Implement session validation for active users before request processing

Co-authored-by: Copilot <copilot@github.com>
Remove Web directory volume mount from Docker Compose files for app service
2026-04-23 23:00:22 +02:00 · 2026-04-23 22:48:23 +02:00 · 2026-04-23 22:41:52 +02:00 · 2026-04-23 22:36:01 +02:00
5 changed files with 58 additions and 32 deletions
@@ -339,6 +339,28 @@ def _enforce_user_permissions():
    return None


+@app.before_request
+def _enforce_active_session_user():
+    endpoint = request.endpoint or ''
+    if endpoint == 'static' or endpoint.startswith('static'):
+        return None
+
+    username = session.get('username')
+    if not username:
+        return None
+
+    user = us.get_user(username)
+    if user:
+        return None
+
+    session.clear()
+    if request.path.startswith('/api/') or request.is_json:
+        return jsonify({'ok': False, 'message': 'Sitzung ungültig. Bitte erneut anmelden.'}), 401
+
+    flash('Ihre Sitzung ist nicht mehr gültig. Bitte erneut anmelden.', 'error')
+    return redirect(url_for('login'))
+
+
 def _get_asset_version():
    """Return a cache-busting asset version tied to deployment state."""
    env_version = os.getenv('INVENTAR_ASSET_VERSION', '').strip()
@@ -92,6 +92,8 @@ services:
      args:
        PYTHON_VERSION: "3.13"
        OPTIMIZATION_LEVEL: 2
+    working_dir: /app/Web
+    command: ["gunicorn", "app:app", "--bind", "0.0.0.0:8000", "--workers", "2", "--timeout", "30", "--graceful-timeout", "20", "--max-requests", "200", "--max-requests-jitter", "50", "--log-level", "info", "--access-logfile", "-", "--error-logfile", "-"]
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
@@ -106,7 +108,6 @@ services:
      - "8000"
    volumes:
      - ./config.json:/app/config.json:ro
-      - ./Web:/app/Web
      - app_uploads:/app/Web/uploads:cached
      - app_thumbnails:/app/Web/thumbnails:cached
      - app_previews:/app/Web/previews:cached
@@ -42,6 +42,8 @@ services:
    build:
      context: .
      dockerfile: Dockerfile
+    working_dir: /app/Web
+    command: ["gunicorn", "app:app", "--bind", "0.0.0.0:8000", "--workers", "2", "--timeout", "30", "--graceful-timeout", "20", "--max-requests", "200", "--max-requests-jitter", "50", "--log-level", "info", "--access-logfile", "-", "--error-logfile", "-"]
    container_name: inventarsystem-app
    restart: unless-stopped
    security_opt:
@@ -66,7 +68,6 @@ services:
      - "8000"
    volumes:
      - ./config.json:/app/config.json:ro
-      - ./Web:/app/Web
      - app_uploads:/app/Web/uploads
      - app_thumbnails:/app/Web/thumbnails
      - app_previews:/app/Web/previews
@@ -564,6 +564,8 @@ write_runtime_compose_override() {
    cat > "$RUNTIME_COMPOSE_OVERRIDE_FILE" <<EOF
 services:
  app:
+    working_dir: /app/Web
+    command: ["gunicorn", "app:app", "--bind", "0.0.0.0:8000", "--workers", "2", "--timeout", "30", "--graceful-timeout", "20", "--max-requests", "200", "--max-requests-jitter", "50", "--log-level", "info", "--access-logfile", "-", "--error-logfile", "-"]
    image: ${APP_IMAGE_VALUE}
    build: null
 EOF
@@ -119,6 +119,36 @@ server {
    return 301 https://$host$request_uri;
 }

+server {
+    listen 443 ssl;
+    server_name _;
+
+    ssl_certificate /etc/nginx/certs/inventarsystem.crt;
+    ssl_certificate_key /etc/nginx/certs/inventarsystem.key;
+
+    client_max_body_size 50M;
+
+    location / {
+        proxy_pass http://app:8000;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 300;
+    }
+
+    error_page 500 502 503 504 /50x.html;
+    location = /50x.html {
+        default_type text/html;
+        return 200 '<!doctype html><html><head><meta charset="utf-8"><title>Server Error</title></head><body><h1>Server Error</h1><p>The service is temporarily unavailable.</p></body></html>';
+    }
+}
+EOF
+        log_message "Recreated missing nginx config at $config_path"
+    fi
+}
+
 usage() {
    cat <<EOF
 Usage: $0 [options]
@@ -154,36 +184,6 @@ parse_args() {
    done
 }

-server {
-    listen 443 ssl;
-    server_name _;
-
-    ssl_certificate /etc/nginx/certs/inventarsystem.crt;
-    ssl_certificate_key /etc/nginx/certs/inventarsystem.key;
-
-    client_max_body_size 50M;
-
-    location / {
-        proxy_pass http://app:8000;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_read_timeout 300;
-    }
-
-    error_page 500 502 503 504 /50x.html;
-    location = /50x.html {
-        default_type text/html;
-        return 200 '<!doctype html><html><head><meta charset="utf-8"><title>Server Error</title></head><body><h1>Server Error</h1><p>The service is temporarily unavailable.</p></body></html>';
-    }
-}
-EOF
-        log_message "Recreated missing nginx config at $config_path"
-    fi
-}
-
 archive_logs() {
    log_message "Checking for monthly log archival..."
    if [ -x "$PROJECT_DIR/archive-logs.sh" ]; then
Author	SHA1	Message	Date
Aiirondev_dev	f2c1dc2ba5	Implement session validation for active users before request processing Co-authored-by: Copilot <copilot@github.com>	2026-04-23 23:00:22 +02:00
Aiirondev_dev	3eeae76e6c	Remove Web directory volume mount from Docker Compose files for app service	2026-04-23 22:48:23 +02:00
Aiirondev_dev	0228e6cb1d	Add working directory and command configuration for app service in Docker Compose files	2026-04-23 22:41:52 +02:00
Aiirondev_dev	4c59cca1a4	Add missing nginx configuration for SSL support and error handling	2026-04-23 22:36:01 +02:00