.path.resolve()).as_posix()
_audit("fileshare.form_saved", f"{mount.label}:{relative}", wohin, severity="notice")
return {"message": f"Gespeichert als {wohin}.", "pfad": wohin}
return {"message": f"Gespeichert als {wohin}.", "path": wohin}
@bp.post("/<token>/ordner")
@bp.post("/<token>/folder")
@permission_required("fileshare.create")
def make_directory(token: str):
mount = _mount_or_404(token)
relative = request.form.get("pfad") or ""
relative = request.form.get("path") or ""
try:
service.make_directory(mount, relative, request.form.get("name", ""))
except (service.FileshareError, OSError) as exc:
flash(str(exc), "danger")
return redirect(url_for("fileshare.browse", freigabe=token, pfad=relative))
return redirect(url_for("fileshare.browse", share=token, path=relative))
_audit("fileshare.directory_created", f"{mount.label}:{relative}/{request.form.get('name')}")
flash("Ordner angelegt.", "success")
return redirect(url_for("fileshare.browse", freigabe=token, pfad=relative))
return redirect(url_for("fileshare.browse", share=token, path=relative))
@bp.post("/<token>/umbenennen")
@bp.post("/<token>/rename")
@permission_required("fileshare.edit")
def rename(token: str):
mount = _mount_or_404(token)
relative = request.form.get("pfad") or ""
relative = request.form.get("path") or ""
parent = request.form.get("parent") or ""
try:
service.rename_entry(mount, relative, request.form.get("name", ""))
except (service.FileshareError, OSError) as exc:
flash(str(exc), "danger")
return redirect(url_for("fileshare.browse", freigabe=token, pfad=parent))
return redirect(url_for("fileshare.browse", share=token, path=parent))
_audit("fileshare.renamed", f"{mount.label}:{relative}")
flash("Umbenannt.", "success")
return redirect(url_for("fileshare.browse", freigabe=token, pfad=parent))
return redirect(url_for("fileshare.browse", share=token, path=parent))
@bp.post("/<token>/loeschen")
@bp.post("/<token>/delete")
@permission_required("fileshare.delete")
def delete(token: str):
mount = _mount_or_404(token)
parent = request.form.get("parent") or ""
removed = 0
for relative in request.form.getlist("pfade"):
for relative in request.form.getlist("paths"):
try:
kind = service.delete_entry(mount, relative)
_audit("fileshare.deleted", f"{mount.label}:{relative}", kind, severity="warning")
@@ -308,10 +308,10 @@ def delete(token: str):
flash(str(exc), "danger")
if removed:
flash(f"{removed} Eintrag/Eintraege geloescht.", "success")
return redirect(url_for("fileshare.browse", freigabe=token, pfad=parent))
return redirect(url_for("fileshare.browse", share=token, path=parent))
@bp.post("/<token>/freigeben")
@bp.post("/<token>/release")
@permission_required("fileshare.view")
def release(token: str):
mount = _mount_or_404(token)
@@ -327,7 +327,7 @@ def release(token: str):
# --------------------------------------------------------------------------- #
@bp.get("/zuordnungen")
@bp.get("/mappings")
@permission_required("fileshare.edit")
def mappings():
from tesm_core.auth import directory
@@ -341,7 +341,7 @@ def mappings():
)
@bp.post("/zuordnungen")
@bp.post("/mappings")
@permission_required("fileshare.edit")
def mapping_add():
try:
@@ -353,18 +353,33 @@ def mapping_add():
label=request.form.get("label", ""),
unc=request.form.get("unc", ""),
)
_audit("fileshare.mapping_added", request.form.get("label", ""), severity="notice")
_audit(
"fileshare.mapping_added",
request.form.get("label", ""),
service.describe_mapping(
{
"unc": request.form.get("unc", ""),
"ad_group_name": request.form.get("ad_group_name", ""),
"ad_group_dn": request.form.get("ad_group_dn", ""),
}
),
severity="notice",
)
flash("Zuordnung gespeichert.", "success")
except service.FileshareError as exc:
flash(str(exc), "danger")
return redirect(url_for("fileshare.mappings"))
@bp.post("/zuordnungen/<int:mapping_id>")
@bp.post("/mappings/<int:mapping_id>")
@permission_required("fileshare.edit")
def mapping_update(mapping_id: int):
try:
with transaction() as conn:
# Den Stand vor der Aenderung merken -- danach ist er weg, und
# "geaendert" ohne "was" beantwortet keine einzige Frage, die man
# spaeter an ein Protokoll stellt.
vorher = service.get_mapping(conn, mapping_id)
service.update_mapping(
conn,
mapping_id,
@@ -373,18 +388,32 @@ def mapping_update(mapping_id: int):
label=request.form.get("label", ""),
unc=request.form.get("unc", ""),
)
_audit("fileshare.mapping_updated", request.form.get("label", ""), severity="notice")
nachher = service.get_mapping(conn, mapping_id)
_audit(
"fileshare.mapping_updated",
str((nachher or {}).get("label") or request.form.get("label", "")),
service.mapping_changes(vorher, nachher) or "keine inhaltliche Aenderung",
severity="notice",
)
flash("Zuordnung geaendert.", "success")
except service.FileshareError as exc:
flash(str(exc), "danger")
return redirect(url_for("fileshare.mappings"))
@bp.post("/zuordnungen/<int:mapping_id>/loeschen")
@bp.post("/mappings/<int:mapping_id>/delete")
@permission_required("fileshare.edit")
def mapping_delete(mapping_id: int):
with transaction() as conn:
entfernt = service.get_mapping(conn, mapping_id)
service.delete_mapping(conn, mapping_id)
_audit("fileshare.mapping_deleted", str(mapping_id), severity="notice")
