stackpilot/backend/routers/files.py

"""Full host filesystem browser: list, read, edit, manage, up/download.

Every operation requires admin. Reads are not less dangerous than writes here:
the browser reaches whatever the backend container can see, which includes
every stack's ``.env`` and ``.secrets/*``. Reading a file and downloading one
are audit-logged just like the mutating operations; directory listing is not,
because the Files page polls it and would drown the log.
All paths are sandboxed by :mod:`services.file_service`.
"""
from __future__ import annotations

import os
import stat
import tempfile
from urllib.parse import quote

from fastapi import (
    APIRouter,
    Depends,
    File,
    Form,
    HTTPException,
    Query,
    Request,
    UploadFile,
)
from fastapi.responses import FileResponse, StreamingResponse
from pydantic import BaseModel
from sqlmodel import Session

from auth import require_admin
from database import get_session
from models.user import User
from services import audit_service, device_service, file_service

router = APIRouter(prefix="/api/files", tags=["files"])


def _attachment(filename: str) -> str:
    """A safe ``Content-Disposition`` value for an arbitrary filename.

    Headers are latin-1; a folder called "Fotos – 2024" (en dash) raised
    UnicodeEncodeError and the download died with a 500. Non-ASCII names go
    out as RFC 5987 ``filename*``, with an ASCII fallback beside it.
    """
    safe = filename.replace("\\", "_").replace('"', "_")
    try:
        safe.encode("ascii")
        return f'attachment; filename="{safe}"'
    except UnicodeEncodeError:
        fallback = safe.encode("ascii", "replace").decode("ascii").replace("?", "_")
        return f"attachment; filename=\"{fallback}\"; filename*=UTF-8''{quote(filename)}"


def _ip(request: Request) -> str:
    return request.client.host if request.client else "unknown"


def _guard(fn, *args, **kwargs):
    try:
        return fn(*args, **kwargs)
    except file_service.BrowseError as exc:
        raise HTTPException(status_code=400, detail=str(exc)) from exc


# --------------------------------------------------------------------------- #
# Read-only
# --------------------------------------------------------------------------- #


@router.get("/list")
def list_dir(
    path: str = Query("/"),
    show_hidden: bool = Query(False),
    _admin: User = Depends(require_admin),
) -> dict:
    return _guard(device_service.browse, path, show_hidden)


@router.get("/read")
def read_file(
    request: Request,
    path: str = Query(...),
    session: Session = Depends(get_session),
    user: User = Depends(require_admin),
) -> dict:
    result = _guard(file_service.read_file, path)
    audit_service.record(
        session, user=user.username, action="file.read", target=path, ip=_ip(request)
    )
    return result


@router.get("/download")
def download(
    request: Request,
    path: str = Query(...),
    session: Session = Depends(get_session),
    user: User = Depends(require_admin),
):
    audit_service.record(
        session, user=user.username, action="file.download", target=path, ip=_ip(request)
    )
    if _guard(file_service.is_dir, path):
        filename, chunks = _guard(file_service.open_archive, path)
        # Stream the zip as it's built so the response starts immediately
        # (large folders no longer hit the proxy's read timeout).
        return StreamingResponse(
            chunks, media_type="application/zip",
            headers={"Content-Disposition": _attachment(filename)},
        )
    real, filename = _guard(file_service.resolve_download, path)
    return FileResponse(real, filename=filename, media_type="application/octet-stream")


# --------------------------------------------------------------------------- #
# Mutating (admin only)
# --------------------------------------------------------------------------- #


class WriteBody(BaseModel):
    path: str
    content: str


class NameBody(BaseModel):
    path: str
    name: str


class RenameBody(BaseModel):
    path: str
    new_name: str


class TransferBody(BaseModel):
    src: str
    dest_dir: str
    overwrite: bool = False


@router.put("/write")
def write_file(
    body: WriteBody,
    request: Request,
    session: Session = Depends(get_session),
    user: User = Depends(require_admin),
) -> dict:
    result = _guard(file_service.write_file, body.path, body.content)
    audit_service.record(
        session, user=user.username, action="file.write", target=body.path, ip=_ip(request)
    )
    return result


