1108 lines
39 KiB
Python
1108 lines
39 KiB
Python
"""
|
|
Authentication endpoints.
|
|
|
|
POST /api/auth/login — email/password login, returns JWT tokens
|
|
POST /api/auth/refresh — refresh access token using refresh token
|
|
POST /api/auth/logout — clear httpOnly cookie
|
|
GET /api/auth/me — return current user info
|
|
POST /api/auth/forgot-password — send password reset email
|
|
POST /api/auth/reset-password — reset password with token
|
|
POST /api/auth/srp/init — SRP Step 1: return salt and server ephemeral B
|
|
POST /api/auth/srp/verify — SRP Step 2: verify client proof M1, return tokens
|
|
GET /api/auth/emergency-kit-template — generate Emergency Kit PDF (without Secret Key)
|
|
POST /api/auth/register-srp — store SRP verifier and encrypted key set
|
|
"""
|
|
|
|
import base64
|
|
import hashlib
|
|
import io
|
|
import json
|
|
import logging
|
|
import secrets
|
|
import uuid
|
|
from datetime import UTC, datetime, timedelta
|
|
from typing import Optional
|
|
|
|
import redis.asyncio as aioredis
|
|
from fastapi import APIRouter, Cookie, Depends, HTTPException, Response, status
|
|
from fastapi.responses import JSONResponse, StreamingResponse
|
|
from sqlalchemy import select, update
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
from starlette.requests import Request as StarletteRequest
|
|
|
|
from app.config import settings
|
|
from app.database import AdminAsyncSessionLocal, get_admin_db
|
|
from app.services.audit_service import log_action
|
|
from app.services.srp_service import srp_init, srp_verify
|
|
from app.services.key_service import get_user_key_set, log_key_access, store_user_key_set
|
|
from app.middleware.rate_limit import limiter
|
|
from app.middleware.rbac import require_authenticated
|
|
from app.middleware.tenant_context import CurrentUser
|
|
from app.models.user import User
|
|
from app.schemas.auth import (
|
|
ChangePasswordRequest,
|
|
DeleteAccountRequest,
|
|
DeleteAccountResponse,
|
|
ForgotPasswordRequest,
|
|
LoginRequest,
|
|
MessageResponse,
|
|
RefreshRequest,
|
|
ResetPasswordRequest,
|
|
SRPInitRequest,
|
|
SRPInitResponse,
|
|
SRPRegisterRequest,
|
|
SRPVerifyRequest,
|
|
SRPVerifyResponse,
|
|
TokenResponse,
|
|
UserMeResponse,
|
|
)
|
|
from app.services.account_service import delete_user_account, export_user_data
|
|
from app.services.auth import (
|
|
create_access_token,
|
|
create_refresh_token,
|
|
hash_password,
|
|
is_token_revoked,
|
|
revoke_user_tokens,
|
|
verify_password,
|
|
verify_token,
|
|
)
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
router = APIRouter(prefix="/auth", tags=["auth"])
|
|
|
|
# Access token cookie settings
|
|
ACCESS_TOKEN_COOKIE = "access_token"
|
|
ACCESS_TOKEN_MAX_AGE = 15 * 60 # 15 minutes in seconds
|
|
|
|
# Refresh token cookie settings (httpOnly, longer-lived)
|
|
REFRESH_TOKEN_COOKIE = "refresh_token"
|
|
REFRESH_TOKEN_MAX_AGE = 7 * 24 * 60 * 60 # 7 days in seconds
|
|
|
|
# Cookie Secure flag requires HTTPS. Safari strictly enforces this —
|
|
# it silently drops Secure cookies over plain HTTP, unlike Chrome
|
|
# which exempts localhost. Auto-detect from CORS origins: if all
|
|
# origins are HTTPS, enable Secure; otherwise disable it.
|
|
_COOKIE_SECURE = all(
|
|
o.startswith("https://") for o in (settings.CORS_ORIGINS or "").split(",") if o.strip()
|
|
)
|
|
|
|
# ─── Redis for SRP Sessions ──────────────────────────────────────────────────
|
|
|
|
_redis: aioredis.Redis | None = None
|
|
|
|
|
|
async def get_redis() -> aioredis.Redis:
|
|
"""Lazily initialise and return the SRP Redis client."""
|
|
global _redis
|
|
if _redis is None:
|
|
_redis = aioredis.from_url(settings.REDIS_URL, decode_responses=True)
|
|
return _redis
|
|
|
|
|
|
# ─── SRP Zero-Knowledge Authentication ───────────────────────────────────────
|
|
|
|
|
|
@router.post("/srp/init", response_model=SRPInitResponse, summary="SRP Step 1: return salt and server ephemeral B")
|
|
@limiter.limit("5/minute")
|
|
async def srp_init_endpoint(
|
|
request: StarletteRequest,
|
|
body: SRPInitRequest,
|
|
db: AsyncSession = Depends(get_admin_db),
|
|
) -> SRPInitResponse:
|
|
"""SRP Step 1: Return salt and server ephemeral B.
|
|
|
|
Anti-enumeration: returns a deterministic fake response if the user
|
|
does not exist or has no SRP credentials. The fake response is
|
|
derived from a hash of the email so it is consistent for repeated
|
|
queries against the same unknown address.
