mirror of
https://github.com/maziggy/bambuddy.git
synced 2026-09-30 11:12:35 +02:00
fix(auth): API keys with Manage Library can curate library files (#1832)
require_ownership_permission gates API keys on `all_perm` only — the
comment at auth.py:1659 says OWN and ALL "both map to the same scope
flag" for queue / archives / etc., so checking `all_perm` is the
correct gate. Library deliberately broke that: LIBRARY_UPDATE_OWN /
LIBRARY_DELETE_OWN mapped to can_manage_library, but the ALL variants
were in _APIKEY_DENIED_PERMISSIONS. Result — every API-key request to
DELETE /library/files/{id}, PUT /library/files/{id} (rename), or
POST /library/files/move hit "administrative operations" 403, even
for keys with can_manage_library=True. Only slice worked, because it
doesn't go through require_ownership_permission.
The "ALL stays admin-only because it crosses the user boundary"
intent was internally inconsistent. API keys have no per-row
ownership identity (user=None), so the route's
`file.created_by_id != user.id` ownership check would AttributeError
on a key acting under OWN anyway — the only working path is
can_modify_all=True, which `all_perm` denial blocked outright.
Fix folds LIBRARY_UPDATE_ALL and LIBRARY_DELETE_ALL into
_APIKEY_SCOPE_BY_PERMISSION under can_manage_library, matching the
can_queue precedent (QUEUE_UPDATE_OWN and QUEUE_UPDATE_ALL both
map to can_queue for the same per-key-identity reason). Both removed
from _APIKEY_DENIED_PERMISSIONS. LIBRARY_PURGE stays denied — it
bypasses the soft-delete window and is genuinely destructive.
This commit is contained in:
maziggy
File diff suppressed because one or more lines are too long
@@ -63,6 +63,11 @@ from backend.app.utils.http import build_content_disposition
|
||||
logger = logging.getLogger(__name__)
|
||||
router = APIRouter(prefix="/printers", tags=["printers"])
|
||||
|
||||
# Seconds the /hms/execute-action route waits for a printer status push
|
||||
# confirming the command landed before reporting 502 to the UI. Module-level
|
||||
# so tests can monkeypatch a near-zero value instead of mocking asyncio.sleep.
|
||||
HMS_ACTION_ACK_WAIT_SECONDS = 2.5
|
||||
|
||||
|
||||
async def _caller_can_view_printer_secrets(user: User | None, db: AsyncSession) -> bool:
|
||||
"""Whether the caller is trusted enough to see ``access_code`` on a printer
|
||||
@@ -458,7 +463,13 @@ async def get_printer_status(
|
||||
# Convert HMS errors to response format
|
||||
hms_errors = [
|
||||
HMSErrorResponse(
|
||||
code=e.code, attr=e.attr, module=e.module, severity=e.severity, actions=e.actions, job_id=e.job_id
|
||||
code=e.code,
|
||||
attr=e.attr,
|
||||
module=e.module,
|
||||
severity=e.severity,
|
||||
actions=e.actions,
|
||||
job_id=e.job_id,
|
||||
full_code=e.full_code,
|
||||
)
|
||||
for e in (state.hms_errors or [])
|
||||
]
|
||||
@@ -3809,8 +3820,37 @@ async def execute_hms_action(
|
||||
if not client:
|
||||
raise HTTPException(400, "Printer not connected")
|
||||
|
||||
# Snapshot pre-state so we can verify the printer actually acted on the
|
||||
# command. publish() success is NOT the same as printer-ack: Bambu's
|
||||
# firmware silently rejects malformed HMS commands at QoS 1 (the broker
|
||||
# ACKs the publish, but the printer drops it). Verified end-to-end against
|
||||
# a live H2D — see #1830 §(3). We sample (gcode_state, hms_errors length)
|
||||
# because every accepted HMS action mutates at least one of them.
|
||||
#
|
||||
# PrinterState.state carries the MQTT `gcode_state` value verbatim (see
|
||||
# bambu_mqtt.py line 2144); the raw `print_error` int isn't preserved on
|
||||
# state, only the derived HMSError entries are.
|
||||
pre_gcode = client.state.state
|
||||
pre_hms_count = len(client.state.hms_errors)
|
||||
|
||||
success = client.execute_hms_action(body.print_error, body.action, body.job_id)
|
||||
if not success:
|
||||
raise HTTPException(400, "Failed to execute HMS action")
|
||||
|
||||
# Give the printer time to push a state update. The dispatch helper already
|
||||
# publishes a pushall after every command, so a fresh status should arrive
|
||||
# within ~1s; the default 2.5s covers slower firmware variants without
|
||||
# making the UI feel hung. Plain sleep is fine — paho's MQTT callback
|
||||
# runs in its own thread and updates state regardless of whether this
|
||||
# coroutine is awaiting.
|
||||
await asyncio.sleep(HMS_ACTION_ACK_WAIT_SECONDS)
|
||||
|
||||
acked = client.state.state != pre_gcode or len(client.state.hms_errors) != pre_hms_count
|
||||
if not acked:
|
||||
# Publish succeeded but the printer's state didn't move. Almost always
|
||||
# firmware-side silent rejection (err mismatch, command/state mismatch).
|
||||
# 502 makes it visible at the UI instead of the 200-but-broken loop
|
||||
# #1830 reported.
|
||||
raise HTTPException(502, "Printer did not acknowledge HMS action within 2.5s")
