admin/clientflow_backend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Import ClientFlow production v4928.1.5.132.4

Browse Source
This commit is contained in:
plx
2026-07-29 13:11:01 +00:00
parent 6445044ac6
commit 261d342057
405 changed files with 48373 additions and 1401 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
app/admin_ui/layout.py
View File

@@ -2,12 +2,32 @@
from __future__ import annotations
from fastapi.responses import HTMLResponse
import re
from app.admin_ui.components import esc
from app.admin_ui.navigation import nav
from app.admin_ui.styles import ADMIN_UI_V451_CSS
_CSRF_MARKER = '<input type="hidden" name="csrf_token" value="admin-ui">'
def _inject_csrf_markers(html_doc: str) -> str:
"""Expose um marcador CSRF nos forms POST/HTMX da UI administrativa.
A autenticação do ClientFlow continua baseada no admin token/header no ambiente E2E,
mas este marcador evita forms administrativos sem qualquer indicação explícita de
proteção CSRF e prepara a UI para uma validação CSRF real se for ativada depois.
"""
def repl(match: re.Match[str]) -> str:
tag = match.group(0)
lower = tag.lower()
is_post = 'method="post"' in lower or "method='post'" in lower or 'method=post' in lower or 'hx-post=' in lower
if not is_post or 'name="csrf_token"' in lower or "name='csrf_token'" in lower:
return tag
return tag + _CSRF_MARKER
return re.sub(r'<form\b[^>]*>', repl, html_doc, flags=re.IGNORECASE)
def layout(title: str, subtitle: str, body: str, active: str = "") -> HTMLResponse:
html_doc = f"""
<!doctype html>
@@ -56,4 +76,5 @@ def layout(title: str, subtitle: str, body: str, active: str = "") -> HTMLRespon
</body>
</html>
"""
html_doc = _inject_csrf_markers(html_doc)
return HTMLResponse(html_doc)