|
|
"""
|
|
# Look up user (case-insensitive)
|
|
result = await db.execute(select(User).where(User.email == body.email.lower()))
|
|
user = result.scalar_one_or_none()
|
|
|
|
# Anti-enumeration: return fake salt/B if user not found or not SRP-enrolled
|
|
if not user or not user.srp_verifier:
|
|
fake_hash = hashlib.sha256(f"srp-fake-{body.email}".encode()).hexdigest()
|
|
return SRPInitResponse(
|
|
salt=fake_hash[:64],
|
|
server_public=fake_hash * 8, # 512 hex chars (256 bytes)
|
|
session_id=secrets.token_urlsafe(16),
|
|
pbkdf2_salt=base64.b64encode(bytes.fromhex(fake_hash[:64])).decode(),
|
|
hkdf_salt=base64.b64encode(bytes.fromhex(fake_hash[:64])).decode(),
|
|
)
|
|
|
|
# Fetch key derivation salts from user_key_sets (needed by client BEFORE SRP verify)
|
|
key_set = await get_user_key_set(db, user.id)
|
|
|
|
# Generate server ephemeral
|
|
try:
|
|
server_public, server_private = await srp_init(
|
|
user.email, user.srp_verifier.hex()
|
|
)
|
|
except ValueError as e:
|
|
logger.error("SRP init failed for %s: %s", user.email, e)
|
|
raise HTTPException(
|
|
status_code=status.HTTP_400_BAD_REQUEST,
|
|
detail="Authentication initialization failed. Please try again.",
|
|
)
|
|
|
|
# Store session in Redis with 60s TTL
|
|
session_id = secrets.token_urlsafe(16)
|
|
redis = await get_redis()
|
|
session_data = json.dumps({
|
|
"email": user.email,
|
|
"server_private": server_private,
|
|
"srp_verifier_hex": user.srp_verifier.hex(),
|
|
"srp_salt_hex": user.srp_salt.hex(),
|
|
"user_id": str(user.id),
|
|
})
|
|
await redis.set(f"srp:session:{session_id}", session_data, ex=60)
|
|
|
|
return SRPInitResponse(
|
|
salt=user.srp_salt.hex(),
|
|
server_public=server_public,
|
|
session_id=session_id,
|
|
pbkdf2_salt=base64.b64encode(key_set.pbkdf2_salt).decode() if key_set else "",
|
|
hkdf_salt=base64.b64encode(key_set.hkdf_salt).decode() if key_set else "",
|
|
)
|
|
|
|
|
|
@router.post("/srp/verify", response_model=SRPVerifyResponse, summary="SRP Step 2: verify client proof and return tokens")
|
|
@limiter.limit("5/minute")
|
|
async def srp_verify_endpoint(
|
|
request: StarletteRequest,
|
|
body: SRPVerifyRequest,
|
|
response: Response,
|
|
db: AsyncSession = Depends(get_admin_db),
|
|
) -> SRPVerifyResponse:
|
|
"""SRP Step 2: Verify client proof M1, return server proof M2 + JWT tokens.
|
|
|
|
The session is consumed (deleted from Redis) immediately on retrieval
|
|
to enforce single-use. If the proof is invalid, the session cannot
|
|
be retried — the client must restart from /srp/init.
|
|
"""
|
|
invalid_error = HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Invalid credentials",
|
|
)
|
|
|
|
# Retrieve session from Redis
|
|
redis = await get_redis()
|
|
session_raw = await redis.get(f"srp:session:{body.session_id}")
|
|
if not session_raw:
|
|
raise invalid_error
|
|
|
|
# Delete session immediately (one-use)
|
|
await redis.delete(f"srp:session:{body.session_id}")
|
|
|
|
session = json.loads(session_raw)
|
|
|
|
# Verify email matches
|
|
if session["email"] != body.email.lower():
|
|
raise invalid_error
|
|
|
|
# Run SRP verification
|
|
try:
|
|
is_valid, server_proof = await srp_verify(
|
|
email=session["email"],
|
|
srp_verifier_hex=session["srp_verifier_hex"],
|
|
server_private=session["server_private"],
|
|
client_public=body.client_public,
|
|
client_proof=body.client_proof,
|
|
srp_salt_hex=session["srp_salt_hex"],
|
|
)
|
|
except ValueError as e:
|
|
logger.error("SRP verify failed for %s: %s", session["email"], e)
|
|
raise HTTPException(
|
|
status_code=status.HTTP_400_BAD_REQUEST,
|
|
detail="Authentication verification failed. Please try again.",
|
|
)
|
|
|
|
if not is_valid:
|
|
raise invalid_error
|
|
|
|
# Fetch user for token creation
|
|
user_id = uuid.UUID(session["user_id"])
|
|
result = await db.execute(select(User).where(User.id == user_id))
|
|
user = result.scalar_one_or_none()
|
|
|
|
if not user or not user.is_active:
|
|
raise invalid_error
|
|
|
|
# Create JWT tokens (same as existing login)
|
|
access_token = create_access_token(user.id, user.tenant_id, user.role)
|
|
refresh_token = create_refresh_token(user.id)
|
|
|
|
# Update last_login and clear upgrade flag on successful SRP login
|
|
await db.execute(
|
|
update(User).where(User.id == user.id).values(
|
|
last_login=datetime.now(UTC),
|
|
must_upgrade_auth=False,
|
|
)
|
|
)
