EiSiMo
2609d3504a
- /actions/apply now no-ops (returns fresh partial) when a running application exists for this user+flat, or when a previous one succeeded. The list button was already visually disabled; this closes the direct-POST and double-click loopholes - Drop the one-line error message under flat entries in the list (bewerbung_detail still shows the full message + the forensic ZIP report) - Strip "min morgens" commute chip from the list; alert._flat_payload sends an empty connectivity dict so Maps.calculate_score is no longer called on every flat. Maps.calculate_score + Flat.connectivity stay in the codebase for easy re-enable (one-line swap in _flat_payload) - List entry shows "vor 23 min" instead of "entdeckt vor 23 min" - Bitwarden: rename profile email/immomio fields to opaque names (contact_addr, immomio_login, immomio_secret) + add data-bwignore across every settings form / input. Server-side update_profile maps the new field names back to the existing DB columns Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1053 lines
38 KiB
Python
1053 lines
38 KiB
Python
"""
|
||
lazyflat web app.
|
||
|
||
Four tabs:
|
||
- / → Wohnungen (all flats, per-user match highlighting, filter block, auto-apply switch)
|
||
- /bewerbungen → Bewerbungen (history + forensics; failed apps expose a ZIP report download)
|
||
- /logs → Logs (user-scoped audit log)
|
||
- /einstellungen/<section> → Einstellungen: profile, filter, notifications, account, admin users
|
||
|
||
All state-changing POSTs require CSRF. Internal endpoints require INTERNAL_API_KEY.
|
||
"""
|
||
import asyncio
|
||
import base64
|
||
import hmac
|
||
import io
|
||
import json
|
||
import logging
|
||
import sqlite3
|
||
import zipfile
|
||
from contextlib import asynccontextmanager
|
||
from datetime import datetime, timedelta, timezone
|
||
from typing import Any
|
||
|
||
from fastapi import Depends, FastAPI, Form, Header, HTTPException, Request, Response, status
|
||
from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse, StreamingResponse
|
||
from fastapi.staticfiles import StaticFiles
|
||
from fastapi.templating import Jinja2Templates
|
||
|
||
try:
|
||
from zoneinfo import ZoneInfo
|
||
BERLIN_TZ = ZoneInfo("Europe/Berlin")
|
||
except Exception:
|
||
BERLIN_TZ = timezone.utc
|
||
|
||
import db
|
||
import notifications
|
||
import retention
|
||
from apply_client import ApplyClient, _row_to_profile
|
||
from auth import (
|
||
bootstrap_admin,
|
||
clear_session_cookie,
|
||
current_user,
|
||
hash_password,
|
||
issue_csrf_token,
|
||
issue_session_cookie,
|
||
rate_limit_login,
|
||
require_admin,
|
||
require_csrf,
|
||
require_user,
|
||
verify_login,
|
||
)
|
||
from matching import flat_matches_filter, row_to_dict
|
||
from settings import (
|
||
ALERT_SCRAPE_INTERVAL_SECONDS,
|
||
APPLY_FAILURE_THRESHOLD,
|
||
INTERNAL_API_KEY,
|
||
PUBLIC_URL,
|
||
)
|
||
|
||
|
||
logging.basicConfig(
|
||
level=logging.INFO,
|
||
format="%(asctime)s %(levelname)-5s %(name)s: %(message)s",
|
||
datefmt="%H:%M:%S",
|
||
)
|
||
logging.getLogger("urllib3").setLevel(logging.WARNING)
|
||
logger = logging.getLogger("web")
|
||
|
||
apply_client = ApplyClient()
|
||
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# App + Jinja
|
||
# ---------------------------------------------------------------------------
|
||
|
||
@asynccontextmanager
|
||
async def lifespan(_app: FastAPI):
|
||
db.init_db()
|
||
bootstrap_admin()
|
||
retention.start()
|
||
logger.info("web service ready")
|
||
yield
|
||
|
||
|
||
app = FastAPI(lifespan=lifespan, title="lazyflat", docs_url=None, redoc_url=None, openapi_url=None)
|
||
app.mount("/static", StaticFiles(directory="static"), name="static")
|
||
templates = Jinja2Templates(directory="templates")
|
||
|
||
|
||
def _parse_iso(s: str | None) -> datetime | None:
|
||
if not s:
|
||
return None
|
||
try:
|
||
# Python handles +00:00 but not trailing Z. Storage always uses +00:00.
|
||
return datetime.fromisoformat(s)
|
||
except ValueError:
|
||
return None
|
||
|
||
|
||
def _de_dt(s: str | None) -> str:
|
||
"""UTC ISO → 'DD.MM.YYYY HH:MM' in Europe/Berlin."""
|
||
dt = _parse_iso(s)
|
||
if dt is None:
|
||
return ""
|
||
if dt.tzinfo is None:
|
||
dt = dt.replace(tzinfo=timezone.utc)
|
||
return dt.astimezone(BERLIN_TZ).strftime("%d.%m.%Y %H:%M")
|
||
|
||
|
||
def _iso_utc(s: str | None) -> str:
|
||
"""Pass-through of a UTC ISO string (for data-attr in JS)."""