|
||||
|
||||
return {"success": True, "message": "HMS action executed"}
|
||||
|
||||
@@ -112,13 +112,21 @@ _APIKEY_SCOPE_BY_PERMISSION: dict[Permission, str] = {
|
||||
Permission.PRINTERS_AMS_RFID: "can_control_printer",
|
||||
Permission.PRINTERS_CLEAR_PLATE: "can_control_printer",
|
||||
Permission.SMART_PLUGS_CONTROL: "can_control_printer",
|
||||
# can_manage_library — file-manager scope (upload/rename/delete OWN library
|
||||
# can_manage_library — file-manager scope (upload/rename/delete library
|
||||
# entries + MakerWorld import which downloads files into the library).
|
||||
# Bulk/ALL-ownership library ops (UPDATE_ALL / DELETE_ALL / PURGE) stay
|
||||
# admin-only because they cross the user boundary.
|
||||
# OWN and ALL ownership variants map to the same scope so the
|
||||
# `require_ownership_permission` checker (which gates on `all_perm`)
|
||||
# passes the API key through. This matches `can_queue` and the
|
||||
# archives/inventory scopes — API keys have no per-row ownership identity
|
||||
# (line 1663), so splitting OWN/ALL across allowlist/denylist made the
|
||||
# whole library curation surface unreachable for API keys (#1832).
|
||||
# LIBRARY_PURGE stays admin-only as a genuinely destructive op that
|
||||
# bypasses the soft-delete window.
|
||||
Permission.LIBRARY_UPLOAD: "can_manage_library",
|
||||
Permission.LIBRARY_UPDATE_OWN: "can_manage_library",
|
||||
Permission.LIBRARY_UPDATE_ALL: "can_manage_library",
|
||||
Permission.LIBRARY_DELETE_OWN: "can_manage_library",
|
||||
Permission.LIBRARY_DELETE_ALL: "can_manage_library",
|
||||
Permission.MAKERWORLD_IMPORT: "can_manage_library",
|
||||
# can_manage_inventory — inventory write scope. Covers the documented
|
||||
# spool/catalog/forecast write surface AND the SpoolBuddy kiosk endpoints
|
||||
@@ -183,8 +191,11 @@ _APIKEY_DENIED_PERMISSIONS: frozenset[Permission] = frozenset(
|
||||
Permission.ARCHIVES_DELETE_OWN,
|
||||
Permission.ARCHIVES_DELETE_ALL,
|
||||
Permission.ARCHIVES_PURGE,
|
||||
Permission.LIBRARY_UPDATE_ALL,
|
||||
Permission.LIBRARY_DELETE_ALL,
|
||||
# LIBRARY_UPDATE_ALL / LIBRARY_DELETE_ALL moved to the allowlist
|
||||
# under `can_manage_library` (#1832) — split between allow/deny made
|
||||
# the whole library curation surface unreachable for API keys via
|
||||
# `require_ownership_permission`. Purge stays denied as a genuinely
|
||||
# destructive op.
|
||||
Permission.LIBRARY_PURGE,
|
||||
Permission.PROJECTS_CREATE,
|
||||
Permission.PROJECTS_UPDATE,
|
||||
|
||||
@@ -155,6 +155,13 @@ class HMSErrorResponse(BaseModel):
|
||||
severity: int # 1=fatal, 2=serious, 3=common, 4=info
|
||||
actions: list[str] = [] # List of user-facing action keys (e.g. "CHECK_FILAMENT")
|
||||
job_id: str | None = None # Optional job ID for actions that require it (e.g. "CHECK_ASSISTANT")
|
||||
# Canonical hex identifier the firmware uses to match HMS-related commands.
|
||||
# 16 chars for `hms[]`-array faults (full 64-bit attr+code), 8 chars for
|
||||
# `print_error` faults. The frontend echoes this back as
|
||||
# HmsActionBody.print_error so we send the firmware-recognised key, not the
|
||||
# truncated short_code that historically caused silent command rejection
|
||||
# (#1830, H2D wrong-plate verification).
|
||||
full_code: str = ""
|
||||
|
||||
|
||||
class AMSTray(BaseModel):
|
||||
@@ -219,9 +226,11 @@ class AmsLabelBody(BaseModel):
|
||||
|
||||
|
||||
class HmsActionBody(BaseModel):
|
||||
# 8-char hex short code without separator (e.g. "05000070") — frontend strips
|
||||
# the underscore from the displayed `MMMM_EEEE` before sending.
|
||||
print_error: str = Field(..., min_length=8, max_length=8, pattern=r"^[0-9A-Fa-f]{8}$")
|
||||
# Canonical hex identifier (HMSErrorResponse.full_code): 8 chars for
|
||||
# `print_error`-sourced faults, 16 chars for `hms[]`-array faults whose
|
||||
# full 64-bit code is the firmware's matching key. Length-bounded to
|
||||
# those two valid shapes to keep stray input from reaching the dispatcher.
|
||||
print_error: str = Field(..., min_length=8, max_length=16, pattern=r"^[0-9A-Fa-f]{8}([0-9A-Fa-f]{8})?$")
|
||||
# One of the HMSAction enum values. Length-capped to keep stray input from
|
||||
# reaching the dispatcher's `match` statement.
|
||||
action: str = Field(..., min_length=1, max_length=64)
|
||||
|
||||
@@ -180,6 +180,13 @@ class HMSError:
|
||||
# The `subtask_id` snapshotted from PrinterState when this error surfaced; Bambu's
|
||||
# HMS-aware commands echo it back as `job_id`. None for idle errors with no job.
|
||||
job_id: str | None = None
|
||||
# Canonical hex identifier for the firmware's `err` matching: 16 chars for the
|
||||
# 64-bit `hms[]` array path (`f"{attr:08X}{code:08X}"`), 8 chars for the
|
||||
# 32-bit `print_error` path. The frontend echoes this back to
|
||||
# execute_hms_action; the truncated 8-char short code that `_parse_status`
|
||||
# used to send caused the firmware to silently reject HMS commands on H2C
|
||||
# (#1830) and on `hms[]`-sourced faults generally.
|
||||
full_code: str = ""