|
|
await db.commit()
|
|
|
|
# Set access token cookie
|
|
response.set_cookie(
|
|
key=ACCESS_TOKEN_COOKIE,
|
|
value=access_token,
|
|
max_age=ACCESS_TOKEN_MAX_AGE,
|
|
httponly=True,
|
|
secure=_COOKIE_SECURE,
|
|
samesite="lax",
|
|
)
|
|
# Set refresh token cookie (httpOnly, scoped to refresh endpoint)
|
|
response.set_cookie(
|
|
key=REFRESH_TOKEN_COOKIE,
|
|
value=refresh_token,
|
|
max_age=REFRESH_TOKEN_MAX_AGE,
|
|
httponly=True,
|
|
secure=_COOKIE_SECURE,
|
|
samesite="lax",
|
|
path="/api/auth/refresh",
|
|
)
|
|
|
|
# Fetch encrypted key set
|
|
key_set = await get_user_key_set(db, user.id)
|
|
encrypted_key_set = None
|
|
if key_set:
|
|
encrypted_key_set = {
|
|
"encrypted_private_key": base64.b64encode(key_set.encrypted_private_key).decode(),
|
|
"private_key_nonce": base64.b64encode(key_set.private_key_nonce).decode(),
|
|
"encrypted_vault_key": base64.b64encode(key_set.encrypted_vault_key).decode(),
|
|
"vault_key_nonce": base64.b64encode(key_set.vault_key_nonce).decode(),
|
|
"public_key": base64.b64encode(key_set.public_key).decode(),
|
|
"pbkdf2_salt": base64.b64encode(key_set.pbkdf2_salt).decode(),
|
|
"hkdf_salt": base64.b64encode(key_set.hkdf_salt).decode(),
|
|
"pbkdf2_iterations": key_set.pbkdf2_iterations,
|
|
}
|
|
|
|
# Audit log
|
|
try:
|
|
async with AdminAsyncSessionLocal() as audit_db:
|
|
await log_action(
|
|
audit_db,
|
|
tenant_id=user.tenant_id or uuid.UUID(int=0),
|
|
user_id=user.id,
|
|
action="login_srp",
|
|
resource_type="auth",
|
|
details={"email": user.email, "role": user.role},
|
|
ip_address=request.client.host if request.client else None,
|
|
)
|
|
await audit_db.commit()
|
|
except Exception:
|
|
pass
|
|
|
|
return SRPVerifyResponse(
|
|
access_token=access_token,
|
|
refresh_token=refresh_token,
|
|
token_type="bearer",
|
|
server_proof=server_proof or "",
|
|
encrypted_key_set=encrypted_key_set,
|
|
)
|
|
|
|
|
|
@router.post("/login", response_model=TokenResponse, summary="Authenticate with email and password")
|
|
@limiter.limit("5/minute")
|
|
async def login(
|
|
request: StarletteRequest,
|
|
body: LoginRequest,
|
|
response: Response,
|
|
db: AsyncSession = Depends(get_admin_db),
|
|
) -> TokenResponse:
|
|
"""
|
|
Login entry point — redirects to SRP for all enrolled users.
|
|
|
|
For SRP-enrolled users: returns 409 srp_required (frontend auto-switches).
|
|
For legacy bcrypt users (must_upgrade_auth=True): verifies bcrypt password
|
|
and returns a temporary session with auth_upgrade_required=True so the
|
|
frontend can register SRP credentials before completing login.
|
|
|
|
Anti-enumeration: dummy verify_password for unknown users preserves timing.
|
|
Rate limited to 5 requests per minute per IP.
|
|
"""
|
|
# Look up user by email (case-insensitive)
|
|
result = await db.execute(
|
|
select(User).where(User.email == body.email.lower())
|
|
)
|
|
user = result.scalar_one_or_none()
|
|
|
|
# Generic error — do not reveal whether email exists (no user enumeration)
|
|
invalid_credentials_error = HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Invalid credentials",
|
|
headers={"WWW-Authenticate": "Bearer"},
|
|
)
|
|
|
|
if not user:
|
|
# Perform dummy verification to prevent timing attacks
|
|
verify_password("dummy", "$2b$12$/MSofyKqE3MkwXyzhigw.OHIefMM.qb5xGt/t9OAwbxgDGnyZjmrG")
|
|
raise invalid_credentials_error
|
|
|
|
if not user.is_active:
|
|
# Still run dummy verify for timing consistency
|
|
verify_password("dummy", "$2b$12$/MSofyKqE3MkwXyzhigw.OHIefMM.qb5xGt/t9OAwbxgDGnyZjmrG")
|
|
raise invalid_credentials_error
|
|
|
|
# SRP-enrolled users: redirect to SRP flow
|
|
if user.srp_verifier is not None:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_409_CONFLICT,
|
|
detail="srp_required",
|
|
headers={"X-Auth-Method": "srp"},
|
|
)
|
|
|
|
# Bcrypt user (auth_version 1) — verify password
|
|
if user.hashed_password:
|
|
if not verify_password(body.password, user.hashed_password):
|
|
raise invalid_credentials_error
|
|
|
|
# Correct bcrypt password — issue session
|
|
access_token = create_access_token(
|
|
user_id=user.id,
|
|
tenant_id=user.tenant_id,
|
|
role=user.role,
|
|
)
|
|
refresh = create_refresh_token(user.id)
|
|
|
|
response.set_cookie(
|
|
key=ACCESS_TOKEN_COOKIE,
|
|
value=access_token,
|
|
max_age=ACCESS_TOKEN_MAX_AGE,
|
|
httponly=True,
|
|
secure=_COOKIE_SECURE,
|
|
samesite="lax",
|
|
)
