8f5e26d2ee
Add email+password auth alongside Google: argon2id hashing; users gains password_hash/email_verified/is_active and google_sub becomes nullable (migration 0022); a single-use, hashed auth_tokens table for email verification + password reset. Registration creates a pending (inactive, unverified) account + an access request; sign-in needs verified email AND admin approval. Anti-enumeration: uniform register/login/reset responses (a correct-password owner still gets a specific pending reason). allow_registration flag (DB-tunable). Admin users-list + role endpoint (guards: not self, not demo, not the last admin); approving access (or a manual whitelist add) now activates the matching pending account. current_user rejects deactivated accounts. Verified end-to-end via curl + DB.
43 lines
1.1 KiB
Python
43 lines
1.1 KiB
Python
from argon2 import PasswordHasher
|
|
from cryptography.fernet import Fernet
|
|
|
|
from app.config import settings
|
|
|
|
# argon2id with the library defaults (sensible memory/time cost). One shared hasher instance.
|
|
_ph = PasswordHasher()
|
|
|
|
|
|
def hash_password(password: str) -> str:
|
|
return _ph.hash(password)
|
|
|
|
|
|
def verify_password(password: str, hashed: str | None) -> bool:
|
|
if not hashed:
|
|
return False
|
|
try:
|
|
return _ph.verify(hashed, password)
|
|
except Exception:
|
|
# Any failure (mismatch, malformed hash) is a non-match — never raise to the caller.
|
|
return False
|
|
|
|
_fernet: Fernet | None = (
|
|
Fernet(settings.token_encryption_key.encode()) if settings.token_encryption_key else None
|
|
)
|
|
|
|
|
|
def _require_fernet() -> Fernet:
|
|
if _fernet is None:
|
|
raise RuntimeError("TOKEN_ENCRYPTION_KEY is not configured")
|
|
return _fernet
|
|
|
|
|
|
def encrypt(value: str | None) -> str | None:
|
|
if value is None:
|
|
return None
|
|
return _require_fernet().encrypt(value.encode()).decode()
|
|
|
|
|
|
def decrypt(value: str | None) -> str | None:
|
|
if value is None:
|
|
return None
|
|
return _require_fernet().decrypt(value.encode()).decode()
|