feat: multi-user support w/ RBAC

backend/apps/ollama/main.py

@@ -1,4 +1,4 @@
-from flask import Flask, request, Response
+from flask import Flask, request, Response, jsonify
 from flask_cors import CORS
 
 
@@ -6,7 +6,10 @@ import requests
 import json
 
 
-from config import OLLAMA_API_BASE_URL
+from apps.web.models.users import Users
+from constants import ERROR_MESSAGES
+from utils import extract_token_from_auth_header
+from config import OLLAMA_API_BASE_URL, OLLAMA_WEBUI_AUTH
 
 app = Flask(__name__)
 CORS(
@@ -28,6 +31,21 @@ def proxy(path):
     data = request.get_data()
     headers = dict(request.headers)
 
+    if OLLAMA_WEBUI_AUTH:
+        if "Authorization" in headers:
+            token = extract_token_from_auth_header(headers["Authorization"])
+            user = Users.get_user_by_token(token)
+            if user:
+                print(user)
+                pass
+            else:
+                return jsonify({"detail": ERROR_MESSAGES.UNAUTHORIZED}), 401
+        else:
+            return jsonify({"detail": ERROR_MESSAGES.UNAUTHORIZED}), 401
+
+    else:
+        pass
+
     # Make a request to the target server
     target_response = requests.request(
         method=request.method,

backend/apps/web/main.py

@@ -0,0 +1,25 @@
+from fastapi import FastAPI, Request, Depends, HTTPException
+from fastapi.middleware.cors import CORSMiddleware
+
+from apps.web.routers import auths
+from config import OLLAMA_WEBUI_VERSION, OLLAMA_WEBUI_AUTH
+
+app = FastAPI()
+
+origins = ["*"]
+
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=origins,
+    allow_credentials=True,
+    allow_methods=["*"],
+    allow_headers=["*"],
+)
+
+
+app.include_router(auths.router, prefix="/auths", tags=["auths"])
+
+
+@app.get("/")
+async def get_status():
+    return {"status": True, "version": OLLAMA_WEBUI_VERSION, "auth": OLLAMA_WEBUI_AUTH}

backend/apps/web/models/auths.py

@@ -0,0 +1,102 @@
+from pydantic import BaseModel
+from typing import List, Union, Optional
+import time
+import uuid
+
+
+from apps.web.models.users import UserModel, Users
+from utils import (
+    verify_password,
+    get_password_hash,
+    bearer_scheme,
+    create_token,
+)
+
+import config
+
+DB = config.DB
+
+####################
+# DB MODEL
+####################
+
+
+class AuthModel(BaseModel):
+    id: str
+    email: str
+    password: str
+    active: bool = True
+
+
+####################
+# Forms
+####################
+
+
+class Token(BaseModel):
+    token: str
+    token_type: str
+
+
+class UserResponse(BaseModel):
+    id: str
+    email: str
+    name: str
+    role: str
+
+
+class SigninResponse(Token, UserResponse):
+    pass
+
+
+class SigninForm(BaseModel):
+    email: str
+    password: str
+
+
+class SignupForm(BaseModel):
+    name: str
+    email: str
+    password: str
+
+
+class AuthsTable:
+    def __init__(self, db):
+        self.db = db
+        self.table = db.auths
+
+    def insert_new_auth(
+        self, email: str, password: str, name: str, role: str = "user"
+    ) -> Optional[UserModel]:
+        print("insert_new_auth")
+
+        id = str(uuid.uuid4())
+
+        auth = AuthModel(
+            **{"id": id, "email": email, "password": password, "active": True}
+        )
+        result = self.table.insert_one(auth.model_dump())
+        user = Users.insert_new_user(id, name, email, role)
+
+        print(result, user)
+        if result and user:
+            return user
+        else:
+            return None
+
+    def authenticate_user(self, email: str, password: str) -> Optional[UserModel]:
+        print("authenticate_user")
+
+        auth = self.table.find_one({"email": email, "active": True})
+
+        if auth:
+            if verify_password(password, auth["password"]):
+                user = self.db.users.find_one({"id": auth["id"]})
+                return UserModel(**user)
+            else:
+                return None
+        else:
+            return None
+
+
+Auths = AuthsTable(DB)