|
||
dt = _parse_iso(s)
|
||
if dt is None:
|
||
return ""
|
||
if dt.tzinfo is None:
|
||
dt = dt.replace(tzinfo=timezone.utc)
|
||
return dt.astimezone(timezone.utc).isoformat(timespec="seconds")
|
||
|
||
|
||
templates.env.filters["de_dt"] = _de_dt
|
||
templates.env.filters["iso_utc"] = _iso_utc
|
||
|
||
|
||
@app.middleware("http")
|
||
async def security_headers(request: Request, call_next):
|
||
resp: Response = await call_next(request)
|
||
resp.headers.setdefault("X-Frame-Options", "DENY")
|
||
resp.headers.setdefault("X-Content-Type-Options", "nosniff")
|
||
resp.headers.setdefault("Referrer-Policy", "strict-origin-when-cross-origin")
|
||
resp.headers.setdefault("Permissions-Policy", "geolocation=(), camera=(), microphone=()")
|
||
resp.headers.setdefault(
|
||
"Content-Security-Policy",
|
||
"default-src 'self'; "
|
||
"script-src 'self' https://cdn.tailwindcss.com https://unpkg.com; "
|
||
"style-src 'self' https://cdn.tailwindcss.com https://unpkg.com 'unsafe-inline'; "
|
||
"img-src 'self' data: "
|
||
"https://*.basemaps.cartocdn.com https://basemaps.cartocdn.com "
|
||
"https://unpkg.com; "
|
||
"connect-src 'self'; frame-ancestors 'none';"
|
||
)
|
||
return resp
|
||
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Helpers
|
||
# ---------------------------------------------------------------------------
|
||
|
||
def client_ip(request: Request) -> str:
|
||
xff = request.headers.get("x-forwarded-for")
|
||
if xff:
|
||
return xff.split(",")[0].strip()
|
||
return request.client.host if request.client else "unknown"
|
||
|
||
|
||
def require_internal(x_internal_api_key: str | None = Header(default=None)) -> None:
|
||
if not x_internal_api_key or not hmac.compare_digest(x_internal_api_key, INTERNAL_API_KEY):
|
||
raise HTTPException(status_code=401, detail="invalid internal key")
|
||
|
||
|
||
def base_context(request: Request, user, active_tab: str) -> dict:
|
||
return {
|
||
"request": request,
|
||
"user": user,
|
||
"csrf": issue_csrf_token(user["id"]),
|
||
"active_tab": active_tab,
|
||
"is_admin": bool(user["is_admin"]),
|
||
}
|
||
|
||
|
||
def _is_htmx(request: Request) -> bool:
|
||
return request.headers.get("hx-request", "").lower() == "true"
|
||
|
||
|
||
def _wohnungen_partial_or_redirect(request: Request, user):
|
||
"""If called via HTMX, render the body partial; otherwise redirect to /."""
|
||
if _is_htmx(request):
|
||
ctx = base_context(request, user, "wohnungen")
|
||
ctx.update(_wohnungen_context(user))
|
||
return templates.TemplateResponse("_wohnungen_body.html", ctx)
|
||
return RedirectResponse("/", status_code=303)
|
||
|
||
|
||
def _manual_apply_allowed() -> tuple[bool, str]:
|
||
"""Manual 'Bewerben' button is only blocked if the apply service is down."""
|
||
if not apply_client.health():
|
||
return False, "apply-service nicht erreichbar"
|
||
return True, ""
|
||
|
||
|
||
def _auto_apply_allowed(prefs) -> bool:
|
||
"""Auto-apply trigger gate: user must have enabled it and the circuit must be closed."""
|
||
if not prefs["auto_apply_enabled"]:
|
||
return False
|
||
if prefs["apply_circuit_open"]:
|
||
return False
|
||
return apply_client.health()
|
||
|
||
|
||
def _next_scrape_utc() -> str:
|
||
hb = db.get_state("last_alert_heartbeat")
|
||
dt = _parse_iso(hb)
|
||
if dt is None:
|
||
return ""
|
||
if dt.tzinfo is None:
|
||
dt = dt.replace(tzinfo=timezone.utc)
|
||
return (dt + timedelta(seconds=ALERT_SCRAPE_INTERVAL_SECONDS)).astimezone(timezone.utc).isoformat(timespec="seconds")
|
||
|
||
|
||
FILTER_KEYS = ("rooms_min", "rooms_max", "max_rent", "min_size", "max_morning_commute", "wbs_required")
|
||
|
||
|
||
def _has_filters(f) -> bool:
|
||
if not f:
|
||
return False
|
||
for k in FILTER_KEYS:
|
||
v = f[k] if hasattr(f, "keys") else None
|
||
if v not in (None, "", 0, 0.0):
|
||
return True
|
||
return False
|
||
|
||
|
||
def _alert_status(notifications_row) -> tuple[str, str]:
|
||
"""Return (label, chip_kind) for the user's alarm (notification) setup.
|
||
|
||
'aktiv' only if a real push channel is configured with credentials.
|
||
'ui' is not a real alarm — the dashboard already shows matches when you
|
||
happen to be looking.