|
||||
|
||||
|
||||
# HMS short codes the firmware emits during normal user-cancel sequences.
|
||||
@@ -2740,7 +2747,15 @@ class BambuMQTTClient:
|
||||
short_code = f"{(attr >> 16) & 0xFFFF:04X}_{code & 0xFFFF:04X}"
|
||||
if short_code in _HMS_USER_ACTION_CODES:
|
||||
continue
|
||||
actions = get_actions_for_error_code(self.serial_number[:3], short_code.replace("_", ""))
|
||||
# Catalog has both 8-char keys (base class) and 16-char keys
|
||||
# (specific variants). The full 16-char identifier preserves
|
||||
# the 32 bits of `attr_low` + `code_high` that the short_code
|
||||
# discards — that's the firmware's matching key, so try it
|
||||
# first and fall back to the short form.
|
||||
full_code = f"{attr:08X}{code:08X}"
|
||||
actions = get_actions_for_error_code(self.serial_number[:3], full_code)
|
||||
if not actions:
|
||||
actions = get_actions_for_error_code(self.serial_number[:3], short_code.replace("_", ""))
|
||||
self.state.hms_errors.append(
|
||||
HMSError(
|
||||
code=f"0x{code:x}" if code else "0x0",
|
||||
@@ -2749,6 +2764,7 @@ class BambuMQTTClient:
|
||||
severity=severity if severity > 0 else 2,
|
||||
actions=actions,
|
||||
job_id=self.state.subtask_id,
|
||||
full_code=full_code,
|
||||
)
|
||||
)
|
||||
|
||||
@@ -2820,6 +2836,9 @@ class BambuMQTTClient:
|
||||
severity=3, # Warning level for print_error
|
||||
actions=actions,
|
||||
job_id=job_id,
|
||||
# print_error is already 32-bit — `f"{print_error:08X}"`
|
||||
# is the firmware's matching key with no truncation.
|
||||
full_code=f"{print_error:08X}",
|
||||
)
|
||||
)
|
||||
|
||||
@@ -5417,13 +5436,17 @@ class BambuMQTTClient:
|
||||
"""Dispatch the user's choice from the HMS-error modal as a printer command.
|
||||
|
||||
Args:
|
||||
print_error: 8-char hex short code with no separator (e.g. "05000070").
|
||||
The frontend strips the underscore from the displayed `MMMM_EEEE`
|
||||
before sending.
|
||||
print_error: Canonical hex identifier for the fault — 8 chars for the
|
||||
32-bit `print_error` path, 16 chars for the 64-bit `hms[]` path
|
||||
(HMSError.full_code). Carried through unchanged from the route.
|
||||
Only the `idle_ignore` branch puts it on the wire; resume / stop
|
||||
use BambuStudio's plain shape (verified against a live H2D, the
|
||||
`err`-bearing shape is silently rejected by the firmware).
|
||||
action: One of HMSAction's string values.
|
||||
job_id: The `subtask_id` snapshotted onto the HMSError at parse-time.
|
||||
Bambu's HMS-aware commands echo it back as `job_id`. May be None
|
||||
for idle errors that never had a job.
|
||||
Preserved for symmetry with the catalog but no longer sent —
|
||||
BambuStudio's actual resume/stop commands are plain and the
|
||||
firmware doesn't echo `job_id` back on the response either.
|
||||
|
||||
Returns False when the MQTT client is offline or when `action` is unknown
|
||||
so the route surfaces it as a 4xx rather than a silent no-op.
|
||||
@@ -5442,34 +5465,52 @@ class BambuMQTTClient:
|
||||
)
|
||||
|
||||
def hms_resume():
|
||||
# BambuStudio's actual shape — plain resume, no err / no job_id.
|
||||
# The `err`-bearing shape (`err`, `param: "reserve"`, `job_id`) is
|
||||
# silently rejected by Bambu firmware on print_error- and hms[]-sourced
|
||||
# faults alike; verified by injecting candidate shapes against a live
|
||||
# H2D paused on a wrong-plate HMS. See #1830 §(2).
|
||||
publish(
|
||||
{
|
||||
"print": {
|
||||
"command": "resume",
|
||||
"err": print_error,
|
||||
"param": "reserve",
|
||||
"job_id": job_id,
|
||||
"param": "",
|
||||
"sequence_id": "0",
|
||||
}
|
||||
}
|
||||
)
|
||||
|
||||
def hms_stop():
|
||||
# Same as hms_resume — BambuStudio's actual shape is plain. The
|
||||
# `err`-bearing variant is silently rejected; verified on the H2D.
|
||||
publish(
|
||||
{
|
||||
"print": {
|
||||
"command": "stop",
|
||||
"err": print_error,
|
||||
"param": "reserve",
|
||||
"job_id": job_id,
|
||||
"param": "",
|
||||
"sequence_id": "0",
|
||||
}
|
||||
}
|
||||
)
|
||||
|
||||
def hms_ignore(persistent: bool = False):