# Eine entfernte Zuordnung nimmt allen Mitgliedern der Gruppe den Zugang
# zu dieser Freigabe -- das ist keine Notiz am Rande, sondern eine Warnung.
_audit(
"fileshare.mapping_deleted",
str((entfernt or {}).get("label") or mapping_id),
service.describe_mapping(entfernt),
severity="warning",
)
flash("Zuordnung entfernt.", "success")
return redirect(url_for("fileshare.mappings"))
apps/tesm/src/tesm/blueprints/hostkeys.py
+5 -5
View File
@@ -31,7 +31,7 @@ from tesm_core.extension import core, db, transaction
from ..services import inventory, ssh
bp = Blueprint("hostkeys", __name__, url_prefix="/hostschluessel")
bp = Blueprint("hostkeys", __name__, url_prefix="/monitoring/host-keys")
KIND_DEVICE = "client"
KIND_SWITCH = "switch"
@@ -142,7 +142,7 @@ def _require(kind: str) -> None:
abort(403)
@bp.post("/<kind>/<int:target_id>/pruefen")
@bp.post("/<kind>/<int:target_id>/probe")
@permission_required("devices.view", "switches.view", mode="any")
def probe(kind: str, target_id: int):
conn = db()
@@ -169,7 +169,7 @@ def probe(kind: str, target_id: int):
)
@bp.post("/<kind>/<int:target_id>/freigeben")
@bp.post("/<kind>/<int:target_id>/trust")
@permission_required("devices.view", "switches.view", mode="any")
@reauth_required
def trust(kind: str, target_id: int):
@@ -203,7 +203,7 @@ def trust(kind: str, target_id: int):
return redirect(url_for("hostkeys.overview"))
@bp.post("/<kind>/<int:target_id>/verwerfen")
@bp.post("/<kind>/<int:target_id>/forget")
@permission_required("devices.view", "switches.view", mode="any")
def forget(kind: str, target_id: int):
conn = db()
@@ -222,7 +222,7 @@ def forget(kind: str, target_id: int):
return redirect(url_for("hostkeys.overview"))
@bp.post("/verwaist/verwerfen")
@bp.post("/orphaned/forget")
@permission_required("devices.edit", "switches.edit", mode="any")
def forget_orphan():
"""Entfernt eine Freigabe, zu der es kein Ziel mehr gibt."""
apps/tesm/src/tesm/blueprints/license.py
+7 -7
View File
@@ -23,7 +23,7 @@ from tesm_core.licensing_client import LICENSED_FEATURES, LicenseError
import tesm_licensing as lic
bp = Blueprint("license", __name__, url_prefix="/lizenz")
bp = Blueprint("license", __name__, url_prefix="/administration/license")
MAX_UPLOAD_BYTES = 256 * 1024
@@ -69,7 +69,7 @@ def overview():
)
@bp.post("/einspielen")
@bp.post("/install")
@permission_required("settings_license.edit")
def upload():
extension = core()
@@ -110,13 +110,13 @@ def upload():
return redirect(url_for("license.overview"))
@bp.post("/aktivieren")
@bp.post("/activate")
@permission_required("settings_license.edit")
def activate():
return _handshake("activate")
@bp.post("/deaktivieren")
@bp.post("/deactivate")
@permission_required("settings_license.edit")
@reauth_required
def deactivate():
@@ -158,7 +158,7 @@ def _handshake(action: str):
return redirect(url_for("license.overview"))
@bp.post("/offline-antwort")
@bp.post("/offline-response")
@permission_required("settings_license.edit")
def offline_response():
extension = core()
@@ -177,7 +177,7 @@ def offline_response():
return redirect(url_for("license.overview"))
@bp.post("/serverzertifikat")
@bp.post("/server-certificate")
@permission_required("settings_license.edit")
def server_certificate():
"""Hinterlegt das Zertifikat des Lizenzservers.
@@ -222,7 +222,7 @@ def server_certificate():
return redirect(url_for("license.overview"))
@bp.post("/aussteller/<key_id>/entfernen")
@bp.post("/issuer/<key_id>/remove")
@admin_required
@reauth_required
def remove_trusted_key(key_id: str):
apps/tesm/src/tesm/blueprints/logs.py
+4 -4
View File
@@ -13,12 +13,12 @@ from tesm_core.extension import core, db
from ..services import kea, monitor
bp = Blueprint("tesmlogs", __name__, url_prefix="/protokolle")
bp = Blueprint("tesmlogs", __name__, url_prefix="/logs")
MAX_TAIL_LINES = 2000
@bp.get("/kea")
@bp.get("/dhcp")
@permission_required("logs_dhcp.view")
def dhcp():
extension = core()
@@ -38,7 +38,7 @@ def dhcp():
return render_template("tesm/logs_kea.html", lines=lines, path=kea.LOG_PATH, error=error)
@bp.get("/neustarts")
@bp.get("/restarts")
@permission_required("devices.view")
def restarts():
"""Alle Neustarts -- ueber den PoE-Port und per Befehl aus der Wartung.
@@ -48,7 +48,7 @@ def restarts():
der Neustart-Historie vollstaendig -- obwohl genau dort jemand nachsieht,
der wissen will, warum ein Geraet weg war.
"""
method = (request.args.get("methode") or "").strip()
method = (request.args.get("method") or "").strip()
if method and method not in monitor.METHOD_LABELS:
method = ""
sql = (
apps/tesm/src/tesm/blueprints/maintenance.py
+7 -7
View File
@@ -25,7 +25,7 @@ from tesm_core.extension import core, db, transaction
from ..services import inventory, maintenance as service, ssh, windowsops, monitor
bp = Blueprint("maintenance", __name__, url_prefix="/wartung")
bp = Blueprint("maintenance", __name__, url_prefix="/maintenance")
@bp.before_request
@@ -85,7 +85,7 @@ def overview():
category_labels=dict(inventory.CREDENTIAL_CATEGORIES),
category_effects=inventory.CATEGORY_EFFECTS,
update_category=inventory.MAINTENANCE_CATEGORY,
terminal_enabled=bool(core().settings.get(conn, "terminal_enabled")),
terminal_enabled=bool(core().settings.get(conn, "terminal_clients_enabled")),
windows_tool_missing=_windows_tool_missing(conn),
windows_package=windowsops.REQUIRED_PACKAGE,
)
@@ -105,7 +105,7 @@ def _windows_tool_missing(conn) -> bool: # type: ignore[no-untyped-def]
)
@bp.post("/paket-nachinstallieren")
@bp.post("/install-package")
@permission_required("maintenance.execute")
def install_windows_tool():
"""Installiert das Paket, das der Fehlermeldung nach fehlt.
