fluent_cli/frontend.py at main · njfio/fluent_cli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
from flask import Flask, request, jsonify
import subprocess
import logging
import os
import tempfile
import atexit
import signal
import sys
from pathlib import Path
import shutil

app = Flask(__name__)

# Global list to track temporary files for cleanup
_temp_files = []

def cleanup_temp_files():
    """Clean up all temporary files on exit"""
    for temp_file in _temp_files:
        try:
            if os.path.exists(temp_file):
                os.unlink(temp_file)
                logging.info(f"Cleaned up temporary file: {temp_file}")
        except Exception as e:
            logging.error(f"Failed to clean up {temp_file}: {e}")
    _temp_files.clear()

# Register cleanup handlers
atexit.register(cleanup_temp_files)
signal.signal(signal.SIGTERM, lambda signum, frame: cleanup_temp_files())
signal.signal(signal.SIGINT, lambda signum, frame: cleanup_temp_files())

@app.route('/', methods=['GET'])
def index():
    return """
    <!DOCTYPE html>
    <html>
    <head><title>Fluent CLI Web Interface</title></head>
    <body>
        <h1>Fluent CLI Web Interface</h1>
        <p>API endpoints are working:</p>
        <ul>
            <li><a href="/api/collections">/api/collections</a></li>
            <li><a href="/api/price/all">/api/price/all</a></li>
        </ul>
        <p>Use the original HTML interface at: <a href="/frontend">/frontend</a></p>
    </body>
    </html>
    """

@app.route('/api/collections', methods=['GET'])
def get_collections():
    """Return a list of available collections"""
    try:
        # For now, return a simple list of mock collections
        # In a real implementation, this would query a database or storage system
        collections = [
            {"id": "1", "name": "Default Collection", "description": "Default collection for testing"},
            {"id": "2", "name": "User Collection", "description": "User-specific collection"}
        ]
        return jsonify(collections)
    except Exception as e:
        logging.error(f"Error fetching collections: {e}")
        return jsonify({"error": "Internal server error"}), 500

@app.route('/api/price/all', methods=['GET'])
def get_price_all():
    """Return pricing information for all items"""
    try:
        # For now, return mock pricing data
        # In a real implementation, this would query pricing from a database or external service
        prices = {
            "items": [
                {"id": "1", "name": "Basic Plan", "price": 9.99, "currency": "USD"},
                {"id": "2", "name": "Pro Plan", "price": 29.99, "currency": "USD"}
            ]
        }
        return jsonify(prices)
    except Exception as e:
        logging.error(f"Error fetching prices: {e}")
        return jsonify({"error": "Internal server error"}), 500

@app.route('/execute', methods=['POST'])
def execute_fluent():
    """Execute fluent command with security validation"""
    try:
        data = request.json
        if not data:
            return jsonify({'error': 'No JSON data provided'}), 400

        # Validate required fields
        if 'engine' not in data:
            return jsonify({'error': 'Engine is required'}), 400

        # Validate engine value
        allowed_engines = ['openai', 'anthropic', 'google', 'cohere', 'mistral']
        if data['engine'] not in allowed_engines:
            return jsonify({'error': f'Invalid engine. Allowed: {allowed_engines}'}), 400

        # Handle config and pipeline files
        config_file = create_temp_file(data.get('config'), '.json')
        pipeline_file = create_temp_file(data.get('pipelineFile'), '.yaml')

        # Start building the fluent command
        fluent_command = ["fluent"]

        # Add the engine
        fluent_command.append(data['engine'])

        # Add the request (optional)
        if data.get('request'):
            fluent_command.append(data['request'])

        # Add the options, checking if they have values
        if config_file:
            fluent_command.extend(['-c', config_file])

        for override in data.get('override', '').split():
            if override:
                fluent_command.extend(['-o', override])

        if data.get('additionalContextFile'):
            fluent_command.extend(['-a', data.get('additionalContextFile')])

        if data.get('upsert'):
            fluent_command.append('--upsert')

        if data.get('input'):
            fluent_command.extend(['-i', data.get('input')])

        if data.get('metadata'):
            fluent_command.extend(['-t', data.get('metadata')])

        if data.get('uploadImageFile'):
            fluent_command.extend(['-l', data.get('uploadImageFile')])

        if data.get('downloadMedia'):
            fluent_command.extend(['-d', data.get('downloadMedia')])

        if data.get('parseCode'):
            fluent_command.append('-p')

        if data.get('executeOutput'):
            fluent_command.append('-x')

        if data.get('markdown'):
            fluent_command.append('-m')

        if data.get('generateCypher'):
            fluent_command.extend(['--generate-cypher', data.get('generateCypher')])