|
||||
# `idle_ignore` is BambuStudio's "dismiss this warning" command.
|
||||
# type=0 dismisses once, type=1 hides the same warning permanently.
|
||||
# `idle_ignore` is BambuStudio's "dismiss this warning" command for
|
||||
# non-pause warnings. type=0 dismisses once, type=1 hides the same
|
||||
# warning permanently.
|
||||
#
|
||||
# For HMS-paused state, `idle_ignore` is silently rejected by the
|
||||
# firmware regardless of `err` (verified on a live H2D — see
|
||||
# #1830 §(2)). The user-facing intent of "Ignore and resume" on a
|
||||
# paused print is to continue, so we dispatch a plain resume
|
||||
# instead. The `persistent` flag is informational in that branch —
|
||||
# firmware can't honour "don't remind" through a resume — but the
|
||||
# button still does what the user expects.
|
||||
#
|
||||
# NB: PrinterState's `state` field carries the MQTT `gcode_state`
|
||||
# value verbatim — line 2144 stores `data["gcode_state"]` onto it.
|
||||
if self.state.state == "PAUSE":
|
||||
hms_resume()
|
||||
return
|
||||
publish(
|
||||
{
|
||||
"print": {
|
||||
|
||||
@@ -1144,6 +1144,7 @@ def printer_state_to_dict(
|
||||
"severity": e.severity,
|
||||
"actions": e.actions,
|
||||
"job_id": e.job_id,
|
||||
"full_code": e.full_code,
|
||||
}
|
||||
for e in (state.hms_errors or [])
|
||||
],
|
||||
|
||||
@@ -300,9 +300,15 @@ class TestCheckApiKeyPermissionsMatrix:
|
||||
("PRINTERS_CONTROL", "can_control_printer", "start/stop print"),
|
||||
("PRINTERS_FILES", "can_control_printer", "send file to printer"),
|
||||
("SMART_PLUGS_CONTROL", "can_control_printer", "smart plug on/off"),
|
||||
# can_manage_library
|
||||
# can_manage_library — OWN and ALL ownership variants both fold into
|
||||
# the same scope (#1832): API keys have no per-row ownership identity,
|
||||
# so splitting OWN/ALL across allowlist/denylist made the curation
|
||||
# surface unreachable. PURGE stays admin-only.
|
||||
("LIBRARY_UPLOAD", "can_manage_library", "upload library file"),
|
||||
("LIBRARY_UPDATE_OWN", "can_manage_library", "rename own library file"),
|
||||
("LIBRARY_UPDATE_ALL", "can_manage_library", "rename any library file"),
|
||||
("LIBRARY_DELETE_OWN", "can_manage_library", "delete own library file"),
|
||||
("LIBRARY_DELETE_ALL", "can_manage_library", "delete any library file"),
|
||||
("MAKERWORLD_IMPORT", "can_manage_library", "import from MakerWorld"),
|
||||
# can_manage_inventory
|
||||
("INVENTORY_CREATE", "can_manage_inventory", "create spool record"),
|
||||
@@ -321,7 +327,8 @@ class TestCheckApiKeyPermissionsMatrix:
|
||||
"FIRMWARE_UPDATE",
|
||||
# Unmapped administrative (allowlist fail-closed catches these too)
|
||||
"PRINTERS_CREATE",
|
||||
"LIBRARY_DELETE_ALL",
|
||||
# LIBRARY_DELETE_ALL / LIBRARY_UPDATE_ALL moved to can_manage_library
|
||||
# under #1832 — covered by the _SCOPE_CASES matrix above.
|
||||
"LIBRARY_PURGE",
|
||||
"DISCOVERY_SCAN",
|
||||
]
|
||||
|
||||
@@ -1349,6 +1349,140 @@ class TestLibraryPermissions:
|
||||
# Viewers don't have delete_own or delete_all permissions
|
||||
assert response.status_code == 403
|
||||
|
||||
# ---------- #1832: API-key curation under can_manage_library ----------
|
||||
#
|
||||
# require_ownership_permission gates API keys on `all_perm`, but the
|
||||
# library deliberately split UPDATE_OWN/DELETE_OWN (allowed under
|
||||
# can_manage_library) from UPDATE_ALL/DELETE_ALL (previously denied).
|
||||
# That made the entire curation surface (DELETE, PUT rename, POST move)
|
||||
# unreachable for API keys, including for files the key's owner uploaded.
|
||||
# The fix folds UPDATE_ALL/DELETE_ALL into can_manage_library so the
|
||||
# checker passes; LIBRARY_PURGE stays admin-only.
|
||||
|
||||
@pytest.fixture
|
||||
async def manage_library_key(self, db_session, auth_setup):
|
||||
"""Mint an API key owned by the admin user with can_manage_library."""
|
||||
from backend.app.core.auth import generate_api_key
|
||||
from backend.app.models.api_key import APIKey
|
||||
|
||||
admin = auth_setup["admin_user"]
|
||||
full_key, key_hash, key_prefix = generate_api_key()
|
||||
row = APIKey(
|
||||
name="lib-curation",
|
||||
key_hash=key_hash,
|
||||
key_prefix=key_prefix,
|
||||
user_id=admin.id,
|
||||
can_manage_library=True,
|
||||
)
|
||||
db_session.add(row)
|
||||
await db_session.commit()
|
||||
return full_key
|
||||
|
||||
@pytest.mark.asyncio
|
||||
@pytest.mark.integration
|
||||
async def test_apikey_with_manage_library_can_delete_file(
|
||||
self, async_client: AsyncClient, db_session, auth_setup, test_file, manage_library_key
|
||||
):
|
||||
"""Pre-#1832 this 403'd with "administrative operations" because
|
||||
LIBRARY_DELETE_ALL wasn't in _APIKEY_SCOPE_BY_PERMISSION."""
|
||||
from pathlib import Path
|
||||
|
||||
from backend.app.core.config import settings as app_settings
|
||||
|
||||
# Materialise the file on disk so the delete handler doesn't 500 on
|
||||
# the path it tries to unlink.
|
||||
file_path = Path(app_settings.base_dir) / test_file.file_path
|
||||
file_path.parent.mkdir(parents=True, exist_ok=True)
|
||||
file_path.write_text("test content")
|
||||
|
||||
response = await async_client.delete(
|
||||
f"/api/v1/library/files/{test_file.id}",
|
||||
headers={"X-API-Key": manage_library_key},
|
||||
)
|
||||
assert response.status_code == 200, response.text
|
||||
|
||||
@pytest.mark.asyncio
|
||||
@pytest.mark.integration
|
||||
async def test_apikey_with_manage_library_can_rename_file(
|
||||
self, async_client: AsyncClient, db_session, auth_setup, test_file, manage_library_key
|
||||
):
|
||||
"""PUT /library/files/{id} is gated on LIBRARY_UPDATE_ALL/OWN. Same
|
||||
#1832 path as delete."""
