adminandClaude Opus 5.5
3c7a7e49f3
Workspace-Liste unter /admin/workspaces/liste, Merkmale, Kategorien, Webapp-Vorlagen und Distro-Abdeckung (frühere Flottenmatrix) unter /admin/workspaces/vorlagen. Gemeinsame Unternavigation, Menüpunkt Datenbank entfällt, alte /admin/technik-Adressen leiten weiter (POST mit 307). Workspace-Creator neu, Schritt B. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
71 lines
2.4 KiB
Python
71 lines
2.4 KiB
Python
from fastapi import FastAPI, Request
|
|
from fastapi.staticfiles import StaticFiles
|
|
|
|
import auth
|
|
from routers import (
|
|
admin_accounts,
|
|
admin_dashboard,
|
|
admin_flows,
|
|
admin_geraete,
|
|
admin_kunden,
|
|
admin_technik,
|
|
admin_workspaces,
|
|
dashboard,
|
|
geraete,
|
|
gruppen,
|
|
installationsmedium,
|
|
organisation,
|
|
struktur,
|
|
webapps,
|
|
workspace,
|
|
)
|
|
|
|
|
|
# Sicherheits-Review 25.08.2026 (vor der geplanten oeffentlichen Freigabe
|
|
# ueber Pangolin): /docs, /redoc, /openapi.json waren zuvor unauthentifiziert
|
|
# erreichbar und legten die komplette interne Routenstruktur (inkl. aller
|
|
# /admin/*-Pfade) offen - fuer eine Plattform in aktiver Entwicklung
|
|
# unnoetige Aufklaerungshilfe fuer Angreifer.
|
|
app = FastAPI(title="Tuxflotte Flotten-Management", docs_url=None, redoc_url=None, openapi_url=None)
|
|
app.mount("/static", StaticFiles(directory="static"), name="static")
|
|
|
|
|
|
@app.middleware("http")
|
|
async def security_headers(request: Request, call_next):
|
|
"""
|
|
Basis-Security-Header (Sicherheits-Review 25.08.2026). Pangolin
|
|
terminiert TLS und kann HSTS ergaenzen, das hier ist die App-seitige
|
|
Schicht unabhaengig davon. CSP erlaubt 'unsafe-inline' nur fuer Styles
|
|
(einzelne style="display:inline"-Attribute in ein paar Admin-Templates),
|
|
nicht fuer Skripte - die Templates enthalten ohnehin kein Inline-JS.
|
|
"""
|
|
|
|
response = await call_next(request)
|
|
response.headers.setdefault("X-Content-Type-Options", "nosniff")
|
|
response.headers.setdefault("X-Frame-Options", "DENY")
|
|
response.headers.setdefault("Referrer-Policy", "same-origin")
|
|
response.headers.setdefault(
|
|
"Content-Security-Policy",
|
|
"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:",
|
|
)
|
|
|
|
return response
|
|
|
|
app.include_router(auth.router)
|
|
app.include_router(dashboard.router)
|
|
app.include_router(geraete.router)
|
|
app.include_router(organisation.router)
|
|
app.include_router(struktur.router)
|
|
app.include_router(gruppen.router)
|
|
app.include_router(workspace.router)
|
|
app.include_router(installationsmedium.router)
|
|
app.include_router(webapps.router)
|
|
app.include_router(admin_technik.router)
|
|
app.include_router(admin_workspaces.router)
|
|
app.include_router(admin_workspaces.technik_weiterleitung)
|
|
app.include_router(admin_geraete.router)
|
|
app.include_router(admin_flows.router)
|
|
app.include_router(admin_kunden.router)
|
|
app.include_router(admin_accounts.router)
|
|
app.include_router(admin_dashboard.router)
|