Merge pull request #80 from Sandor59100/feature/cluster-context-selector

 Diagram format additions, cluster improvements, and backend security hardening

Author: philippemerle

webapp/backend/app.py

@@ -8,6 +8,7 @@
 from routes.helmfile import helmfile_bp
 from routes.submit import submit_bp
 from routes.cluster import cluster_bp
+from routes.render import render_bp
 from utils.access_logger import log_request, get_real_ip, get_all_ip_headers
 from time import time
 
@@ -91,6 +92,7 @@ def after_request(response):
     app.register_blueprint(helmfile_bp)
     app.register_blueprint(submit_bp)
     app.register_blueprint(cluster_bp)
+    app.register_blueprint(render_bp)
 
     return app
 

webapp/backend/config.py

@@ -8,7 +8,7 @@ class Config:
     """Config App and Logger."""
 
     # Flask
-    DEBUG = True
+    DEBUG = os.environ.get('FLASK_DEBUG', 'false').lower() == 'true'
     PORT = 5000
     HOST = 'localhost'
 

webapp/backend/constants.py

@@ -11,10 +11,12 @@
     "pdf": "application/pdf",
     "dot": "text/vnd.graphviz",
     "dot_json": "application/json",
-    "drawio": "application/xml"
+    "drawio": "application/xml",
+    "mermaid": "text/vnd.mermaid",
+    "d2": "text/vnd.d2"
 }
 # no binary format
-TEXT_FORMATS = {"svg", "dot", "dot_json", "drawio"}
+TEXT_FORMATS = {"svg", "dot", "dot_json", "drawio", "mermaid", "d2"}
 # Manifest_detector
 MANIFEST_RE = re.compile(r'^\s*apiVersion\s*:\s*.+$', re.MULTILINE)
 KIND_RE = re.compile(r'^\s*kind\s*:\s*.+$', re.MULTILINE)
@@ -23,3 +25,23 @@
 # file extensions
 YAML_EXTENSIONS = ['.yaml', '.yml']
 TGZ_EXTENSIONS = ['.tgz', '.tar.gz']
+
+# Allowlist of CLI flags accepted through the free-text "extra args" field, per
+# underlying tool. -o/--output, -f/--format and -c/--config are excluded even
+# though the tools support them: -o/-f are already managed by the app itself
+# (allowing them would let a request override the computed output path/format),
+# and -c/--config (plus helm's --values/--set-file) let the tool read an
+# arbitrary local file path, which would be a local file disclosure primitive.
+EXTRA_ARGS_ALLOWED_FLAGS = {
+    "kube-diagrams": {
+        "--embed-all-icons", "-v", "--verbose", "-n", "--namespace", "--without-namespace",
+    },
+    "kubectl-diagrams": {
+        "--embed-all-icons", "--version",
+    },
+    "helm-diagrams": {
+        "--set", "--set-string", "--set-json", "--set-literal",
+        "-g", "--generate-name", "--include-crds", "-l", "--labels",
+        "--name-template", "--version", "--embed-all-icons",
+    },
+}

webapp/backend/routes/cluster.py

@@ -7,6 +7,7 @@
     get_namespaces,
     get_resource_types,
     get_current_context,
+    get_contexts,
 )
 from utils import InputValidator, ResponseBuilder
 
@@ -16,43 +17,48 @@
 @cluster_bp.route('/api/cluster/context', methods=['GET'])
 def get_context():
     """Return the name of the currently active kubectl context."""
-    try:
-        context = get_current_context()
-        return ResponseBuilder.success({"context": context})
-    except RuntimeError as e:
-        return ResponseBuilder.error(str(e))
-    except Exception as e:
-        return ResponseBuilder.error(f"Unexpected error: {str(e)}")
+    context, error = get_current_context()
+    if error:
+        return ResponseBuilder.error(error)
+    return ResponseBuilder.success({"context": context})
+
+
+@cluster_bp.route('/api/cluster/contexts', methods=['GET'])
+def list_contexts():
+    """Return the list of kubectl contexts configured locally, marking which one is current."""
+    contexts, error = get_contexts()
+    if error:
+        return ResponseBuilder.error(error)
+    return ResponseBuilder.success({
+        "contexts": contexts,
+        "count": len(contexts)
+    })
 
 
 @cluster_bp.route('/api/cluster/namespaces', methods=['GET'])
 def list_namespaces():
     """Return the list of namespaces available in the connected Kubernetes cluster."""
-    try:
-        namespaces = get_namespaces()
-        return ResponseBuilder.success({
-            "namespaces": namespaces,
-            "count": len(namespaces)
-        })
-    except RuntimeError as e:
-        return ResponseBuilder.error(str(e))
-    except Exception as e:
-        return ResponseBuilder.error(f"Unexpected error: {str(e)}")
+    context = request.args.get('context') or None
+    namespaces, error = get_namespaces(context=context)
+    if error:
+        return ResponseBuilder.error(error)
+    return ResponseBuilder.success({
+        "namespaces": namespaces,
+        "count": len(namespaces)
+    })
 