|
||||
response = await async_client.put(
|
||||
f"/api/v1/library/files/{test_file.id}",
|
||||
headers={"X-API-Key": manage_library_key},
|
||||
json={"filename": "renamed.txt"},
|
||||
)
|
||||
assert response.status_code == 200, response.text
|
||||
assert response.json()["filename"] == "renamed.txt"
|
||||
|
||||
@pytest.mark.asyncio
|
||||
@pytest.mark.integration
|
||||
async def test_apikey_with_manage_library_can_move_file(
|
||||
self, async_client: AsyncClient, db_session, auth_setup, test_file, manage_library_key
|
||||
):
|
||||
"""POST /library/files/move (bulk) is gated on LIBRARY_UPDATE_ALL/OWN
|
||||
— same checker, same #1832 path."""
|
||||
# Create a target folder the move can land in.
|
||||
from backend.app.models.library import LibraryFolder
|
||||
|
||||
folder = LibraryFolder(name="target")
|
||||
db_session.add(folder)
|
||||
await db_session.commit()
|
||||
await db_session.refresh(folder)
|
||||
|
||||
response = await async_client.post(
|
||||
"/api/v1/library/files/move",
|
||||
headers={"X-API-Key": manage_library_key},
|
||||
json={"file_ids": [test_file.id], "folder_id": folder.id},
|
||||
)
|
||||
assert response.status_code == 200, response.text
|
||||
|
||||
@pytest.mark.asyncio
|
||||
@pytest.mark.integration
|
||||
async def test_apikey_without_manage_library_still_blocked(
|
||||
self, async_client: AsyncClient, db_session, auth_setup, test_file
|
||||
):
|
||||
"""Regression guard: a key WITHOUT can_manage_library must still get
|
||||
403 — the fix widens the allowed-permission set, it doesn't bypass
|
||||
the per-key scope check."""
|
||||
from backend.app.core.auth import generate_api_key
|
||||
from backend.app.models.api_key import APIKey
|
||||
|
||||
admin = auth_setup["admin_user"]
|
||||
full_key, key_hash, key_prefix = generate_api_key()
|
||||
row = APIKey(
|
||||
name="read-only",
|
||||
key_hash=key_hash,
|
||||
key_prefix=key_prefix,
|
||||
user_id=admin.id,
|
||||
can_read_status=True,
|
||||
can_manage_library=False,
|
||||
)
|
||||
db_session.add(row)
|
||||
await db_session.commit()
|
||||
|
||||
response = await async_client.delete(
|
||||
f"/api/v1/library/files/{test_file.id}",
|
||||
headers={"X-API-Key": full_key},
|
||||
)
|
||||
assert response.status_code == 403
|
||||
|
||||
@pytest.mark.asyncio
|
||||
@pytest.mark.integration
|
||||
async def test_apikey_with_manage_library_still_cannot_purge(
|
||||
self, async_client: AsyncClient, db_session, auth_setup, manage_library_key
|
||||
):
|
||||
"""LIBRARY_PURGE deliberately stays in _APIKEY_DENIED_PERMISSIONS as
|
||||
a genuinely destructive op that bypasses the soft-delete window.
|
||||
can_manage_library does NOT grant it."""
|
||||
response = await async_client.post(
|
||||
"/api/v1/library/purge",
|
||||
headers={"X-API-Key": manage_library_key},
|
||||
json={"days_in_trash": 30},
|
||||
)
|
||||
assert response.status_code == 403
|
||||
|
||||
|
||||
class TestPrintFileUploadValidation:
|
||||
"""#1401: pre-flight rejection of unprintable uploads at the library +
|
||||
|
||||
@@ -1770,13 +1770,32 @@ class TestExecuteHMSActionAPI:
|
||||
@pytest.mark.asyncio
|
||||
@pytest.mark.integration
|
||||
async def test_execute_hms_action_success(self, async_client: AsyncClient, printer_factory):
|
||||
"""200 happy path — dispatcher returns True, body forwarded verbatim."""
|
||||
"""200 happy path — dispatcher returns True AND printer state moves
|
||||
within the ack-wait window. The state delta is the firmware's only
|
||||
proof that the command landed (publish success is necessary but not
|
||||
sufficient; see #1830 §(3))."""
|
||||
printer = await printer_factory(name="Test Printer")
|
||||
|
||||
mock_client = MagicMock()
|
||||
mock_client.execute_hms_action.return_value = True
|
||||
# Pre-action state — paused with a fault.
|
||||
mock_client.state.state = "PAUSE"
|
||||
mock_client.state.print_error = 0x05008051
|
||||
mock_client.state.hms_errors = [object()]
|
||||
|
||||
with patch("backend.app.api.routes.printers.printer_manager") as mock_pm:
|
||||
def _act(*_a, **_kw):
|
||||
# Simulate the printer accepting the command and clearing the fault
|
||||
# by the time the ack-wait expires.
|
||||
mock_client.state.state = "FAILED"
|
||||
mock_client.state.print_error = 0
|
||||
mock_client.state.hms_errors = []
|
||||
return True
|
||||
|
||||
mock_client.execute_hms_action.side_effect = _act
|
||||
|
||||
with (
|
||||
patch("backend.app.api.routes.printers.printer_manager") as mock_pm,
|
||||
patch("backend.app.api.routes.printers.HMS_ACTION_ACK_WAIT_SECONDS", 0.01),
|
||||
):
|
||||
mock_pm.get_client.return_value = mock_client
|
||||
|
||||
body = {"print_error": "07008029", "action": "FILAMENT_EXTRUDED", "job_id": "task-7"}
|
||||
@@ -1808,17 +1827,82 @@ class TestExecuteHMSActionAPI:
|
||||
assert response.status_code == 400
|
||||
assert "failed" in response.json()["detail"].lower()
|
||||
|
||||
@pytest.mark.asyncio
|
||||
@pytest.mark.integration
|
||||
async def test_execute_hms_action_no_printer_ack_returns_502(self, async_client: AsyncClient, printer_factory):
|
||||
"""502 when publish succeeded but printer state didn't move within the
|
||||
ack-wait window. This is the silent-rejection failure mode #1830
|
||||
identifies: the broker ACKs the publish at QoS 1 but the firmware
|
||||
drops the command (err mismatch, wrong shape, state mismatch).
