deploy: Simple protection for metrics endpoint

.forgejo/workflows/pull_request.yml

@@ -0,0 +1,20 @@
+on:
+  pull_request:
+
+jobs:
+  test:
+    runs-on: docker
+    container:
+      image: ghcr.io/catthehacker/ubuntu:act-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+          cache-dependency-path: '**/requirements.dev.txt'
+      - name: Install dependencies
+        working-directory: core
+        run: pip3 install -r requirements.dev.txt
+      - name: Run django tests
+        working-directory: core
+        run: python3 manage.py test

.forgejo/workflows/testing.yml

@@ -0,0 +1,60 @@
+on:
+  push:
+    branches:
+      - testing
+
+jobs:
+  test:
+    runs-on: docker
+    container:
+      image: ghcr.io/catthehacker/ubuntu:act-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+          cache-dependency-path: '**/requirements.dev.txt'
+      - name: Install dependencies
+        working-directory: core
+        run: pip3 install -r requirements.dev.txt
+      - name: Run django tests
+        working-directory: core
+        run: python3 manage.py test
+
+  deploy:
+    needs: [test]
+    runs-on: docker
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install ansible
+        run: |
+          apt update -y
+          apt install python3-pip -y
+          python3 -m pip install ansible
+          python3 -m pip install ansible-lint
+
+      - name: Populate relevant files
+        run: |
+          mkdir ~/.ssh
+          echo "${{ secrets.C3LF_SSH_TESTING }}" > ~/.ssh/id_ed25519
+          chmod 0600 ~/.ssh/id_ed25519
+          ls -lah ~/.ssh
+          command -v ssh-agent >/dev/null || ( apt-get update -y && apt-get install openssh-client -y )
+          eval $(ssh-agent -s)
+          ssh-add ~/.ssh/id_ed25519
+          echo "andromeda.lab.or.it ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDXPoO0PE+B9PYwbGaLo98zhbmjAkp6eBtVeZe43v/+T" >> ~/.ssh/known_hosts
+          mkdir /etc/ansible
+          echo "${{ secrets.C3LF_INVENTORY_TESTING }}" > /etc/ansible/hosts
+
+      - name: Check ansible version
+        run: |
+          ansible --version
+
+      - name: List ansible hosts
+        run: |
+          ansible -m ping Andromeda
+
+      - name: Deploy testing
+        run: |
+          cd deploy/ansible
+          ansible-playbook playbooks/deploy-c3lf-sys3.yml

core/.coveragerc

@@ -0,0 +1,14 @@
+[run]
+source = .
+
+[report]
+fail_under = 100
+show_missing = True
+skip_covered = True
+omit =
+    */tests/*
+    */migrations/*
+    core/asgi.py
+    core/wsgi.py
+    core/settings.py
+    manage.py

core/core/settings.py

@@ -15,6 +15,9 @@ import sys
 import dotenv
 from pathlib import Path
 
+def truthy_str(s):
+    return s.lower() in ['true', '1', 't', 'y', 'yes', 'yeah', 'yup', 'certainly', 'sure', 'positive', 'uh-huh', '👍']
+
 # Build paths inside the project like this: BASE_DIR / 'subdir'.
 BASE_DIR = Path(__file__).resolve().parent.parent
 
@@ -24,10 +27,10 @@ dotenv.load_dotenv(BASE_DIR / '.env')
 # See https://docs.djangoproject.com/en/4.2/howto/deployment/checklist/
 
 # SECURITY WARNING: keep the secret key used in production secret!
-SECRET_KEY = 'django-insecure-tm*$w_14iqbiy-!7(8#ba7j+_@(7@rf2&a^!=shs&$03b%2*rv'
+SECRET_KEY = os.getenv('DJANGO_SECRET_KEY', 'django-insecure-tm*$w_14iqbiy-!7(8#ba7j+_@(7@rf2&a^!=shs&$03b%2*rv')
 
 # SECURITY WARNING: don't run with debug turned on in production!
-DEBUG = True
+DEBUG = truthy_str(os.getenv('DEBUG_MODE_ACTIVE', 'False'))
 
 ALLOWED_HOSTS = [os.getenv('HTTP_HOST', 'localhost')]
 
@@ -40,6 +43,8 @@ LEGACY_USER_PASSWORD = os.getenv('LEGACY_API_PASSWORD', 'legacy_password')
 
 SYSTEM3_VERSION = "0.0.0-dev.0"
 
+ACTIVE_SPAM_TRAINING = truthy_str(os.getenv('ACTIVE_SPAM_TRAINING', 'False'))
+
 # Application definition
 
 INSTALLED_APPS = [
@@ -50,6 +55,7 @@ INSTALLED_APPS = [
     'django.contrib.messages',
     'django.contrib.staticfiles',
     'django_extensions',
+    'django_prometheus',
     'rest_framework',
     'knox',
     'drf_yasg',
@@ -85,6 +91,7 @@ SWAGGER_SETTINGS = {
 }
 
 MIDDLEWARE = [
+    'django_prometheus.middleware.PrometheusBeforeMiddleware',
     'django.middleware.security.SecurityMiddleware',
     'django.contrib.sessions.middleware.SessionMiddleware',
     'django.middleware.common.CommonMiddleware',
@@ -92,6 +99,7 @@ MIDDLEWARE = [
     'django.contrib.auth.middleware.AuthenticationMiddleware',
     'django.contrib.messages.middleware.MessageMiddleware',
     'django.middleware.clickjacking.XFrameOptionsMiddleware',
+    'django_prometheus.middleware.PrometheusAfterMiddleware',
 ]
 
 ROOT_URLCONF = 'core.urls'
@@ -204,10 +212,12 @@ CHANNEL_LAYERS = {
     'default': {
         'BACKEND': 'channels_redis.core.RedisChannelLayer',
         'CONFIG': {
-            'hosts': [('localhost', 6379)],
+            'hosts': [(os.getenv('REDIS_HOST', 'localhost'), 6379)],
         },
     }
 