|
||
"""
|
||
if not notifications_row:
|
||
return "nicht eingerichtet", "warn"
|
||
ch = (notifications_row["channel"] or "ui").strip()
|
||
if ch == "telegram":
|
||
if notifications_row["telegram_bot_token"] and notifications_row["telegram_chat_id"]:
|
||
return "aktiv (Telegram)", "ok"
|
||
return "unvollständig", "warn"
|
||
return "nicht eingerichtet", "warn"
|
||
|
||
|
||
def _filter_summary(f) -> str:
|
||
if not _has_filters(f):
|
||
return "—"
|
||
parts = []
|
||
rmin, rmax = f["rooms_min"], f["rooms_max"]
|
||
if rmin or rmax:
|
||
def fmt(x):
|
||
return "–" if x is None else ("%g" % x)
|
||
parts.append(f"{fmt(rmin)}–{fmt(rmax)} Zi")
|
||
if f["max_rent"]:
|
||
parts.append(f"≤ {int(f['max_rent'])} €")
|
||
if f["min_size"]:
|
||
parts.append(f"≥ {int(f['min_size'])} m²")
|
||
if f["max_morning_commute"]:
|
||
parts.append(f"≤ {int(f['max_morning_commute'])} min")
|
||
if f["wbs_required"] == "yes":
|
||
parts.append("WBS")
|
||
elif f["wbs_required"] == "no":
|
||
parts.append("ohne WBS")
|
||
return " · ".join(parts)
|
||
|
||
|
||
def _has_running_application(user_id: int) -> bool:
|
||
row = db._conn.execute(
|
||
"SELECT 1 FROM applications WHERE user_id = ? AND finished_at IS NULL LIMIT 1",
|
||
(user_id,),
|
||
).fetchone()
|
||
return row is not None
|
||
|
||
|
||
def _run_apply_background(user_id: int, flat_id: str, url: str, triggered_by: str) -> None:
|
||
prefs = db.get_preferences(user_id)
|
||
profile_row = db.get_profile(user_id)
|
||
profile = _row_to_profile(profile_row)
|
||
submit_forms = bool(prefs["submit_forms"])
|
||
|
||
app_id = db.start_application(
|
||
user_id=user_id, flat_id=flat_id, url=url,
|
||
triggered_by=triggered_by, submit_forms=submit_forms,
|
||
profile_snapshot=profile,
|
||
)
|
||
|
||
logger.info("apply.start user=%s flat=%s application=%s submit=%s",
|
||
user_id, flat_id, app_id, submit_forms)
|
||
|
||
result = apply_client.apply(url=url, profile=profile,
|
||
submit_forms=submit_forms, application_id=app_id)
|
||
success = bool(result.get("success"))
|
||
message = result.get("message", "")
|
||
provider = result.get("provider", "")
|
||
forensics = result.get("forensics") or {}
|
||
|
||
db.finish_application(app_id, success=success, message=message,
|
||
provider=provider, forensics=forensics)
|
||
|
||
if success:
|
||
db.update_preferences(user_id, {"apply_recent_failures": 0})
|
||
else:
|
||
failures = int(prefs["apply_recent_failures"] or 0) + 1
|
||
updates = {"apply_recent_failures": failures}
|
||
if failures >= APPLY_FAILURE_THRESHOLD:
|
||
updates["apply_circuit_open"] = 1
|
||
db.log_error(source="apply", kind="circuit_open", user_id=user_id,
|
||
summary=f"{failures} aufeinanderfolgende Fehler",
|
||
application_id=app_id)
|
||
db.update_preferences(user_id, updates)
|
||
db.log_error(source="apply", kind="apply_failure", user_id=user_id,
|
||
summary=message or "Bewerbung fehlgeschlagen",
|
||
application_id=app_id,
|
||
context={"provider": provider, "url": url})
|
||
|
||
flat = db.get_flat(flat_id)
|
||
flat_dict = {"address": flat["address"] if flat else "", "link": url,
|
||
"rooms": flat["rooms"] if flat else None,
|
||
"total_rent": flat["total_rent"] if flat else None}
|
||
if success:
|
||
notifications.on_apply_ok(user_id, flat_dict, message)
|
||
else:
|
||
notifications.on_apply_fail(user_id, flat_dict, message)
|
||
|
||
db.log_audit("system", "apply_finished", f"app={app_id} success={success}", user_id=user_id)
|
||
|
||
|
||
def _kick_apply(user_id: int, flat_id: str, url: str, triggered_by: str) -> None:
|
||
asyncio.create_task(asyncio.to_thread(
|
||
_run_apply_background, user_id, flat_id, url, triggered_by,
|
||
))
|
||
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Public routes
|
||
# ---------------------------------------------------------------------------
|
||
|
||
@app.get("/health")
|
||
def health():
|
||
return {"status": "ok"}
|
||
|
||
|
||
@app.get("/login", response_class=HTMLResponse)
|
||
def login_form(request: Request, error: str | None = None):
|
||
if current_user(request):
|
||
return RedirectResponse("/", status_code=303)
|
||
return templates.TemplateResponse("login.html", {"request": request, "error": error})
|
||
|
||
|
||
@app.post("/login")
|
||
def login_submit(request: Request, username: str = Form(...), password: str = Form(...)):
|
||
ip = client_ip(request)
|
||
if not rate_limit_login(ip):
|
||
db.log_audit(username or "?", "login_rate_limited", ip=ip)
|
||
db.log_error(source="web", kind="rate_limit", summary=f"login throttled for {ip}",
|
||
context={"username": username or ""})
|
||
return templates.TemplateResponse(
|
||
"login.html",
|
||
{"request": request, "error": "Zu viele Versuche. Bitte später erneut."},
|
||
status_code=status.HTTP_429_TOO_MANY_REQUESTS,
|
||
)
|
||
user = verify_login(username, password)
|
||
if not user:
|
||
db.log_audit(username or "?", "login_failed", ip=ip)
|
||
return templates.TemplateResponse(
|
||
"login.html",
|
||
{"request": request, "error": "Login fehlgeschlagen."},
|
||
status_code=status.HTTP_401_UNAUTHORIZED,
|
||
)
|
||
response = RedirectResponse("/", status_code=303)
|
||
issue_session_cookie(response, user["id"])
|
||
db.log_audit(user["username"], "login_success", user_id=user["id"], ip=ip)
|
||
return response
|
||
|
||
|
||
@app.post("/logout")
|
||
def logout(request: Request):
|
||
u = current_user(request)
|
||
response = RedirectResponse("/login", status_code=303)
|
||
clear_session_cookie(response)
|
||
if u:
|
||
db.log_audit(u["username"], "logout", user_id=u["id"], ip=client_ip(request))
|
||
return response
|
||
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Tab: Wohnungen
|
||
# ---------------------------------------------------------------------------
|