backend/apps/web/models/users.py

@@ -0,0 +1,76 @@
+from pydantic import BaseModel
+from typing import List, Union, Optional
+from pymongo import ReturnDocument
+import time
+
+from utils import decode_token
+from config import DB
+
+####################
+# User DB Schema
+####################
+
+
+class UserModel(BaseModel):
+    id: str
+    name: str
+    email: str
+    role: str = "user"
+    created_at: int  # timestamp in epoch
+
+
+####################
+# Forms
+####################
+
+
+class UsersTable:
+    def __init__(self, db):
+        self.db = db
+        self.table = db.users
+
+    def insert_new_user(
+        self, id: str, name: str, email: str, role: str = "user"
+    ) -> Optional[UserModel]:
+        user = UserModel(
+            **{
+                "id": id,
+                "name": name,
+                "email": email,
+                "role": role,
+                "created_at": int(time.time()),
+            }
+        )
+        result = self.table.insert_one(user.model_dump())
+
+        if result:
+            return user
+        else:
+            return None
+
+    def get_user_by_email(self, email: str) -> Optional[UserModel]:
+        user = self.table.find_one({"email": email}, {"_id": False})
+
+        if user:
+            return UserModel(**user)
+        else:
+            return None
+
+    def get_user_by_token(self, token: str) -> Optional[UserModel]:
+        data = decode_token(token)
+
+        if data != None and "email" in data:
+            return self.get_user_by_email(data["email"])
+        else:
+            return None
+
+    def get_users(self, skip: int = 0, limit: int = 50) -> Optional[UserModel]:
+        return [
+            UserModel(**user)
+            for user in list(self.table.find({}, {"_id": False}))
+            .skip(skip)
+            .limit(limit)
+        ]
+
+
+Users = UsersTable(DB)

backend/apps/web/routers/auths.py

@@ -0,0 +1,107 @@
+from fastapi import Response
+from fastapi import Depends, FastAPI, HTTPException, status
+from datetime import datetime, timedelta
+from typing import List, Union
+
+from fastapi import APIRouter
+from pydantic import BaseModel
+import time
+import uuid
+
+from constants import ERROR_MESSAGES
+from utils import (
+    get_password_hash,
+    bearer_scheme,
+    create_token,
+)
+
+from apps.web.models.auths import (
+    SigninForm,
+    SignupForm,
+    UserResponse,
+    SigninResponse,
+    Auths,
+)
+from apps.web.models.users import Users
+import config
+
+router = APIRouter()
+
+DB = config.DB
+
+
+############################
+# GetSessionUser
+############################
+
+
+@router.get("/", response_model=UserResponse)
+async def get_session_user(cred=Depends(bearer_scheme)):
+    token = cred.credentials
+    user = Users.get_user_by_token(token)
+    if user:
+        return {
+            "id": user.id,
+            "email": user.email,
+            "name": user.name,
+            "role": user.role,
+        }
+    else:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+        )
+
+
+############################
+# SignIn
+############################
+
+
+@router.post("/signin", response_model=SigninResponse)
+async def signin(form_data: SigninForm):
+    user = Auths.authenticate_user(form_data.email.lower(), form_data.password)
+    if user:
+        token = create_token(data={"email": user.email})
+
+        return {
+            "token": token,
+            "token_type": "Bearer",
+            "id": user.id,
+            "email": user.email,
+            "name": user.name,
+            "role": user.role,
+        }
+    else:
+        raise HTTPException(400, detail=ERROR_MESSAGES.DEFAULT())
+
+
+############################
+# SignUp
+############################
+
+
+@router.post("/signup", response_model=SigninResponse)
+async def signup(form_data: SignupForm):
+    if not Users.get_user_by_email(form_data.email.lower()):
+        try:
+            hashed = get_password_hash(form_data.password)
+            user = Auths.insert_new_auth(form_data.email, hashed, form_data.name)
+
+            if user:
+                token = create_token(data={"email": user.email})
+                # response.set_cookie(key='token', value=token, httponly=True)
+
+                return {
+                    "token": token,
+                    "token_type": "Bearer",
+                    "id": user.id,
+                    "email": user.email,
+                    "name": user.name,
+                    "role": user.role,
+                }
+            else:
+                raise HTTPException(500, detail=ERROR_MESSAGES.DEFAULT(err))
+        except Exception as err:
+            raise HTTPException(500, detail=ERROR_MESSAGES.DEFAULT(err))
+    else:
+        raise HTTPException(400, detail=ERROR_MESSAGES.DEFAULT())

backend/config.py

@@ -1,11 +1,22 @@
-import sys
-import os
 from dotenv import load_dotenv, find_dotenv
+from pymongo import MongoClient
+
+from secrets import token_bytes
+from base64 import b64encode
+import os
 
 load_dotenv(find_dotenv())
 
+####################################
+# ENV (dev,test,prod)
+####################################
+
 ENV = os.environ.get("ENV", "dev")
 
