Kayos
213801ca70
Adds the multi-user plumbing layer underneath v0.1's batch-only API: - DB module (db.py) — PyMySQL against sulkta-mariadb, in-process migrations. Tables: cauldron_users, cauldron_user_mealie_tokens, cauldron_chat_log, schema_migrations. - Crypto module (crypto.py) — thin Fernet wrapper. Master key in env, per-row encryption of stored Mealie tokens, decrypt only in-process. - OIDC module (oidc.py) — Authlib-based Authentik integration. Issuer https://auth.sulkta.com/application/o/cauldron/, sub_mode=user_email, scopes openid+email+profile. App gated to 'Sulkta Family' group. - Two-tier Mealie shape — system_mealie (env token, admin batch) + current_user_mealie() helper that loads + decrypts the calling user's token from DB. Per the v0.2 design (memory/spec-cauldron-v0.2.md). - Connect flow — /connect-mealie pages walk users through minting their own Mealie API token and pasting it back. Validated against /api/users/self before encryption + storage. - Routes — /, /login, /auth/callback, /logout, /me, /connect-mealie, /disconnect-mealie. v0.1 admin endpoints kept under bearer auth. - Mealie.who_am_i() helper added. - Auth flow uses Authentik subject (sub) as the canonical user key. UI is minimal — connect-mealie page uses the locked palette (forest #1f2d1f, panels #2d3a2a, meadow #6b8e5a/#88a87a, parchment text #f0e6cc/#ddd4ba) and Cormorant Garamond serif headers. Strict palette. The fuller dashboard / plan / list / recipes views land in subsequent commits. Authentik provider PK 24, client_id ZIwEugWWWZinR1KcVC9IT9hpGoTds9ps8XDDHPPN. Group 'Sulkta Family' (pk 6d0c75e9-...) created with cobb member. Foundation only — Abby's branded UI and the meal-plan / shopping-list features land in subsequent v0.2 commits.
23 lines
1,004 B
Python
23 lines
1,004 B
Python
"""Fernet wrapper for at-rest encryption of per-user secrets (Mealie tokens).
|
|
|
|
The Fernet master key lives in env (CAULDRON_FERNET_KEY) and never on disk
|
|
in the cauldron container itself — it's bind-mounted in via the env_file.
|
|
Rotating it requires re-encrypting every cauldron_user_mealie_tokens row;
|
|
not implemented yet (would need a rotation flow with old + new key).
|
|
"""
|
|
from cryptography.fernet import Fernet, InvalidToken
|
|
|
|
|
|
class TokenCrypto:
|
|
def __init__(self, master_key: str):
|
|
# Fernet expects bytes; ours is a 44-char urlsafe-b64 string in env
|
|
self.f = Fernet(master_key.encode() if isinstance(master_key, str) else master_key)
|
|
|
|
def encrypt(self, plaintext: str) -> bytes:
|
|
return self.f.encrypt(plaintext.encode("utf-8"))
|
|
|
|
def decrypt(self, blob: bytes) -> str:
|
|
try:
|
|
return self.f.decrypt(blob).decode("utf-8")
|
|
except InvalidToken as e:
|
|
raise RuntimeError("fernet decrypt failed (bad key or corrupted blob)") from e
|