||
|
||
def _wohnungen_context(user) -> dict:
|
||
uid = user["id"]
|
||
filters_row = db.get_filters(uid)
|
||
notif_row = db.get_notifications(uid)
|
||
prefs = db.get_preferences(uid)
|
||
filters = row_to_dict(filters_row)
|
||
flats = db.recent_flats(100)
|
||
|
||
rejected = db.rejected_flat_ids(uid)
|
||
flats_view = []
|
||
for f in flats:
|
||
if f["id"] in rejected:
|
||
continue
|
||
if not flat_matches_filter({
|
||
"rooms": f["rooms"], "total_rent": f["total_rent"], "size": f["size"],
|
||
"wbs": f["wbs"], "connectivity": {"morning_time": f["connectivity_morning_time"]},
|
||
}, filters):
|
||
continue
|
||
last = db.last_application_for_flat(uid, f["id"])
|
||
flats_view.append({"row": f, "last": last})
|
||
|
||
rejected_view = db.rejected_flats(uid)
|
||
|
||
allowed, reason = _manual_apply_allowed()
|
||
alert_label, alert_chip = _alert_status(notif_row)
|
||
has_running = _has_running_application(uid)
|
||
map_points = []
|
||
for item in flats_view:
|
||
f = item["row"]
|
||
if f["lat"] is None or f["lng"] is None:
|
||
continue
|
||
last = item["last"]
|
||
is_running = bool(last and last["finished_at"] is None)
|
||
already_applied = bool(last and last["success"] == 1)
|
||
if is_running:
|
||
status = {"label": "läuft…", "chip": "warn"}
|
||
elif already_applied:
|
||
status = {"label": "beworben", "chip": "ok"}
|
||
elif last and last["success"] == 0:
|
||
status = {"label": "fehlgeschlagen", "chip": "bad"}
|
||
else:
|
||
status = None
|
||
map_points.append({
|
||
"id": f["id"],
|
||
"lat": f["lat"], "lng": f["lng"],
|
||
"address": f["address"] or f["link"],
|
||
"link": f["link"],
|
||
"rent": f["total_rent"],
|
||
"rooms": f["rooms"],
|
||
"size": f["size"],
|
||
"status": status,
|
||
"can_apply": allowed and not already_applied,
|
||
"is_running": is_running,
|
||
})
|
||
return {
|
||
"flats": flats_view,
|
||
"rejected_flats": rejected_view,
|
||
"map_points": map_points,
|
||
"has_filters": _has_filters(filters_row),
|
||
"alert_label": alert_label,
|
||
"alert_chip": alert_chip,
|
||
"filter_summary": _filter_summary(filters_row),
|
||
"auto_apply_enabled": bool(prefs["auto_apply_enabled"]),
|
||
"submit_forms": bool(prefs["submit_forms"]),
|
||
"circuit_open": bool(prefs["apply_circuit_open"]),
|
||
"apply_failures": int(prefs["apply_recent_failures"] or 0),
|
||
"apply_allowed": allowed,
|
||
"apply_block_reason": reason,
|
||
"apply_reachable": apply_client.health(),
|
||
"next_scrape_utc": _next_scrape_utc(),
|
||
"has_running_apply": has_running,
|
||
"poll_interval": 3 if has_running else 30,
|
||
}
|
||
|
||
|
||
@app.get("/", response_class=HTMLResponse)
|
||
def tab_wohnungen(request: Request):
|
||
u = current_user(request)
|
||
if not u:
|
||
return RedirectResponse("/login", status_code=303)
|
||
ctx = base_context(request, u, "wohnungen")
|
||
ctx.update(_wohnungen_context(u))
|
||
return templates.TemplateResponse("wohnungen.html", ctx)
|
||
|
||
|
||
@app.get("/partials/wohnungen", response_class=HTMLResponse)
|
||
def partial_wohnungen(request: Request, user=Depends(require_user)):
|
||
ctx = base_context(request, user, "wohnungen")
|
||
ctx.update(_wohnungen_context(user))
|
||
return templates.TemplateResponse("_wohnungen_body.html", ctx)
|
||
|
||
|
||
@app.post("/actions/filters")
|
||
async def action_save_filters(
|
||
request: Request,
|
||
csrf: str = Form(...),
|
||
rooms_min: str = Form(""),
|
||
rooms_max: str = Form(""),
|
||
max_rent: str = Form(""),
|
||
min_size: str = Form(""),
|
||
max_morning_commute: str = Form(""),
|
||
wbs_required: str = Form(""),
|
||
user=Depends(require_user),
|
||
):
|
||
require_csrf(user["id"], csrf)
|
||
|
||
def _f(v):
|
||
v = (v or "").strip().replace(",", ".")
|
||
return float(v) if v else None
|
||
|
||
db.update_filters(user["id"], {
|
||
"rooms_min": _f(rooms_min),
|
||
"rooms_max": _f(rooms_max),
|
||
"max_rent": _f(max_rent),
|
||
"min_size": _f(min_size),
|
||
"max_morning_commute": _f(max_morning_commute),
|
||
"wbs_required": (wbs_required or "").strip(),
|
||
})
|
||
db.log_audit(user["username"], "filters.updated", user_id=user["id"], ip=client_ip(request))
|
||
return RedirectResponse("/", status_code=303)
|
||
|
||
|
||
@app.post("/actions/auto-apply")
|
||
async def action_auto_apply(
|
||
request: Request,
|
||
value: str = Form(default="off"),
|
||
csrf: str = Form(...),
|
||
user=Depends(require_user),
|
||
):
|
||
require_csrf(user["id"], csrf)
|
||
new = 1 if value == "on" else 0
|
||
db.update_preferences(user["id"], {"auto_apply_enabled": new})
|
||
db.log_audit(user["username"], "auto_apply", "on" if new else "off",
|
||
user_id=user["id"], ip=client_ip(request))
|
||
return _wohnungen_partial_or_redirect(request, user)
|
||
|
||
|
||
@app.post("/actions/reset-circuit")
|
||
async def action_reset_circuit(
|
||
request: Request,
|
||
csrf: str = Form(...),
|
||
user=Depends(require_user),
|
||
):
|
||
require_csrf(user["id"], csrf)
|
||
db.update_preferences(user["id"], {"apply_circuit_open": 0, "apply_recent_failures": 0})
|
||
db.log_audit(user["username"], "reset_circuit", user_id=user["id"], ip=client_ip(request))
|
||
return _wohnungen_partial_or_redirect(request, user)
|
||
|
||
|
||
@app.post("/actions/apply")
|
||
async def action_apply(
|
||
request: Request,
|
||
flat_id: str = Form(...),
|
||
csrf: str = Form(...),
|
||
user=Depends(require_user),
|
||
):
|
||
require_csrf(user["id"], csrf)
|
||
allowed, reason = _manual_apply_allowed()
|
||
if not allowed:
|
||
raise HTTPException(409, f"apply disabled: {reason}")
|
||
flat = db.get_flat(flat_id)
|
||
if not flat:
|
||
raise HTTPException(404, "flat not found")
|
||
last = db.last_application_for_flat(user["id"], flat_id)
|
||
if last and last["finished_at"] is None:
