start

backend/app/api/v1/devices.py

@@ -0,0 +1,494 @@
+from __future__ import annotations
+
+from datetime import datetime, timezone
+
+from fastapi import APIRouter, Depends, HTTPException, Response, status
+from sqlalchemy.orm import Session
+
+from ...core.db import get_db
+from ...core.security import decrypt_secret, encrypt_secret
+from ...models.device import Device
+from ...models.metric import DeviceMetric
+from ...models.user import User
+from ...schemas.device import (
+    DeviceCreate,
+    DeviceOut,
+    DeviceResource,
+    DeviceUpdate,
+)
+from ...services.events import add_alert, add_audit
+from ...services.routeros.client import (
+    RouterOSCredentials,
+    RouterOSError,
+    check_internet,
+    cmd_reboot,
+    cmd_safe_mode,
+    cmd_upgrade_check,
+    cmd_upgrade_install,
+    fetch_dhcp_leases,
+    fetch_identity,
+    fetch_interface_stats,
+    fetch_resource,
+    parse_uptime,
+    push_firmware_via_ftp,
+)
+from ..deps import get_current_user, require_role
+
+router = APIRouter()
+
+
+def _creds(d: Device) -> RouterOSCredentials:
+    return RouterOSCredentials(
+        host=d.host,
+        username=d.username,
+        password=decrypt_secret(d.password_enc),
+        port=d.port,
+        use_tls=d.use_tls,
+    )
+
+
+@router.get("", response_model=list[DeviceOut])
+def list_devices(
+    kind: str | None = None,
+    db: Session = Depends(get_db),
+    _: User = Depends(get_current_user),
+) -> list[Device]:
+    q = db.query(Device)
+    if kind:
+        q = q.filter(Device.kind == kind)
+    return q.order_by(Device.id.desc()).all()
+
+
+@router.post("", response_model=DeviceOut, status_code=status.HTTP_201_CREATED)
+def create_device(
+    payload: DeviceCreate,
+    db: Session = Depends(get_db),
+    _: User = Depends(require_role("admin", "operator")),
+) -> Device:
+    d = Device(
+        name=payload.name,
+        host=payload.host,
+        port=payload.port,
+        use_tls=payload.use_tls,
+        username=payload.username,
+        password_enc=encrypt_secret(payload.password),
+        kind=payload.kind or "router",
+    )
+    db.add(d)
+    db.commit()
+    db.refresh(d)
+    return d
+
+
+@router.get("/{device_id}", response_model=DeviceOut)
+def get_device(
+    device_id: int,
+    db: Session = Depends(get_db),
+    _: User = Depends(get_current_user),
+) -> Device:
+    d = db.get(Device, device_id)
+    if not d:
+        raise HTTPException(status.HTTP_404_NOT_FOUND, "device not found")
+    return d
+
+
+@router.patch("/{device_id}", response_model=DeviceOut)
+def update_device(
+    device_id: int,
+    payload: DeviceUpdate,
+    db: Session = Depends(get_db),
+    _: User = Depends(require_role("admin", "operator")),
+) -> Device:
+    d = db.get(Device, device_id)
+    if not d:
+        raise HTTPException(status.HTTP_404_NOT_FOUND, "device not found")
+    data = payload.model_dump(exclude_unset=True)
+    if "password" in data:
+        d.password_enc = encrypt_secret(data.pop("password"))
+    for k, v in data.items():
+        setattr(d, k, v)
+    db.commit()
+    db.refresh(d)
+    return d
+
+
+@router.delete("/{device_id}", status_code=status.HTTP_204_NO_CONTENT, response_class=Response)
+def delete_device(
+    device_id: int,
+    db: Session = Depends(get_db),
+    _: User = Depends(require_role("admin")),
+) -> Response:
+    d = db.get(Device, device_id)
+    if not d:
+        raise HTTPException(status.HTTP_404_NOT_FOUND, "device not found")
+    db.delete(d)
+    db.commit()
+    return Response(status_code=status.HTTP_204_NO_CONTENT)
+
+
+@router.post("/{device_id}/probe", response_model=DeviceResource)
+def probe_device(
+    device_id: int,
+    db: Session = Depends(get_db),
+    _: User = Depends(get_current_user),
+) -> DeviceResource:
+    """Подключиться к устройству, прочитать `/system/resource` и обновить
+    метаданные (identity, model, serial, version, status)."""