 }
 
+PROMETHEUS_METRIC_NAMESPACE = 'c3lf'
+
 TEST_RUNNER = 'core.test_runner.FastTestRunner'

core/core/urls.py

@@ -32,4 +32,5 @@ urlpatterns = [
     path('api/2/', include('notify_sessions.api_v2')),
     path('api/2/', include('authentication.api_v2')),
     path('api/', get_info),
+    path('', include('django_prometheus.urls')),
 ]

core/inventory/serializers.py

@@ -3,12 +3,21 @@ from rest_framework import serializers
 
 from files.models import File
 from inventory.models import Event, Container, Item
+from mail.models import EventAddress
+
+
+class EventAdressSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = EventAddress
+        fields = ['address']
 
 
 class EventSerializer(serializers.ModelSerializer):
+    addresses = EventAdressSerializer(many=True, required=False)
+
     class Meta:
         model = Event
-        fields = ['eid', 'slug', 'name', 'start', 'end', 'pre_start', 'post_end']
+        fields = ['eid', 'slug', 'name', 'start', 'end', 'pre_start', 'post_end', 'addresses']
         read_only_fields = ['eid']
 
 

core/inventory/tests/v2/test_events.py

@@ -54,3 +54,15 @@ class EventTestCase(TestCase):
         response = client.delete(f'/api/2/events/{event.eid}/')
         self.assertEqual(response.status_code, 204)
         self.assertEqual(len(Event.objects.all()), 1)
+
+    def test_items2(self):
+        from mail.models import EventAddress
+        event1 = Event.objects.create(slug='TEST1', name='Event')
+        EventAddress.objects.create(event=Event.objects.get(slug='TEST1'), address='foo@bar.baz')
+        response = self.client.get('/api/2/events/')
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(1, len(response.json()))
+        self.assertEqual('TEST1', response.json()[0]['slug'])
+        self.assertEqual('Event', response.json()[0]['name'])
+        self.assertEqual(1, len(response.json()[0]['addresses']))
+

core/mail/migrations/0005_alter_eventaddress_event.py

@@ -0,0 +1,20 @@
+# Generated by Django 4.2.7 on 2024-11-03 18:30
+
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('inventory', '0004_alter_event_created_at_alter_item_created_at'),
+        ('mail', '0004_alter_emailattachment_file'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='eventaddress',
+            name='event',
+            field=models.ForeignKey(null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='addresses', to='inventory.event'),
+        ),
+    ]

core/mail/migrations/0006_email_raw_file.py

@@ -0,0 +1,36 @@
+# Generated by Django 4.2.7 on 2024-11-08 20:37
+from django.core.files.base import ContentFile
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ('mail', '0005_alter_eventaddress_event'),
+    ]
+
+    def move_raw_mails_to_file(apps, schema_editor):
+        Email = apps.get_model('mail', 'Email')
+        for email in Email.objects.all():
+            raw_content = email.raw
+            path = "mail_{}".format(email.id)
+            if len(raw_content):
+                email.raw_file.save(path, ContentFile(raw_content))
+            email.save()
+
+    operations = [
+        migrations.AddField(
+            model_name='email',
+            name='raw_file',
+            field=models.FileField(null=True, upload_to='raw_mail/'),
+        ),
+        migrations.RunPython(move_raw_mails_to_file),
+        migrations.RemoveField(
+            model_name='email',
+            name='raw',
+        ),
+        migrations.AlterField(
+            model_name='email',
+            name='raw_file',
+            field=models.FileField(upload_to='raw_mail/'),
+        ),
+    ]

core/mail/models.py

@@ -3,7 +3,7 @@ import random
 from django.db import models
 from django_softdelete.models import SoftDeleteModel
 
-from core.settings import MAIL_DOMAIN
+from core.settings import MAIL_DOMAIN, ACTIVE_SPAM_TRAINING
 from files.models import AbstractFile
 from inventory.models import Event
 from tickets.models import IssueThread
@@ -18,7 +18,7 @@ class Email(SoftDeleteModel):
     recipient = models.CharField(max_length=255)
     reference = models.CharField(max_length=255, null=True, unique=True)
     in_reply_to = models.CharField(max_length=255, null=True)
-    raw = models.TextField()
+    raw_file = models.FileField(upload_to='raw_mail/')
     issue_thread = models.ForeignKey(IssueThread, models.SET_NULL, null=True, related_name='emails')
     event = models.ForeignKey(Event, models.SET_NULL, null=True)
 
@@ -28,10 +28,22 @@ class Email(SoftDeleteModel):
             self.reference = f'<{random.randint(0, 1000000000):09}@{MAIL_DOMAIN}>'
             self.save()
 
+    def train_spam(self):
+        if ACTIVE_SPAM_TRAINING:
+            import subprocess
+            path = self.raw_file.path
+            subprocess.run(["rspamc", "learn_spam", path])
+
+    def train_ham(self):
+        if ACTIVE_SPAM_TRAINING:
+            import subprocess
+            path = self.raw_file.path
+            subprocess.run(["rspamc", "learn_ham", path])
+
 
 class EventAddress(models.Model):
     id = models.AutoField(primary_key=True)
-    event = models.ForeignKey(Event, models.SET_NULL, null=True)
+    event = models.ForeignKey(Event, models.SET_NULL, null=True, related_name='addresses')
     address = models.CharField(max_length=255)
 
 

core/mail/protocol.py

@@ -1,4 +1,5 @@
 import logging
+from re import match
 
 import aiosmtplib
 from channels.layers import get_channel_layer
@@ -10,6 +11,10 @@ from notify_sessions.models import SystemEvent
 from tickets.models import IssueThread
 
 
+class SpecialMailException(Exception):
+    pass
+
+
 def find_quoted_printable(s, marker):
     positions = [i for i in range(len(s)) if s.lower().startswith('=?utf-8?' + marker + '?', i)]
     for pos in positions:
@@ -180,13 +185,13 @@ def receive_email(envelope, log=None):
     header_in_reply_to = parsed.get('In-Reply-To')
     header_message_id = parsed.get('Message-ID')
 
-    if header_from != envelope.mail_from:
-        log.warning("Header from does not match envelope from")
-        log.info(f"Header from: {header_from}, envelope from: {envelope.mail_from}")
+    if match(r'^([a-zA-Z ]*<)?MAILER-DAEMON@', header_from) and envelope.mail_from.strip("<>") == "":
+        log.warning("Ignoring mailer daemon")
+        raise SpecialMailException("Ignoring mailer daemon")
 