|
|
# Also set refresh token as httpOnly cookie so auto-refresh works
|
|
# without the frontend needing to persist the token in JS memory.
|
|
if not user.must_upgrade_auth:
|
|
response.set_cookie(
|
|
key=REFRESH_TOKEN_COOKIE,
|
|
value=refresh,
|
|
max_age=REFRESH_TOKEN_MAX_AGE,
|
|
httponly=True,
|
|
secure=_COOKIE_SECURE,
|
|
samesite="lax",
|
|
path="/api/auth/refresh", # scope cookie to refresh endpoint only
|
|
)
|
|
|
|
# Update last_login
|
|
await db.execute(
|
|
update(User).where(User.id == user.id).values(
|
|
last_login=datetime.now(UTC),
|
|
)
|
|
)
|
|
await db.commit()
|
|
|
|
# Audit log (fire-and-forget)
|
|
try:
|
|
async with AdminAsyncSessionLocal() as audit_db:
|
|
await log_action(
|
|
audit_db,
|
|
tenant_id=user.tenant_id or uuid.UUID(int=0),
|
|
user_id=user.id,
|
|
action="login_upgrade" if user.must_upgrade_auth else "login",
|
|
resource_type="auth",
|
|
details={"email": user.email, **({"upgrade": "bcrypt_to_srp"} if user.must_upgrade_auth else {})},
|
|
ip_address=request.client.host if request.client else None,
|
|
)
|
|
await audit_db.commit()
|
|
except Exception:
|
|
pass
|
|
|
|
return TokenResponse(
|
|
access_token=access_token,
|
|
refresh_token=refresh if not user.must_upgrade_auth else "",
|
|
token_type="bearer",
|
|
auth_upgrade_required=user.must_upgrade_auth,
|
|
)
|
|
|
|
# No valid credentials at all
|
|
raise invalid_credentials_error
|
|
|
|
|
|
@router.post("/refresh", response_model=TokenResponse, summary="Refresh access token")
|
|
@limiter.limit("10/minute")
|
|
async def refresh_token(
|
|
request: StarletteRequest,
|
|
body: Optional[RefreshRequest] = None,
|
|
response: Response = None,
|
|
db: AsyncSession = Depends(get_admin_db),
|
|
redis: aioredis.Redis = Depends(get_redis),
|
|
refresh_token_cookie: Optional[str] = Cookie(default=None, alias="refresh_token"),
|
|
) -> TokenResponse:
|
|
"""
|
|
Exchange a valid refresh token for a new access token.
|
|
|
|
Accepts the refresh token either in the JSON body (legacy) or as an
|
|
httpOnly cookie named 'refresh_token' (preferred — set automatically at login).
|
|
Rate limited to 10 requests per minute per IP.
|
|
"""
|
|
# Resolve token: body takes precedence over cookie
|
|
raw_token = (body.refresh_token if body and body.refresh_token else None) or refresh_token_cookie
|
|
if not raw_token:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="No refresh token provided",
|
|
)
|
|
|
|
# Validate refresh token
|
|
payload = verify_token(raw_token, expected_type="refresh")
|
|
|
|
user_id_str = payload.get("sub")
|
|
if not user_id_str:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Invalid refresh token",
|
|
)
|
|
|
|
try:
|
|
user_id = uuid.UUID(user_id_str)
|
|
except ValueError:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Invalid refresh token",
|
|
)
|
|
|
|
# Check if token was revoked (issued before logout)
|
|
issued_at = payload.get("iat", 0)
|
|
if await is_token_revoked(redis, user_id_str, float(issued_at)):
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Token has been revoked",
|
|
)
|
|
|
|
# Fetch current user state from DB
|
|
result = await db.execute(select(User).where(User.id == user_id))
|
|
user = result.scalar_one_or_none()
|
|
|
|
if not user or not user.is_active:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="User not found or inactive",
|
|
)
|
|
|
|
# Issue new tokens
|
|
new_access_token = create_access_token(
|
|
user_id=user.id,
|
|
tenant_id=user.tenant_id,
|
|
role=user.role,
|
|
)
|
|
new_refresh_token = create_refresh_token(user_id=user.id)
|
|
|
|
# Rotate access token cookie
|
|
response.set_cookie(
|
|
key=ACCESS_TOKEN_COOKIE,
|
|
value=new_access_token,
|
|
max_age=ACCESS_TOKEN_MAX_AGE,
|
|
httponly=True,
|
|
secure=_COOKIE_SECURE,
|
|
samesite="lax",
|
|
)
|
|
# Rotate refresh token cookie (silent token rotation)
|
|
response.set_cookie(
|
|
key=REFRESH_TOKEN_COOKIE,
|
|
value=new_refresh_token,
|
|
max_age=REFRESH_TOKEN_MAX_AGE,
|
|
httponly=True,
|
|
secure=_COOKIE_SECURE,
|
|
samesite="lax",
|
|
path="/api/auth/refresh",
|
|
)
|
|
|
|
return TokenResponse(
|
|
access_token=new_access_token,
|
|
refresh_token=new_refresh_token,
|
|
token_type="bearer",
|
|
)
|
|
|
|
|
|
@router.post("/logout", status_code=status.HTTP_204_NO_CONTENT, summary="Log out and clear session cookie")
|
|
@limiter.limit("10/minute")
|
|
async def logout(
|
|
request: StarletteRequest,
|
|
response: Response,
|
|
current_user: CurrentUser = Depends(require_authenticated),
|
|
redis: aioredis.Redis = Depends(get_redis),
|
|
) -> None:
|
|
"""Clear the httpOnly access token cookie and revoke all refresh tokens."""