+####################################
+# OLLAMA_API_BASE_URL
+####################################
+
 OLLAMA_API_BASE_URL = os.environ.get(
     "OLLAMA_API_BASE_URL", "http://localhost:11434/api"
 )
@@ -13,3 +24,42 @@ OLLAMA_API_BASE_URL = os.environ.get(
 if ENV == "prod":
     if OLLAMA_API_BASE_URL == "/ollama/api":
         OLLAMA_API_BASE_URL = "http://host.docker.internal:11434/api"
+
+####################################
+# OLLAMA_WEBUI_VERSION
+####################################
+
+OLLAMA_WEBUI_VERSION = os.environ.get("OLLAMA_WEBUI_VERSION", "v1.0.0-alpha.9")
+
+####################################
+# OLLAMA_WEBUI_AUTH
+####################################
+
+OLLAMA_WEBUI_AUTH = (
+    True if os.environ.get("OLLAMA_WEBUI_AUTH", "TRUE") == "TRUE" else False
+)
+
+
+if OLLAMA_WEBUI_AUTH:
+    ####################################
+    # OLLAMA_WEBUI_DB
+    ####################################
+
+    OLLAMA_WEBUI_DB_URL = os.environ.get(
+        "OLLAMA_WEBUI_DB_URL", "mongodb://root:root@localhost:27017/"
+    )
+
+    DB_CLIENT = MongoClient(f"{OLLAMA_WEBUI_DB_URL}?authSource=admin")
+    DB = DB_CLIENT["ollama-webui"]
+
+    ####################################
+    # OLLAMA_WEBUI_JWT_SECRET_KEY
+    ####################################
+
+    OLLAMA_WEBUI_JWT_SECRET_KEY = os.environ.get(
+        "OLLAMA_WEBUI_JWT_SECRET_KEY", "t0p-s3cr3t"
+    )
+
+    if ENV == "prod":
+        if OLLAMA_WEBUI_JWT_SECRET_KEY == "":
+            OLLAMA_WEBUI_JWT_SECRET_KEY = str(b64encode(token_bytes(32)).decode())

backend/constants.py

@@ -0,0 +1,13 @@
+from enum import Enum
+
+
+class MESSAGES(str, Enum):
+    DEFAULT = lambda msg="": f"{msg if msg else ''}"
+
+
+class ERROR_MESSAGES(str, Enum):
+    DEFAULT = lambda err="": f"Something went wrong :/\n{err if err else ''}"
+    UNAUTHORIZED = "401 Unauthorized"
+    NOT_FOUND = "We could not find what you're looking for :/"
+    USER_NOT_FOUND = "We could not find what you're looking for :/"
+    MALICIOUS = "Unusual activities detected, please try again in a few minutes."

backend/main.py

@@ -1,16 +1,14 @@
-import time
-import sys
-
 from fastapi import FastAPI, Request
 from fastapi.staticfiles import StaticFiles
-
 from fastapi import HTTPException
-from starlette.exceptions import HTTPException as StarletteHTTPException
-
 from fastapi.middleware.wsgi import WSGIMiddleware
 from fastapi.middleware.cors import CORSMiddleware
+from starlette.exceptions import HTTPException as StarletteHTTPException
 
 from apps.ollama.main import app as ollama_app
+from apps.web.main import app as webui_app
+
+import time
 
 
 class SPAStaticFiles(StaticFiles):
@@ -47,5 +45,6 @@ async def check_url(request: Request, call_next):
     return response
 
 
+app.mount("/api/v1", webui_app)
 app.mount("/ollama/api", WSGIMiddleware(ollama_app))
 app.mount("/", SPAStaticFiles(directory="../build", html=True), name="spa-static-files")

backend/utils.py

@@ -0,0 +1,68 @@
+from fastapi.security import HTTPBasicCredentials, HTTPBearer
+from pydantic import BaseModel
+from typing import Union, Optional
+
+from passlib.context import CryptContext
+from datetime import datetime, timedelta
+import requests
+import jwt
+
+import config
+
+JWT_SECRET_KEY = config.OLLAMA_WEBUI_JWT_SECRET_KEY
+ALGORITHM = "HS256"
+
+##############
+# Auth Utils
+##############
+
+bearer_scheme = HTTPBearer()
+pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
+
+
+def verify_password(plain_password, hashed_password):
+    return (
+        pwd_context.verify(plain_password, hashed_password) if hashed_password else None
+    )
+
+
+def get_password_hash(password):
+    return pwd_context.hash(password)
+
+
+def create_token(data: dict, expires_delta: Union[timedelta, None] = None) -> str:
+    payload = data.copy()
+
+    if expires_delta:
+        expire = datetime.utcnow() + expires_delta
+        payload.update({"exp": expire})
+
+    encoded_jwt = jwt.encode(payload, JWT_SECRET_KEY, algorithm=ALGORITHM)
+    return encoded_jwt
+
+
+def decode_token(token: str) -> Optional[dict]:
+    try:
+        decoded = jwt.decode(token, JWT_SECRET_KEY, options={"verify_signature": False})
+        return decoded
+    except Exception as e:
+        return None
+
+
+def extract_token_from_auth_header(auth_header: str):
+    return auth_header[len("Bearer ") :]
+
+
+def verify_token(request):
+    try:
+        bearer = request.headers["authorization"]
+        if bearer:
+            token = bearer[len("Bearer ") :]
+            decoded = jwt.decode(
+                token, JWT_SECRET_KEY, options={"verify_signature": False}
+            )
+            return decoded
+        else:
+            return None
+    except Exception as e:
+        return None