+    d = db.get(Device, device_id)
+    if not d:
+        raise HTTPException(status.HTTP_404_NOT_FOUND, "device not found")
+
+    try:
+        res = fetch_resource(_creds(d))
+        identity = fetch_identity(_creds(d))
+    except RouterOSError as exc:
+        d.status = "down"
+        d.last_error = str(exc)
+        db.commit()
+        raise HTTPException(status.HTTP_502_BAD_GATEWAY, str(exc)) from exc
+
+    d.identity = identity or d.identity
+    d.model = res.get("board-name") or d.model
+    d.ros_version = res.get("version") or d.ros_version
+    d.architecture = res.get("architecture-name") or d.architecture
+    prev_status = d.status
+    d.status = "up"
+    d.last_error = None
+    d.last_seen = datetime.now(timezone.utc)
+
+    def _to_int(v):
+        try:
+            return int(v) if v is not None else None
+        except (TypeError, ValueError):
+            return None
+
+    cpu = _to_int(res.get("cpu-load"))
+    free_mem = _to_int(res.get("free-memory"))
+    total_mem = _to_int(res.get("total-memory"))
+    uptime_s = parse_uptime(res.get("uptime"))
+
+    # abnormal reboot detection: новый uptime < предыдущего и отличие > 60s
+    abnormal = False
+    if uptime_s is not None and d.last_uptime_seconds is not None:
+        if uptime_s < d.last_uptime_seconds - 60:
+            abnormal = True
+            d.abnormal_reboot = True
+            add_alert(
+                db,
+                severity="warning",
+                category="abnormal_reboot",
+                source=f"device:{d.id}",
+                title=f"Возможен аварийный перезапуск: {d.identity or d.name}",
+                message=(
+                    f"Uptime упал с {d.last_uptime_seconds}s до {uptime_s}s "
+                    f"без штатной команды reboot."
+                ),
+            )
+    if not abnormal:
+        d.abnormal_reboot = False
+    d.last_uptime_seconds = uptime_s
+
+    # internet check
+    try:
+        ok = check_internet(_creds(d))
+        d.internet_ok = ok
+        if not ok:
+            add_alert(
+                db,
+                severity="warning",
+                category="internet",
+                source=f"device:{d.id}",
+                title=f"Нет интернета на {d.identity or d.name}",
+                message="Ping 8.8.8.8 не прошёл.",
+            )
+    except Exception:
+        d.internet_ok = None
+
+    # уведомление о возврате в строй
+    if prev_status == "down" and d.status == "up":
+        add_alert(
+            db,
+            severity="info",
+            category="device",
+            source=f"device:{d.id}",
+            title=f"Устройство снова онлайн: {d.identity or d.name}",
+        )
+
+    mem_used_pct = None
+    if free_mem is not None and total_mem and total_mem > 0:
+        mem_used_pct = round(100 - (free_mem / total_mem) * 100, 1)
+
+    metric = DeviceMetric(
+        device_id=d.id,
+        cpu_load=float(cpu) if cpu is not None else None,
+        mem_used_pct=mem_used_pct,
+        free_memory=free_mem,
+        total_memory=total_mem,
+        uptime_seconds=uptime_s,
+        internet_ok=d.internet_ok,
+    )
+    db.add(metric)
+    db.commit()
+
+    return DeviceResource(
+        cpu_load=cpu,
+        free_memory=free_mem,
+        total_memory=total_mem,
+        uptime=res.get("uptime"),
+        version=res.get("version"),
+        board_name=res.get("board-name"),
+        architecture_name=res.get("architecture-name"),
+    )
+
+
+@router.post("/{device_id}/reboot", status_code=status.HTTP_204_NO_CONTENT, response_class=Response)
+def reboot_device(
+    device_id: int,
+    db: Session = Depends(get_db),
+    user: User = Depends(require_role("admin", "operator")),
+) -> Response:
+    """Отправить команду перезагрузки устройству."""
+    d = db.get(Device, device_id)
+    if not d:
+        raise HTTPException(status.HTTP_404_NOT_FOUND, "device not found")
+    try:
+        cmd_reboot(_creds(d))
+    except RouterOSError as exc:
+        raise HTTPException(status.HTTP_502_BAD_GATEWAY, str(exc)) from exc
+    add_audit(db, actor=user.email, action="device.reboot", target=f"device:{device_id}")
+    add_alert(db, severity="info", category="device", source=f"device:{device_id}",
+              title=f"Reboot отправлен: {d.identity or d.name}", message=f"by {user.email}")
+    return Response(status_code=status.HTTP_204_NO_CONTENT)
+
+
+@router.post("/{device_id}/safe-mode", status_code=status.HTTP_204_NO_CONTENT, response_class=Response)
+def toggle_safe_mode(
+    device_id: int,
+    db: Session = Depends(get_db),
+    user: User = Depends(require_role("admin", "operator")),
+) -> Response:
+    """Переключить safe mode на устройстве."""