-    if header_to != envelope.rcpt_tos[0]:
-        log.warning("Header to does not match envelope to")
-        log.info(f"Header to: {header_to}, envelope to: {envelope.rcpt_tos[0]}")
+    if Email.objects.filter(reference=header_message_id).exists():  # break before issue thread is created
+        log.warning("Email already exists")
+        raise Exception("Email already exists")
 
     recipient = envelope.rcpt_tos[0].lower() if envelope.rcpt_tos else header_to.lower()
     sender = envelope.mail_from if envelope.mail_from else header_from
@@ -201,7 +206,7 @@ def receive_email(envelope, log=None):
 
     email = Email.objects.create(
         sender=sender, recipient=recipient, body=body, subject=subject, reference=header_message_id,
-        in_reply_to=header_in_reply_to, raw=envelope.content, event=target_event,
+        in_reply_to=header_in_reply_to, raw_file=ContentFile(envelope.content), event=target_event,
         issue_thread=active_issue_thread)
     for attachment in attachments:
         email.attachments.add(attachment)
@@ -233,7 +238,7 @@ Your c3lf (Cloakroom + Lost&Found) Team'''.format(active_issue_thread.short_uuid
             active_issue_thread.state = 'pending_open'
             active_issue_thread.save()
 
-    return email, new, reply
+    return email, new, reply, active_issue_thread
 
 
 class LMTPHandler:
@@ -255,7 +260,7 @@ class LMTPHandler:
         content = None
         try:
             content = envelope.content
-            email, new, reply = await receive_email(envelope, log)
+            email, new, reply, thread = await receive_email(envelope, log)
             log.info(f"Created email {email.id}")
             systemevent = await database_sync_to_async(SystemEvent.objects.create)(type='email received',
                                                                                    reference=email.id)
@@ -263,14 +268,20 @@ class LMTPHandler:
             channel_layer = get_channel_layer()
             await channel_layer.group_send(
                 'general', {"type": "generic.event", "name": "send_message_to_frontend", "event_id": systemevent.id,
-                            "message": "email received"}
-            )
+                            "message": "email received"})
             log.info(f"Sent message to frontend")
             if new and reply:
                 log.info('Sending message to %s' % reply['To'])
                 await send_smtp(reply)
                 log.info("Sent auto reply")
 
+            return '250 Message accepted for delivery'
+        except SpecialMailException as e:
+            import uuid
+            random_filename = 'special-' + str(uuid.uuid4())
+            with open(random_filename, 'wb') as f:
+                f.write(content)
+            log.warning(f"Special mail exception: {e} saved to {random_filename}")
             return '250 Message accepted for delivery'
         except Exception as e:
             from hashlib import sha256

core/mail/tests/v2/test_mails.py

@@ -760,7 +760,6 @@ dGVzdGltYWdl
         response = self.client.post(f'/api/2/tickets/{issue_thread.id}/reply/', {
             'message': 'test'
         })
-        aiosmtplib.send.assert_called_once()
         self.assertEqual(response.status_code, 201)
         self.assertEqual(5, len(Email.objects.all()))
         self.assertEqual(5, len(Email.objects.filter(issue_thread=issue_thread)))
@@ -776,6 +775,7 @@ dGVzdGltYWdl
         self.assertEqual('test subject', IssueThread.objects.all()[0].name)
         self.assertEqual('pending_new', IssueThread.objects.all()[0].state)
         self.assertEqual(None, IssueThread.objects.all()[0].assigned_to)
+        aiosmtplib.send.assert_called_once()
 
     def test_mail_4byte_unicode_emoji(self):
         from aiosmtpd.smtp import Envelope

core/requirements.dev.txt

@@ -1,3 +1,6 @@
+aiodns==3.2.0
+aiohttp==3.9.5
+aiosignal==1.3.1
 aiosmtpd==1.4.4.post2
 aiosmtplib==3.0.1
 anyio==4.1.0
@@ -28,6 +31,7 @@ django-rest-knox==4.2.0
 django-soft-delete==0.9.21
 djangorestframework==3.14.0
 drf-yasg==1.21.7
+frozenlist==1.4.1
 h11==0.14.0
 hyperlink==21.0.0
 idna==3.4
@@ -38,11 +42,13 @@ Jinja2==3.1.2
 MarkupSafe==2.1.3
 msgpack==1.0.7
 msgpack-python==0.5.6
+multidict==6.0.5
 openapi-codec==1.3.2
 packaging==23.2
 Pillow==10.1.0
 pyasn1==0.5.1
 pyasn1-modules==0.3.0
+pycares==4.4.0
 pycparser==2.21
 pyOpenSSL==23.3.0
 python-dotenv==1.0.0
@@ -65,4 +71,7 @@ urllib3==2.1.0
 uvicorn==0.24.0.post1
 watchfiles==0.21.0
 websockets==12.0
+yarl==1.9.4
 zope.interface==6.1
+django-prometheus==2.3.1
+prometheus_client==0.21.0

core/requirements.prod.txt

@@ -1,3 +1,6 @@
+aiodns==3.2.0
+aiohttp==3.9.5
+aiosignal==1.3.1
 aiosmtpd==1.4.4.post2
 aiosmtplib==3.0.1
 asgiref==3.7.2
@@ -38,3 +41,5 @@ urllib3==2.1.0
 uvicorn==0.24.0.post1
 watchfiles==0.21.0
 websockets==12.0
+django-prometheus==2.3.1
+prometheus_client==0.21.0

core/tickets/api_v2.py

@@ -10,6 +10,7 @@ from asgiref.sync import async_to_sync
 from channels.layers import get_channel_layer
 
 from core.settings import MAIL_DOMAIN
+from inventory.models import Event
 from mail.models import Email
 from mail.protocol import send_smtp, make_reply, collect_references
 from notify_sessions.models import SystemEvent

core/tickets/migrations/0011_train_old_spam.py

@@ -0,0 +1,31 @@
+# Generated by Django 4.2.7 on 2024-06-23 02:17
+
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ('mail', '0006_email_raw_file'),
+        ('tickets', '0010_issuethread_event_itemrelation_and_more'),
+    ]
+
+    def train_old_mails(apps, schema_editor):
+        from tickets.models import IssueThread
+        for t in IssueThread.objects.all():
+            try:
+                state = t.state
+                i = 0
+                for e in t.emails.all():
+                    if e.raw_file:
+                        if state == 'closed_spam' and i == 0:
+                            e.train_spam()
+                        else:
+                            e.train_ham()
+                    i += 1
+            except:
+                pass
+
+    operations = [
+        migrations.RunPython(train_old_mails),
+    ]

core/tickets/models.py

@@ -60,6 +60,8 @@ class IssueThread(SoftDeleteModel):
         if self.state == value:
             return
         self.state_changes.create(state=value)
+        if value == 'closed_spam' and self.emails.exists():
+            self.emails.first().train_spam()
 