|
||
# Another apply is already running for this user+flat; don't queue a second.
|
||
return _wohnungen_partial_or_redirect(request, user)
|
||
if last and last["success"] == 1:
|
||
# Already successfully applied — no point in re-running.
|
||
return _wohnungen_partial_or_redirect(request, user)
|
||
db.log_audit(user["username"], "trigger_apply", f"flat_id={flat_id}",
|
||
user_id=user["id"], ip=client_ip(request))
|
||
_kick_apply(user["id"], flat_id, flat["link"], "user")
|
||
return _wohnungen_partial_or_redirect(request, user)
|
||
|
||
|
||
@app.post("/actions/reject")
|
||
async def action_reject(
|
||
request: Request,
|
||
flat_id: str = Form(...),
|
||
csrf: str = Form(...),
|
||
user=Depends(require_user),
|
||
):
|
||
require_csrf(user["id"], csrf)
|
||
db.reject_flat(user["id"], flat_id)
|
||
db.log_audit(user["username"], "flat.rejected", f"flat_id={flat_id}",
|
||
user_id=user["id"], ip=client_ip(request))
|
||
return _wohnungen_partial_or_redirect(request, user)
|
||
|
||
|
||
@app.post("/actions/unreject")
|
||
async def action_unreject(
|
||
request: Request,
|
||
flat_id: str = Form(...),
|
||
csrf: str = Form(...),
|
||
user=Depends(require_user),
|
||
):
|
||
require_csrf(user["id"], csrf)
|
||
db.unreject_flat(user["id"], flat_id)
|
||
db.log_audit(user["username"], "flat.unrejected", f"flat_id={flat_id}",
|
||
user_id=user["id"], ip=client_ip(request))
|
||
return _wohnungen_partial_or_redirect(request, user)
|
||
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Tab: Bewerbungen
|
||
# ---------------------------------------------------------------------------
|
||
|
||
@app.get("/bewerbungen", response_class=HTMLResponse)
|
||
def tab_bewerbungen(request: Request):
|
||
u = current_user(request)
|
||
if not u:
|
||
return RedirectResponse("/login", status_code=303)
|
||
ctx = base_context(request, u, "bewerbungen")
|
||
ctx["applications"] = db.recent_applications(u["id"], limit=100)
|
||
return templates.TemplateResponse("bewerbungen.html", ctx)
|
||
|
||
|
||
@app.get("/bewerbungen/{app_id}", response_class=HTMLResponse)
|
||
def bewerbung_detail(request: Request, app_id: int):
|
||
u = current_user(request)
|
||
if not u:
|
||
return RedirectResponse("/login", status_code=303)
|
||
a = db.get_application(app_id)
|
||
if not a or (a["user_id"] != u["id"] and not u["is_admin"]):
|
||
raise HTTPException(404, "not found")
|
||
forensics = json.loads(a["forensics_json"]) if a["forensics_json"] else None
|
||
profile = json.loads(a["profile_snapshot_json"]) if a["profile_snapshot_json"] else {}
|
||
ctx = base_context(request, u, "bewerbungen")
|
||
ctx.update({"application": a, "forensics": forensics, "profile_snapshot": profile})
|
||
return templates.TemplateResponse("bewerbung_detail.html", ctx)
|
||
|
||
|
||
@app.get("/bewerbungen/{app_id}/report.zip")
|
||
def bewerbung_zip(request: Request, app_id: int):
|
||
u = current_user(request)
|
||
if not u:
|
||
raise HTTPException(401)
|
||
a = db.get_application(app_id)
|
||
if not a or (a["user_id"] != u["id"] and not u["is_admin"]):
|
||
raise HTTPException(404)
|
||
|
||
flat = db.get_flat(a["flat_id"])
|
||
forensics = json.loads(a["forensics_json"]) if a["forensics_json"] else {}
|
||
profile = json.loads(a["profile_snapshot_json"]) if a["profile_snapshot_json"] else {}
|
||
app_meta = {k: a[k] for k in a.keys() if k not in ("forensics_json", "profile_snapshot_json")}
|
||
|
||
buf = io.BytesIO()
|
||
with zipfile.ZipFile(buf, "w", compression=zipfile.ZIP_DEFLATED) as zf:
|
||
zf.writestr(
|
||
"README.txt",
|
||
f"lazyflat application report\n"
|
||
f"application_id={a['id']}\n"
|
||
f"flat_id={a['flat_id']}\n"
|
||
f"provider={a['provider']}\n"
|
||
f"success={a['success']}\n"
|
||
f"started_at_utc={a['started_at']}\n"
|
||
f"finished_at_utc={a['finished_at']}\n"
|
||
f"submit_forms_used={bool(a['submit_forms_used'])}\n"
|
||
f"\n"
|
||
f"Contents:\n"
|
||
f" application.json DB row + metadata\n"
|
||
f" flat.json Flat details at discovery time\n"
|
||
f" profile_snapshot.json Profile used for this attempt\n"
|
||
f" forensics.json Full captured forensics\n"
|
||
f" step_log.txt Human-readable step log\n"
|
||
f" page.html Final page HTML (if captured)\n"
|
||
f" console.json Browser console entries\n"
|
||
f" errors.json Browser pageerror events\n"
|
||
f" network.json Network requests + partial responses\n"
|
||
f" snapshots/NN_*.jpg Screenshot at each step (NN = order)\n"
|
||
f" snapshots/NN_*.html Page HTML at each step\n"
|
||
)
|
||
zf.writestr("application.json", json.dumps(app_meta, indent=2, default=str))
|
||
zf.writestr("flat.json", json.dumps(dict(flat) if flat else {}, indent=2, default=str))
|
||
zf.writestr("profile_snapshot.json", json.dumps(profile, indent=2, default=str))
|
||
zf.writestr("forensics.json", json.dumps(forensics, indent=2, default=str))
|
||
|
||
step_lines = []
|
||
for s in forensics.get("steps", []):
|
||
step_lines.append(f"[{s.get('ts', 0):7.2f}s] {s.get('step', '?'):<24} {s.get('status', ''):<5} {s.get('detail', '')}")
