feat: Google Photos provider backend + API hardening

- Add Google Photos provider: client, models, change detector, capabilities
- Add notification templates (en/ru) for all GP event slots
- Add command templates (en/ru) for GP bot commands
- Register GP in slot/command loaders, capabilities, and seeds
- Harden provider API: validate OAuth credentials on create/update
- Add internal URL rewriting for asset fetches (LAN optimization)
- Fix template renderer to handle missing variables gracefully
- Improve webhook command routing for multi-provider support
- Add provider health check endpoint and watcher improvements
This commit is contained in:
2026-03-25 22:07:03 +03:00
parent 337276113d
commit 307871cae5
73 changed files with 1154 additions and 144 deletions
@@ -104,7 +104,9 @@ async def _get(session: AsyncSession, config_id: int, user_id: int) -> CommandTe
# ---------------------------------------------------------------------------
@router.get("/variables")
async def get_command_variables():
async def get_command_variables(
user: User = Depends(get_current_user),
):
"""Get variable reference for each command template slot."""
common_vars = {
"locale": "Current locale (en/ru)",
@@ -13,7 +13,7 @@ import aiohttp
from ..auth.dependencies import get_current_user
from ..database.engine import get_session
from ..database.models import ServiceProvider, User
from ..services import make_immich_provider, make_gitea_provider, make_planka_provider, make_nut_provider
from ..services import make_immich_provider, make_gitea_provider, make_planka_provider, make_nut_provider, make_google_photos_provider
_LOGGER = logging.getLogger(__name__)
@@ -76,12 +76,19 @@ class NutProviderConfig(BaseModel):
password: str | None = None
class GooglePhotosProviderConfig(BaseModel):
client_id: str
client_secret: str
refresh_token: str
_PROVIDER_CONFIG_MODELS: dict[str, type[BaseModel]] = {
"immich": ImmichProviderConfig,
"gitea": GiteaProviderConfig,
"planka": PlankaProviderConfig,
"scheduler": SchedulerProviderConfig,
"nut": NutProviderConfig,
"google_photos": GooglePhotosProviderConfig,
}
@@ -122,65 +129,93 @@ async def create_provider(
_validate_provider_config(body.type, body.config)
# Validate connection for known provider types
if body.type == "immich":
from notify_bridge_core.providers.immich import ImmichServiceProvider
config = body.config
async with aiohttp.ClientSession() as http_session:
immich = ImmichServiceProvider(
http_session, config.get("url", ""), config.get("api_key", ""),
config.get("external_domain"), body.name,
)
test_result = await immich.test_connection()
try:
if body.type == "immich":
from notify_bridge_core.providers.immich import ImmichServiceProvider
config = body.config
async with aiohttp.ClientSession() as http_session:
immich = ImmichServiceProvider(
http_session, config.get("url", ""), config.get("api_key", ""),
config.get("external_domain"), body.name,
)
test_result = await immich.test_connection()
if not test_result.get("ok"):
raise HTTPException(
status_code=status.HTTP_400_BAD_REQUEST,
detail=test_result.get("message", f"Cannot connect to {body.type} provider"),
)
# Store external_domain from server config if available
if test_result.get("external_domain"):
config["external_domain"] = test_result["external_domain"]
elif body.type == "gitea":
config = body.config
# api_token is optional (webhook_secret is required, but token only for repo listing)
if config.get("api_token"):
async with aiohttp.ClientSession() as http_session:
from notify_bridge_core.providers.gitea import GiteaServiceProvider
gitea = GiteaServiceProvider(
http_session, config.get("url", ""), config.get("api_token", ""), body.name,
)
test_result = await gitea.test_connection()
if not test_result.get("ok"):
raise HTTPException(
status_code=status.HTTP_400_BAD_REQUEST,
detail=test_result.get("message", "Cannot connect to Gitea"),
)
elif body.type == "planka":
