234 lines
9.6 KiB
Python
234 lines
9.6 KiB
Python
"""Serve one local review run through a loopback-only read-only HTTP API."""
|
||
|
||
from __future__ import annotations
|
||
|
||
import argparse
|
||
import json
|
||
import mimetypes
|
||
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
|
||
from pathlib import Path
|
||
from typing import Any
|
||
from urllib.parse import unquote, urlsplit
|
||
|
||
from reviewer.server.artifacts import JsonObject, ReviewArtifactError, ReviewArtifacts
|
||
|
||
_SECURITY_HEADERS = {
|
||
"Cache-Control": "no-store",
|
||
"Content-Security-Policy": (
|
||
"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'none'; "
|
||
"font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'"
|
||
),
|
||
"Referrer-Policy": "no-referrer",
|
||
"X-Content-Type-Options": "nosniff",
|
||
"X-Frame-Options": "DENY",
|
||
}
|
||
|
||
|
||
class ReviewerHttpServer(ThreadingHTTPServer):
|
||
"""Threaded local server whose workers never keep process shutdown alive."""
|
||
|
||
daemon_threads = True
|
||
|
||
|
||
def _valid_local_request(handler: BaseHTTPRequestHandler) -> bool:
|
||
host = handler.headers.get("Host")
|
||
if host is None:
|
||
return False
|
||
try:
|
||
parsed_host = urlsplit(f"//{host}")
|
||
if parsed_host.username is not None or parsed_host.password is not None:
|
||
return False
|
||
if parsed_host.hostname not in {"127.0.0.1", "localhost"}:
|
||
return False
|
||
if parsed_host.port is not None and not 0 < parsed_host.port < 65536:
|
||
return False
|
||
except ValueError:
|
||
return False
|
||
|
||
origin = handler.headers.get("Origin")
|
||
if origin is None:
|
||
return True
|
||
try:
|
||
parsed_origin = urlsplit(origin)
|
||
return parsed_origin.scheme == "http" and parsed_origin.netloc == host
|
||
except ValueError:
|
||
return False
|
||
|
||
|
||
def _api_response(repository: ReviewArtifacts, path: str) -> JsonObject:
|
||
if path == "/api/v1/run":
|
||
return repository.run_summary()
|
||
parts = [part for part in path.split("/") if part]
|
||
try:
|
||
if len(parts) == 4 and parts[:3] == ["api", "v1", "documents"]:
|
||
return repository.document_comparison(unquote(parts[3], encoding="utf-8", errors="strict"))
|
||
if len(parts) == 6 and parts[:3] == ["api", "v1", "documents"] and parts[4] == "components":
|
||
document_id = unquote(parts[3], encoding="utf-8", errors="strict")
|
||
try:
|
||
component_position = int(parts[5])
|
||
except ValueError:
|
||
raise ReviewArtifactError("unknown_component", "组件位置不存在。", 404) from None
|
||
return repository.component_stage(document_id, component_position)
|
||
except UnicodeDecodeError:
|
||
raise ReviewArtifactError("not_found", "请求的资源不存在。", 404) from None
|
||
raise ReviewArtifactError("not_found", "请求的资源不存在。", 404)
|
||
|
||
|
||
def _handler_factory(repository: ReviewArtifacts, static_root: Path) -> type[BaseHTTPRequestHandler]:
|
||
class ReviewRequestHandler(BaseHTTPRequestHandler):
|
||
server_version = "mdpolish-reviewer"
|
||
sys_version = ""
|
||
|
||
def log_message(self, format_: str, *args: Any) -> None:
|
||
del format_, args
|
||
|
||
def _headers(self, status: int, content_type: str, content_length: int) -> None:
|
||
self.send_response(status)
|
||
for name, value in _SECURITY_HEADERS.items():
|
||
self.send_header(name, value)
|
||
self.send_header("Content-Type", content_type)
|
||
self.send_header("Content-Length", str(content_length))
|
||
self.end_headers()
|
||
|
||
def _json(self, status: int, payload: JsonObject, *, head_only: bool) -> None:
|
||
content = (json.dumps(payload, ensure_ascii=False, separators=(",", ":")) + "\n").encode()
|
||
self._headers(status, "application/json; charset=utf-8", len(content))
|
||
if not head_only:
|
||
self.wfile.write(content)
|
||
|
||
def _error(self, error: Exception, *, head_only: bool) -> None:
|
||
if isinstance(error, ReviewArtifactError):
|
||
status = error.http_status
|
||
code = error.code
|
||
message = str(error)
|
||
else:
|
||
status = 500
|
||
code = "internal_error"
|
||
message = "评审器无法完成该请求。"
|
||
self._json(status, {"error": {"code": code, "message": message}}, head_only=head_only)
|
||
|
||
def _static(self, path: str, *, head_only: bool) -> None:
|
||
requested = "index.html" if path == "/" else unquote(path[1:], encoding="utf-8", errors="strict")
|
||
if "\0" in requested:
|
||
raise ReviewArtifactError("not_found", "请求的资源不存在。", 404)
