sprint-2.5: RBAC 4 roles + Studio bootable + Flash Console
End-to-end implementation per docs/sprint-2.5-plan.md. New requirement added by user mid-sprint: 4-role RBAC (Super Admin / Engineer / Owner / User) with dual-auth for Engineer flashing firmware, plus a "mini Arduino IDE" inside the Studio. Tests: pytest 231/231 green (129 Sprint 2 + 102 Sprint 2.5 new). RBAC core (arautopilot/core/): - rbac.py: 4 roles, 12 capabilities, immutable capability matrix, has() / capabilities_of() / require() / requires_dual_auth() helpers. Engineer flashing firmware needs SA approval; everything else is single-factor. - user.py: User model with PBKDF2-HMAC-SHA256 PIN hashing (200k iters, 16-byte salt, self-describing hash format for future migrations). 4-8 digit numeric PINs enforced. - user_store.py: JSON-backed user database. seed_demo_users() for first-run UX. - audit.py: append-only JSONL audit log. AuditEvent with timestamp, user_id, role, action, target, outcome, reason, secondary_user_id for dual-auth, optional extra payload. Crypto signing of lines deferred to Sprint 8. Studio GUI (arautopilot/studio/): - app.py: real entry point (replaces Sprint 0 stub). --seed-demo populates demo users without launching GUI; --data-dir overrides the ~/.ar-autopilot/studio/ default. - session.py: Session + SessionHolder. check() always audits the decision; verify_super_admin_pin() + log_dual_auth_grant() for dual-auth flows. - login_window.py: modal login dialog with user picker + PIN field. Audits login attempts (success and bad-PIN denials). - main_window.py: top-level window with sidebar (user + role + caps) and tab area (Overview, Flash Console, Project placeholder, Telemetry placeholder). - flash_console.py: the "mini Arduino IDE". Lists serial ports via pyserial; picks firmware variant (esp32-dev / esp32-debug); compiles via 'pio run'; flashes via 'pio run -t upload --upload-port <port>'; streams pio output to a dark-themed read-only console; supports cancel. For Engineer flashes, asks the Super Admin for their PIN inline before invoking pio. Records dual-auth grant + pio exit code in the audit log. Dependencies: - New [project.optional-dependencies] group 'studio': PySide6>=6.6, pyserial>=3.5, platformio>=6.1. Kept optional so the core can be installed in lean / CI environments. Tests (arautopilot/tests/): - test_rbac.py: 32 tests for capability matrix, dual-auth policy, no-privilege-escalation invariants, partial overlap between roles. - test_user.py: 11 tests for PIN hashing, verification, salting, serialisation, field validators. - test_audit.py: 9 tests for JSONL append, immutability, round-trip, corrupt-line detection, dual-auth event shape, blank-line tolerance. - test_user_store.py: 10 tests for CRUD, persistence, role filtering, demo seed idempotency. - test_session.py: 9 tests for capability checks + audit side effects, SA PIN verification, dual-auth recording, SessionHolder lifecycle. - test_studio_smoke.py: 5 headless tests verifying Studio modules import without a display server, --seed-demo works, helpers safe to call without hardware. NOT in Sprint 2.5 (intentional): - Crypto signing of audit log lines (hash-chain) -- Sprint 8 - HWID binding of the user store -- Sprint 8 - Project configurator + .appack compiler -- Sprint 4 - Flutter bridge display -- Sprint 4 - Telemetry dashboard tab -- Sprint 4 - Serial monitor as a separate tab -- future enhancement Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
@@ -9,6 +9,95 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
||||
|
||||
## [Unreleased]
|
||||
|
||||
## [0.1.0-sprint2.5] — Sprint 2.5 — RBAC + Studio + Flash Console — 2026-05-18
|
||||
|
||||
> New sprint added at the user's request: 4-role RBAC and a "mini Arduino
|
||||
> IDE" inside the Studio that lets an Engineer flash firmware to an
|
||||
> AR-NMEA-IO board with the Super Admin's PIN as a second factor.
|
||||
|
||||
### Added
|
||||
|
||||
#### RBAC core (`arautopilot/core/`)
|
||||
|
||||
- **`rbac.py`** -- 4 roles (`SUPER_ADMIN`, `ENGINEER`, `OWNER`, `USER`),
|
||||
12 capabilities, immutable capability matrix, `has()`,
|
||||
`capabilities_of()`, `require()`, and `requires_dual_auth()` policy
|
||||
helper. Engineer flashing firmware needs SA approval; everything else
|
||||
is single-factor.
|
||||
- **`user.py`** -- `User` model with PBKDF2-HMAC-SHA256 PIN hashing
|
||||
(200k iterations, 16-byte salt). Self-describing hash format for
|
||||
future migrations. 4-8 digit numeric PINs enforced.