@@ -165,7 +165,7 @@ def status():
)
@bp.get("/auftrag/<job_id>")
@bp.get("/job/<job_id>")
@permission_required("maintenance.view", "maintenance.execute", mode="any")
def job_detail(job_id: str):
conn = db()
@@ -175,7 +175,7 @@ def job_detail(job_id: str):
return render_template("tesm/maintenance_job.html", job=job)
@bp.get("/auftrag/<job_id>/ausgabe")
@bp.get("/job/<job_id>/output")
@permission_required("maintenance.view", "maintenance.execute", mode="any")
@fragment
def job_output(job_id: str):
@@ -276,14 +276,14 @@ def _start(kind: str) -> None:
flash(f"{started} Auftrag/Auftraege gestartet.", "success")
@bp.post("/aktualisieren")
@bp.post("/update")
@permission_required("maintenance.execute")
def start_update():
_start(service.JOB_KIND_UPDATE)
return redirect(url_for("maintenance.overview"))
@bp.post("/neustarten")
@bp.post("/restart")
@permission_required("maintenance.execute")
def start_reboot():
_start(service.JOB_KIND_REBOOT)
apps/tesm/src/tesm/blueprints/settings.py
+12 -5
View File
@@ -18,7 +18,7 @@ from tesm_core.auth.service import client_ip
from tesm_core.extension import core, db, transaction
from tesm_core.licensing_client import LicenseError
bp = Blueprint("settings", __name__, url_prefix="/einstellungen")
bp = Blueprint("settings", __name__, url_prefix="/administration")
def _audit(action: str, target: str = "", detail: str = "", severity: str = "info") -> None:
@@ -79,9 +79,12 @@ def system():
"monitor_failures_before_restart",
"monitor_auto_restart",
"dashboard_public",
"terminal_enabled",
"terminal_switches_enabled",
"terminal_clients_enabled",
"terminal_idle_timeout",
"trash_retention_days",
"session_idle_minutes",
"session_absolute_hours",
"log_rotate_interval",
"log_rotate_keep",
],
@@ -92,6 +95,7 @@ def system():
timezones=_timezone_choices(),
nav_items=extension.nav.items,
nav_order=extension.settings.get(conn, "nav_order") or extension.nav.default_order(),
nav_child_order=extension.settings.get(conn, "nav_child_order") or {},
license_hint=_license_hint("monitor_interval"),
sysops_available=bool(sysops and sysops.available),
)
@@ -109,9 +113,12 @@ def system_save():
"monitor_failures_before_restart",
"monitor_auto_restart",
"dashboard_public",
"terminal_enabled",
"terminal_switches_enabled",
"terminal_clients_enabled",
"terminal_idle_timeout",
"trash_retention_days",
"session_idle_minutes",
"session_absolute_hours",
"log_rotate_interval",
"log_rotate_keep",
):
@@ -181,7 +188,7 @@ def set_hostname():
return redirect(url_for("settings.system"))
@bp.post("/system/zeitzone")
@bp.post("/system/timezone")
@permission_required("settings_system.execute")
def set_timezone():
extension = core()
@@ -210,7 +217,7 @@ def set_timezone():
return redirect(url_for("settings.system"))
@bp.post("/system/pruefung-jetzt")
@bp.post("/system/check-now")
@permission_required("settings_system.execute")
def run_check_now():
"""Startet einen Ueberwachungsdurchlauf sofort, im Hintergrund."""
apps/tesm/src/tesm/blueprints/switches.py
+9 -9
View File
@@ -17,7 +17,7 @@ from tesm_core.extension import core, db, transaction
from ..services import inventory, ssh, switchcli
bp = Blueprint("switches", __name__, url_prefix="/switche")
bp = Blueprint("switches", __name__, url_prefix="/monitoring/switches")
def _audit(conn: Any, action: str, target: str, detail: str = "", severity: str = "info") -> None:
@@ -54,11 +54,11 @@ def overview():
"tesm/switches.html",
switches=inventory.list_switches(conn),
credentials=inventory.list_credentials(conn),
terminal_enabled=bool(core().settings.get(conn, "terminal_enabled")),
terminal_enabled=bool(core().settings.get(conn, "terminal_switches_enabled")),
)
@bp.post("/neu")
@bp.post("/new")
@permission_required("switches.create")
def create():
try:
@@ -98,7 +98,7 @@ def update(switch_id: int):
return redirect(request.referrer or url_for("switches.overview"))
@bp.post("/<int:switch_id>/loeschen")
@bp.post("/<int:switch_id>/delete")
@permission_required("switches.delete")
def delete(switch_id: int):
try:
@@ -142,7 +142,7 @@ def detail(switch_id: int):
devices=devices,
credentials=inventory.list_credentials(conn),
safe_commands=switchcli.SAFE_COMMANDS,
terminal_enabled=bool(core().settings.get(conn, "terminal_enabled")),
terminal_enabled=bool(core().settings.get(conn, "terminal_switches_enabled")),
)
@@ -151,7 +151,7 @@ def detail(switch_id: int):
# --------------------------------------------------------------------------- #
@bp.post("/<int:switch_id>/hostkey/pruefen")
@bp.post("/<int:switch_id>/host-key/probe")
@permission_required("switches.edit")
def probe_host_key(switch_id: int):
conn = db()
@@ -176,7 +176,7 @@ def probe_host_key(switch_id: int):
)
@bp.post("/<int:switch_id>/hostkey/freigeben")
@bp.post("/<int:switch_id>/host-key/trust")
@permission_required("switches.edit")
@reauth_required
def trust_host_key(switch_id: int):
@@ -215,7 +215,7 @@ def trust_host_key(switch_id: int):
return redirect(url_for("switches.detail", switch_id=switch_id))
@bp.post("/<int:switch_id>/hostkey/verwerfen")
@bp.post("/<int:switch_id>/host-key/forget")
@permission_required("switches.edit")
def forget_host_key(switch_id: int):
conn = db()
@@ -234,7 +234,7 @@ def forget_host_key(switch_id: int):
# --------------------------------------------------------------------------- #
@bp.post("/<int:switch_id>/kommando")
@bp.post("/<int:switch_id>/command")
@permission_required("switches.execute")
@reauth_required
def run_command(switch_id: int):
apps/tesm/src/tesm/blueprints/terminal.py
+20 -5
View File
@@ -24,7 +24,10 @@ Rechteausweitung, die dieses Projekt an anderer Stelle ausschliesst.