|
||
candidate = static_root / requested
|
||
try:
|
||
if candidate.is_symlink():
|
||
raise ReviewArtifactError("not_found", "请求的资源不存在。", 404)
|
||
resolved = candidate.resolve(strict=True)
|
||
if not resolved.is_relative_to(static_root) or not resolved.is_file():
|
||
raise FileNotFoundError
|
||
except (FileNotFoundError, OSError):
|
||
if Path(requested).suffix:
|
||
raise ReviewArtifactError("not_found", "请求的资源不存在。", 404) from None
|
||
resolved = (static_root / "index.html").resolve(strict=True)
|
||
content = resolved.read_bytes()
|
||
content_type = mimetypes.guess_type(resolved.name)[0] or "application/octet-stream"
|
||
if content_type.startswith("text/") or content_type in {"application/javascript", "application/json"}:
|
||
content_type += "; charset=utf-8"
|
||
self._headers(200, content_type, len(content))
|
||
if not head_only:
|
||
self.wfile.write(content)
|
||
|
||
def _handle(self, method: str) -> None:
|
||
head_only = method == "HEAD"
|
||
if method not in {"GET", "HEAD"}:
|
||
self.send_response(405)
|
||
for name, value in _SECURITY_HEADERS.items():
|
||
self.send_header(name, value)
|
||
self.send_header("Allow", "GET, HEAD")
|
||
payload: JsonObject = {
|
||
"error": {"code": "method_not_allowed", "message": "只允许 GET 和 HEAD。"}
|
||
}
|
||
content = (json.dumps(payload, ensure_ascii=False, separators=(",", ":")) + "\n").encode()
|
||
self.send_header("Content-Type", "application/json; charset=utf-8")
|
||
self.send_header("Content-Length", str(len(content)))
|
||
self.end_headers()
|
||
self.wfile.write(content)
|
||
return
|
||
try:
|
||
if not _valid_local_request(self):
|
||
raise ReviewArtifactError("invalid_origin", "只接受本机同源请求。", 403)
|
||
request_path = urlsplit(self.path).path
|
||
if request_path.startswith("/api/"):
|
||
self._json(200, _api_response(repository, request_path), head_only=head_only)
|
||
else:
|
||
self._static(request_path, head_only=head_only)
|
||
except Exception as error: # the response intentionally hides unexpected implementation details
|
||
self._error(error, head_only=head_only)
|
||
|
||
def do_GET(self) -> None:
|
||
self._handle("GET")
|
||
|
||
def do_HEAD(self) -> None:
|
||
self._handle("HEAD")
|
||
|
||
def do_POST(self) -> None:
|
||
self._handle("POST")
|
||
|
||
def do_PUT(self) -> None:
|
||
self._handle("PUT")
|
||
|
||
def do_PATCH(self) -> None:
|
||
self._handle("PATCH")
|
||
|
||
def do_DELETE(self) -> None:
|
||
self._handle("DELETE")
|
||
|
||
def do_OPTIONS(self) -> None:
|
||
self._handle("OPTIONS")
|
||
|
||
return ReviewRequestHandler
|
||
|
||
|
||
def create_server(
|
||
repository: ReviewArtifacts,
|
||
static_root: Path,
|
||
*,
|
||
port: int = 0,
|
||
) -> ReviewerHttpServer:
|
||
"""Create, but do not start, the loopback reviewer server."""
|
||
index = static_root / "index.html"
|
||
if not index.is_file():
|
||
raise ReviewArtifactError("missing_build", "未找到前端构建结果，请先运行 npm run build。", 400)
|
||
return ReviewerHttpServer(("127.0.0.1", port), _handler_factory(repository, static_root.resolve()))
|
||
|
||
|
||
def _arguments(argv: list[str] | None = None) -> argparse.Namespace:
|
||
parser = argparse.ArgumentParser(description="只读查看一次 mdpolish 本地清洗运行。")
|
||
parser.add_argument("--run-dir", required=True, help="一次已发布运行目录的绝对或相对路径")
|
||
parser.add_argument("--port", type=int, default=0, help="本机端口；默认 0 表示自动选择")
|
||
arguments = parser.parse_args(argv)
|
||
if arguments.port < 0 or arguments.port > 65535:
|
||
parser.error("--port 必须在 0 到 65535 之间")
|
||
return arguments
|
||
|
||
|
||
def main(argv: list[str] | None = None) -> None:
|
||
arguments = _arguments(argv)
|
||
repository = ReviewArtifacts(arguments.run_dir)
|
||
static_root = Path(__file__).resolve().parents[1] / "dist"
|
||
try:
|
||
server = create_server(repository, static_root, port=arguments.port)
|
||
except OSError as error:
|
||
raise ReviewArtifactError("server_error", "无法启动本地评审服务。", 500) from error
|
||
port = server.server_address[1]
|
||
print(
|
||
f"mdpolish 评审器已启动：http://127.0.0.1:{port}（{repository.run_id}，"
|
||
f"{len(repository.documents)} 份文档）",
|
||
flush=True,
|
||
)
|
||
try:
|
||
server.serve_forever()
|
||
except KeyboardInterrupt:
|
||
pass
|
||
finally:
|
||
server.server_close()
|
||
|
||
|
||
if __name__ == "__main__":
|
||
try:
|
||
main()
|
||
except ReviewArtifactError as error:
|
||
raise SystemExit(f"评审器启动失败：{error}") from None
|