        # Handle the pipeline command
        if pipeline_file:
            fluent_command.extend(['pipeline', '--file', pipeline_file])

            if data.get('pipelineInput'):
                fluent_command.extend(['--input', data.get('pipelineInput')])

            if data.get('jsonOutput'):
                fluent_command.append('--json-output')

            if data.get('runId'):
                fluent_command.extend(['--run-id', data.get('runId')])

            if data.get('forceFresh'):
                fluent_command.append('--force-fresh')

        # Enhanced input validation for command injection prevention
        dangerous_chars = [';', '&', '|', '`', '$', '(', ')', '<', '>', '"', "'", '\\', '\n', '\r']
        for arg in fluent_command:
            if any(char in str(arg) for char in dangerous_chars):
                logging.warning(f"Blocked command with dangerous characters: {arg}")
                return jsonify({'error': 'Invalid characters in command arguments'}), 400

            # Check for path traversal attempts
            if '..' in str(arg) or arg.startswith('/'):
                logging.warning(f"Blocked potential path traversal: {arg}")
                return jsonify({'error': 'Invalid path in arguments'}), 400

        # Validate command length
        if len(' '.join(fluent_command)) > 2000:
            return jsonify({'error': 'Command too long'}), 400

        # Log the command for debugging (but not in production)
        if os.environ.get('FLASK_DEBUG', 'false').lower() == 'true':
            logging.debug(f"Executing command: {fluent_command}")

        # Execute the fluent command with enhanced security restrictions
        output = subprocess.check_output(
            fluent_command,
            timeout=30,  # 30 second timeout
            stderr=subprocess.STDOUT,
            env={'PATH': '/usr/bin:/bin'},  # Minimal environment
            cwd=os.getcwd(),  # Explicit working directory
            shell=False  # Never use shell=True
        ).decode('utf-8')

        # Validate output size
        if len(output) > 1_000_000:  # 1MB limit
            return jsonify({'error': 'Output too large'}), 413

        # Return the output as a JSON response
        return jsonify({'output': output})
    except subprocess.CalledProcessError as e:
        # If there is an error, return the error message as a JSON response
        logging.error(f"Subprocess error: {e}")
        return jsonify({'error': str(e)}), 500
    except ValueError as e:
        # Input validation errors
        logging.error(f"Validation error: {e}")
        return jsonify({'error': str(e)}), 400
    except Exception as e:
        # Unexpected errors
        logging.error(f"Unexpected error: {e}")
        return jsonify({'error': 'Internal server error'}), 500
    finally:
        # Clean up any temporary files created in this request
        # Note: Global cleanup happens on exit, but we could add request-specific cleanup here
        pass

# Helper functions to create temporary files with security and cleanup
def create_temp_file(content, extension):
    """Create a temporary file with proper security and cleanup tracking"""
    if not content:
        return None

    # Input validation
    if len(content) > 10 * 1024 * 1024:  # 10MB limit
        raise ValueError("Content too large (max 10MB)")

    # Validate extension
    allowed_extensions = ['.json', '.yaml', '.yml', '.txt']
    if extension not in allowed_extensions:
        raise ValueError(f"Invalid extension. Allowed: {allowed_extensions}")

    try:
        # Create secure temporary file
        with tempfile.NamedTemporaryFile(
            delete=False,
            suffix=extension,
            mode='w',
            encoding='utf-8',
            prefix='fluent_temp_'
        ) as temp:
            temp.write(content)
            temp_path = temp.name

        # Track for cleanup
        _temp_files.append(temp_path)
        logging.info(f"Created temporary file: {temp_path}")

        # Set restrictive permissions (owner read/write only)
        os.chmod(temp_path, 0o600)

        return temp_path

    except Exception as e:
        logging.error(f"Failed to create temporary file: {e}")
        raise

if __name__ == '__main__':
    # Production-safe logging configuration
    log_level = os.environ.get('LOG_LEVEL', 'INFO').upper()
    logging.basicConfig(
        level=getattr(logging, log_level, logging.INFO),
        format='%(asctime)s - %(name)s - %(levelname)s - %(message)s'
    )

    logging.info("Flask app starting...")
    logging.info(f"Working directory: {os.getcwd()}")
    # Never log environment variables in production - they may contain secrets

    # Production-safe Flask configuration
    debug_mode = os.environ.get('FLASK_DEBUG', 'false').lower() == 'true'
    host = os.environ.get('FLASK_HOST', '127.0.0.1')  # Default to localhost only
    port = int(os.environ.get('FLASK_PORT', '5000'))

    if debug_mode:
        logging.warning("Running in debug mode - not suitable for production!")

    app.run(debug=debug_mode, host=host, port=port)