Gemeinsame Sicherheitsmerkmale:
* Frische Passwortbestaetigung, zusaetzlich zum Recht.
* Abschaltbar ueber die Einstellung ``terminal_enabled``.
* Abschaltbar -- getrennt fuer Switche (``terminal_switches_enabled``) und
Clients (``terminal_clients_enabled``). Das Freigeben von Host-Schluesseln
haengt an eigenen Routen und bleibt davon unberuehrt: es wird fuer den
PoE-Neustart gebraucht.
* Der Host-Schluessel muss vorher freigegeben sein -- die Konsole akzeptiert
keine unbekannten Schluessel (anders als der Vorgaenger, der sie hier
interaktiv uebernahm). Freigegeben wird auf der jeweiligen Detailseite.
@@ -128,6 +131,18 @@ def _load_target(conn: Any, kind: str, target_id: int) -> Target | None:
)
def _konsole_erlaubt(conn: Any, kind: str) -> bool:
"""Ist die Konsole fuer diese Art Ziel eingeschaltet?
Zwei Schalter, weil beides unabhaengig voneinander gebraucht wird: eine
Werkstatt will vielleicht auf Switche, aber nicht auf Clients.
"""
schluessel = (
"terminal_switches_enabled" if kind == KIND_SWITCH else "terminal_clients_enabled"
)
return bool(core().settings.get(conn, schluessel))
def _client_module_active() -> bool:
manager = core().license
return manager is None or manager.module_active("maintenance")
@@ -136,7 +151,7 @@ def _client_module_active() -> bool:
def _render_console(target: Target): # type: ignore[no-untyped-def]
extension = core()
conn = db()
if not extension.settings.get(conn, "terminal_enabled"):
if not _konsole_erlaubt(conn, target.kind):
abort(404)
if not target.credential_id:
abort(409, description="Fuer dieses Ziel sind keine Zugangsdaten hinterlegt.")
@@ -151,7 +166,7 @@ def _render_console(target: Target): # type: ignore[no-untyped-def]
)
@bp.get("/switche/<int:switch_id>/konsole")
@bp.get("/monitoring/switches/<int:switch_id>/console")
@permission_required("switches.execute")
@reauth_required
def switch_console(switch_id: int):
@@ -161,7 +176,7 @@ def switch_console(switch_id: int):
return _render_console(target)
@bp.get("/clients/<int:device_id>/konsole")
@bp.get("/monitoring/clients/<int:device_id>/console")
@permission_required("maintenance.execute")
@reauth_required
def device_console(device_id: int):
@@ -217,7 +232,7 @@ def _handle_socket(ws, kind: str, target_id: int) -> None: # type: ignore[no-un
if not reauth_is_fresh():
_send(ws, "error", "Die Passwortbestaetigung ist abgelaufen. Bitte Seite neu laden.")
return
if not extension.settings.get(conn, "terminal_enabled"):
if not _konsole_erlaubt(conn, kind):
_send(ws, "error", "Die Konsole ist in dieser Installation abgeschaltet.")
return
if kind == KIND_DEVICE and not _client_module_active():
apps/tesm/src/tesm/navigation.py
+12 -12
View File
@@ -45,10 +45,10 @@ def _has_fileshare_mounts(user: Any) -> bool:
NAVIGATION = NavTree(
[
NavItem(key="index", label="Statusuebersicht", icon="grid", endpoint="dashboard.index"),
NavItem(key="index", label="Statusübersicht", icon="grid", endpoint="dashboard.index"),
NavItem(
key="monitoring",
label="Ueberwachung",
label="Überwachung",
icon="cpu",
children=(
NavItem(
@@ -74,21 +74,21 @@ NAVIGATION = NavTree(
),
NavItem(
key="hostkeys",
label="Host-Schluessel",
label="Host-Schlüssel",
icon="shield",
endpoint="hostkeys.overview",
permissions=("devices.view", "switches.view"),
),
NavItem(
key="maintenance",
label="Wartung",
icon="wrench",
endpoint="maintenance.overview",
permissions=("maintenance.view", "maintenance.execute"),
condition=_module("maintenance"),
),
),
),
NavItem(
key="maintenance",
label="Wartung",
icon="wrench",
endpoint="maintenance.overview",
permissions=("maintenance.view", "maintenance.execute"),
condition=_module("maintenance"),
),
NavItem(
key="dhcp",
label="DHCP-Server",
@@ -147,7 +147,7 @@ NAVIGATION = NavTree(
),
NavItem(
key="logs_dhcp",
label="Kea-DHCP",
label="DHCP",
icon="network",
endpoint="tesmlogs.dhcp",
permissions=("logs_dhcp.view",),
apps/tesm/src/tesm/permissions.py
+4 -4
View File
@@ -31,7 +31,7 @@ DEVICES = Resource(
key="devices",
label="Clients",
actions=(A.VIEW, A.CREATE, A.EDIT, A.DELETE, A.EXECUTE),
hint="Ueberwachte PoE-Endgeraete",
hint="Überwachte PoE-Endgeräte",
action_hints={
A.EXECUTE: "PoE-Neustart eines Geraets manuell ausloesen. Der automatische "
"Neustart bei Ausfall ist davon unabhaengig und laeuft immer.",
@@ -75,7 +75,7 @@ DHCP = Resource(
key="dhcp",
label="DHCP-Server",
actions=(A.VIEW, A.EDIT, A.EXECUTE),
hint="Kea-DHCP: Subnetze, Optionen, Reservierungen (lizenzpflichtiges Modul)",
hint="DHCP: Subnetze, Optionen, Reservierungen (lizenzpflichtiges Modul)",
action_hints={
A.EDIT: "Konfiguration aendern und schreiben.",
A.EXECUTE: "Dienst installieren, starten oder stoppen.",
@@ -120,13 +120,13 @@ FILESHARE_PDF = Resource(
LOGS_DHCP = Resource(
key="logs_dhcp",
label="Kea-DHCP-Protokoll",
label="DHCP-Protokoll",
actions=(A.VIEW,),
)
MONITORING_AREA = Area(
key="monitoring",
label="Ueberwachung",
label="Überwachung",
icon="cpu",
hint="Geraete, Switche, Zugangsdaten und Wartung. Ohne diesen Zugang bleibt der "
"gesamte Bereich verborgen.",
apps/tesm/src/tesm/schema.py
+17
View File
@@ -273,9 +273,26 @@ INSERT OR IGNORE INTO group_permissions (group_id, permission)
"""