|
||||
- **`user_store.py`** -- JSON-backed user database (one file per Studio
|
||||
install). `seed_demo_users()` for first-run UX.
|
||||
- **`audit.py`** -- Append-only JSONL audit log. `AuditEvent` records
|
||||
user_id, role, action, target, outcome (success/denied/failed/
|
||||
approval_pending), reason, and optional secondary_user_id for
|
||||
dual-auth events. Crypto-signing of lines deferred to Sprint 8.
|
||||
|
||||
#### Studio GUI (`arautopilot/studio/`)
|
||||
|
||||
- **`app.py`** -- entry point. Replaces the Sprint 0 stub. Supports
|
||||
`--seed-demo` (populate demo users without launching GUI), `--data-dir`
|
||||
(override the `~/.ar-autopilot/studio/` default).
|
||||
- **`session.py`** -- runtime context: `Session` (user + audit + caps),
|
||||
`SessionHolder` (process-global singleton). `check()` always records
|
||||
an audit event; `verify_super_admin_pin()` for dual-auth flows;
|
||||
`log_dual_auth_grant()` for the approval-recorded variant.
|
||||
- **`login_window.py`** -- modal login dialog with user picker + PIN
|
||||
field. Audits login attempts (success and bad-PIN denials).
|
||||
- **`main_window.py`** -- top-level window with sidebar (user + role +
|
||||
granted capabilities) and central tab area (Overview, Flash Console,
|
||||
placeholders for Project and Telemetry tabs).
|
||||
- **`flash_console.py`** -- the "mini Arduino IDE". Lists serial ports
|
||||
via pyserial; lets the operator pick the firmware variant
|
||||
(`esp32-dev` / `esp32-debug`); compiles via `pio run`; flashes via
|
||||
`pio run -t upload --upload-port <port>`; streams pio output to a
|
||||
dark-themed read-only console; supports cancel. For Engineer flashes,
|
||||
asks the Super Admin for their PIN inline before invoking pio. The
|
||||
audit log records both the dual-auth grant and the pio exit code.
|
||||
|
||||
#### Dependencies (new optional group)
|
||||
|
||||
- New `[project.optional-dependencies]` group `studio`:
|
||||
`PySide6>=6.6`, `pyserial>=3.5`, `platformio>=6.1`. Kept optional so
|
||||
the core can be installed in lean / CI environments.
|
||||
|
||||
#### Tests (`arautopilot/tests/`)
|
||||
|
||||
- `test_rbac.py` -- 32 tests covering capability assignment per role,
|
||||
dual-auth policy, `require()` helper, no-privilege-escalation
|
||||
invariants, partial-overlap between Engineer and Owner.
|
||||
- `test_user.py` -- 11 tests covering PIN hashing, verification,
|
||||
serialisation, salting (different hashes for same PIN), pin_hash
|
||||
field validator, vessel-scoped users.
|
||||
- `test_audit.py` -- 9 tests covering single-line JSONL append,
|
||||
immutability, round-trip, corrupt-line detection, dual-auth event
|
||||
shape, extra payload, blank-line tolerance.
|
||||
- `test_user_store.py` -- 10 tests covering CRUD, persistence across
|
||||
instances, role filtering, demo seed idempotency, membership tests.
|
||||
- `test_session.py` -- 9 tests covering capability checks with audit
|
||||
side effects, SA PIN verification, dual-auth recording,
|
||||
`SessionHolder` lifecycle.
|
||||
- `test_studio_smoke.py` -- 5 headless tests verifying Studio modules
|
||||
import without a display server, `--seed-demo` works, the helpers in
|
||||
`flash_console` are safe to call without hardware.
|
||||
|
||||
### Verification
|
||||
|
||||
- `pytest` -- **231 passed** in 4.78 s (129 from Sprint 2 + 102 new).
|
||||
- `python -m arautopilot.studio.app --seed-demo --data-dir <tmp>` --
|
||||
populates 4 demo users, prints a notice, exits 0.
|
||||
|
||||
### Not in Sprint 2.5 (intentional)
|
||||
|
||||
- Cryptographic signing of audit log lines (hash-chain) -- Sprint 8.
|
||||
- HWID binding of the user store -- Sprint 8.
|
||||
- Project configurator + .appack compiler -- Sprint 4.
|
||||
- Flutter bridge display -- Sprint 4.
|
||||
- Telemetry dashboard tab -- Sprint 4.
|
||||
- Serial monitor as a separate tab -- a future enhancement; for now the
|
||||
Flash Console only streams pio output, not arbitrary serial.
|
||||
|
||||
## [0.1.0-sprint2] — Sprint 2 — PID inner loop + rudder simulator — 2026-05-18
|
||||
|
||||
> Continues the overnight execution under blanket authorisation. Builds on
|
||||
|
||||
Reference in New Issue
Block a user