     @property
     def assigned_to(self):

deploy/ansible/inventory.yml.sample

@@ -12,3 +12,5 @@ c3lf-nodes:
       main_email: <main_email>
       legacy_api_user: <legacy_api_user>
       legacy_api_password: <legacy_api_password>
+      debug_mode_active: false
+      django_secret_key: 'django-insecure-tm*$w_14iqbiy-!7(8#ba7j+_@(7@rf2&a^!=shs&$03b%2*rv'

deploy/ansible/playbooks/templates/django.env.j2

@@ -1,3 +1,4 @@
+REDIS_HOST=localhost
 DB_HOST=localhost
 DB_PORT=3306
 DB_NAME=c3lf_sys3
@@ -9,3 +10,6 @@ LEGACY_API_USER={{ legacy_api_user }}
 LEGACY_API_PASSWORD={{ legacy_api_password }}
 MEDIA_ROOT=/var/www/c3lf-sys3/userfiles
 STATIC_ROOT=/var/www/c3lf-sys3/staticfiles
+ACTIVE_SPAM_TRAINING=True
+DEBUG_MODE_ACTIVE={{ debug_mode_active }}
+DJANGO_SECRET_KEY={{ django_secret_key }}

deploy/ansible/playbooks/templates/nginx.conf.j2

@@ -70,6 +70,13 @@ server {
         alias /var/www/c3lf-sys3/staticfiles/;
     }
 
+    location /metrics {
+        allow 95.156.226.90;
+        allow 127.0.0.1;
+        allow ::1;
+        deny all;
+    }
+
     listen 443 ssl http2; # managed by Certbot
     ssl_certificate /etc/letsencrypt/live/{{ web_domain }}/fullchain.pem; # managed by Certbot
     ssl_certificate_key /etc/letsencrypt/live/{{ web_domain }}/privkey.pem; # managed by Certbot

deploy/dev/Dockerfile.backend

@@ -0,0 +1,13 @@
+FROM python:3.11-bookworm
+LABEL authors="lagertonne"
+
+ENV PYTHONUNBUFFERED 1
+RUN mkdir /code
+WORKDIR /code
+COPY requirements.dev.txt /code/
+COPY requirements.prod.txt /code/
+RUN apt update && apt install -y mariadb-client
+RUN pip install -r requirements.dev.txt
+RUN pip install -r requirements.prod.txt
+RUN pip install mysqlclient
+COPY .. /code/

deploy/dev/Dockerfile.frontend

@@ -0,0 +1,6 @@
+FROM docker.io/node:22
+
+RUN mkdir /web
+WORKDIR /web
+COPY package.json /web/
+RUN npm install

deploy/dev/docker-compose.yml

@@ -0,0 +1,48 @@
+services:
+  core:
+    build:
+      context: ../../core
+      dockerfile: ../deploy/dev/Dockerfile.backend
+    command: bash -c 'python manage.py migrate && python manage.py runserver 0.0.0.0:8000'
+    environment:
+      - HTTP_HOST=core
+      - DB_HOST=db
+      - DB_PORT=3306
+      - DB_NAME=system3
+      - DB_USER=system3
+      - DB_PASSWORD=system3
+    volumes:
+      - ../../core:/code
+    ports:
+      - "8000:8000"
+    depends_on:
+      - db
+
+  frontend:
+    build:
+      context: ../../web
+      dockerfile: ../deploy/dev/Dockerfile.frontend
+    command: npm run serve
+    volumes:
+      - ../../web:/web:ro
+      - /web/node_modules
+      - ./vue.config.js:/web/vue.config.js
+    ports:
+      - "8080:8080"
+    depends_on:
+      - core
+
+  db:
+    image: mariadb
+    environment:
+      MARIADB_RANDOM_ROOT_PASSWORD: true
+      MARIADB_DATABASE: system3
+      MARIADB_USER: system3
+      MARIADB_PASSWORD: system3
+    volumes:
+      - mariadb_data:/var/lib/mysql
+    ports:
+      - "3306:3306"
+
+volumes:
+  mariadb_data:

deploy/dev/vue.config.js

@@ -0,0 +1,27 @@
+// vue.config.js
+
+module.exports = {
+    devServer: {
+        headers: {
+            "Access-Control-Allow-Origin": "*",
+            "Access-Control-Allow-Headers": "*",
+            "Access-Control-Allow-Methods": "*"
+        },
+        proxy: {
+            '^/media/2': {
+                target: 'http://core:8000/',
+            },
+            '^/api/2': {
+                target: 'http://core:8000/',
+            },
+            '^/api/1': {
+                target: 'http://core:8000/',
+            },
+            '^/ws/2': {
+                target: 'http://core:8000/',
+                ws: true,
+                logLevel: 'debug',
+            },
+        }
+    }
+}

deploy/testing/Dockerfile.backend

@@ -0,0 +1,11 @@
+FROM python:3.11-bookworm
+LABEL authors="lagertonne"
+
+ENV PYTHONUNBUFFERED 1
+RUN mkdir /code
+WORKDIR /code
+COPY requirements.prod.txt /code/
+RUN apt update && apt install -y mariadb-client
+RUN pip install -r requirements.prod.txt
+RUN pip install mysqlclient
+COPY .. /code/

deploy/testing/Dockerfile.frontend

@@ -0,0 +1,6 @@
+FROM docker.io/node:22
+
+RUN mkdir /web
+WORKDIR /web
+COPY package.json /web/
+RUN npm install