|
|
# Revoke all refresh tokens for this user
|
|
await revoke_user_tokens(redis, str(current_user.user_id))
|
|
|
|
# Audit log for logout
|
|
try:
|
|
tenant_id = current_user.tenant_id or uuid.UUID(int=0)
|
|
async with AdminAsyncSessionLocal() as audit_db:
|
|
await log_action(
|
|
audit_db, tenant_id, current_user.user_id, "logout",
|
|
resource_type="auth",
|
|
ip_address=request.client.host if request.client else None,
|
|
)
|
|
await audit_db.commit()
|
|
except Exception:
|
|
pass # Fire-and-forget: never fail logout
|
|
|
|
response.delete_cookie(
|
|
key=ACCESS_TOKEN_COOKIE,
|
|
httponly=True,
|
|
secure=_COOKIE_SECURE,
|
|
samesite="lax",
|
|
)
|
|
response.delete_cookie(
|
|
key=REFRESH_TOKEN_COOKIE,
|
|
httponly=True,
|
|
secure=_COOKIE_SECURE,
|
|
samesite="lax",
|
|
path="/api/auth/refresh",
|
|
)
|
|
|
|
|
|
@router.post("/change-password", response_model=MessageResponse, summary="Change password for authenticated user")
|
|
@limiter.limit("3/minute")
|
|
async def change_password(
|
|
request: StarletteRequest,
|
|
body: ChangePasswordRequest,
|
|
current_user: CurrentUser = Depends(require_authenticated),
|
|
db: AsyncSession = Depends(get_admin_db),
|
|
redis: aioredis.Redis = Depends(get_redis),
|
|
) -> MessageResponse:
|
|
"""Change the current user's password. Revokes all existing sessions."""
|
|
result = await db.execute(select(User).where(User.id == current_user.user_id))
|
|
user = result.scalar_one_or_none()
|
|
if not user:
|
|
raise HTTPException(status_code=404, detail="User not found")
|
|
|
|
# For SRP users (auth_version 2): client must provide new salt, verifier, and key bundle
|
|
if user.auth_version == 2:
|
|
if not body.new_srp_salt or not body.new_srp_verifier:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_400_BAD_REQUEST,
|
|
detail="SRP users must provide new salt and verifier",
|
|
)
|
|
# Update SRP credentials
|
|
user.srp_salt = bytes.fromhex(body.new_srp_salt)
|
|
user.srp_verifier = bytes.fromhex(body.new_srp_verifier)
|
|
|
|
# Also update bcrypt hash as a login fallback if SRP ever fails
|
|
# (e.g., crypto.subtle unavailable on HTTP, stale Secret Key, etc.)
|
|
if body.new_password:
|
|
user.hashed_password = hash_password(body.new_password)
|
|
|
|
# Update re-wrapped key bundle if provided
|
|
if body.encrypted_private_key and body.pbkdf2_salt:
|
|
existing_ks = await get_user_key_set(db, user.id)
|
|
if existing_ks:
|
|
existing_ks.encrypted_private_key = base64.b64decode(body.encrypted_private_key)
|
|
existing_ks.private_key_nonce = base64.b64decode(body.private_key_nonce or "")
|
|
existing_ks.encrypted_vault_key = base64.b64decode(body.encrypted_vault_key or "")
|
|
existing_ks.vault_key_nonce = base64.b64decode(body.vault_key_nonce or "")
|
|
existing_ks.public_key = base64.b64decode(body.public_key or "")
|
|
existing_ks.pbkdf2_salt = base64.b64decode(body.pbkdf2_salt)
|
|
existing_ks.hkdf_salt = base64.b64decode(body.hkdf_salt or "")
|
|
else:
|
|
# Legacy bcrypt user — verify current password
|
|
if not user.hashed_password or not verify_password(body.current_password, user.hashed_password):
|
|
raise HTTPException(
|
|
status_code=status.HTTP_400_BAD_REQUEST,
|
|
detail="Current password is incorrect",
|
|
)
|
|
user.hashed_password = hash_password(body.new_password)
|
|
|
|
# Revoke all existing sessions
|
|
await revoke_user_tokens(redis, str(user.id))
|
|
|
|
await db.commit()
|
|
|
|
# Audit log
|
|
try:
|
|
async with AdminAsyncSessionLocal() as audit_db:
|
|
await log_action(
|
|
audit_db,
|
|
tenant_id=user.tenant_id or uuid.UUID(int=0),
|
|
user_id=user.id,
|
|
action="password_change",
|
|
resource_type="user",
|
|
details={"ip": request.client.host if request.client else None},
|
|
ip_address=request.client.host if request.client else None,
|
|
)
|
|
await audit_db.commit()
|
|
except Exception:
|
|
pass
|
|
|
|
return MessageResponse(message="Password changed successfully. Please sign in again.")
|
|
|
|
|
|
@router.get("/me", response_model=UserMeResponse, summary="Get current user profile")
|
|
async def get_me(
|
|
current_user: CurrentUser = Depends(require_authenticated),
|
|
db: AsyncSession = Depends(get_admin_db),
|
|
) -> UserMeResponse:
|
|
"""Return current user info from JWT payload."""
|
|
# Fetch from DB to get latest data
|
|
result = await db.execute(select(User).where(User.id == current_user.user_id))
|
|
user = result.scalar_one_or_none()
|
|
|
|
if not user:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_404_NOT_FOUND,
|
|
detail="User not found",
|
|
)
|
|
|
|
return UserMeResponse(
|
|
id=user.id,
|
|
email=user.email,
|
|
name=user.name,
|
|
role=user.role,
|
|
tenant_id=user.tenant_id,
|
|
auth_version=user.auth_version or 1,
|
|
)
|
|
|
|
|
|
# ─── Account Self-Service (Deletion & Export) ─────────────────────────────────
|
|
|
|
|
|
@router.delete(
|
|
"/delete-my-account",
|
|
response_model=DeleteAccountResponse,
|
|
summary="Delete your own account and erase all PII",
|
|
)
|
|
@limiter.limit("1/minute")
|
|
async def delete_my_account(
|
|
request: StarletteRequest,
|
|
body: DeleteAccountRequest,
|
|
response: Response,
|
|
current_user: CurrentUser = Depends(require_authenticated),
|
|
db: AsyncSession = Depends(get_admin_db),
|
|
) -> DeleteAccountResponse:
|
|
"""Permanently delete the authenticated user's account.