# Aus einem Schalter werden zwei. Wer die Konsole abgeschaltet hatte, soll sie
# nicht durch ein Update zurueckbekommen -- der alte Wert gilt deshalb fuer
# beide weiter. Fehlt er, greift die Vorgabe der Einstellung.
V5 = """
INSERT OR IGNORE INTO settings (key, value, updated_at, updated_by)
SELECT 'terminal_switches_enabled', value, datetime('now'), 'migration'
FROM settings WHERE key = 'terminal_enabled';
INSERT OR IGNORE INTO settings (key, value, updated_at, updated_by)
SELECT 'terminal_clients_enabled', value, datetime('now'), 'migration'
FROM settings WHERE key = 'terminal_enabled';
DELETE FROM settings WHERE key = 'terminal_enabled';
"""
TESM_MIGRATIONS: tuple[Migration, ...] = (
Migration(version=1, name="baseline", sql=V1),
Migration(version=2, name="seed-dhcp-options", fn=seed_dhcp_options),
Migration(version=3, name="restart-events", sql=V3),
Migration(version=4, name="fileshare-pdf-rechte", sql=V4),
Migration(version=5, name="terminal-getrennt", sql=V5),
)
apps/tesm/src/tesm/services/fileshare.py
+87 -7
View File
@@ -33,7 +33,7 @@ import sqlite3
from dataclasses import dataclass
from datetime import datetime, timedelta, timezone
from pathlib import Path, PurePosixPath
from typing import Any, Iterable
from typing import Any, Iterable, Mapping
from tesm_core.db import Database
from tesm_core.extension import core
@@ -208,6 +208,50 @@ def list_mappings(conn: sqlite3.Connection) -> list[dict[str, Any]]:
)
#: Felder einer Zuordnung mit der Beschriftung, unter der sie in der
#: Oberflaeche stehen. Das Protokoll soll dieselben Woerter benutzen wie das
#: Formular -- sonst muss man beim Lesen uebersetzen.
MAPPING_FELDER: tuple[tuple[str, str], ...] = (
("label", "Anzeigename"),
("unc", "Pfad"),
("ad_group_name", "Gruppe"),
("ad_group_dn", "Gruppen-DN"),
)
def get_mapping(conn: sqlite3.Connection, mapping_id: int) -> dict[str, Any] | None:
return Database.one(conn, "SELECT * FROM fileshare_mappings WHERE id=?", (mapping_id,))
def describe_mapping(row: Mapping[str, Any] | None) -> str:
"""Eine Zuordnung in einer Zeile -- fuer das Protokoll.
Ohne sie stand beim Loeschen nur die Nummer der Zuordnung im Protokoll.
Die ist nach dem Loeschen nirgends mehr nachschlagbar; damit war der
Eintrag da, aber wertlos.
"""
if row is None:
return ""
teile = [str(row["unc"] or "")]
gruppe = str(row["ad_group_name"] or row["ad_group_dn"] or "")
if gruppe:
teile.append(f"Gruppe: {gruppe}")
return " -- ".join(teil for teil in teile if teil)
def mapping_changes(vorher: Mapping[str, Any] | None, nachher: Mapping[str, Any] | None) -> str:
"""Was sich geaendert hat, Feld fuer Feld: ``Anzeigename: alt -> neu``."""
if vorher is None or nachher is None:
return ""
geaendert = []
for feld, beschriftung in MAPPING_FELDER:
alt = str(vorher[feld] or "")
neu = str(nachher[feld] or "")
if alt != neu:
geaendert.append(f"{beschriftung}: {alt or '(leer)'} -> {neu or '(leer)'}")
return "; ".join(geaendert)
def add_mapping(
conn: sqlite3.Connection, *, ad_group_dn: str, ad_group_name: str, label: str, unc: str
) -> int:
@@ -389,7 +433,39 @@ def mount_for_login(
if not password:
return ["Kein Passwort fuer den Fileserver verfuegbar -- keine Einbindungen."]
# Was zuerst kommt: das Ende der Sitzung oder die eigene Obergrenze. Die
# Sitzung ist die eigentliche Klammer -- mit ihr endet die Einbindung; die
# Obergrenze sorgt dafuer, dass eine sehr lange Sitzung nicht beliebig
# lange auf fremden Zugangsdaten sitzt.
hours = int(extension.settings.get(conn, "fileshare_max_age_hours") or 12)
frist = _now() + timedelta(hours=hours)