deploy/testing/docker-compose.yml

@@ -0,0 +1,55 @@
+services:
+  redis:
+    image: redis
+    ports:
+      - "6379:6379"
+
+  db:
+    image: mariadb
+    environment:
+      MARIADB_RANDOM_ROOT_PASSWORD: true
+      MARIADB_DATABASE: system3
+      MARIADB_USER: system3
+      MARIADB_PASSWORD: system3
+    volumes:
+      - mariadb_data:/var/lib/mysql
+    ports:
+      - "3306:3306"
+
+  core:
+    build:
+      context: ../../core
+      dockerfile: ../deploy/testing/Dockerfile.backend
+    command: bash -c 'python manage.py migrate && python /code/server.py'
+    environment:
+      - HTTP_HOST=core
+      - REDIS_HOST=redis
+      - DB_HOST=db
+      - DB_PORT=3306
+      - DB_NAME=system3
+      - DB_USER=system3
+      - DB_PASSWORD=system3
+    volumes:
+      - ../../core:/code
+    ports:
+      - "8000:8000"
+    depends_on:
+      - db
+      - redis
+
+  frontend:
+    build:
+      context: ../../web
+      dockerfile: ../deploy/testing/Dockerfile.frontend
+    command: npm run serve
+    volumes:
+      - ../../web:/web:ro
+      - /web/node_modules
+      - ./vue.config.js:/web/vue.config.js
+    ports:
+      - "8080:8080"
+    depends_on:
+      - core
+
+volumes:
+  mariadb_data:

deploy/testing/vue.config.js

@@ -0,0 +1,27 @@
+// vue.config.js
+
+module.exports = {
+    devServer: {
+        headers: {
+            "Access-Control-Allow-Origin": "*",
+            "Access-Control-Allow-Headers": "*",
+            "Access-Control-Allow-Methods": "*"
+        },
+        proxy: {
+            '^/media/2': {
+                target: 'http://core:8000/',
+            },
+            '^/api/2': {
+                target: 'http://core:8000/',
+            },
+            '^/api/1': {
+                target: 'http://core:8000/',
+            },
+            '^/ws/2': {
+                target: 'http://core:8000/',
+                ws: true,
+                logLevel: 'debug',
+            },
+        }
+    }
+}

web/src/components/AsyncLoader.vue

@@ -0,0 +1,133 @@
+<template>
+    <div class="async-wrapper" :class="{ 'loaded': loaded }">
+        <div class="deferred">
+            <slot></slot>
+        </div>
+        <div class="loader-wrapper">
+            <div class="loader-ellipsis">
+                <div></div>
+                <div></div>
+                <div></div>
+                <div></div>
+            </div>
+        </div>
+    </div>
+</template>
+
+<script>
+
+export default {
+    name: 'AsyncLoader',
+    props: {
+        loaded: {
+            type: Boolean,
+            default: false
+        }
+    }
+};
+</script>
+
+<style>
+.async-wrapper {
+    position: relative;
+}
+
+.async-wrapper > .deferred {
+    width: 100%;
+    height: 100%;
+    display: none;
+}
+
+.async-wrapper.loaded > .deferred {
+    display: block;
+}
+
+.async-wrapper > .loader-wrapper {
+    display: flex;
+    justify-content: center;
+    align-items: center;
+    position: absolute;
+    top: 0;
+    left: 0;
+    width: 100%;
+    height: 100%;
+}
+
+.async-wrapper > .loader-wrapper > .loader-ellipsis {
+    color: #17a2b8;
+}
+
+.async-wrapper.loaded > .loader-wrapper {
+    display: none;
+}
+
+
+.async-wrapper > .loader-wrapper > .loader-ellipsis,
+.async-wrapper > .loader-wrapper > .loader-ellipsis div {
+    box-sizing: border-box;
+}
+
+.async-wrapper > .loader-wrapper > .loader-ellipsis {
+    display: inline-block;
+    position: relative;
+    width: 80px;
+    height: 80px;
+}
+
+.async-wrapper > .loader-wrapper > .loader-ellipsis div {
+    position: absolute;
+    top: 33.33333px;
+    width: 13.33333px;
+    height: 13.33333px;
+    border-radius: 50%;
+    background: currentColor;
+    animation-timing-function: cubic-bezier(0, 1, 1, 0);
+}
+
+.async-wrapper > .loader-wrapper > .loader-ellipsis div:nth-child(1) {
+    left: 8px;
+    animation: loader-ellipsis1 0.6s infinite;
+}
+
+.async-wrapper > .loader-wrapper > .loader-ellipsis div:nth-child(2) {
+    left: 8px;
+    animation: loader-ellipsis2 0.6s infinite;
+}
+
+.async-wrapper > .loader-wrapper > .loader-ellipsis div:nth-child(3) {
+    left: 32px;
+    animation: loader-ellipsis2 0.6s infinite;
+}
+
+.async-wrapper > .loader-wrapper > .loader-ellipsis div:nth-child(4) {
+    left: 56px;
+    animation: loader-ellipsis3 0.6s infinite;
+}
+
+@keyframes loader-ellipsis1 {
+    0% {
+        transform: scale(0);
+    }
+    100% {
+        transform: scale(1);
+    }
+}
+
+@keyframes loader-ellipsis3 {
+    0% {
+        transform: scale(1);
+    }
+    100% {
+        transform: scale(0);
+    }
+}
+
+@keyframes loader-ellipsis2 {
+    0% {
+        transform: translate(0, 0);
+    }
+    100% {
+        transform: translate(24px, 0);
+    }
+}
+</style>

web/src/components/Navbar.vue

@@ -29,16 +29,7 @@
                 </router-link>
             </li>
         </ul>
-        <form class="form-inline mt-1 my-lg-auto my-xl-auto w-100 d-inline mr-1" v-if="hasPermissions">
-            <input
-                class="form-control w-100"
-                type="search"
-                placeholder="Search"
-                aria-label="Search"
-                @input="searchEventItems($event.target.value)"
-                disabled
-            >
-        </form>
+        <SearchBox v-if="hasPermissions" class="mt-1 my-lg-auto my-xl-auto w-100 d-inline mr-1"/>
         <div class="custom-control-inline mr-1" v-if="hasPermissions">
             <div class="btn-group btn-group-toggle mr-1" v-if="isItemView()">
                 <button :class="['btn', 'btn-info', { active: layout === 'cards' }]" @click="setLayout('cards')">
@@ -103,9 +94,13 @@
 