|
||
zf.writestr("step_log.txt", "\n".join(step_lines))
|
||
|
||
if forensics.get("final_html"):
|
||
zf.writestr("page.html", forensics["final_html"])
|
||
zf.writestr("console.json", json.dumps(forensics.get("console", []), indent=2))
|
||
zf.writestr("errors.json", json.dumps(forensics.get("errors", []), indent=2))
|
||
zf.writestr("network.json", json.dumps(forensics.get("network", []), indent=2))
|
||
|
||
for idx, s in enumerate(forensics.get("screenshots", []), start=1):
|
||
label = (s.get("label") or f"step{idx}").replace("/", "_").replace(" ", "_")
|
||
b64 = s.get("b64_jpeg", "")
|
||
if b64:
|
||
try:
|
||
data = base64.b64decode(b64)
|
||
zf.writestr(f"snapshots/{idx:02d}_{label}.jpg", data)
|
||
except Exception:
|
||
pass
|
||
html = s.get("html") or ""
|
||
if html:
|
||
zf.writestr(f"snapshots/{idx:02d}_{label}.html", html)
|
||
|
||
buf.seek(0)
|
||
filename = f"lazyflat-report-{a['id']}.zip"
|
||
return StreamingResponse(
|
||
buf, media_type="application/zip",
|
||
headers={"Content-Disposition": f'attachment; filename="{filename}"'},
|
||
)
|
||
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Tab: Logs
|
||
# ---------------------------------------------------------------------------
|
||
|
||
def _parse_date_range(from_str: str | None, to_str: str | None) -> tuple[str | None, str | None]:
|
||
"""Parse 'YYYY-MM-DD' local-Berlin date inputs into UTC ISO bounds.
|
||
Bounds are inclusive start-of-day and start-of-next-day."""
|
||
def _to_utc_iso(s: str, end_of_day: bool) -> str | None:
|
||
try:
|
||
d = datetime.strptime(s, "%Y-%m-%d").replace(tzinfo=BERLIN_TZ)
|
||
except ValueError:
|
||
return None
|
||
if end_of_day:
|
||
d = d + timedelta(days=1)
|
||
return d.astimezone(timezone.utc).isoformat(timespec="seconds")
|
||
|
||
start = _to_utc_iso(from_str, False) if from_str else None
|
||
end = _to_utc_iso(to_str, True) if to_str else None
|
||
return start, end
|
||
|
||
|
||
def _collect_events(start_iso: str | None, end_iso: str | None) -> list[dict]:
|
||
users = {row["id"]: row["username"] for row in db.list_users()}
|
||
events: list[dict] = []
|
||
for a in db.recent_audit(None, limit=5000):
|
||
if start_iso and a["timestamp"] < start_iso: continue
|
||
if end_iso and a["timestamp"] >= end_iso: continue
|
||
events.append({
|
||
"kind": "audit", "ts": a["timestamp"], "source": "web",
|
||
"actor": a["actor"], "action": a["action"],
|
||
"details": a["details"] or "",
|
||
"user": users.get(a["user_id"], ""),
|
||
"ip": a["ip"] or "",
|
||
})
|
||
for e in db.recent_errors(None, limit=5000):
|
||
if start_iso and e["timestamp"] < start_iso: continue
|
||
if end_iso and e["timestamp"] >= end_iso: continue
|
||
events.append({
|
||
"kind": "error", "ts": e["timestamp"], "source": e["source"],
|
||
"actor": e["source"], "action": e["kind"],
|
||
"details": e["summary"] or "",
|
||
"user": users.get(e["user_id"], "") if e["user_id"] else "",
|
||
"ip": "",
|
||
})
|
||
events.sort(key=lambda x: x["ts"], reverse=True)
|
||
return events
|
||
|
||
|
||
@app.get("/logs", response_class=HTMLResponse)
|
||
def tab_logs(request: Request):
|
||
u = current_user(request)
|
||
if not u:
|
||
return RedirectResponse("/login", status_code=303)
|
||
if not u["is_admin"]:
|
||
raise HTTPException(403, "admin only")
|
||
|
||
q = request.query_params
|
||
from_str = q.get("from") or ""
|
||
to_str = q.get("to") or ""
|
||
start_iso, end_iso = _parse_date_range(from_str or None, to_str or None)
|
||
events = _collect_events(start_iso, end_iso)[:500]
|
||
|
||
ctx = base_context(request, u, "logs")
|
||
ctx.update({"events": events, "from_str": from_str, "to_str": to_str})
|
||
return templates.TemplateResponse("logs.html", ctx)
|
||
|
||
|
||
@app.get("/logs/export.csv")
|
||
def tab_logs_export(request: Request):
|
||
u = current_user(request)
|
||
if not u:
|
||
raise HTTPException(401)
|
||
if not u["is_admin"]:
|
||
raise HTTPException(403)
|
||
|
||
import csv as _csv
|
||
q = request.query_params
|
||
start_iso, end_iso = _parse_date_range(q.get("from") or None, q.get("to") or None)
|
||
events = _collect_events(start_iso, end_iso)
|
||
|
||
buf = io.StringIO()
|
||
w = _csv.writer(buf, delimiter=",", quoting=_csv.QUOTE_MINIMAL)
|
||
w.writerow(["timestamp_utc", "timestamp_berlin", "kind", "source", "actor", "action", "user", "details", "ip"])
|
||
for e in events:
|
||
w.writerow([
|
||
e["ts"],
|
||
_de_dt(e["ts"]),
|
||
e["kind"],
|
||
e["source"],
|
||
e["actor"],
|
||
e["action"],
|
||
e["user"],
|
||
e["details"],
|
||
e["ip"],
|
||
])
|
||
body = buf.getvalue().encode("utf-8")
|
||
filename = "lazyflat-protokoll"
|
||
if q.get("from"): filename += f"-{q['from']}"
|
||
if q.get("to"): filename += f"-bis-{q['to']}"
|
||
filename += ".csv"
|
||
return Response(
|
||
content=body, media_type="text/csv; charset=utf-8",
|
||
headers={"Content-Disposition": f'attachment; filename="{filename}"'},
|
||
)
|