+    d = db.get(Device, device_id)
+    if not d:
+        raise HTTPException(status.HTTP_404_NOT_FOUND, "device not found")
+    try:
+        cmd_safe_mode(_creds(d))
+    except RouterOSError as exc:
+        raise HTTPException(status.HTTP_502_BAD_GATEWAY, str(exc)) from exc
+    add_audit(db, actor=user.email, action="device.safe_mode", target=f"device:{device_id}")
+    return Response(status_code=status.HTTP_204_NO_CONTENT)
+
+
+# ---------- Sprint 09: интерфейсы / DHCP / upgrade ----------
+
+@router.get("/{device_id}/interfaces")
+def list_interfaces(
+    device_id: int,
+    db: Session = Depends(get_db),
+    _: User = Depends(get_current_user),
+) -> list[dict]:
+    """Список интерфейсов устройства со счётчиками rx/tx и running."""
+    d = db.get(Device, device_id)
+    if not d:
+        raise HTTPException(status.HTTP_404_NOT_FOUND, "device not found")
+    try:
+        return fetch_interface_stats(_creds(d))
+    except RouterOSError as exc:
+        raise HTTPException(status.HTTP_502_BAD_GATEWAY, str(exc)) from exc
+
+
+@router.get("/{device_id}/interface-traffic")
+def interface_traffic(
+    device_id: int,
+    names: str | None = None,
+    hours: float = 24.0,
+    db: Session = Depends(get_db),
+    _: User = Depends(get_current_user),
+) -> dict:
+    """Серии bps по выбранным интерфейсам за окно `hours`.
+
+    `names` — CSV. Если пусто — берётся из `device.monitored_interfaces`.
+    Возвращает {"series": {name: [{ts, rx_bps, tx_bps, running}]}}.
+    """
+    from ...models.interface_stat import InterfaceStat
+    from datetime import datetime, timedelta, timezone
+    d = db.get(Device, device_id)
+    if not d:
+        raise HTTPException(status.HTTP_404_NOT_FOUND, "device not found")
+    if not names:
+        names = d.monitored_interfaces or ""
+    name_list = [x.strip() for x in names.split(",") if x.strip()]
+    if not name_list:
+        return {"series": {}, "hours": hours}
+    since = datetime.now(timezone.utc) - timedelta(hours=hours)
+    rows = (
+        db.query(InterfaceStat)
+        .filter(
+            InterfaceStat.device_id == device_id,
+            InterfaceStat.name.in_(name_list),
+            InterfaceStat.ts >= since,
+        )
+        .order_by(InterfaceStat.name.asc(), InterfaceStat.ts.asc())
+        .all()
+    )
+    by_name: dict[str, list] = {n: [] for n in name_list}
+    last: dict[str, tuple] = {}
+    for r in rows:
+        prev = last.get(r.name)
+        rx_bps = tx_bps = None
+        if prev is not None:
+            dt = (r.ts - prev[0]).total_seconds()
+            if dt > 0:
+                # счётчики могут сброситься после reboot — игнорируем отрицательные дельты
+                drx = r.rx_bytes - prev[1]
+                dtx = r.tx_bytes - prev[2]
+                if drx >= 0 and dtx >= 0:
+                    rx_bps = round(drx * 8 / dt)
+                    tx_bps = round(dtx * 8 / dt)
+        by_name[r.name].append({
+            "ts": r.ts.isoformat(),
+            "rx_bps": rx_bps,
+            "tx_bps": tx_bps,
+            "running": r.running,
+        })
+        last[r.name] = (r.ts, r.rx_bytes, r.tx_bytes)
+    return {"series": by_name, "hours": hours}
+
+
+@router.get("/{device_id}/uplink-status")
+def uplink_status(
+    device_id: int,
+    db: Session = Depends(get_db),
+    _: User = Depends(get_current_user),
+) -> list[dict]:
+    """Текущий статус выбранных аплинков (running) — по последней записи."""
+    from ...models.interface_stat import InterfaceStat
+    d = db.get(Device, device_id)
+    if not d:
+        raise HTTPException(status.HTTP_404_NOT_FOUND, "device not found")
+    name_list = [x.strip() for x in (d.uplink_interfaces or "").split(",") if x.strip()]
+    out = []
+    for n in name_list:
+        last = (
+            db.query(InterfaceStat)
+            .filter(InterfaceStat.device_id == device_id, InterfaceStat.name == n)
+            .order_by(InterfaceStat.ts.desc()).first()
+        )
+        out.append({
+            "name": n,
+            "running": bool(last.running) if last else None,
+            "ts": last.ts.isoformat() if last else None,
+        })
+    return out
+
+
+@router.get("/{device_id}/dhcp-leases")
+def dhcp_leases(
+    device_id: int,
+    db: Session = Depends(get_db),
+    _: User = Depends(get_current_user),
+) -> list[dict]:
+    """Список выданных DHCP-лизов по всем DHCP-серверам устройства."""