|
||||
Surfacing this as 502 instead of 200 stops the UI from claiming
|
||||
success while the modal sticks."""
|
||||
printer = await printer_factory(name="Test Printer")
|
||||
|
||||
mock_client = MagicMock()
|
||||
mock_client.state.state = "PAUSE"
|
||||
mock_client.state.print_error = 0x05008051
|
||||
mock_client.state.hms_errors = [object()]
|
||||
mock_client.execute_hms_action.return_value = True # publish "succeeded"
|
||||
# Crucially: state does NOT change → ack-wait detects no movement.
|
||||
|
||||
with (
|
||||
patch("backend.app.api.routes.printers.printer_manager") as mock_pm,
|
||||
patch("backend.app.api.routes.printers.HMS_ACTION_ACK_WAIT_SECONDS", 0.01),
|
||||
):
|
||||
mock_pm.get_client.return_value = mock_client
|
||||
|
||||
response = await async_client.post(
|
||||
f"/api/v1/printers/{printer.id}/hms/execute-action", json=self._VALID_BODY
|
||||
)
|
||||
|
||||
assert response.status_code == 502
|
||||
assert "acknowledge" in response.json()["detail"].lower()
|
||||
|
||||
@pytest.mark.asyncio
|
||||
@pytest.mark.integration
|
||||
async def test_execute_hms_action_accepts_16_char_full_code(self, async_client: AsyncClient, printer_factory):
|
||||
"""200 for a 16-char full_code (hms[]-array-sourced fault). The
|
||||
schema's relaxed pattern allows both 8-char (print_error) and
|
||||
16-char (hms[]) shapes."""
|
||||
printer = await printer_factory(name="Test Printer")
|
||||
|
||||
mock_client = MagicMock()
|
||||
mock_client.state.state = "RUNNING"
|
||||
mock_client.state.print_error = 0
|
||||
mock_client.state.hms_errors = [object()]
|
||||
|
||||
def _act(*_a, **_kw):
|
||||
mock_client.state.hms_errors = []
|
||||
return True
|
||||
|
||||
mock_client.execute_hms_action.side_effect = _act
|
||||
|
||||
with (
|
||||
patch("backend.app.api.routes.printers.printer_manager") as mock_pm,
|
||||
patch("backend.app.api.routes.printers.HMS_ACTION_ACK_WAIT_SECONDS", 0.01),
|
||||
):
|
||||
mock_pm.get_client.return_value = mock_client
|
||||
|
||||
body = {"print_error": "0C00030000020010", "action": "IGNORE_RESUME"}
|
||||
response = await async_client.post(f"/api/v1/printers/{printer.id}/hms/execute-action", json=body)
|
||||
|
||||
assert response.status_code == 200
|
||||
mock_client.execute_hms_action.assert_called_once_with("0C00030000020010", "IGNORE_RESUME", None)
|
||||
|
||||
@pytest.mark.asyncio
|
||||
@pytest.mark.integration
|
||||
async def test_execute_hms_action_rejects_malformed_print_error(self, async_client: AsyncClient, printer_factory):
|
||||
"""422 when print_error fails the ^[0-9A-Fa-f]{8}$ pattern — stray
|
||||
"""422 when print_error fails the relaxed pattern (8 OR 16 hex chars).
|
||||
Lengths in between (9-15) and outside (7, 17+) are invalid; stray
|
||||
input can't reach the dispatcher's match statement."""
|
||||
printer = await printer_factory(name="Test Printer")
|
||||
|
||||
bad_bodies = [
|
||||
{"print_error": "0300_8070", "action": "OK_BUTTON"}, # underscore
|
||||
{"print_error": "0300807", "action": "OK_BUTTON"}, # 7 chars
|
||||
{"print_error": "030080700", "action": "OK_BUTTON"}, # 9 chars
|
||||
{"print_error": "0300807", "action": "OK_BUTTON"}, # 7 chars (too short)
|
||||
{"print_error": "030080700", "action": "OK_BUTTON"}, # 9 chars (between)
|
||||
{"print_error": "030080700300807", "action": "OK_BUTTON"}, # 15 chars (between)
|
||||
{"print_error": "0300807003008070A", "action": "OK_BUTTON"}, # 17 chars (too long)
|
||||
{"print_error": "0300GGGG", "action": "OK_BUTTON"}, # non-hex
|
||||
]
|
||||
for body in bad_bodies:
|
||||
|
||||
@@ -4928,6 +4928,83 @@ class TestHMSUserActionFiltering:
|
||||
assert mqtt_client.state.hms_errors[0].code == "0x8061"
|
||||
|
||||
|
||||
class TestHMSFullCode:
|
||||
"""full_code is the firmware-matching key for HMS-related commands.
|
||||
Truncating it to the 8-char short code is what caused #1830's silent
|
||||
rejection on H2C, and the H2D wrong-plate path needs the print_error
|
||||
32-bit form. Both branches must populate full_code consistently."""
|
||||
|
||||
@pytest.fixture
|
||||
def mqtt_client(self):
|
||||
from backend.app.services.bambu_mqtt import BambuMQTTClient
|
||||
|
||||
return BambuMQTTClient(
|
||||
ip_address="192.168.1.100",
|
||||
serial_number="TEST_FULLCODE",
|
||||
access_code="12345678",
|
||||
)
|
||||
|
||||
def test_hms_array_path_populates_16_char_full_code(self, mqtt_client):
|
||||
"""hms[] entries carry a 64-bit identifier (attr + code, 32 bits each).
|
||||
The full 16-char hex is what BambuStudio uses to match err on
|
||||
idle_ignore — the truncated short_code drops 32 bits and the firmware
|
||||
silently rejects (#1830). Verifies the parser preserves the full
|
||||
identifier on HMSError.full_code."""