@router.post("/mkdir")
def mkdir(
    body: NameBody,
    request: Request,
    session: Session = Depends(get_session),
    user: User = Depends(require_admin),
) -> dict:
    result = _guard(file_service.create_dir, body.path, body.name)
    audit_service.record(
        session, user=user.username, action="file.mkdir", target=result["path"], ip=_ip(request)
    )
    return result


@router.post("/touch")
def touch(
    body: NameBody,
    request: Request,
    session: Session = Depends(get_session),
    user: User = Depends(require_admin),
) -> dict:
    result = _guard(file_service.create_file, body.path, body.name)
    audit_service.record(
        session, user=user.username, action="file.create", target=result["path"], ip=_ip(request)
    )
    return result


@router.post("/rename")
def rename(
    body: RenameBody,
    request: Request,
    session: Session = Depends(get_session),
    user: User = Depends(require_admin),
) -> dict:
    result = _guard(file_service.rename, body.path, body.new_name)
    audit_service.record(
        session, user=user.username, action="file.rename",
        target=body.path, detail=f"-> {result['path']}", ip=_ip(request),
    )
    return result


@router.post("/copy")
def copy(
    body: TransferBody,
    request: Request,
    session: Session = Depends(get_session),
    user: User = Depends(require_admin),
) -> dict:
    result = _guard(file_service.copy, body.src, body.dest_dir, body.overwrite)
    audit_service.record(
        session, user=user.username, action="file.copy",
        target=body.src, detail=f"-> {result['path']}", ip=_ip(request),
    )
    return result


@router.post("/move")
def move(
    body: TransferBody,
    request: Request,
    session: Session = Depends(get_session),
    user: User = Depends(require_admin),
) -> dict:
    result = _guard(file_service.move, body.src, body.dest_dir, body.overwrite)
    audit_service.record(
        session, user=user.username, action="file.move",
        target=body.src, detail=f"-> {result['path']}", ip=_ip(request),
    )
    return result


@router.delete("")
def delete(
    request: Request,
    path: str = Query(...),
    recursive: bool = Query(False),
    session: Session = Depends(get_session),
    user: User = Depends(require_admin),
) -> dict:
    result = _guard(file_service.delete, path, recursive)
    audit_service.record(
        session, user=user.username, action="file.delete", target=path,
        detail="recursive" if recursive else None, ip=_ip(request),
    )
    return result


def _settle_mode(tmp: str, target: str) -> None:
    """Give an upload the permissions a normal file there would have.

    A temp file is created 0600, and ``os.replace`` kept that — so a config
    uploaded into a stack folder was unreadable for any container not running
    as root. An overwritten file keeps its mode and owner; a new one gets the
    usual 0644 (minus umask).
    """
    try:
        st = os.stat(target)
        os.chmod(tmp, stat.S_IMODE(st.st_mode))
        try:
            os.chown(tmp, st.st_uid, st.st_gid)
        except OSError:
            pass
    except FileNotFoundError:
        umask = os.umask(0)
        os.umask(umask)
        os.chmod(tmp, 0o666 & ~umask)


@router.post("/upload")
async def upload(
    request: Request,
    path: str = Form(...),
    overwrite: bool = Form(False),
    rel_path: str = Form(""),
    file: UploadFile = File(...),
    session: Session = Depends(get_session),
    user: User = Depends(require_admin),
) -> dict:
    real = _guard(
        file_service.upload_target, path, file.filename or "", overwrite, rel_path or None
    )
    # Stream to a temp file first, then move into place atomically.
    tmp = tempfile.NamedTemporaryFile(delete=False, dir=os.path.dirname(real))
    try:
        while chunk := await file.read(1024 * 1024):
            tmp.write(chunk)
        tmp.close()
        _settle_mode(tmp.name, real)
        os.replace(tmp.name, real)
    except OSError as exc:
        if os.path.exists(tmp.name):
            os.unlink(tmp.name)
        raise HTTPException(status_code=400, detail=f"Upload failed: {exc}") from exc
    audit_service.record(
        session, user=user.username, action="file.upload",
        target=path, detail=rel_path or file.filename, ip=_ip(request),
    )
    return {"ok": True, "name": rel_path or file.filename}