# Die Sitzungszeile gibt es hier noch nicht: eingebunden wird waehrend der
# Anmeldung, geschrieben wird sie erst beim Speichern der Antwort. Die
# Dauer steht aber in derselben Einstellung, aus der die Sitzung sie
# gleich bekommt -- und falls die Zeile doch schon steht (erneutes
# Einbinden), gilt deren Ende.
zeile = (
Database.one(
conn, "SELECT absolute_expires_at FROM user_sessions WHERE id=?", (session_id,)
)
if session_id
else None
)
if zeile is not None and zeile["absolute_expires_at"]:
try:
sitzungsende = datetime.fromisoformat(str(zeile["absolute_expires_at"]))
if sitzungsende.tzinfo is None:
sitzungsende = sitzungsende.replace(tzinfo=timezone.utc)
frist = min(frist, sitzungsende)
except ValueError:
pass
else:
try:
dauer = int(extension.settings.get(conn, "session_absolute_hours") or 0)
except (TypeError, ValueError):
dauer = 0
if dauer > 0:
frist = min(frist, _now() + timedelta(hours=dauer))
root = Path(str(extension.settings.get(conn, "fileshare_mount_root") or "/mnt/tesm-shares"))
messages: list[str] = []
@@ -419,7 +495,7 @@ def mount_for_login(
str(share["unc"]),
str(target),
_iso(_now()),
_iso(_now() + timedelta(hours=hours)),
_iso(frist),
),
)
messages.append(f"{share['label']}: eingebunden")
@@ -474,7 +550,10 @@ def sweep_expired(database: Any) -> int:
released = 0
with database.session() as conn:
# Eine Einbindung lebt genau so lange wie die Sitzung, aus der sie
# entstanden ist. Vorher hing sie an einer eigenen Frist von zwoelf
# entstanden ist. Ohne Sitzungsangabe gilt allein die eigene Frist:
# "keine Sitzung eingetragen" ist etwas anderes als "Sitzung
# abgelaufen". Diese Verwechslung hat jede frische Einbindung binnen
# Minuten wieder geloest, weil die ID beim Anmelden noch nicht stand. Vorher hing sie an einer eigenen Frist von zwoelf
# Stunden: nach dem Abmelden -- oder nach der automatischen Abmeldung
# bei Leerlauf -- blieb die Freigabe mit den Zugangsdaten des Benutzers
# weiter eingebunden. Die eigene Frist bleibt als Obergrenze bestehen;
@@ -487,10 +566,11 @@ def sweep_expired(database: Any) -> int:
LEFT JOIN user_sessions s ON s.id = m.session_id
WHERE m.released_at IS NULL
AND (m.expires_at <= ?
OR s.id IS NULL
OR s.revoked_at IS NOT NULL
OR s.idle_expires_at <= ?
OR s.absolute_expires_at <= ?)
OR (COALESCE(m.session_id, '') <> ''
AND (s.id IS NULL
OR s.revoked_at IS NOT NULL
OR s.idle_expires_at <= ?
OR s.absolute_expires_at <= ?)))
""",
(_iso(_now()), _iso(_now()), _iso(_now())),
)
apps/tesm/src/tesm/settings_spec.py
+14 -3
View File
@@ -100,12 +100,23 @@ TESM_SETTINGS: tuple[SettingSpec, ...] = (
),
# -- Terminal ----------------------------------------------------------- #
SettingSpec(
"terminal_enabled",
"terminal_switches_enabled",
True,
"bool",
"Browser-Terminal fuer Switche aktiv",
"Browser-Konsole fuer Switche zulassen",
hint="Auch wenn aktiv: erfordert das Recht 'Ausfuehren' auf Switche, eine frische "
"Passwortbestaetigung und wird vollstaendig protokolliert.",
"Passwortbestaetigung und wird vollstaendig protokolliert. Das Freigeben von "
"Host-Schluesseln bleibt davon unberuehrt -- es wird fuer den PoE-Neustart "
"gebraucht.",
section="monitoring",
),
SettingSpec(
"terminal_clients_enabled",
True,
"bool",
"Browser-Konsole fuer Clients zulassen",
hint="Braucht zusaetzlich das Modul Wartung und das Recht 'Ausfuehren' auf Wartung. "
"Das Freigeben von Host-Schluesseln bleibt davon unberuehrt.",
section="monitoring",
),
SettingSpec(
apps/tesm/src/tesm/templates/tesm/fileshare.html
+17 -17
View File
@@ -23,7 +23,7 @@
<div class="tabs">
{% for mount in mounts %}
<a class="tab {{ 'is-active' if mount.token == token else '' }}"
href="{{ url_for('fileshare.browse', freigabe=mount.token) }}">{{ mount.label }}</a>
href="{{ url_for('fileshare.browse', share=mount.token) }}">{{ mount.label }}</a>
{% endfor %}
</div>
@@ -33,9 +33,9 @@
<div class="card__header">
<div class="flex-1">
<nav class="breadcrumb">
<span><a href="{{ url_for('fileshare.browse', freigabe=token) }}">{{ current.label }}</a></span>
<span><a href="{{ url_for('fileshare.browse', share=token) }}">{{ current.label }}</a></span>
{% for crumb in listing.breadcrumb %}
<span><a href="{{ url_for('fileshare.browse', freigabe=token, pfad=crumb.relative) }}">{{ crumb.name }}</a></span>
<span><a href="{{ url_for('fileshare.browse', share=token, path=crumb.relative) }}">{{ crumb.name }}</a></span>
{% endfor %}
</nav>
<div class="card__sub mono fs-xs">{{ current.unc }}</div>
@@ -69,8 +69,8 @@
<tr>
{% if current_user.has('fileshare.delete') %}<td></td>{% endif %}
<td colspan="4">
<a class="link-icon" href="{{ url_for('fileshare.browse', freigabe=token,
pfad=(listing.breadcrumb[-2].relative if listing.breadcrumb | length > 1 else '')) }}">
<a class="link-icon" href="{{ url_for('fileshare.browse', share=token,
path=(listing.breadcrumb[-2].relative if listing.breadcrumb | length > 1 else '')) }}">
{{ icon('chevron-right', size=14) }} eine Ebene höher
</a>
</td>
@@ -79,11 +79,11 @@
{% for entry in listing.directories %}
<tr>
{% if current_user.has('fileshare.delete') %}
<td><label class="check"><input type="checkbox" name="pfade" value="{{ entry.relative }}"><span class="sr-only">auswählen</span></label></td>
<td><label class="check"><input type="checkbox" name="paths" value="{{ entry.relative }}"><span class="sr-only">auswählen</span></label></td>
{% endif %}
<td>
{{ icon('folder', size=15) }}
<a href="{{ url_for('fileshare.browse', freigabe=token, pfad=entry.relative) }}">{{ entry.name }}</a>
<a href="{{ url_for('fileshare.browse', share=token, path=entry.relative) }}">{{ entry.name }}</a>
</td>
<td class="numeric faint">&ndash;</td>
<td class="fs-sm">{{ entry.modified | dt }}</td>
@@ -93,7 +93,7 @@
{% for entry in listing.files %}
<tr>
{% if current_user.has('fileshare.delete') %}
<td><label class="check"><input type="checkbox" name="pfade" value="{{ entry.relative }}"><span class="sr-only">auswählen</span></label></td>