||
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Tab: Einstellungen (sub-tabs)
|
||
# ---------------------------------------------------------------------------
|
||
|
||
VALID_SECTIONS = ("profil", "filter", "benachrichtigungen", "account", "benutzer")
|
||
|
||
|
||
@app.get("/einstellungen", response_class=HTMLResponse)
|
||
def tab_settings_root(request: Request):
|
||
return RedirectResponse("/einstellungen/profil", status_code=303)
|
||
|
||
|
||
@app.get("/einstellungen/{section}", response_class=HTMLResponse)
|
||
def tab_settings(request: Request, section: str):
|
||
u = current_user(request)
|
||
if not u:
|
||
return RedirectResponse("/login", status_code=303)
|
||
if section not in VALID_SECTIONS:
|
||
raise HTTPException(404)
|
||
if section == "benutzer" and not u["is_admin"]:
|
||
raise HTTPException(403)
|
||
|
||
ctx = base_context(request, u, "einstellungen")
|
||
ctx["section"] = section
|
||
|
||
if section == "profil":
|
||
ctx["profile"] = db.get_profile(u["id"])
|
||
elif section == "filter":
|
||
ctx["filters"] = row_to_dict(db.get_filters(u["id"]))
|
||
elif section == "benachrichtigungen":
|
||
ctx["notifications"] = db.get_notifications(u["id"])
|
||
elif section == "account":
|
||
pass
|
||
elif section == "benutzer":
|
||
ctx["users"] = db.list_users()
|
||
return templates.TemplateResponse("einstellungen.html", ctx)
|
||
|
||
|
||
@app.post("/actions/profile")
|
||
async def action_profile(request: Request, user=Depends(require_user)):
|
||
form = await request.form()
|
||
require_csrf(user["id"], form.get("csrf", ""))
|
||
|
||
def _b(name): return form.get(name, "").lower() in ("true", "on", "yes", "1")
|
||
def _i(name):
|
||
try: return int(form.get(name) or 0)
|
||
except ValueError: return 0
|
||
|
||
# Field names are intentionally opaque ("contact_addr", "immomio_login",
|
||
# "immomio_secret") to keep password managers — specifically Bitwarden —
|
||
# from recognising the form as a login/identity form and autofilling.
|
||
db.update_profile(user["id"], {
|
||
"salutation": form.get("salutation", ""),
|
||
"firstname": form.get("firstname", ""),
|
||
"lastname": form.get("lastname", ""),
|
||
"email": form.get("contact_addr", ""),
|
||
"telephone": form.get("telephone", ""),
|
||
"street": form.get("street", ""),
|
||
"house_number": form.get("house_number", ""),
|
||
"postcode": form.get("postcode", ""),
|
||
"city": form.get("city", ""),
|
||
"is_possessing_wbs": 1 if _b("is_possessing_wbs") else 0,
|
||
"wbs_type": form.get("wbs_type", "0"),
|
||
"wbs_valid_till": form.get("wbs_valid_till", "1970-01-01"),
|
||
"wbs_rooms": _i("wbs_rooms"),
|
||
"wbs_adults": _i("wbs_adults"),
|
||
"wbs_children": _i("wbs_children"),
|
||
"is_prio_wbs": 1 if _b("is_prio_wbs") else 0,
|
||
"immomio_email": form.get("immomio_login", ""),
|
||
"immomio_password": form.get("immomio_secret", ""),
|
||
})
|
||
db.log_audit(user["username"], "profile.updated", user_id=user["id"], ip=client_ip(request))
|
||
return RedirectResponse("/einstellungen/profil", status_code=303)
|
||
|
||
|
||
@app.post("/actions/notifications")
|
||
async def action_notifications(request: Request, user=Depends(require_user)):
|
||
form = await request.form()
|
||
require_csrf(user["id"], form.get("csrf", ""))
|
||
def _b(n): return 1 if form.get(n, "").lower() in ("on", "true", "1", "yes") else 0
|
||
channel = form.get("channel", "ui")
|
||
if channel not in ("ui", "telegram"):
|
||
channel = "ui"
|
||
db.update_notifications(user["id"], {
|
||
"channel": channel,
|
||
"telegram_bot_token": form.get("telegram_bot_token", ""),
|
||
"telegram_chat_id": form.get("telegram_chat_id", ""),
|
||
"email_address": "",
|
||
"notify_on_match": _b("notify_on_match"),
|
||
"notify_on_apply_success": _b("notify_on_apply_success"),
|
||
"notify_on_apply_fail": _b("notify_on_apply_fail"),
|
||
})
|
||
db.log_audit(user["username"], "notifications.updated", user_id=user["id"], ip=client_ip(request))
|
||
return RedirectResponse("/einstellungen/benachrichtigungen", status_code=303)
|
||
|
||
|
||
@app.post("/actions/account/password")
|
||
async def action_password(
|
||
request: Request,
|
||
old_password: str = Form(""),
|
||
new_password: str = Form(""),
|
||
new_password_repeat: str = Form(""),
|
||
csrf: str = Form(...),
|
||
user=Depends(require_user),
|
||
):
|
||
require_csrf(user["id"], csrf)
|
||
if not new_password or new_password != new_password_repeat:
|
||
return RedirectResponse("/einstellungen/account?err=mismatch", status_code=303)
|
||
if len(new_password) < 10:
|
||
return RedirectResponse("/einstellungen/account?err=tooshort", status_code=303)
|
||
row = db.get_user_by_username(user["username"])
|
||
from auth import verify_hash
|
||
if not row or not verify_hash(row["password_hash"], old_password):
|
||
return RedirectResponse("/einstellungen/account?err=wrongold", status_code=303)
|
||
db.set_user_password(user["id"], hash_password(new_password))
|
||
