sprint-2.5: RBAC 4 roles + Studio bootable + Flash Console
End-to-end implementation per docs/sprint-2.5-plan.md. New requirement added by user mid-sprint: 4-role RBAC (Super Admin / Engineer / Owner / User) with dual-auth for Engineer flashing firmware, plus a "mini Arduino IDE" inside the Studio. Tests: pytest 231/231 green (129 Sprint 2 + 102 Sprint 2.5 new). RBAC core (arautopilot/core/): - rbac.py: 4 roles, 12 capabilities, immutable capability matrix, has() / capabilities_of() / require() / requires_dual_auth() helpers. Engineer flashing firmware needs SA approval; everything else is single-factor. - user.py: User model with PBKDF2-HMAC-SHA256 PIN hashing (200k iters, 16-byte salt, self-describing hash format for future migrations). 4-8 digit numeric PINs enforced. - user_store.py: JSON-backed user database. seed_demo_users() for first-run UX. - audit.py: append-only JSONL audit log. AuditEvent with timestamp, user_id, role, action, target, outcome, reason, secondary_user_id for dual-auth, optional extra payload. Crypto signing of lines deferred to Sprint 8. Studio GUI (arautopilot/studio/): - app.py: real entry point (replaces Sprint 0 stub). --seed-demo populates demo users without launching GUI; --data-dir overrides the ~/.ar-autopilot/studio/ default. - session.py: Session + SessionHolder. check() always audits the decision; verify_super_admin_pin() + log_dual_auth_grant() for dual-auth flows. - login_window.py: modal login dialog with user picker + PIN field. Audits login attempts (success and bad-PIN denials). - main_window.py: top-level window with sidebar (user + role + caps) and tab area (Overview, Flash Console, Project placeholder, Telemetry placeholder). - flash_console.py: the "mini Arduino IDE". Lists serial ports via pyserial; picks firmware variant (esp32-dev / esp32-debug); compiles via 'pio run'; flashes via 'pio run -t upload --upload-port <port>'; streams pio output to a dark-themed read-only console; supports cancel. For Engineer flashes, asks the Super Admin for their PIN inline before invoking pio. Records dual-auth grant + pio exit code in the audit log. Dependencies: - New [project.optional-dependencies] group 'studio': PySide6>=6.6, pyserial>=3.5, platformio>=6.1. Kept optional so the core can be installed in lean / CI environments. Tests (arautopilot/tests/): - test_rbac.py: 32 tests for capability matrix, dual-auth policy, no-privilege-escalation invariants, partial overlap between roles. - test_user.py: 11 tests for PIN hashing, verification, salting, serialisation, field validators. - test_audit.py: 9 tests for JSONL append, immutability, round-trip, corrupt-line detection, dual-auth event shape, blank-line tolerance. - test_user_store.py: 10 tests for CRUD, persistence, role filtering, demo seed idempotency. - test_session.py: 9 tests for capability checks + audit side effects, SA PIN verification, dual-auth recording, SessionHolder lifecycle. - test_studio_smoke.py: 5 headless tests verifying Studio modules import without a display server, --seed-demo works, helpers safe to call without hardware. NOT in Sprint 2.5 (intentional): - Crypto signing of audit log lines (hash-chain) -- Sprint 8 - HWID binding of the user store -- Sprint 8 - Project configurator + .appack compiler -- Sprint 4 - Flutter bridge display -- Sprint 4 - Telemetry dashboard tab -- Sprint 4 - Serial monitor as a separate tab -- future enhancement Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
+98
-12
@@ -1,24 +1,110 @@
|
||||
"""Studio application entry point — Sprint 4 stub.
|
||||
"""AR-Autopilot Studio application entry point.
|
||||
|
||||
This module is intentionally a stub. The real PySide6 ``QApplication`` and
|
||||
``MainWindow`` arrive in Sprint 4. Trying to launch the Studio now will
|
||||
print a friendly notice and exit cleanly.
|
||||
Usage:
|
||||
|
||||
python studio_main.py # launch the GUI
|
||||
python -m arautopilot.studio.app # same
|
||||
python -m arautopilot.studio.app --seed-demo
|
||||
# populate the local user store
|
||||
# with one of each role + default
|
||||
# PINs (1111 SA, 2222 Eng,
|
||||
# 3333 Owner, 4444 User)
|
||||
|
||||
The Studio runs locally on the integrator's workstation. The dedicated
|
||||
bridge display is a separate Flutter app (Sprint 4+); the two share the
|
||||
same data model (``arautopilot.core``) and Modbus register map
|
||||
(``arautopilot.shared.modbus_register_map``).