|
||||
# 0x07FF0200 / 0x8011 → displayed as 07FF_0200_0000_8011 in the wiki
|
||||
mqtt_client._update_state({"hms": [{"attr": 0x07FF0200, "code": 0x8011}]})
|
||||
assert len(mqtt_client.state.hms_errors) == 1
|
||||
assert mqtt_client.state.hms_errors[0].full_code == "07FF02000000" + "8011"
|
||||
|
||||
def test_print_error_path_populates_8_char_full_code(self, mqtt_client):
|
||||
"""print_error is already 32 bits — no truncation. full_code is the
|
||||
8-char hex form, which is exactly what the firmware matches against."""
|
||||
mqtt_client._update_state({"print_error": 0x05008051})
|
||||
assert len(mqtt_client.state.hms_errors) == 1
|
||||
assert mqtt_client.state.hms_errors[0].full_code == "05008051"
|
||||
|
||||
def test_hms_array_catalog_lookup_tries_16_char_first(self, mqtt_client, monkeypatch):
|
||||
"""When the catalog has both an 8-char and a 16-char entry for the
|
||||
same fault family, the 16-char (specific variant) wins. The 8-char
|
||||
is the fallback for codes that aren't in the long-form catalog."""
|
||||
from backend.app.services import bambu_mqtt as mod
|
||||
|
||||
calls = []
|
||||
|
||||
def fake_lookup(device, code):
|
||||
calls.append((device, code))
|
||||
if len(code) == 16:
|
||||
return ["RESUME_PRINTING"]
|
||||
return []
|
||||
|
||||
monkeypatch.setattr(mod, "get_actions_for_error_code", fake_lookup)
|
||||
# SN prefix "TES" — irrelevant for the test, we mocked the lookup.
|
||||
mqtt_client._update_state({"hms": [{"attr": 0x07FF0200, "code": 0x8011}]})
|
||||
# 16-char lookup attempted first, then 8-char only if 16-char missed.
|
||||
assert calls[0][1] == "07FF020000008011"
|
||||
assert mqtt_client.state.hms_errors[0].actions == ["RESUME_PRINTING"]
|
||||
|
||||
def test_hms_array_catalog_falls_back_to_8_char(self, mqtt_client, monkeypatch):
|
||||
"""If the catalog has no 16-char entry, fall back to the 8-char short
|
||||
code — that's where base-class HMS codes live."""
|
||||
from backend.app.services import bambu_mqtt as mod
|
||||
|
||||
calls = []
|
||||
|
||||
def fake_lookup(device, code):
|
||||
calls.append((device, code))
|
||||
if len(code) == 16:
|
||||
return [] # no specific variant
|
||||
return ["CHECK_ASSISTANT"] # base class hit
|
||||
|
||||
monkeypatch.setattr(mod, "get_actions_for_error_code", fake_lookup)
|
||||
mqtt_client._update_state({"hms": [{"attr": 0x07FF0200, "code": 0x8011}]})
|
||||
# Two lookups: 16-char miss, then 8-char hit.
|
||||
assert len(calls) == 2
|
||||
assert calls[0][1] == "07FF020000008011"
|
||||
assert calls[1][1] == "07FF8011"
|
||||
assert mqtt_client.state.hms_errors[0].actions == ["CHECK_ASSISTANT"]
|
||||
|
||||
|
||||
class TestForceReconnectRouting:
|
||||
"""#1136 — force_reconnect_stale_session routes between hard-reset (full
|
||||
paho-client teardown, wipes the QoS 1 queue) and socket-close (the legacy
|
||||
|
||||
@@ -88,7 +88,11 @@ class TestExecuteHmsActionDispatch:
|
||||
# tail — just confirm no command went out by inspecting the helper.
|
||||
assert self._published_commands(client) == []
|
||||
|
||||
def test_resume_carries_err_param_and_job_id(self, client):
|
||||
def test_resume_is_plain_no_err_no_job_id(self, client):
|
||||
# Verified against a live H2D — the `err`-bearing shape is silently
|
||||
# rejected by Bambu firmware. BambuStudio sends a plain resume; we
|
||||
# match that. job_id is accepted on the call for symmetry with the
|
||||
# catalog but deliberately dropped from the wire. See #1830 §(2).
|
||||
ok = client.execute_hms_action("03008070", HMSAction.RESUME_PRINTING, job_id="task-42")
|
||||
assert ok is True
|
||||
cmds = self._published_commands(client)
|
||||
@@ -96,27 +100,56 @@ class TestExecuteHmsActionDispatch:
|
||||
{
|
||||
"print": {
|
||||
"command": "resume",
|
||||
"err": "03008070",
|
||||
"param": "reserve",
|
||||
"job_id": "task-42",
|
||||
"param": "",
|
||||
"sequence_id": "0",
|
||||
}
|
||||
}
|
||||
]
|
||||
assert "err" not in cmds[0]["print"]
|
||||
assert "job_id" not in cmds[0]["print"]
|
||||
|
||||
def test_proceed_falls_through_to_resume(self, client):
|
||||
client.execute_hms_action("03008070", HMSAction.PROCEED, job_id="task-1")
|
||||
cmds = self._published_commands(client)
|
||||
assert cmds[0]["print"]["command"] == "resume"
|
||||
assert cmds[0]["print"]["err"] == "03008070"
|
||||
# Same plain shape as RESUME_PRINTING — no err.
|
||||
assert "err" not in cmds[0]["print"]
|
||||
|
||||
def test_stop_carries_err_and_job_id(self, client):
|
||||
def test_stop_is_plain_no_err_no_job_id(self, client):