<td><label class="check"><input type="checkbox" name="paths" value="{{ entry.relative }}"><span class="sr-only">auswählen</span></label></td>
{% endif %}
{# Der Name ist die grösste Fläche der Zeile -- er soll auch
das Naheliegende tun. Was sich anzeigen lässt, öffnet die
@@ -102,17 +102,17 @@
{% if entry.previewable %}
<button class="link-icon file-name" type="button"
data-dialog-open="file-preview"
data-fill-Src="{{ url_for('fileshare.preview', token=token, pfad=entry.relative) }}"
data-fill-Src="{{ url_for('fileshare.preview', token=token, path=entry.relative) }}"
data-fill-Kind="{{ entry.preview_kind }}"
data-fill-Pfad="{{ entry.relative }}"
data-fill-Name="{{ entry.name }}"
{% if current_user.has('fileshare.export') %}data-fill-Download="{{ url_for('fileshare.download', token=token, pfad=entry.relative) }}"{% endif %}>
{% if current_user.has('fileshare.export') %}data-fill-Download="{{ url_for('fileshare.download', token=token, path=entry.relative) }}"{% endif %}>
{{ icon('file-text', size=15) }} {{ entry.name }}
</button>
{% else %}
{% if current_user.has('fileshare.export') %}
<a class="link-icon"
href="{{ url_for('fileshare.download', token=token, pfad=entry.relative) }}">
href="{{ url_for('fileshare.download', token=token, path=entry.relative) }}">
{{ icon('file-text', size=15) }} {{ entry.name }}
</a>
{% else %}
@@ -130,11 +130,11 @@
{% if entry.previewable %}
<button class="btn btn--sm btn--ghost" type="button"
data-dialog-open="file-preview"
data-fill-Src="{{ url_for('fileshare.preview', token=token, pfad=entry.relative) }}"
data-fill-Src="{{ url_for('fileshare.preview', token=token, path=entry.relative) }}"
data-fill-Kind="{{ entry.preview_kind }}"
data-fill-Pfad="{{ entry.relative }}"
data-fill-Name="{{ entry.name }}"
{% if current_user.has('fileshare.export') %}data-fill-Download="{{ url_for('fileshare.download', token=token, pfad=entry.relative) }}"{% endif %}
{% if current_user.has('fileshare.export') %}data-fill-Download="{{ url_for('fileshare.download', token=token, path=entry.relative) }}"{% endif %}
aria-label="Vorschau">{{ icon('eye', size=15) }}</button>
{% endif %}
{% if current_user.has('fileshare.edit') %}
@@ -147,7 +147,7 @@
{% endif %}
{% if current_user.has('fileshare.export') %}
<a class="btn btn--sm btn--ghost"
href="{{ url_for('fileshare.download', token=token, pfad=entry.relative) }}"
href="{{ url_for('fileshare.download', token=token, path=entry.relative) }}"
aria-label="Herunterladen">{{ icon('download', size=15) }}</a>
{% endif %}
</td>
@@ -182,7 +182,7 @@
<form method="post" enctype="multipart/form-data" data-no-guard
action="{{ url_for('fileshare.upload', token=token) }}">
<input type="hidden" name="{{ csrf_field_name }}" value="{{ csrf_token() }}">
<input type="hidden" name="pfad" value="{{ listing.relative }}">
<input type="hidden" name="path" value="{{ listing.relative }}">
<div class="card__body row">
<input class="input" type="file" name="files" multiple required style="flex:1">
<button class="btn btn--primary" type="submit" data-busy-label="Lädt ...">Hochladen</button>
@@ -199,7 +199,7 @@
{% call modal('folder-new', 'Ordner anlegen', listing.relative or 'Wurzelverzeichnis', 'narrow') %}
<form method="post" action="{{ url_for('fileshare.make_directory', token=token) }}">
<input type="hidden" name="{{ csrf_field_name }}" value="{{ csrf_token() }}">
<input type="hidden" name="pfad" value="{{ listing.relative }}">
<input type="hidden" name="path" value="{{ listing.relative }}">
<div class="modal__body">{{ field('name', 'Name', required=True) }}</div>
<div class="modal__footer">
<button class="btn" type="button" data-dialog-close>Abbrechen</button>
@@ -312,7 +312,7 @@
<form method="post" action="{{ url_for('fileshare.rename', token=token) }}">
<input type="hidden" name="{{ csrf_field_name }}" value="{{ csrf_token() }}">
<input type="hidden" name="parent" value="{{ listing.relative }}">
<input type="hidden" name="pfad" data-fill-target="Pfad" value="">
<input type="hidden" name="path" data-fill-target="Pfad" value="">
<div class="modal__body">
{{ field('name', 'Neuer Name (ohne Endung)', required=True,
attrs='data-fill-target="Name"') }}
apps/tesm/src/tesm/templates/tesm/logs_kea.html
+1 -1
View File
@@ -1,6 +1,6 @@
{% extends "tesm_core/base.html" %}
{% from "tesm_core/macros.html" import alert %}
{% block page_title %}Kea-DHCP-Protokoll{% endblock %}
{% block page_title %}DHCP-Protokoll{% endblock %}
{% block page_sub %}{{ path }}{% endblock %}
{% block content %}
{% if error %}{{ alert(error, 'warning') }}{% endif %}
apps/tesm/src/tesm/templates/tesm/logs_restarts.html
+1 -1
View File
@@ -15,7 +15,7 @@ Der Vorgänger protokollierte Neustarts ausdrücklich nicht.', 'info') }}
<div class="card__sub">
{% for value, label in methods %}
<a class="btn btn--sm {{ 'btn--ghost' if method != value else '' }}"
href="{{ url_for('tesmlogs.restarts', methode=value) }}">{{ label }}</a>
href="{{ url_for('tesmlogs.restarts', method=value) }}">{{ label }}</a>
{% endfor %}
<a class="btn btn--sm {{ 'btn--ghost' if method else '' }}"
href="{{ url_for('tesmlogs.restarts') }}">Alle</a>
apps/tesm/src/tesm/templates/tesm/settings_system.html
+43 -41
View File
@@ -1,5 +1,5 @@
{% extends "tesm_core/base.html" %}
{% from "tesm_core/macros.html" import field, select_field, checkbox, alert, pill %}
{% from "tesm_core/macros.html" import field, select_field, checkbox, alert, pill, nav_order_card %}
{% block page_title %}Systemeinstellungen{% endblock %}
{% block page_sub %}Überwachung, Protokolle, Host, Navigation{% endblock %}
@@ -54,18 +54,23 @@
<section class="card">
<div class="card__header">
<div class="flex-1">
<div class="card__title">{{ icon('terminal', size=17) }} Switch-Konsole</div>
<div class="card__title">{{ icon('terminal', size=17) }} Terminal</div>
<div class="card__sub">
Auch bei aktiver Konsole gilt: eigenes Recht, frische Passwortbestätigung,
vollständige Mitschrift
vollständige Mitschrift. Abgeschaltet bleibt das Freigeben von
SSH-Host-Schlüsseln möglich – es wird für den PoE-Neustart gebraucht.
