a 㬕jH@s0dZddlZddlZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl m Z m Z dZdddddZd Zd Zd d Zd Ze\ZZddZdZdZddZefddZddZdZddZdddd dZe Z ddZ!d d!Z"d"Z#d#d$Z$Gd%d&d&e Z%d'd(Z&e'd)kr,e(e&dS)*aServe the dashboard on the local network. No publishing, no upload. WHY. The GitHub Pages route republished a 9MB encrypted page every 30 minutes, which accumulated to a 2.2GB repository and got the account suspended for excessive bandwidth. The fix is not a better host -- it is to stop uploading. The page already exists on this machine; a phone can just fetch it. WHAT IT DOES NOT SERVE. A bare `python -m http.server` over E:\soccer would expose .env (Kalshi keys, Poly-US keys, Gmail password, GitHub token) to anything on the LAN. This serves an EXPLICIT ALLOW-LIST of files and nothing else -- no directory listing, no path traversal, no wildcards. PLAINTEXT ON PURPOSE. dashboard.html on disk is unencrypted; only the published copy was ever AES-wrapped, and that was solely because Pages is world-readable. On your own network there is nothing to hide it from, which also means the page compresses normally instead of being an incompressible blob. Usage: python main\serve_dashboard.py -> http://:8000/ python main\serve_dashboard.py --port 9000 python main\serve_dashboard.py --localhost -> 127.0.0.1 only Reachable from the phone on the same wifi at http://:8000/. Away from home, put Tailscale on both and use the box's Tailscale name. N)BaseHTTPRequestHandlerThreadingHTTPServerz E:\soccer)zdashboard.htmltext/html; charset=utf-8)zresearch\mm_book_dataset.csvtext/csv)zresearch\mm_live_realfills.csvr)//dashboard.htmlz /book.csvz /fills.csvz"E:/soccer/data/dashboard_auth.jsonzsoccer dashboardc Cszttdd}t|}Wdn1s.0Y|dr|dr|dstd|d<zBttddd }tj||d d Wdn1s0YWntyYn0|dt d <|d|dfWSWntt fyYn0d td tdd}|dt d <zRttddd }tj||d d Wdn1sR0Yt dtWn:ty}z t dtd|WYd}~n d}~00|d|dfS)aRead the credentials, creating strong ones on first run. Kept out of .env deliberately: .env holds exchange keys, and this file is something you will want to open and read off to type into a browser. `key` is a THIRD credential, for a browser that cannot be typed into at all. A managed work machine suppressed the basic-auth dialog AND blocked text input to the login form (2026-08-31), leaving no way to present a password. The key travels in the URL instead and is swapped for a cookie on arrival. It is deliberately separate from the password so it can be rotated on its own after being pasted somewhere it should not have been. utf-8)encodingNuserpasswordkeyw)indent ACCESS_KEYZsoccer)r r r zwrote new credentials to zcould not write : ) open AUTH_FILEjsonloadgetsecretsZ token_urlsafedumpOSErrorglobals ValueErrorprint)fhaer"main/serve_dashboard.py load_authAs4 ( 2  0*r$cCst|r|dsdSzt|ddd}WntyBYdS0|d\}}}t|t}t|t }|or|S)zFConstant-time check of an Authorization header. False if absent/wrong.zBasic FNr:) startswithbase64Z b64decodedecode Exception partitionhmaccompare_digestUSERPASSWORD)headerrawr _pwok_uok_pr"r"r# check_authms   r7ZdashicCstdtdS)Nr'r)r/r0encoder"r"r"r#_secretsr9cCsFttt|d}tt|tj dd}|d|S)N .) strinttimer-newr9r8hashlibsha256 hexdigest)Zhoursexpmacr"r"r# make_tokens"rFcCsnzT|pddd\}}tt|tjdd}t||oRt |t kWSt yhYdS0dS)zValid, unexpired, and signed by the current password. Signing with the password means rotating it invalidates every session, which is what you want from a rotation. r%r<Nr;F) splitr-r@r9r8rArBrCr.r>r?r+)tokrDrEZwantr"r"r#token_oks " rJa9 soccer dashboard