config = body.config
if config.get("api_key"):
async with aiohttp.ClientSession() as http_session:
from notify_bridge_core.providers.planka import PlankaServiceProvider
planka = PlankaServiceProvider(
http_session, config.get("url", ""), config.get("api_key", ""), body.name,
)
test_result = await planka.test_connection()
if not test_result.get("ok"):
raise HTTPException(
status_code=status.HTTP_400_BAD_REQUEST,
detail=test_result.get("message", "Cannot connect to Planka"),
)
elif body.type == "nut":
nut = make_nut_provider(ServiceProvider(
id=0, user_id=0, type="nut", name=body.name, config=body.config,
))
test_result = await nut.test_connection()
if not test_result.get("ok"):
raise HTTPException(
status_code=status.HTTP_400_BAD_REQUEST,
detail=test_result.get("message", f"Cannot connect to {body.type} provider"),
detail=test_result.get("message", "Cannot connect to NUT server"),
)
# Store external_domain from server config if available
if test_result.get("external_domain"):
config["external_domain"] = test_result["external_domain"]
elif body.type == "gitea":
config = body.config
# api_token is optional (webhook_secret is required, but token only for repo listing)
if config.get("api_token"):
elif body.type == "google_photos":
config = body.config
async with aiohttp.ClientSession() as http_session:
from notify_bridge_core.providers.gitea import GiteaServiceProvider
gitea = GiteaServiceProvider(
http_session, config.get("url", ""), config.get("api_token", ""), body.name,
from notify_bridge_core.providers.google_photos import GooglePhotosServiceProvider
gp = GooglePhotosServiceProvider(
http_session, config.get("client_id", ""), config.get("client_secret", ""),
config.get("refresh_token", ""), body.name,
)
test_result = await gitea.test_connection()
test_result = await gp.test_connection()
if not test_result.get("ok"):
raise HTTPException(
status_code=status.HTTP_400_BAD_REQUEST,
detail=test_result.get("message", "Cannot connect to Gitea"),
detail=test_result.get("message", "Cannot connect to Google Photos"),
)
elif body.type == "planka":
config = body.config
if config.get("api_key"):
async with aiohttp.ClientSession() as http_session:
from notify_bridge_core.providers.planka import PlankaServiceProvider
planka = PlankaServiceProvider(
http_session, config.get("url", ""), config.get("api_key", ""), body.name,
)
test_result = await planka.test_connection()
if not test_result.get("ok"):
raise HTTPException(
status_code=status.HTTP_400_BAD_REQUEST,
detail=test_result.get("message", "Cannot connect to Planka"),
)
elif body.type == "nut":
nut = make_nut_provider(ServiceProvider(
id=0, user_id=0, type="nut", name=body.name, config=body.config,
))
test_result = await nut.test_connection()
if not test_result.get("ok"):
raise HTTPException(
status_code=status.HTTP_400_BAD_REQUEST,
detail=test_result.get("message", "Cannot connect to NUT server"),
)
except HTTPException:
raise
except aiohttp.ClientError as err:
raise HTTPException(
status_code=status.HTTP_400_BAD_REQUEST,
detail=f"Connection error: {err}",
)
except OSError as err:
raise HTTPException(
status_code=status.HTTP_400_BAD_REQUEST,
detail=f"Connection error: {err}",
)
# Scheduler: no validation needed (virtual provider)
@@ -198,7 +233,9 @@ async def create_provider(
@router.get("/capabilities")
async def list_provider_capabilities():
async def list_provider_capabilities(
user: User = Depends(get_current_user),
):
"""List capabilities for all registered provider types."""
from notify_bridge_core.providers.capabilities import get_all_capabilities
result = {}
@@ -218,7 +255,10 @@ async def list_provider_capabilities():
@router.get("/capabilities/{provider_type}")
async def get_provider_capabilities(provider_type: str):
async def get_provider_capabilities(
provider_type: str,
user: User = Depends(get_current_user),
):
"""Get capabilities for a provider type (events, slots, commands)."""
