Merge pull request #44 from robswc/password-protection

add password protection for GUI page

Author: robswc

README.md

@@ -1,7 +1,6 @@
 ![demopic](https://user-images.githubusercontent.com/38849824/160300853-ef6fe753-36d6-41a9-9bd2-8a06f7add71d.png)
 
 ![](https://img.shields.io/github/license/robswc/tradingview-webhooks-bot?style=for-the-badge)
-![](https://img.shields.io/github/repo-size/robswc/tradingview-webhooks-bot?style=for-the-badge)
 ![](https://img.shields.io/github/commit-activity/y/robswc/tradingview-webhooks-bot?style=for-the-badge)
 ![](https://img.shields.io/twitter/follow/robswc?style=for-the-badge)
 

requirements.txt

@@ -32,6 +32,22 @@
 @app.route("/", methods=["GET"])
 def dashboard():
     if request.method == 'GET':
+
+        # check if gui key file exists
+        try:
+            with open('.gui_key', 'r') as key_file:
+                gui_key = key_file.read().strip()
+                # check that the gui key from file matches the gui key from request
+                if gui_key == request.args.get('guiKey', None):
+                    pass
+                else:
+                    return 'Access Denied', 401
+
+        # if gui key file does not exist, the tvwb.py did not start gui in closed mode
+        except FileNotFoundError:
+            logger.warning('GUI key file not found. Open GUI mode detected.')
+
+        # serve the dashboard
         action_list = am.get_all()
         return render_template(
             template_name_or_list='dashboard.html',

src/main.py

@@ -1,3 +1,4 @@
+import os
 from logging import getLogger, DEBUG
 
 import typer
@@ -16,9 +17,60 @@
 logger = get_logger(__name__)
 
 
-@app.command()
-def start():
-    run('gunicorn --bind 0.0.0.0:5000 wsgi:app'.split(' '))
+@app.command('start')
+def start(
+        open_gui: bool = typer.Option(
+            default=False,
+            help='Determines whether the GUI should be served at the root path, or behind a unique key.',
+        ),
+        host: str = typer.Option(
+            default='0.0.0.0'
+        ),
+        port: int = typer.Option(
+            default=5000
+        )
+):
+
+    def clear_gui_key():
+        try:
+            os.remove('.gui_key')
+        except FileNotFoundError:
+            pass
+
+    def generate_gui_key():
+        import secrets
+        if os.path.exists('.gui_key'):
+            pass
+        else:
+            open('.gui_key', 'w').write(secrets.token_urlsafe(24))
+
+    def read_gui_key():
+        return open('.gui_key', 'r').read()
+
+    def print_gui_info():
+        if open_gui:
+            print('GUI is set to [OPEN] - it will be served at the root path.')
+            print(f'\n\tView GUI dashboard here: http://{host}:{port}\n')
+        else:
+            print('GUI is set to [CLOSED] - it will be served at the path /?guiKey=<unique_key>')
+            print(f'\n\tView GUI dashboard here: http://{host}:{port}?guiKey={read_gui_key()}\n')
+            print('To run the GUI in [OPEN] mode (for development purposes only), run the following command: tvwb start --open-gui')
+            gui_modes_url = 'https://github.com/robswc/tradingview-webhooks-bot/discussions/43'
+            print(f'To learn more about GUI modes, visit: {gui_modes_url}')
+
+
+    def run_server():
+        run(f'gunicorn --bind {host}:{port} wsgi:app'.split(' '))
+
+    # clear gui key if gui is set to open, else generate key
+    if open_gui:
+        clear_gui_key()
+    else:
+        generate_gui_key()
+
+    print_gui_info()
+    run_server()
+
 
 
 @app.command('action:create')
@@ -156,5 +208,6 @@ def shell():
         run(f'python3 tvwb.py {cmd}'.split(' '))
         cmd = typer.prompt("Enter TVWB command (q) to exit")
 
+
 if __name__ == "__main__":
     app()