|
||||
# Same firmware silent-rejection class as resume — the `err` variant
|
||||
# was confirmed broken on H2D-1 (PAUSE → PAUSE), the plain shape
|
||||
# transitions to FAILED within ~2s.
|
||||
client.execute_hms_action("03008070", HMSAction.STOP_PRINTING, job_id="task-1")
|
||||
cmds = self._published_commands(client)
|
||||
assert cmds[0]["print"]["command"] == "stop"
|
||||
assert cmds[0]["print"]["job_id"] == "task-1"
|
||||
assert cmds[0] == {
|
||||
"print": {
|
||||
"command": "stop",
|
||||
"param": "",
|
||||
"sequence_id": "0",
|
||||
}
|
||||
}
|
||||
assert "err" not in cmds[0]["print"]
|
||||
assert "job_id" not in cmds[0]["print"]
|
||||
|
||||
def test_ignore_resume_uses_idle_ignore_type_zero(self, client):
|
||||
def test_ignore_resume_dispatches_resume_when_print_paused(self, client):
|
||||
# Verified on H2D: idle_ignore is silently rejected while gcode_state
|
||||
# is PAUSE. The user's intent on a paused HMS modal is to continue,
|
||||
# so IGNORE_RESUME dispatches a plain resume instead. See #1830 §(2).
|
||||
client.state.state = "PAUSE"
|
||||
client.execute_hms_action("03008070", HMSAction.IGNORE_RESUME)
|
||||
cmds = self._published_commands(client)
|
||||
assert cmds[0] == {
|
||||
"print": {
|
||||
"command": "resume",
|
||||
"param": "",
|
||||
"sequence_id": "0",
|
||||
}
|
||||
}
|
||||
|
||||
def test_ignore_resume_uses_idle_ignore_when_not_paused(self, client):
|
||||
# For non-pause warnings (e.g. AMS-side prompts during printing),
|
||||
# idle_ignore IS the correct command and the firmware honours it.
|
||||
client.state.state = "RUNNING"
|
||||
client.execute_hms_action("03008070", HMSAction.IGNORE_RESUME)
|
||||
cmds = self._published_commands(client)
|
||||
assert cmds[0] == {
|
||||
@@ -128,14 +161,32 @@ class TestExecuteHmsActionDispatch:
|
||||
}
|
||||
}
|
||||
|
||||
def test_dont_remind_uses_idle_ignore_type_one(self, client):
|
||||
# DONT_REMIND_NEXT_TIME and IGNORE_NO_REMINDER_NEXT_TIME are the
|
||||
# persistent variants — Bambu hides the warning for future prints.
|
||||
def test_dont_remind_dispatches_resume_when_paused(self, client):
|
||||
# The persistent variant still degrades to resume on a paused print —
|
||||
# the "don't remind" flag can't ride along on a resume, but the user
|
||||
# clicked an action whose top-level intent is to continue, so we
|
||||
# honour that. The behavioural contract is documented in hms_ignore.
|
||||
client.state.state = "PAUSE"
|
||||
client.execute_hms_action("03008070", HMSAction.DONT_REMIND_NEXT_TIME)
|
||||
cmds = self._published_commands(client)
|
||||
assert cmds[0]["print"]["command"] == "resume"
|
||||
|
||||
def test_dont_remind_uses_idle_ignore_type_one_when_not_paused(self, client):
|
||||
client.state.state = "RUNNING"
|
||||
client.execute_hms_action("03008070", HMSAction.DONT_REMIND_NEXT_TIME)
|
||||
cmds = self._published_commands(client)
|
||||
assert cmds[0]["print"]["command"] == "idle_ignore"
|
||||
assert cmds[0]["print"]["type"] == 1
|
||||
|
||||
def test_idle_ignore_accepts_16_char_full_code(self, client):
|
||||
# hms[]-array faults carry a 16-char full identifier. The firmware
|
||||
# matches against the full 64-bit code; the truncated 8-char form
|
||||
# (used pre-#1830) was silently rejected on H2C.
|
||||
client.state.state = "RUNNING"
|
||||
client.execute_hms_action("0C00030000020010", HMSAction.IGNORE_RESUME)
|
||||
cmds = self._published_commands(client)
|
||||
assert cmds[0]["print"]["err"] == "0C00030000020010"
|
||||
|
||||
def test_filament_extruded_sends_ams_done(self, client):
|
||||
client.execute_hms_action("07008029", HMSAction.FILAMENT_EXTRUDED)
|
||||
cmds = self._published_commands(client)
|
||||
|
||||
@@ -335,6 +335,11 @@ export interface HMSError {
|
||||
severity: number; // 1=fatal, 2=serious, 3=common, 4=info
|
||||
actions?: string[]; // List of user-facing action keys (e.g. "CHECK_FILAMENT")
|
||||
job_id?: string; // Optional job ID for actions that require it (e.g. "CHECK_ASSISTANT")
|
||||
// Canonical hex identifier the firmware matches against — 8 chars for
|
||||
// print_error-sourced faults, 16 chars for hms[]-array-sourced faults. Send
|
||||
// this back as HmsActionBody.print_error so we don't truncate the 64-bit
|
||||
// identifier into the silent-rejection short code (#1830).
|
||||
full_code?: string;
|
||||
}
|
||||
|
||||
export interface HMSActionBody {
|
||||
|
||||
@@ -1023,9 +1023,14 @@ export function HMSErrorModal({ printerName, errors, onClose, printerId, hasPerm
|
||||
<button
|
||||
key={action}
|
||||
onClick={() => {
|
||||
// full_code is the firmware-matching key (16
|
||||
// chars for hms[]-array faults, 8 chars for
|
||||
// print_error). Fall back to the 8-char
|
||||
// shortCode for older backends that haven't
|
||||
// populated it. See #1830.
|
||||
activateActionMutation.mutate({
|
||||
action,
|
||||
print_error: shortCode.replace("_", ""),
|
||||
print_error: error.full_code || shortCode.replace("_", ""),
|
||||
job_id: error.job_id ?? null,
|
||||
});
|
||||
}}
|
||||
|
||||
Reference in New Issue
Block a user