soccer dashboard

__ERR__
cCs@ddlm}||dd}|ddgd|ddgdfS)Nrparse_qsrreplaceur%p) urllib.parserLr*r)bodyrLqr"r"r# _form_fieldss rSZidlestateZstartedfinishedmessagec Cs0t}zdtjtjtjtddgtdddddd}|j dk}|j pFd |j pNd  }|rf|d nd }Wn>ty}z&d t|jd |}}WYd}~n d}~00t<|rd ndtd<ttd<|ddtd<Wdn1s0Ytdtddt|dd|dddS)Nmainzbuild_dashboard.pyTrrMiX)cwdZcapture_outputtextr errorsZtimeoutrr%FrokerrorrVrWi,rXz refresh: z in z.1fzs x)r? subprocessrunsys executableospathjoinROOT returncodestdoutstderrstrip splitlinesr+type__name__ _BUILD_LOCKBUILDr)Zt0rOr^tailmsgr!r"r"r# _do_builds$ 0 .rtcCs|tRtddkr(ttWdStdtdddtt}Wdn1s\0Ytjtdd|S) zDKick off a rebuild unless one is already running. Returns the state.rVZrunningNrTr%rUT)targetZdaemon) rprqdictupdater? threadingZThreadrtstart)Zsnapshotr"r"r# start_builds  &rzuQ
cCsDd}td}||}|dkr<|d||||dS||S)z:Put the refresh control into the page just before .srr]N) REFRESH_UIr8rfind)rQtagZuiir"r"r#inject"s  rc@sPeZdZddZddZdddZdd Zdd d Zd dZddZ ddZ dS)HandlercCsZd}|d|ddtd|dd|dtt|||j|dS) Nsauthentication requiredizWWW-Authenticatez Basic realm="z", charset="UTF-8" Content-Typeztext/plain; charset=utf-8Content-Length) send_response send_headerREALMr=len end_headerswfilewrite)selfrQr"r"r#_deny+s  z Handler._denycCs^t|jdrdS|jdp"ddD].}|d\}}}|tkr*t|r*dSq*dS)NZ AuthorizationTZCookier%;=F)r7headersrrHrlr,COOKIErJ)rpartkr3vr"r"r#_authed4szHandler._authedr%cCs`td|d}|d|dd|dtt||dd||j |dS) NZ__ERR__rrrr Cache-Controlno-store) LOGIN_PAGErMr8rrr=rrrr)rerrrQr"r"r# _login_page=s   zHandler._login_pagecCs|r dS|dS)zoGate a DATA request. Never renders the form -- a CSV or a refresh POST wants a status code, not a page.TF)rr)rr"r"r#_okFsz Handler._okrcCs^t|d}|||dd|dtt||dd||j |dS)Nrrzapplication/jsonrrr) rdumpsr8rrr=rrrr)robjcoderQr"r"r#_jsonNs   z Handler._jsonc Cs|jddd}|dkrt|jdp*d}t|r@|j|nd\}}t |t }t |t }|r|r| d| dd | d td td td d| dd|n |ddS|sdS|dkr|dddS|tdS)N?rGr/loginr/Locationr Set-Cookier; Path=/; Max-Age=r:; HttpOnly; SameSite=Lax0zwrong username or passwordz/refresh Not found)rfrHr>rrrSZrfilereadr-r.r/r0rrrrF SESSION_HOURSrrr send_errorrrz)rrfnrNr4r5r6r"r"r#do_POSTWs0        zHandler.do_POSTc CsF|jddd}ddlm}d|jvr>||jdddni}|dpPdgd}|rtrt|tr|d| d|d krd n|| d t d t d t dd| dd| dS|s|dvr|n|dS|dkr0t|ttWdn1s"0YdSt|}|sP|dddS|\}}tjt|}z8t|d} | } Wdn1s0YWnDty} z*|d|dt| jWYd} ~ dSd} ~ 00|drt | } |d| d|| dt!t"| | dd| |j#$| dS)NrrGrrKrr%rrrrrrrr:rrr)rrrz/refresh/statusrrrbiz unavailable: z text/htmlrrrr)%rfrHrPrLrrr-r.rrrrFrrrrrrprrvrqALLOWrrergrhrrrrnror(rr=rrr) rrfrLrRrentryZrelZctypeZfullrrQr!r"r"r#do_GETpsX $    .   ,    zHandler.do_GETcGst|d||dS)N )rZaddress_string)rZfmtargsr"r"r# log_messageszHandler.log_messageN)r%)r) ro __module__ __qualname__rrrrrrrrr"r"r"r#r*s   4rc Cs@d}dtjvr(ttjtjdd}dtjvr6dnd}ddtD}|rjtd d tt |t ||ft }td t td t d |d|td|d|dkr ddl}z(||}td|d|dWntyYn0td|dtdz |Wnty:tdYn0dS)Ni@z--portrGz --localhostz 127.0.0.1z0.0.0.0cSs*g|]"\}}tjtjt|s|qSr")rerfexistsrgrh).0rr3r"r"r# s zmain..znote: not yet on disk -> z, zserving z allow-listed paths from z on r'z this box : http://localhost:rrz same wifi : http://z' away : http://:z/ (if Tailscale is on)zCtrl-C to stop.z stopped)rcargvr>indexrvaluesrrgsortedsetrrrrhsocketZ gethostbynameZ gethostnamerZ serve_foreverKeyboardInterrupt)ZportZhostZmissingZsrvrZipr"r"r#rYs0 $   rY__main__))__doc__r)rAr-rrerrarcrxr?Z http.serverrrrhrrrr$rr/r0r7rrr9rFrJrrSrqZLockrprtrzr{rrrYroexitr"r"r"r#sP(  ,