 <script>
 import {mapState, mapActions, mapMutations, mapGetters} from 'vuex';
+import SearchBox from "@/components/inputs/SearchBox.vue";
 
 export default {
     name: 'Navbar',
+    components: {
+        SearchBox
+    },
     data: () => ({
         views: [
             {'title': 'items', 'path': 'items'},
@@ -122,7 +117,7 @@ export default {
         ...mapGetters(['getEventSlug', 'getActiveView', "checkPermission", "hasPermissions", "layout", "route"]),
     },
     methods: {
-        ...mapActions(['changeEvent', 'changeView', 'searchEventItems']),
+        ...mapActions(['changeEvent', 'changeView']),
         ...mapMutations(['logout']),
         navigateTo(link) {
             if (this.route.path !== link)

web/src/components/Timeline.vue

@@ -40,10 +40,10 @@
                 <div class="">
                     <textarea placeholder="add comment..." v-model="newComment" class="form-control">
                     </textarea>
-                    <button class="btn btn-primary float-right" @click="addCommentAndClear">
+                    <AsyncButton class="btn btn-primary float-right" :task="addCommentAndClear">
                         <font-awesome-icon icon="comment"/>
                         Save Comment
-                    </button>
+                    </AsyncButton>
                 </div>
             </div>
         </li>
@@ -58,10 +58,10 @@
                 <div>
                     <textarea placeholder="reply mail..." v-model="newMail" class="form-control">
                     </textarea>
-                    <button class="btn btn-primary float-right" @click="sendMailAndClear">
+                    <AsyncButton class="btn btn-primary float-right" :task="sendMailAndClear">
                         <font-awesome-icon icon="envelope"/>
                         Send Mail
-                    </button>
+                    </AsyncButton>
                 </div>
             </div>
         </li>
@@ -77,11 +77,12 @@ import {mapActions, mapGetters} from "vuex";
 import TimelineAssignment from "@/components/TimelineAssignment.vue";
 import TimelineRelatedItem from "@/components/TimelineRelatedItem.vue";
 import TimelineShippingVoucher from "@/components/TimelineShippingVoucher.vue";
+import AsyncButton from "@/components/inputs/AsyncButton.vue";
 
 export default {
     name: 'Timeline',
     components: {
-        TimelineShippingVoucher,
+        TimelineShippingVoucher, AsyncButton,
         TimelineRelatedItem, TimelineAssignment, TimelineStateChange, TimelineComment, TimelineMail
     },
     props: {
@@ -103,18 +104,15 @@ export default {
         },
     },
     methods: {
-        ...mapActions(['fetchShippingVouchers']),
-        sendMailAndClear: function () {
-            this.$emit('sendMail', this.newMail);
+        ...mapActions(['sendMail', 'postComment']),
+        sendMailAndClear: async function () {
+            await this.sendMail(this.newMail);
             this.newMail = "";
         },
-        addCommentAndClear: function () {
-            this.$emit('addComment', this.newComment);
+        addCommentAndClear: async function () {
+            await this.postComment(this.newComment);
             this.newComment = "";
         }
-    },
-    mounted() {
-        this.fetchShippingVouchers();
     }
 };
 </script>

web/src/components/inputs/AsyncButton.vue

@@ -0,0 +1,47 @@
+<template>
+    <button @click.stop="handleClick" :disabled="disabled">
+        <span class="spinner-border spinner-border-sm" role="status" aria-hidden="true"
+              :class="{'d-none': !disabled}"></span>
+        <span class="ml-2" :class="{'d-none': !disabled}">In Progress...</span>
+        <span :class="{'d-none': disabled}"><slot></slot></span>
+    </button>
+</template>
+
+<script>
+
+export default {
+    name: 'AsyncButton',
+    data() {
+        return {
+            disabled: false,
+        };
+    },
+    props: {
+        task: {
+            type: Function,
+            required: true,
+        },
+    },
+    methods: {
+        async handleClick() {
+            console.log("AsyncButton.handleClick() called");
+            if (this.task && typeof this.task === 'function') {
+                this.disabled = true;
+                try {
+                    await this.task();
+                } catch (e) {
+                    console.error(e);
+                } finally {
+                    this.disabled = false;
+                }
+            }
+        },
+    }
+};
+</script>
+
+<style scoped>
+.spinner-border {
+    vertical-align: -0.125em;
+}
+</style>

web/src/components/inputs/SearchBox.vue

@@ -0,0 +1,43 @@
+<template>
+    <input
+        class="form-control w-100"
+        type="search"
+        placeholder="Search"
+        aria-label="Search"
+        v-model="search_query"
+        @keyup.enter="dispatchSearch"
+    >
+</template>
+
+<script>
+
+import {mapActions, mapGetters} from "vuex";
+
+export default {
+    name: 'SearchBox',
+    data() {
+        return {
+            search_query: ''
+        }
+    },
+    computed: {
+        ...mapGetters(['getActiveView'])
+    },
+    methods: {
+        ...mapActions(['searchEventItems', 'searchEventTickets']),
+        isItemView() {
+            return this.getActiveView === 'items' || this.getActiveView === 'item';
+        },
+        isTicketView() {
+            return this.getActiveView === 'tickets' || this.getActiveView === 'ticket';
+        },
+        dispatchSearch() {
+            if (this.isItemView()) {
+                this.searchEventItems(this.search_query);
+            } else if (this.isTicketView()) {
+                this.searchEventTickets(this.search_query);
+            }
+        }
+    }
+};
+</script>

web/src/router.js

@@ -7,7 +7,7 @@ import Files from './views/Files';
 import HowTo from './views/HowTo';
 import Login from '@/views/Login.vue';
 import Register from '@/views/Register.vue';
-import Debug from "@/views/admin/Debug.vue";
+import Dashboard from "@/views/admin/Dashboard.vue";
 import Tickets from "@/views/Tickets.vue";
 import Ticket from "@/views/Ticket.vue";
 import Admin from "@/views/admin/Admin.vue";
@@ -59,7 +59,7 @@ const routes = [
                     {requiresAuth: true, requiresPermission: 'delete_event'}
             },
             {
-                path: '', name: 'admin', component: Debug, meta:
+                path: '', name: 'admin', component: Dashboard, meta:
                     {requiresAuth: true, requiresPermission: 'delete_event'}
             },
             {

web/src/store.js

@@ -23,6 +23,7 @@ const store = createStore({
 
         lastEvent: '37C3',
         lastUsed: {},
+        searchQuery: '',
         remember: false,
         user: {
             username: null,
@@ -355,10 +356,9 @@ const store = createStore({
             }
         },
         async searchEventItems({commit, getters, state}, query) {
-            const foo = utf8.encode(query);
-            const bar = base64.encode(foo);
+            const encoded_query = base64.encode(utf8.encode(query));
 