|
|
|
|
Performs full PII erasure: anonymizes audit logs, scrubs encrypted
|
|
details, and hard-deletes the user row (CASCADE handles related
|
|
tables). Requires typing 'DELETE' as confirmation.
|
|
"""
|
|
from sqlalchemy import text as sa_text
|
|
|
|
# Validate confirmation
|
|
if body.confirmation != "DELETE":
|
|
raise HTTPException(
|
|
status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
|
|
detail="You must type 'DELETE' to confirm account deletion.",
|
|
)
|
|
|
|
# Super admin protection: cannot delete last super admin
|
|
if current_user.role == "super_admin":
|
|
result = await db.execute(
|
|
sa_text(
|
|
"SELECT COUNT(*) AS cnt FROM users "
|
|
"WHERE role = 'super_admin' AND is_active = true "
|
|
"AND id != :current_user_id"
|
|
),
|
|
{"current_user_id": current_user.user_id},
|
|
)
|
|
other_admins = result.scalar_one()
|
|
if other_admins == 0:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|
detail="Cannot delete the last super admin account. Transfer the role first.",
|
|
)
|
|
|
|
# Fetch user email BEFORE deletion (needed for audit hash)
|
|
result = await db.execute(
|
|
sa_text("SELECT email FROM users WHERE id = :user_id"),
|
|
{"user_id": current_user.user_id},
|
|
)
|
|
email_row = result.mappings().first()
|
|
if not email_row:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_404_NOT_FOUND,
|
|
detail="User not found.",
|
|
)
|
|
user_email = email_row["email"]
|
|
|
|
# Perform account deletion
|
|
await delete_user_account(
|
|
db=db,
|
|
user_id=current_user.user_id,
|
|
tenant_id=current_user.tenant_id,
|
|
user_email=user_email,
|
|
)
|
|
|
|
# Clear access token cookie (same pattern as logout)
|
|
response.delete_cookie(
|
|
key=ACCESS_TOKEN_COOKIE,
|
|
httponly=True,
|
|
secure=_COOKIE_SECURE,
|
|
samesite="lax",
|
|
)
|
|
|
|
return DeleteAccountResponse(
|
|
message="Account deleted successfully. All personal data has been erased.",
|
|
deleted=True,
|
|
)
|
|
|
|
|
|
@router.get(
|
|
"/export-my-data",
|
|
summary="Export all your personal data (GDPR Art. 20)",
|
|
)
|
|
@limiter.limit("3/minute")
|
|
async def export_my_data(
|
|
request: StarletteRequest,
|
|
current_user: CurrentUser = Depends(require_authenticated),
|
|
db: AsyncSession = Depends(get_admin_db),
|
|
) -> JSONResponse:
|
|
"""Export all personal data for the authenticated user.
|
|
|
|
Returns a JSON file containing user profile, API keys, audit logs,
|
|
and key access log entries. Complies with GDPR Article 20
|
|
(Right to Data Portability).
|
|
"""
|
|
data = await export_user_data(
|
|
db=db,
|
|
user_id=current_user.user_id,
|
|
tenant_id=current_user.tenant_id,
|
|
)
|
|
|
|
# Audit log the export action
|
|
try:
|
|
async with AdminAsyncSessionLocal() as audit_db:
|
|
await log_action(
|
|
audit_db,
|
|
tenant_id=current_user.tenant_id or uuid.UUID(int=0),
|
|
user_id=current_user.user_id,
|
|
action="data_export",
|
|
resource_type="user",
|
|
details={"type": "gdpr_art20"},
|
|
ip_address=request.client.host if request.client else None,
|
|
)
|
|
await audit_db.commit()
|
|
except Exception:
|
|
pass # Fire-and-forget: never fail the export
|
|
|
|
return JSONResponse(
|
|
content=data,
|
|
headers={
|
|
"Content-Disposition": 'attachment; filename="my-data-export.json"',
|
|
},
|
|
)
|
|
|
|
|
|
# ─── Emergency Kit & SRP Registration ─────────────────────────────────────────
|
|
|
|
|
|
@router.get("/emergency-kit-template", summary="Generate Emergency Kit PDF template")
|
|
@limiter.limit("3/minute")
|
|
async def get_emergency_kit_template(
|
|
request: StarletteRequest,
|
|
current_user: CurrentUser = Depends(require_authenticated),
|
|
db: AsyncSession = Depends(get_admin_db),
|
|
) -> StreamingResponse:
|
|
"""Generate Emergency Kit PDF template (without Secret Key).
|
|
|
|
The Secret Key is injected client-side. This endpoint returns
|
|
a PDF with a placeholder that the browser fills in before
|
|
the user downloads it.
|
|
"""
|
|
from app.services.emergency_kit_service import generate_emergency_kit_template
|
|
|
|
result = await db.execute(select(User).where(User.id == current_user.user_id))
|
|
user = result.scalar_one_or_none()
|
|
if not user:
|
|
raise HTTPException(status_code=404, detail="User not found")
|
|
|
|
pdf_bytes = await generate_emergency_kit_template(email=user.email)
|
|
|
|
return StreamingResponse(
|
|
io.BytesIO(pdf_bytes),
|
|
media_type="application/pdf",
|
|
headers={
|
|
"Content-Disposition": 'attachment; filename="The-Other-Dude-Emergency-Kit.pdf"',
|
|
},
|
|
)
|
|
|
|
|
|
@router.post("/register-srp", response_model=MessageResponse, summary="Register SRP credentials for a user")
|
|
@limiter.limit("3/minute")
|
|
async def register_srp(
|
|
request: StarletteRequest,
|
|
body: SRPRegisterRequest,
|
|
current_user: CurrentUser = Depends(require_authenticated),
|
|
db: AsyncSession = Depends(get_admin_db),
|
|
) -> MessageResponse:
|
|
"""Store SRP verifier and encrypted key set for the current user.
