POC fastapi - #167
Conversation
| @@ -0,0 +1,196 @@ | |||
| import httpx | |||
There was a problem hiding this comment.
I think we should extract that library to a seperate python package "attackmate_api". We can also put the attackmate_client to that package as executable. By seperating that part, other python programms can add only that api-package instead of the full attackmate-package(with lots of dependencies)
| DEFAULT_TIMEOUT = 60.0 # what should the timeout be for requests? what about background? | ||
| # make timeout configurable? | ||
|
|
||
| logger = logging.getLogger('playbook') |
There was a problem hiding this comment.
If we extract that file to a seperate package as an api, we don't necessary need a logger, and can simply throw exceptions. the logging part can be done by the python-script that uses that package
| token = self._get_session_token() | ||
| if not token: | ||
| # Attempt login if credentials are set on the client instance | ||
| if self.username and self.password: | ||
| logger.info( | ||
| f"No active token for {self.server_url}, try login with provided credentials." | ||
| ) | ||
| token = self._login(self.username, self.password) | ||
| if not token: | ||
| logger.error(f"Auth required for {self.server_url} but no token available and login failed") | ||
| return None # Or raise an AuthException? |
There was a problem hiding this comment.
Extract this to a seperate method: "authenticate()"
| headers = {'X-Auth-Token': token} | ||
| if content_data: | ||
| headers['Content-Type'] = 'application/yaml' |
There was a problem hiding this comment.
Seperate this to a method "set_headers(token)"
| if content_data: | ||
| headers['Content-Type'] = 'application/yaml' | ||
|
|
||
| url = f"{self.server_url}/{endpoint.lstrip('/')}" |
There was a problem hiding this comment.
check if urllib might be suitable
| """Runs a command on a given AttackMate instance.""" | ||
| try: | ||
| logger.info(f"Executing command type '{command_data.type}' on instance") # type: ignore | ||
| # TODO does this work? need to pass command class object here? |
| @@ -0,0 +1,168 @@ | |||
| from contextlib import asynccontextmanager | |||
There was a problem hiding this comment.
We might talk about extracting that attackmate-remote-server to a seperate repo. People who use attackmate in their python-scripts, might not want to download all the dependencies for the attackmate-remote-server
| # In-Memory token Store | ||
| # token looks like this token : {"username": str, "expires": datetime} | ||
| # state is lost on server restart. | ||
| # Not inherently thread-safe for multi-worker setups without locks ? |
There was a problem hiding this comment.
maybe we will switch at some point to jwt. I guess that would be thread-safe, since we don't have any state anymore
|
|
||
| def get_user_hash(username: str) -> Optional[str]: | ||
| """Fetches the hashed password from environment variables.""" | ||
| env_var_name = f"USER_{username.upper()}_HASH" |
There was a problem hiding this comment.
looks like something for pydantic-settings
| import os | ||
| import sys | ||
| from typing import Any, Dict, List, Optional | ||
|
|
There was a problem hiding this comment.
this should use our remote_client object. and we will put that executable to the attackmate-api-repo
whotwagner
left a comment
whotwagner
left a comment
There was a problem hiding this comment.
We will merge that now. and separate the projects later
3 participants
No description provided.