 
 @cluster_bp.route('/api/cluster/resource-types', methods=['GET'])
 def list_resource_types():
     """Return all resource types known by the cluster, tagged with namespace scope and common status."""
-    try:
-        resource_types = get_resource_types()
-        return ResponseBuilder.success({
-            "resourceTypes": resource_types,
-            "count": len(resource_types)
-        })
-    except RuntimeError as e:
-        return ResponseBuilder.error(str(e))
-    except Exception as e:
-        return ResponseBuilder.error(f"Unexpected error: {str(e)}")
+    context = request.args.get('context') or None
+    resource_types, error = get_resource_types(context=context)
+    if error:
+        return ResponseBuilder.error(error)
+    return ResponseBuilder.success({
+        "resourceTypes": resource_types,
+        "count": len(resource_types)
+    })
 
 
 @cluster_bp.route('/api/cluster/generate', methods=['POST'])
@@ -66,6 +72,7 @@ def generate_cluster_diagram():
     output_format = (data.get('outputFormat') or 'png').lower()
     extra_args = data.get('extraArgs', '')
     without_namespace = data.get('withoutNamespace', False)
+    context = data.get('context') or None
 
     # Log to CSV
     client_ip = request.remote_addr
@@ -76,7 +83,8 @@ def generate_cluster_diagram():
         f"allNamespaces={all_namespaces};"
         f"format={output_format};"
         f"extraArgs={compact_for_log(extra_args)};"
-        f"withoutNamespace={without_namespace}"
+        f"withoutNamespace={without_namespace};"
+        f"context={context}"
     )
     log_to_csv(client_ip, route, params)
 
@@ -94,7 +102,7 @@ def generate_cluster_diagram():
         return ResponseBuilder.validation_error("outputFormat", error_msg)
 
     # Extra arguments validation
-    is_valid, error_msg = InputValidator.validate_extra_args(extra_args)
+    is_valid, error_msg = InputValidator.validate_extra_args(extra_args, "kubectl-diagrams")
     if not is_valid:
         return ResponseBuilder.validation_error("extraArgs", error_msg)
 
@@ -105,7 +113,8 @@ def generate_cluster_diagram():
         all_namespaces=all_namespaces,
         output_format=output_format,
         extra_args=extra_args,
-        without_namespace=without_namespace
+        without_namespace=without_namespace,
+        context=context
     )
 
     if result.success:

webapp/backend/routes/helm.py

@@ -32,7 +32,7 @@ def generate_helm_diagram():
         return ResponseBuilder.validation_error("outputFormat", error_msg)
 
     # Extra arguments validation
-    is_valid, error_msg = InputValidator.validate_extra_args(extra_args)
+    is_valid, error_msg = InputValidator.validate_extra_args(extra_args, "helm-diagrams")
     if not is_valid:
         return ResponseBuilder.validation_error("extraArgs", error_msg)
 

webapp/backend/routes/helmfile.py

@@ -40,7 +40,7 @@ def generate_helmfile_diagram():
         return ResponseBuilder.validation_error("outputFormat", error_msg)
 
     # Extra arguments validation
-    is_valid, error_msg = InputValidator.validate_extra_args(extra_args)
+    is_valid, error_msg = InputValidator.validate_extra_args(extra_args, "kube-diagrams")
     if not is_valid:
         return ResponseBuilder.validation_error("extraArgs", error_msg)
 

webapp/backend/routes/manifest.py

@@ -44,7 +44,7 @@ def generate_diagram():
         return ResponseBuilder.validation_error("outputFormat", error_msg)
 
     # Extra arguments validation
-    is_valid, error_msg = InputValidator.validate_extra_args(extra_args)
+    is_valid, error_msg = InputValidator.validate_extra_args(extra_args, "kube-diagrams")
     if not is_valid:
         return ResponseBuilder.validation_error("extraArgs", error_msg)
 

webapp/backend/routes/render.py

@@ -0,0 +1,30 @@
+"""Route for on-demand rendering of already-generated diagram source."""
+from flask import Blueprint, request
+
+from services import dot_to_svg
+from utils import ResponseBuilder
+from .utils import compact_for_log, log_to_csv
+
+render_bp = Blueprint('render', __name__)
+
+@render_bp.route('/api/render-dot-svg', methods=['POST'])
+def render_dot_svg():
+    """Render DOT source (already generated by a previous /api/generate-* call) to SVG."""
+    data = request.get_json()
+    dot_content = data.get('dot', '')
+
+    client_ip = request.remote_addr
+    route = request.path
+    log_to_csv(client_ip, route, f"dot={compact_for_log(dot_content)}")
+
+    if not dot_content or not dot_content.strip():
+        return ResponseBuilder.validation_error("dot", "DOT content cannot be empty.")
+
+    svg = dot_to_svg(dot_content)
+    if svg is None:
+        return ResponseBuilder.error(
+            "dot -Tsvg conversion failed (is graphviz installed?).",
+            status_code=500
+        )
+
+    return ResponseBuilder.success(data={"svg": svg})

webapp/backend/services/__init__.py

@@ -9,7 +9,9 @@
     get_namespaces,
     get_resource_types,
     get_current_context,
+    get_contexts,
 )
+from .utils import dot_to_svg
 
 __all__ = [
     'DiagramResult',
@@ -21,5 +23,7 @@
     'get_namespaces',
     'get_resource_types',
     'get_current_context',
+    'get_contexts',
+    'dot_to_svg',
 ]