</div>
</div>
</div>
<form method="post" action="{{ url_for('settings.system_save') }}">
<input type="hidden" name="{{ csrf_field_name }}" value="{{ csrf_token() }}">
<div class="card__body stack">
{{ checkbox('terminal_enabled', 'Browser-Konsole für Switche zulassen',
checked=values.terminal_enabled) }}
{{ checkbox('terminal_switches_enabled', 'Browser-Konsole für Switche zulassen',
checked=values.terminal_switches_enabled,
hint_text=specs['terminal_switches_enabled'].hint) }}
{{ checkbox('terminal_clients_enabled', 'Browser-Konsole für Clients zulassen',
checked=values.terminal_clients_enabled,
hint_text=specs['terminal_clients_enabled'].hint) }}
{{ field('terminal_idle_timeout', 'Trennen bei Untätigkeit (Sekunden)',
value=values.terminal_idle_timeout, type='number') }}
</div>
@@ -73,6 +78,37 @@
</form>
</section>
{# Eigene Karte: die Abmeldung stand zwischen Protokollrotation und
Papierkorb -- drei Dinge ohne Zusammenhang. Wer die Sitzungsdauer sucht,
sucht sie nicht unter "Protokolle". #}
<section class="card">
<div class="card__header">
<div class="flex-1">
<div class="card__title">{{ icon('clock', size=17) }} Sitzungen</div>
<div class="card__sub">
Wie lange eine Anmeldung gilt. Beides bestimmt auch, wie lange eine
eingebundene Dateifreigabe bestehen bleibt -- sie endet mit der Sitzung.
</div>
</div>
</div>
<form method="post" action="{{ url_for('settings.system_save') }}">
<input type="hidden" name="{{ csrf_field_name }}" value="{{ csrf_token() }}">
<div class="card__body">
<div class="form-grid">
{{ field('session_idle_minutes', 'Automatische Abmeldung nach Leerlauf (Minuten)',
value=values.session_idle_minutes, type='number',
attrs='min="5" max="1440" step="1"',
hint_text=specs['session_idle_minutes'].hint) }}
{{ field('session_absolute_hours', 'Längstmögliche Sitzungsdauer (Stunden)',
value=values.session_absolute_hours, type='number',
attrs='min="1" max="168" step="1"',
hint_text=specs['session_absolute_hours'].hint) }}
</div>
</div>
<div class="card__footer"><button class="btn btn--primary" type="submit">Speichern</button></div>
</form>
</section>
<section class="card">
<div class="card__header">
<div class="flex-1">
@@ -87,9 +123,6 @@
specs['log_rotate_interval'].choices, selected=values.log_rotate_interval) }}
{{ field('log_rotate_keep', 'Aufbewahrte Rotationen', value=values.log_rotate_keep,
type='number') }}
{{ field('session_idle_minutes', 'Automatische Abmeldung (Minuten)',
value=values.session_idle_minutes, type='number',
hint_text=specs['session_idle_minutes'].hint) }}
{{ field('trash_retention_days', 'Papierkorb-Aufbewahrung (Tage)',
value=values.trash_retention_days, type='number',
hint_text=specs['trash_retention_days'].hint) }}
@@ -133,39 +166,8 @@
</section>
{% if current_user.is_admin %}
<section class="card">
<div class="card__header">
<div class="flex-1">
<div class="card__title">{{ icon('sliders', size=17) }} Navigationsreihenfolge</div>
<div class="card__sub">Gilt für alle Benutzer; jeder sieht weiter nur, was er darf</div>
</div>
</div>
<form method="post" action="{{ url_for('admin.nav_order') }}">
<input type="hidden" name="{{ csrf_field_name }}" value="{{ csrf_token() }}">
<div class="card__body">
<ol class="stack stack--tight">
{% for key in nav_order %}
{% set item = nav_items | selectattr('key', 'equalto', key) | list | first %}
{% if item %}
<li class="row row--tight">
<input class="input" type="number" name="position_{{ item.key }}" value="{{ loop.index }}"
min="1" style="width:70px" disabled>
<input type="hidden" name="order" value="{{ item.key }}">
<span class="flex-1">{{ icon(item.icon, size=15) }} {{ item.label }}</span>
</li>
{% endif %}
{% endfor %}
</ol>
<p class="fs-xs faint mt-3">
Die Reihenfolge folgt der Liste. Zum Umsortieren die Einträge in der gewünschten
Reihenfolge speichern (Drag-and-drop folgt in einer späteren Version).
</p>
</div>
<div class="card__footer">
<button class="btn btn--sm" type="submit">Reihenfolge speichern</button>
</div>
</form>
</section>
{{ nav_order_card(nav_items, nav_order, nav_child_order,
url_for('admin.nav_order'), csrf_field_name, csrf_token()) }}
{% endif %}
</div>
</div>