-            const {data, success} = await http.get(`/2/${getters.getEventSlug}/items/${bar}/`, state.user.token);
+            const {data, success} = await http.get(`/2/${getters.getEventSlug}/items/${encoded_query}/`, state.user.token);
             if (data && success)
                 commit('replaceLoadedItems', data);
         },
@@ -407,6 +407,13 @@ const store = createStore({
             if (data && success)
                 commit('replaceTickets', data);
         },
+        async searchEventTickets({commit, getters, state}, query) {
+            const encoded_query = base64.encode(utf8.encode(query));
+
+            const {data, success} = await http.get(`/2/${getters.getEventSlug}/tickets/${encoded_query}/`, state.user.token);
+            if (data && success)
+                commit('replaceTickets', data);
+        },
         async sendMail({commit, dispatch, state}, {id, message}) {
             const {data, success} = await http.post(`/2/tickets/${id}/reply/`, {message}, state.user.token);
             if (data && success) {

web/src/views/Items.vue

@@ -1,4 +1,5 @@
 <template>
+    <AsyncLoader :loaded="loadedItems.length > 0">
         <div class="container-fluid px-xl-5 mt-3">
             <Modal title="Edit Item" v-if="editingItem" @close="closeEditingModal()">
                 <template #body>
@@ -24,7 +25,8 @@
                         <template #actions="{ item }">
                             <div class="btn-group">
                                 <button class="btn btn-success"
-                                    @click.stop="confirm('return Item?') && markItemReturned(item)" title="returned">
+                                        @click.stop="confirm('return Item?') && markItemReturned(item)"
+                                        title="returned">
                                     <font-awesome-icon icon="check"/>
                                 </button>
                                 <button class="btn btn-secondary" @click.stop="openEditingModalWith(item)" title="edit">
@@ -60,10 +62,12 @@
                                     @click.stop="confirm('return Item?') && markItemReturned(item)" title="returned">
                                 <font-awesome-icon icon="check"/>
                             </button>
-                        <button class="btn btn-outline-secondary" @click.stop="openEditingModalWith(item)" title="edit">
+                            <button class="btn btn-outline-secondary" @click.stop="openEditingModalWith(item)"
+                                    title="edit">
                                 <font-awesome-icon icon="edit"/>
                             </button>
-                        <button class="btn btn-outline-danger" @click.stop="confirm('delete Item?') && deleteItem(item)"
+                            <button class="btn btn-outline-danger"
+                                    @click.stop="confirm('delete Item?') && deleteItem(item)"
                                     title="delete">
                                 <font-awesome-icon icon="trash"/>
                             </button>
@@ -72,6 +76,7 @@
                 </div>
             </Cards>
         </div>
+    </AsyncLoader>
 </template>
 
 <script>
@@ -82,6 +87,7 @@ import EditItem from '@/components/EditItem';
 import {mapActions, mapGetters, mapState} from 'vuex';
 import Lightbox from '../components/Lightbox';
 import AuthenticatedImage from "@/components/AuthenticatedImage.vue";
+import AsyncLoader from "@/components/AsyncLoader.vue";
 
 export default {
     name: 'Items',
@@ -89,7 +95,7 @@ export default {
         lightboxHash: null,
         editingItem: null,
     }),
-    components: {AuthenticatedImage, Lightbox, Table, Cards, Modal, EditItem},
+    components: {AsyncLoader, AuthenticatedImage, Lightbox, Table, Cards, Modal, EditItem},
     computed: {
         ...mapState(['loadedItems']),
         ...mapGetters(['layout']),

web/src/views/Ticket.vue

@@ -1,4 +1,5 @@
 <template>
+    <AsyncLoader :loaded="ticket.id">
         <div class="container-fluid px-xl-5 mt-3">
             <div class="row">
                 <div class="col-xl-8 offset-xl-2">
@@ -14,18 +15,25 @@
                                 Delete
                             </button-->
                             <div class="btn-group">
-                            <select class="form-control" v-model="ticket.assigned_to">
+                                <select class="form-control" v-model="selected_assignee">
                                     <option v-for="user in users" :value="user.username">{{ user.username }}</option>
                                 </select>
-                            <button class="form-control btn btn-success" @click="assigTicket(ticket)">
+                                <button class="form-control btn btn-success"
+                                        @click="assignTicket(ticket)"
+                                        :disabled="!selected_assignee || (selected_assignee == ticket.assigned_to)">
                                     Assign&nbsp;Ticket
                                 </button>
                             </div>
                             <div class="btn-group">
-                            <select class="form-control" v-model="ticket.state">
-                                <option v-for="status in state_options" :value="status.value">{{ status.text }}</option>
+                                <select class="form-control" v-model="selected_state">
+                                    <option v-for="status in state_options" :value="status.value">{{
+                                            status.text
+                                        }}
+                                    </option>
                                 </select>
-                            <button class="form-control btn btn-success" @click="changeTicketStatus(ticket)">
+                                <button class="form-control btn btn-success"
+                                        @click="changeTicketStatus(ticket)"
+                                        :disabled="(selected_state == ticket.state)">
                                     Change&nbsp;Status
                                 </button>
                             </div>
@@ -52,19 +60,23 @@
                 </div>
             </div>
         </div>
+    </AsyncLoader>
 </template>
 