db.log_audit(user["username"], "password.changed", user_id=user["id"], ip=client_ip(request))
|
||
return RedirectResponse("/einstellungen/account?ok=1", status_code=303)
|
||
|
||
|
||
@app.post("/actions/submit-forms")
|
||
async def action_submit_forms(
|
||
request: Request,
|
||
value: str = Form(default="off"),
|
||
csrf: str = Form(...),
|
||
user=Depends(require_user),
|
||
):
|
||
require_csrf(user["id"], csrf)
|
||
new = 1 if value == "on" else 0
|
||
db.update_preferences(user["id"], {"submit_forms": new})
|
||
db.log_audit(user["username"], "submit_forms", "on" if new else "off",
|
||
user_id=user["id"], ip=client_ip(request))
|
||
if _is_htmx(request):
|
||
return _wohnungen_partial_or_redirect(request, user)
|
||
return RedirectResponse(request.headers.get("referer", "/einstellungen/profil"), status_code=303)
|
||
|
||
|
||
@app.post("/actions/users/create")
|
||
async def action_users_create(
|
||
request: Request,
|
||
username: str = Form(...),
|
||
password: str = Form(...),
|
||
is_admin: str = Form(""),
|
||
csrf: str = Form(...),
|
||
admin=Depends(require_admin),
|
||
):
|
||
require_csrf(admin["id"], csrf)
|
||
username = (username or "").strip()
|
||
if not username or len(password) < 10:
|
||
raise HTTPException(400, "username required, password >= 10 chars")
|
||
try:
|
||
uid = db.create_user(username, hash_password(password),
|
||
is_admin=(is_admin.lower() in ("on", "true", "yes", "1")))
|
||
except sqlite3.IntegrityError:
|
||
return RedirectResponse("/einstellungen/benutzer?err=exists", status_code=303)
|
||
db.log_audit(admin["username"], "user.created", f"new_user={username} id={uid}",
|
||
user_id=admin["id"], ip=client_ip(request))
|
||
return RedirectResponse("/einstellungen/benutzer?ok=1", status_code=303)
|
||
|
||
|
||
@app.post("/actions/users/disable")
|
||
async def action_users_disable(
|
||
request: Request,
|
||
target_id: int = Form(...),
|
||
value: str = Form(...),
|
||
csrf: str = Form(...),
|
||
admin=Depends(require_admin),
|
||
):
|
||
require_csrf(admin["id"], csrf)
|
||
if target_id == admin["id"]:
|
||
raise HTTPException(400, "refusing to disable self")
|
||
db.set_user_disabled(target_id, value == "on")
|
||
db.log_audit(admin["username"], "user.toggle_disable",
|
||
f"target={target_id} disabled={value=='on'}",
|
||
user_id=admin["id"], ip=client_ip(request))
|
||
return RedirectResponse("/einstellungen/benutzer", status_code=303)
|
||
|
||
|
||
@app.post("/actions/users/delete")
|
||
async def action_users_delete(
|
||
request: Request,
|
||
target_id: int = Form(...),
|
||
csrf: str = Form(...),
|
||
admin=Depends(require_admin),
|
||
):
|
||
require_csrf(admin["id"], csrf)
|
||
if target_id == admin["id"]:
|
||
raise HTTPException(400, "refusing to delete self")
|
||
target = db.get_user(target_id)
|
||
if not target:
|
||
return RedirectResponse("/einstellungen/benutzer", status_code=303)
|
||
db.delete_user(target_id)
|
||
db.log_audit(admin["username"], "user.deleted",
|
||
f"target={target_id} username={target['username']}",
|
||
user_id=admin["id"], ip=client_ip(request))
|
||
return RedirectResponse("/einstellungen/benutzer?deleted=1", status_code=303)
|
||
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Internal endpoints
|
||
# ---------------------------------------------------------------------------
|
||
|
||
@app.post("/internal/flats")
|
||
async def internal_submit_flat(
|
||
payload: dict,
|
||
_guard: None = Depends(require_internal),
|
||
):
|
||
if not payload.get("id") or not payload.get("link"):
|
||
raise HTTPException(400, "id and link required")
|
||
|
||
is_new = db.upsert_flat(payload)
|
||
if not is_new:
|
||
return {"status": "duplicate"}
|
||
|
||
for u in db.list_users():
|
||
if u["disabled"]:
|
||
continue
|
||
filters = row_to_dict(db.get_filters(u["id"]))
|
||
if not flat_matches_filter(payload, filters):
|
||
continue
|
||
|
||
db.log_audit("alert", "flat_matched",
|
||
f"user={u['username']} flat={payload['id']}",
|
||
user_id=u["id"])
|
||
notifications.on_match(u["id"], payload)
|
||
|
||
prefs = db.get_preferences(u["id"])
|
||
if _auto_apply_allowed(prefs):
|
||
_kick_apply(u["id"], str(payload["id"]), payload["link"], "auto")
|
||
db.log_audit("system", "auto_apply_kick",
|
||
f"user={u['username']} flat={payload['id']}",
|
||
user_id=u["id"])
|
||
|
||
return {"status": "ok"}
|
||
|
||
|
||
@app.post("/internal/heartbeat")
|
||
async def internal_heartbeat(payload: dict, _g: None = Depends(require_internal)):
|
||
service = payload.get("service", "unknown")
|
||
db.set_state(f"last_{service}_heartbeat", db.now_iso())
|
||
return {"status": "ok"}
|
||
|
||
|
||
@app.post("/internal/error")
|
||
async def internal_report_error(
|
||
payload: dict,
|
||
_g: None = Depends(require_internal),
|
||
):
|
||
db.log_error(
|
||
source=payload.get("source", "unknown"),
|
||
kind=payload.get("kind", "error"),
|
||
summary=payload.get("summary", ""),
|
||
context=payload.get("context"),
|
||
)
|
||
return {"status": "ok"}
|