from notify_bridge_core.providers.capabilities import get_capabilities
caps = get_capabilities(provider_type)
@@ -324,6 +364,21 @@ async def update_provider(
status_code=status.HTTP_400_BAD_REQUEST,
detail=test_result.get("message", "Cannot connect to NUT server"),
)
elif config_changed and provider.type == "google_photos":
try:
async with aiohttp.ClientSession() as http_session:
gp = make_google_photos_provider(http_session, provider)
test_result = await gp.test_connection()
if not test_result.get("ok"):
raise HTTPException(
status_code=status.HTTP_400_BAD_REQUEST,
detail=test_result.get("message", "Cannot connect to Google Photos"),
)
except aiohttp.ClientError as err:
raise HTTPException(
status_code=status.HTTP_400_BAD_REQUEST,
detail=f"Connection error: {err}",
)
session.add(provider)
await session.commit()
@@ -380,6 +435,11 @@ async def test_provider(
nut = make_nut_provider(provider)
return await nut.test_connection()
if provider.type == "google_photos":
async with aiohttp.ClientSession() as http_session:
gp = make_google_photos_provider(http_session, provider)
return await gp.test_connection()
return {"ok": False, "message": f"Unknown provider type: {provider.type}"}
@@ -400,22 +460,8 @@ async def list_people(
provider.config.get("url", ""),
provider.config.get("api_key", ""),
)
try:
async with http_session.get(
f"{client.url}/api/people",
headers={"x-api-key": client.api_key},
ssl=False,
) as response:
if response.status == 200:
data = await response.json()
people_list = data.get("people", data) if isinstance(data, dict) else data
return [
{"id": p["id"], "name": p.get("name", "")}
for p in people_list
if p.get("name")
]
except Exception as e:
_LOGGER.error("Failed to fetch people: %s", e)
people = await client.get_people()
return [{"id": pid, "name": name} for pid, name in people.items()]
return []
@@ -452,6 +498,11 @@ async def list_collections(
nut = make_nut_provider(provider)
return await nut.list_collections()
if provider.type == "google_photos":
async with aiohttp.ClientSession() as http_session:
gp = make_google_photos_provider(http_session, provider)
return await gp.list_collections()
return []
@@ -510,10 +561,11 @@ def _provider_response(p: ServiceProvider) -> dict:
"""Build a safe response dict for a provider."""
config = dict(p.config)
# Mask sensitive fields
for secret_field in ("api_key", "api_token", "webhook_secret", "password"):
for secret_field in ("api_key", "api_token", "webhook_secret", "password",
"client_secret", "refresh_token"):
if secret_field in config:
key = config[secret_field]
config[secret_field] = f"{key[:8]}...{key[-4:]}" if len(key) > 12 else "***"
config[secret_field] = f"***{key[-4:]}" if len(key) > 4 else "***"
return {
"id": p.id,
"type": p.type,
@@ -79,17 +79,20 @@ async def list_targets(
)
targets = result.all()
# Load receivers for each target
target_receivers: dict[int, list[TargetReceiver]] = {}
for tgt in targets:
# Batch-load all receivers for the user's targets in one query
target_ids = [tgt.id for tgt in targets]
target_receivers: dict[int, list[TargetReceiver]] = {tid: [] for tid in target_ids}
if target_ids:
recv_result = await session.exec(
select(TargetReceiver).where(TargetReceiver.target_id == tgt.id)
select(TargetReceiver).where(TargetReceiver.target_id.in_(target_ids))
)
target_receivers[tgt.id] = list(recv_result.all())
for recv in recv_result.all():
target_receivers[recv.target_id].append(recv)
# Resolve chat names and languages from receivers for telegram targets
# Batch-load chat names and languages for all telegram targets
chat_names: dict[str, str] = {}
chat_languages: dict[str, str] = {}
chat_lookups: list[tuple[int, str]] = [] # (bot_id, chat_id)
for tgt in targets:
if tgt.type == "telegram":
bot_id = tgt.config.get("bot_id")
@@ -98,18 +101,23 @@ async def list_targets(
for recv in target_receivers.get(tgt.id, []):