 <script>
 import {mapActions, mapGetters, mapState} from 'vuex';
 import Timeline from "@/components/Timeline.vue";
 import ClipboardButton from "@/components/inputs/ClipboardButton.vue";
+import AsyncLoader from "@/components/AsyncLoader.vue";
 
 export default {
     name: 'Ticket',
-    components: {ClipboardButton, Timeline},
+    components: {AsyncLoader, ClipboardButton, Timeline},
     data() {
         return {
-            shipping_voucher_type: null
+            selected_state: null,
+            selected_assignee: null,
+            shipping_voucher_type: null,
         }
     },
     computed: {
@@ -83,7 +95,7 @@ export default {
     methods: {
         ...mapActions(['deleteItem', 'markItemReturned', 'sendMail', 'updateTicketPartial', 'postComment']),
         ...mapActions(['loadTickets', 'fetchTicketStates', 'loadUsers', 'scheduleAfterInit']),
-        ...mapActions(['claimShippingVoucher']),
+        ...mapActions(['claimShippingVoucher', 'fetchShippingVouchers']),
         handleMail(mail) {
             this.sendMail({
                 id: this.ticket.id,
@@ -97,20 +109,29 @@ export default {
             })
         },
         changeTicketStatus(ticket) {
+            ticket.state = this.selected_state;
             this.updateTicketPartial({
                 id: ticket.id,
-                state: ticket.state
+                state: this.selected_state,
             })
         },
-        assigTicket(ticket) {
+        assignTicket(ticket) {
+            ticket.assigned_to = this.selected_assignee;
             this.updateTicketPartial({
                 id: ticket.id,
-                assigned_to: ticket.assigned_to
+                assigned_to: this.selected_assignee
             })
         },
     },
     mounted() {
-        this.scheduleAfterInit(() => [this.fetchTicketStates(), this.loadTickets(), this.loadUsers()]);
+		this.scheduleAfterInit(() => [Promise.all([this.fetchTicketStates(), this.loadTickets(), this.loadUsers(), this.fetchShippingVouchers()]).then(()=>{
+			if (this.ticket.state == "pending_new"){
+				this.selected_state = "pending_open";
+				this.changeTicketStatus(this.ticket)
+			};
+			this.selected_state = this.ticket.state;
+			this.selected_assignee = this.ticket.assigned_to
+		})]);
     }
 };
 </script>

web/src/views/Tickets.vue

@@ -1,14 +1,15 @@
 <template>
+    <AsyncLoader :loaded="tickets.length > 0">
         <div class="container-fluid px-xl-5 mt-3">
             <div class="row">
                 <div class="col-xl-8 offset-xl-2">
                     <Table
-                    :columns="['id', 'name', 'state', 'last_activity', 'assigned_to']"
-                    :items="tickets"
+                        :columns="['id', 'name', 'state', 'last_activity', 'assigned_to', 'actions', 'actions2']"
+                        :items="tickets.map(formatTicket)"
                         :keyName="'id'"
                         v-if="layout === 'table'"
                     >
-                    <template #actions="{ item }">
+                        <template v-slot:actions="{item}">
                             <div class="btn-group">
                                 <a class="btn btn-primary" :href="'/'+ getEventSlug + '/ticket/' + item.id" title="view"
                                    @click.prevent="gotoDetail(item)">
@@ -46,6 +47,7 @@
                 </template>
             </CollapsableCards>
         </div>
+    </AsyncLoader>
 </template>
 
 <script>
@@ -56,10 +58,11 @@ import {mapActions, mapGetters, mapState} from 'vuex';
 import Lightbox from '../components/Lightbox';
 import Table from '@/components/Table';
 import CollapsableCards from "@/components/CollapsableCards.vue";
+import AsyncLoader from "@/components/AsyncLoader.vue";
 
 export default {
     name: 'Tickets',
-    components: {Lightbox, Table, Cards, Modal, EditItem, CollapsableCards},
+    components: {AsyncLoader, Lightbox, Table, Cards, Modal, EditItem, CollapsableCards},
     computed: {
         ...mapState(['tickets']),
         ...mapGetters(['stateInfo', 'getEventSlug', 'layout']),

web/src/views/admin/Dashboard.vue

@@ -0,0 +1,33 @@
+<template>
+    <div>
+        <h3 class="text-center">Events</h3>
+        <ul>
+            <li v-for="event in events" :key="event.id">
+                {{ event.slug }}
+            </li>
+        </ul>
+    </div>
+</template>
+
+<script>
+import {mapActions, mapState} from 'vuex';
+import Table from '@/components/Table';
+
+export default {
+    name: 'Dashboard',
+    components: {},
+    computed: {
+        ...mapState(['events']),
+    },
+    methods: {
+        ...mapActions(['loadEvents']),
+
+    },
+    mounted() {
+        this.loadEvents();
+    }
+};
+</script>
+
+<style>
+</style>

web/src/views/admin/Debug.vue

@@ -1,62 +0,0 @@
-<template>
-    <div>
-    <!--qr-code :text="qr_url" color="#000" bg-color="#fff" error-level="H" class="qr-code"></qr-code-->
-    <h3 class="text-center">Events</h3>
-    <!--p>{{ events }}</p-->
-    <ul>
-        <li v-for="event in events" :key="event.id">
-            {{ event.slug }}
-        </li>
-    </ul>
-    <h3 class="text-center">Items</h3>
-    <!--p>{{ loadedItems }}</p-->
-    <ul>
-        <li v-for="item in loadedItems" :key="item.id">
-            {{ item.description }}
-        </li>
-    </ul>
-    <h3 class="text-center">Boxes</h3>
-    <!--p>{{ loadedBoxes }}</p-->
-    <ul>
-        <li v-for="box in loadedBoxes" :key="box.id">
-            {{ box.name }}
-        </li>
-    </ul>
-    <h3 class="text-center">Issues</h3>
-    <!--p>{{ issues }}</p-->
-    <ul>
-        <li v-for="issue in tickets" :key="issue.id">
-            {{ issue.id }}
-        </li>
-    </ul>
-    </div>
-</template>
-
-<script>
-import {mapActions, mapState} from 'vuex';
-import Table from '@/components/Table';
-
-export default {
-    name: 'Debug',
-    components: {Table},
-    computed: {
-        ...mapState(['events', 'loadedItems', 'loadedBoxes', 'tickets']),
-        qr_url() {
-            return window.location.href;
-        }
-    },
-    methods: {
-        ...mapActions(['changeEvent', 'loadTickets']),
-
-    },
-    mounted() {
-        this.loadTickets();
-    }
-};
-</script>
-
-<style>
-.qr-code img {
-    border: #fff solid 7px
-}
-</style>