mirror of https://github.com/ChuckBuilds/LEDMatrix.git synced 2026-08-13 22:58:06 +00:00

Files

T

Claude 799733fb1d test(api): cover the music auth endpoints, and always clean up the wrapper

The Spotify step-2 handler writes a Python wrapper script to a temp file
with the user's redirect URL embedded in its source, then executes it.
That is the most dangerous shape in the blueprint and had no tests.

The wrapper was deleted in the success/failure branch and again in the
TimeoutExpired handler. Any other failure from subprocess.run — no
interpreter, a fork failure, an interrupted call — reached neither, and
left a world-readable temp file containing the user's redirect URL on
disk. Cleanup moves to a finally block, which is what "delete this
whatever happens" should have been from the start.

The injection tests are the point of this file. Eight adversarial
redirect URLs (embedded quotes, backslashes, newlines, triple quotes, a
full `"; import os; os.system("id"); "`) are each pushed through the
endpoint and the generated wrapper is parsed with ast: it must still be
valid Python, the URL must still be a single string literal bound to
redirect_url, and no os.system call may appear anywhere in the tree.
json.dumps holds up, but nothing was checking that it does.

40 tests. Also pins that the two endpoints are not symmetrical despite
the matching names — only Spotify has a two-step flow and a wrapper; YTM
runs its script directly — so a later change does not "restore" a parity
that was never there.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NohXi78cwsAKtN1sCfxjUh

2026-08-13 13:52:17 +00:00

blueprints

test(api): cover the music auth endpoints, and always clean up the wrapper

2026-08-13 13:52:17 +00:00

static/v3

feat(web): let schemas label enum dropdown options (#442 )

2026-08-07 13:27:20 -04:00

templates/v3

Add panel orientation setting for upside-down mounting (#455 )

2026-08-12 09:40:48 -04:00

__init__.py

fix(version): make the core version have exactly one answer (#428 )

2026-08-03 15:21:47 -04:00

app.py

fix(web): say what actually went wrong instead of "unknown" (#448 )

2026-08-11 13:56:16 -04:00

cache.py

Codebase audit: fix shipping bugs, remove verified-dead code, repair doc drift, add regression guards (#438 )

2026-08-06 14:04:23 -04:00

logging_config.py

fix: Codacy security fixes, CVE dependency bumps, and code quality cleanup (#331 )

2026-05-15 10:19:55 -04:00

README.md

Codebase audit: fix shipping bugs, remove verified-dead code, repair doc drift, add regression guards (#438 )

2026-08-06 14:04:23 -04:00

requirements.txt

Codebase audit: fix shipping bugs, remove verified-dead code, repair doc drift, add regression guards (#438 )

2026-08-06 14:04:23 -04:00

run.sh

Plugins (#145 )

2025-12-27 14:15:49 -05:00

start.py

fix: Codacy round-2 — urllib3 CVEs, missed JS/Python issues (#336 )

2026-05-15 18:04:21 -04:00

README.md

LED Matrix Web Interface V3

Modern, production web interface for controlling the LED Matrix display.

Overview

This directory contains the active V3 web interface with the following features:

Real-time display preview via Server-Sent Events (SSE)
Plugin management and configuration
System monitoring and logs
Modern, responsive UI
RESTful API

Directory Structure

web_interface/
├── app.py                    # Main Flask application
├── start.py                  # Startup script
├── run.sh                    # Shell runner script
├── requirements.txt          # Python dependencies
├── blueprints/               # Flask blueprints
│   ├── api_v3.py            # API endpoints
│   └── pages_v3.py          # Page routes
├── templates/                # HTML templates
│   └── v3/
│       ├── base.html
│       ├── index.html
│       └── partials/
└── static/                   # CSS/JS assets
    └── v3/
        ├── app.css
        ├── app.js
        ├── manifest.json     # PWA manifest
        ├── plugins_manager.js
        ├── icons/            # PWA / touch icons
        ├── js/               # Alpine, htmx, app shell, widgets, utils
        └── vendor/           # codemirror, fontawesome

Running the Web Interface

Standalone (Development)

From the project root:

python3 web_interface/start.py

Or using the shell script:

./web_interface/run.sh

As a Service (Production)

The web interface can run as a systemd service that starts automatically based on the web_display_autostart configuration setting:

sudo systemctl start ledmatrix-web
sudo systemctl enable ledmatrix-web  # Start on boot

Accessing the Interface

Once running, access the web interface at:

Local: http://localhost:5000
Network: http://:5000

Configuration

The web interface reads configuration from:

config/config.json - Main configuration
config/config_secrets.json - API keys and secrets

API Documentation

The V3 API is mounted at /api/v3/ (app.py:144). For the complete list and request/response formats, see docs/REST_API_REFERENCE.md. Quick reference for the most common endpoints:

Configuration

GET /api/v3/config/main - Get main configuration
POST /api/v3/config/main - Save main configuration
GET /api/v3/config/secrets - Get secrets configuration
POST /api/v3/config/raw/main - Save raw main config (Config Editor)
POST /api/v3/config/raw/secrets - Save raw secrets

Display & System Control

GET /api/v3/system/status - System status
POST /api/v3/system/action - Control display (action body: start_display, stop_display, restart_display_service, restart_web_service, git_pull, reboot_system, shutdown_system, enable_autostart, disable_autostart)
GET /api/v3/display/current - Current display frame
GET /api/v3/display/on-demand/status - On-demand status
POST /api/v3/display/on-demand/start - Trigger on-demand display
POST /api/v3/display/on-demand/stop - Clear on-demand

Plugins

GET /api/v3/plugins/installed - List installed plugins
GET /api/v3/plugins/config?plugin_id=<id> - Get plugin config
POST /api/v3/plugins/config - Update plugin configuration
GET /api/v3/plugins/schema?plugin_id=<id> - Get plugin schema
POST /api/v3/plugins/toggle - Enable/disable plugin
POST /api/v3/plugins/install - Install from registry
POST /api/v3/plugins/install-from-url - Install from GitHub URL
POST /api/v3/plugins/uninstall - Uninstall plugin
POST /api/v3/plugins/update - Update plugin

Plugin Store

GET /api/v3/plugins/store/list - List available registry plugins
GET /api/v3/plugins/store/github-status - GitHub authentication status
POST /api/v3/plugins/store/refresh - Refresh registry from GitHub

Real-time Streams (SSE)

SSE stream endpoints are defined directly on the Flask app (app.py:607-619 — includes the CSRF exemption and rate-limit hookup alongside the three route definitions), not on the api_v3 blueprint:

GET /api/v3/stream/stats - System statistics stream
GET /api/v3/stream/display - Display preview stream
GET /api/v3/stream/logs - Service logs stream

Development

When making changes to the web interface:

Edit files in this directory
Test changes by running python3 web_interface/start.py
Restart the service if running: sudo systemctl restart ledmatrix-web

Notes

Templates and static files use the v3/ prefix to allow for future versions
The interface uses Flask blueprints for modular organization
SSE streams provide real-time updates without polling