|
|
|
|
Called after client-side key generation during initial setup
|
|
or when upgrading from bcrypt to SRP.
|
|
"""
|
|
result = await db.execute(select(User).where(User.id == current_user.user_id))
|
|
user = result.scalar_one_or_none()
|
|
if not user:
|
|
raise HTTPException(status_code=404, detail="User not found")
|
|
|
|
if user.srp_verifier is not None:
|
|
raise HTTPException(status_code=409, detail="SRP already registered")
|
|
|
|
# Update user with SRP credentials and clear upgrade flag
|
|
await db.execute(
|
|
update(User).where(User.id == user.id).values(
|
|
srp_salt=bytes.fromhex(body.srp_salt),
|
|
srp_verifier=bytes.fromhex(body.srp_verifier),
|
|
auth_version=2,
|
|
must_upgrade_auth=False,
|
|
)
|
|
)
|
|
|
|
# Store encrypted key set
|
|
await store_user_key_set(
|
|
db=db,
|
|
user_id=user.id,
|
|
tenant_id=user.tenant_id,
|
|
encrypted_private_key=base64.b64decode(body.encrypted_private_key),
|
|
private_key_nonce=base64.b64decode(body.private_key_nonce),
|
|
encrypted_vault_key=base64.b64decode(body.encrypted_vault_key),
|
|
vault_key_nonce=base64.b64decode(body.vault_key_nonce),
|
|
public_key=base64.b64decode(body.public_key),
|
|
pbkdf2_salt=base64.b64decode(body.pbkdf2_salt),
|
|
hkdf_salt=base64.b64decode(body.hkdf_salt),
|
|
)
|
|
|
|
await db.commit()
|
|
|
|
# Audit log
|
|
try:
|
|
async with AdminAsyncSessionLocal() as audit_db:
|
|
await log_key_access(
|
|
audit_db, user.tenant_id or uuid.UUID(int=0), user.id,
|
|
"create_key_set", resource_type="user_key_set",
|
|
ip_address=request.client.host if request.client else None,
|
|
)
|
|
await audit_db.commit()
|
|
except Exception:
|
|
pass
|
|
|
|
return MessageResponse(message="SRP credentials registered successfully")
|
|
|
|
|
|
# ─── SSE Exchange Tokens ─────────────────────────────────────────────────────
|
|
|
|
|
|
@router.post("/sse-token", summary="Issue a short-lived SSE exchange token")
|
|
async def create_sse_token(
|
|
current_user: CurrentUser = Depends(require_authenticated),
|
|
redis: aioredis.Redis = Depends(get_redis),
|
|
) -> dict:
|
|
"""Issue a 30-second, single-use token for SSE connections.
|
|
|
|
Replaces sending the full JWT in the SSE URL query parameter.
|
|
The returned token is stored in Redis with user context and a 30s TTL.
|
|
The SSE endpoint retrieves and deletes it on first use (single-use).
|
|
"""
|
|
token = secrets.token_urlsafe(32)
|
|
key = f"sse_token:{token}"
|
|
# Store user context for the SSE endpoint to retrieve
|
|
await redis.set(key, json.dumps({
|
|
"user_id": str(current_user.user_id),
|
|
"tenant_id": str(current_user.tenant_id) if current_user.tenant_id else None,
|
|
"role": current_user.role,
|
|
}), ex=30) # 30 second TTL
|
|
return {"token": token}
|
|
|
|
|
|
# ─── Password Reset ──────────────────────────────────────────────────────────
|
|
|
|
|
|
def _hash_token(token: str) -> str:
|
|
"""SHA-256 hash a reset token so plaintext is never stored."""
|
|
return hashlib.sha256(token.encode()).hexdigest()
|
|
|
|
|
|
async def _send_reset_email(email: str, token: str) -> None:
|
|
"""Send password reset email via unified email service."""
|
|
from app.routers.settings import get_smtp_config
|
|
from app.services.email_service import send_email
|
|
|
|
reset_url = f"{settings.APP_BASE_URL}/reset-password?token={token}"
|
|
expire_mins = settings.PASSWORD_RESET_TOKEN_EXPIRE_MINUTES
|
|
|
|
plain = (
|
|
f"You requested a password reset for The Other Dude.\n\n"
|
|
f"Click the link below to reset your password (valid for {expire_mins} minutes):\n\n"
|
|
f"{reset_url}\n\n"
|
|
f"If you did not request this, you can safely ignore this email."
|
|
)
|
|
|
|
html = f"""
|
|
<div style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; max-width: 600px; margin: 0 auto;">
|
|
<div style="background: #0f172a; padding: 24px; border-radius: 8px 8px 0 0;">
|
|
<h2 style="color: #38bdf8; margin: 0;">Password Reset</h2>
|
|
</div>
|
|
<div style="background: #1e293b; padding: 24px; border-radius: 0 0 8px 8px; color: #e2e8f0;">
|
|
<p>You requested a password reset for The Other Dude.</p>
|
|
<p>Click the button below to reset your password. This link is valid for {expire_mins} minutes.</p>
|
|
<div style="text-align: center; margin: 32px 0;">
|
|
<a href="{reset_url}" style="background: #38bdf8; color: #0f172a; padding: 12px 32px; border-radius: 6px; text-decoration: none; font-weight: 600;">
|
|
Reset Password
|
|
</a>
|
|
</div>
|
|
<p style="color: #94a3b8; font-size: 13px;">
|
|
If you did not request this, you can safely ignore this email.