chat_id = str(recv.config.get("chat_id", ""))
if chat_id:
chat_result = await session.exec(
select(TelegramChat).where(
TelegramChat.bot_id == bot_id,
TelegramChat.chat_id == chat_id,
)
)
chat = chat_result.first()
if chat:
chat_names[f"{bot_id}_{chat_id}"] = chat.title or chat.username or ""
lang = getattr(chat, 'language_override', '') or getattr(chat, 'language_code', '') or ''
if lang:
chat_languages[f"{bot_id}_{chat_id}"] = lang
chat_lookups.append((bot_id, chat_id))
if chat_lookups:
all_bot_ids = list({bl[0] for bl in chat_lookups})
all_chat_ids = list({bl[1] for bl in chat_lookups})
chat_result = await session.exec(
select(TelegramChat).where(
TelegramChat.bot_id.in_(all_bot_ids),
TelegramChat.chat_id.in_(all_chat_ids),
)
)
for chat in chat_result.all():
key = f"{chat.bot_id}_{chat.chat_id}"
chat_names[key] = chat.title or chat.username or ""
lang = getattr(chat, 'language_override', '') or getattr(chat, 'language_code', '') or ''
if lang:
chat_languages[key] = lang
# Build lookup for broadcast child target resolution
target_map = {t.id: t for t in targets}
@@ -130,7 +130,9 @@ async def list_configs(
@router.get("/variables")
async def get_template_variables():
async def get_template_variables(
user: User = Depends(get_current_user),
):
"""Get template variable reference grouped by slot.
Returns a dict keyed by template slot name, each containing:
@@ -1,16 +1,22 @@
"""Template variable documentation endpoint."""
from fastapi import APIRouter
from fastapi import APIRouter, Depends
from notify_bridge_core.providers.base import ServiceProviderType
from notify_bridge_core.providers.immich import ImmichServiceProvider # noqa: F401 — triggers registration
from notify_bridge_core.templates.variables import registry
from ..auth.dependencies import get_current_user
from ..database.models import User
router = APIRouter(prefix="/api/template-vars", tags=["template-vars"])
@router.get("")
async def get_template_variables(provider_type: str | None = None):
async def get_template_variables(
provider_type: str | None = None,
user: User = Depends(get_current_user),
):
"""Get available template variables, optionally filtered by provider type."""
if provider_type:
try:
@@ -55,6 +55,9 @@ async def create_user(
if result.first():
raise HTTPException(status_code=409, detail="Username already exists")
if len(body.password) < 8:
raise HTTPException(status_code=400, detail="Password must be at least 8 characters")
user = User(
username=body.username,
hashed_password=bcrypt.hashpw(body.password.encode(), bcrypt.gensalt()).decode(),
@@ -81,8 +84,8 @@ async def reset_user_password(
user = await session.get(User, user_id)
if not user:
raise HTTPException(status_code=404, detail="User not found")
if len(body.new_password) < 6:
raise HTTPException(status_code=400, detail="Password must be at least 6 characters")
if len(body.new_password) < 8:
raise HTTPException(status_code=400, detail="Password must be at least 8 characters")
user.hashed_password = bcrypt.hashpw(body.new_password.encode(), bcrypt.gensalt()).decode()
session.add(user)
await session.commit()
@@ -156,7 +156,6 @@ async def gitea_webhook(provider_id: int, request: Request):
)},
},
))
await session.commit()
# Dispatch to targets
dispatcher = NotificationDispatcher()
@@ -172,6 +171,8 @@ async def gitea_webhook(provider_id: int, request: Request):
tracker.id, r.get("error", "unknown"),
)
await session.commit()
return {"ok": True, "dispatched": dispatched}
@@ -268,7 +269,6 @@ async def planka_webhook(provider_id: int, request: Request):
)},
},
))
await session.commit()
# Dispatch to targets
dispatcher = NotificationDispatcher()
@@ -284,6 +284,8 @@ async def planka_webhook(provider_id: int, request: Request):
tracker.id, r.get("error", "unknown"),
)
await session.commit()
return {"ok": True, "dispatched": dispatched}