+    d = db.get(Device, device_id)
+    if not d:
+        raise HTTPException(status.HTTP_404_NOT_FOUND, "device not found")
+    try:
+        return fetch_dhcp_leases(_creds(d))
+    except RouterOSError as exc:
+        raise HTTPException(status.HTTP_502_BAD_GATEWAY, str(exc)) from exc
+
+
+@router.post("/{device_id}/upgrade/internet")
+def upgrade_from_internet(
+    device_id: int,
+    channel: str = "stable",
+    install: bool = False,
+    db: Session = Depends(get_db),
+    user: User = Depends(require_role("admin", "operator")),
+) -> dict:
+    """Запросить у MikroTik проверку обновления и при `install=true` — установить.
+
+    Идёт через штатный `/system/package/update` (репозиторий MikroTik).
+    Установка перезагрузит устройство.
+    """
+    d = db.get(Device, device_id)
+    if not d:
+        raise HTTPException(status.HTTP_404_NOT_FOUND, "device not found")
+    try:
+        info = cmd_upgrade_check(_creds(d), channel=channel)
+        if install:
+            cmd_upgrade_install(_creds(d))
+            add_audit(db, actor=user.email, action="device.upgrade.internet",
+                      target=f"device:{device_id}", detail=f"channel={channel}")
+            add_alert(db, severity="info", category="firmware",
+                      source=f"device:{device_id}",
+                      title=f"Обновление из интернета запущено: {d.identity or d.name}",
+                      message=f"by {user.email}, channel={channel}")
+            db.commit()
+        return {"ok": True, "info": info, "installed": bool(install)}
+    except RouterOSError as exc:
+        raise HTTPException(status.HTTP_502_BAD_GATEWAY, str(exc)) from exc
+
+
+@router.post("/{device_id}/upgrade/local")
+def upgrade_from_local(
+    device_id: int,
+    firmware_id: int,
+    reboot: bool = True,
+    db: Session = Depends(get_db),
+    user: User = Depends(require_role("admin", "operator")),
+) -> dict:
+    """Установить прошивку из локального репозитория контроллера.
+
+    Файл прошивки временно публикуется во встроенный FTP, устройство сам
+    скачивает его командой `/tool/fetch`, затем (опц.) перезагружается —
+    RouterOS установит .npk при загрузке.
+    """
+    from ...models.firmware import Firmware
+    from ...services.backup_ftp_server import get_server, detect_push_host
+    from ...core.config import get_settings as _cfg
+    import os
+    d = db.get(Device, device_id)
+    if not d:
+        raise HTTPException(status.HTTP_404_NOT_FOUND, "device not found")
+    fw = db.get(Firmware, firmware_id)
+    if not fw:
+        raise HTTPException(status.HTTP_404_NOT_FOUND, "firmware not found")
+    if not fw.content:
+        raise HTTPException(status.HTTP_400_BAD_REQUEST, "firmware has no payload")
+    srv = get_server()
+    if srv is None:
+        raise HTTPException(status.HTTP_503_SERVICE_UNAVAILABLE, "backup ftp server not running")
+    cfg = _cfg()
+    push_host = cfg.backup_push_host or detect_push_host()
+    if not push_host:
+        raise HTTPException(status.HTTP_400_BAD_REQUEST, "BACKUP_PUSH_HOST not configured")
+    sess = srv.open_session([fw.name])
+    try:
+        path = os.path.join(sess.home_dir, fw.name)
+        with open(path, "wb") as f:
+            f.write(fw.content)
+        try:
+            push_firmware_via_ftp(
+                _creds(d),
+                server=push_host, port=int(cfg.backup_ftp_port),
+                user=sess.username, password=sess.password,
+                src_path=fw.name, dst_filename=fw.name,
+            )
+        except RouterOSError as exc:
+            raise HTTPException(status.HTTP_502_BAD_GATEWAY, str(exc)) from exc
+        if reboot:
+            try:
+                cmd_reboot(_creds(d))
+            except RouterOSError as exc:
+                raise HTTPException(status.HTTP_502_BAD_GATEWAY, str(exc)) from exc
+        add_audit(db, actor=user.email, action="device.upgrade.local",
+                  target=f"device:{device_id}", detail=f"firmware={fw.name}")
+        add_alert(db, severity="info", category="firmware",
+                  source=f"device:{device_id}",
+                  title=f"Установлена локальная прошивка: {d.identity or d.name}",
+                  message=f"{fw.name} by {user.email}")
+        db.commit()
+        return {"ok": True, "file": fw.name, "reboot": reboot}
+    finally:
+        srv.close_session(sess.session_id)