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import argparse
|
||||
import sys
|
||||
from pathlib import Path
|
||||
|
||||
from arautopilot.core.audit import AuditLog
|
||||
from arautopilot.core.user_store import UserStore, seed_demo_users
|
||||
from arautopilot.studio.session import studio_data_dir
|
||||
|
||||
|
||||
def run() -> int:
|
||||
"""Stub entry point. Will be replaced by a real ``QApplication`` in Sprint 4."""
|
||||
print(
|
||||
"AR-Autopilot Studio — Sprint 0 stub.\n"
|
||||
"The Studio GUI is implemented starting in Sprint 4.\n"
|
||||
"For now, use the core API (`arautopilot.core`) and the demo:\n"
|
||||
" python examples/sprint0_demo.py"
|
||||
def run(argv: list[str] | None = None) -> int:
|
||||
parser = argparse.ArgumentParser(description=__doc__)
|
||||
parser.add_argument(
|
||||
"--seed-demo",
|
||||
action="store_true",
|
||||
help="Populate the local user store with one of each role + default "
|
||||
"PINs (1111/2222/3333/4444). Then exit.",
|
||||
)
|
||||
return 0
|
||||
parser.add_argument(
|
||||
"--data-dir",
|
||||
type=Path,
|
||||
default=None,
|
||||
help="Override the per-user data directory. Defaults to "
|
||||
"~/.ar-autopilot/studio/.",
|
||||
)
|
||||
args = parser.parse_args(argv)
|
||||
|
||||
data_dir = args.data_dir or studio_data_dir()
|
||||
data_dir.mkdir(parents=True, exist_ok=True)
|
||||
user_store = UserStore(data_dir / "users.json")
|
||||
audit_log = AuditLog(data_dir / "audit.jsonl")
|
||||
|
||||
if args.seed_demo:
|
||||
before = len(user_store)
|
||||
seed_demo_users(user_store)
|
||||
after = len(user_store)
|
||||
print(
|
||||
f"User store at {user_store.path}: {before} -> {after} users.\n"
|
||||
"Demo PINs: 1111 (Super Admin), 2222 (Engineer), 3333 (Owner), "
|
||||
"4444 (User).\n"
|
||||
"Change them with the Studio's user manager (Sprint 4+) before "
|
||||
"shipping to a customer."
|
||||
)
|
||||
return 0
|
||||
|
||||
# Lazy-import the Qt machinery so that --seed-demo (and pytest collection
|
||||
# of this module) does not depend on a working display server.
|
||||
try:
|
||||
from PySide6.QtWidgets import QApplication, QMessageBox
|
||||
except ImportError:
|
||||
sys.stderr.write(
|
||||
"PySide6 is not installed. Run:\n\n"
|
||||
" pip install -e \".[studio]\"\n\n"
|
||||
"or:\n\n"
|
||||
" pip install PySide6 pyserial\n"
|
||||
)
|
||||
return 2
|
||||
|
||||
from arautopilot.studio.login_window import LoginDialog
|
||||
from arautopilot.studio.main_window import StudioMainWindow
|
||||
|
||||
app = QApplication(sys.argv)
|
||||
app.setApplicationName("AR-Autopilot Studio")
|
||||
|
||||
if len(user_store) == 0:
|
||||
QMessageBox.information(
|
||||
None,
|
||||
"No users",
|
||||
"The local user store is empty. The Studio will seed it with "
|
||||
"demo users (PINs 1111/2222/3333/4444). Change them immediately "
|
||||
"in production.",
|
||||
)
|
||||
seed_demo_users(user_store)
|
||||
|
||||
login = LoginDialog(store=user_store, audit=audit_log)
|
||||
win_holder: list[StudioMainWindow] = []
|
||||
|
||||
def on_logged_in(_session: object) -> None:
|
||||
from arautopilot.studio.session import SessionHolder
|
||||
session = SessionHolder.require()
|
||||
win = StudioMainWindow(session)
|
||||
win.show()
|
||||
win_holder.append(win)
|
||||
|
||||
login.logged_in.connect(on_logged_in)
|
||||
if login.exec() == 0 and not win_holder:
|
||||
return 0
|
||||
return app.exec()
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
|
||||
Reference in New Issue
Block a user