|
|
</p>
|
|
<p style="color: #64748b; font-size: 12px; margin-top: 24px;">
|
|
TOD — Fleet Management for MikroTik RouterOS
|
|
</p>
|
|
</div>
|
|
</div>
|
|
"""
|
|
|
|
smtp_config = await get_smtp_config()
|
|
await send_email(email, "TOD — Password Reset", html, plain, smtp_config)
|
|
|
|
|
|
@router.post(
|
|
"/forgot-password",
|
|
response_model=MessageResponse,
|
|
summary="Request password reset email",
|
|
)
|
|
@limiter.limit("3/minute")
|
|
async def forgot_password(
|
|
request: StarletteRequest,
|
|
body: ForgotPasswordRequest,
|
|
db: AsyncSession = Depends(get_admin_db),
|
|
) -> MessageResponse:
|
|
"""Send a password reset link if the email exists.
|
|
|
|
Always returns success to prevent user enumeration.
|
|
Rate limited to 3 requests per minute per IP.
|
|
"""
|
|
generic_msg = "If an account with that email exists, a reset link has been sent."
|
|
|
|
result = await db.execute(
|
|
select(User).where(User.email == body.email.lower())
|
|
)
|
|
user = result.scalar_one_or_none()
|
|
|
|
if not user or not user.is_active:
|
|
return MessageResponse(message=generic_msg)
|
|
|
|
# Generate a secure token
|
|
raw_token = secrets.token_urlsafe(32)
|
|
token_hash = _hash_token(raw_token)
|
|
expires_at = datetime.now(UTC) + timedelta(
|
|
minutes=settings.PASSWORD_RESET_TOKEN_EXPIRE_MINUTES
|
|
)
|
|
|
|
# Insert token record (using raw SQL to avoid importing the model globally)
|
|
from sqlalchemy import text
|
|
|
|
await db.execute(
|
|
text(
|
|
"INSERT INTO password_reset_tokens (user_id, token_hash, expires_at) "
|
|
"VALUES (:user_id, :token_hash, :expires_at)"
|
|
),
|
|
{"user_id": user.id, "token_hash": token_hash, "expires_at": expires_at},
|
|
)
|
|
await db.commit()
|
|
|
|
# Send email (best-effort)
|
|
try:
|
|
await _send_reset_email(user.email, raw_token)
|
|
except Exception as e:
|
|
logger.warning("Failed to send password reset email to %s: %s", user.email, e)
|
|
|
|
return MessageResponse(message=generic_msg)
|
|
|
|
|
|
@router.post(
|
|
"/reset-password",
|
|
response_model=MessageResponse,
|
|
summary="Reset password with token",
|
|
)
|
|
@limiter.limit("5/minute")
|
|
async def reset_password(
|
|
request: StarletteRequest,
|
|
body: ResetPasswordRequest,
|
|
db: AsyncSession = Depends(get_admin_db),
|
|
) -> MessageResponse:
|
|
"""Validate the reset token and update the user's password.
|
|
|
|
Rate limited to 5 requests per minute per IP.
|
|
"""
|
|
from sqlalchemy import text
|
|
|
|
token_hash = _hash_token(body.token)
|
|
|
|
# Find the token record
|
|
result = await db.execute(
|
|
text(
|
|
"SELECT id, user_id, expires_at, used_at "
|
|
"FROM password_reset_tokens "
|
|
"WHERE token_hash = :token_hash"
|
|
),
|
|
{"token_hash": token_hash},
|
|
)
|
|
row = result.mappings().first()
|
|
|
|
if not row:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_400_BAD_REQUEST,
|
|
detail="Invalid or expired reset token.",
|
|
)
|
|
|
|
if row["used_at"] is not None:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_400_BAD_REQUEST,
|
|
detail="This reset link has already been used.",
|
|
)
|
|
|
|
if row["expires_at"] < datetime.now(UTC):
|
|
raise HTTPException(
|
|
status_code=status.HTTP_400_BAD_REQUEST,
|
|
detail="Invalid or expired reset token.",
|
|
)
|
|
|
|
# Validate password strength (minimum 8 characters)
|
|
if len(body.new_password) < 8:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
|
|
detail="Password must be at least 8 characters.",
|
|
)
|
|
|
|
# Update the user's password and clear SRP credentials for re-registration.
|
|
# The bcrypt hash is kept as a temporary credential for the upgrade flow:
|
|
# user logs in with bcrypt -> gets temp session -> registers SRP -> done.
|
|
new_hash = hash_password(body.new_password)
|
|
await db.execute(
|
|
text(
|
|
"UPDATE users SET hashed_password = :pw, auth_version = 1, "
|
|
"must_upgrade_auth = true, srp_salt = NULL, srp_verifier = NULL, "
|
|
"updated_at = now() WHERE id = :uid"
|
|
),
|
|
{"pw": new_hash, "uid": row["user_id"]},
|
|
)
|
|
|
|
# Mark token as used
|
|
await db.execute(
|
|
text("UPDATE password_reset_tokens SET used_at = now() WHERE id = :tid"),
|
|
{"tid": row["id"]},
|
|
)
|
|
|
|
await db.commit()
|
|
|
|
# Audit log
|
|
try:
|
|
async with AdminAsyncSessionLocal() as audit_db:
|
|
await log_action(
|
|
audit_db,
|
|
tenant_id=uuid.UUID(int=0),
|
|
user_id=row["user_id"],
|
|
action="password_reset",
|
|
resource_type="auth",
|
|
ip_address=request.client.host if request.client else None,
|
|
)
|
|
await audit_db.commit()
|
|
except Exception:
|
|
pass
|
|
|
|
return MessageResponse(message="Password has been reset successfully.")
|