Add username-based login + mandatory first-time admin setup; push-ready
- User id/login = username (was email). Email is a separate settable field. - Default admin: username admin / password 1234, must_setup=True. - Login forces /setup on first login: set email + change password, then clears must_setup. - New /api/auth/setup endpoint; JWT sub = username; admin routes use username. - Frontend: Login uses username, router guard forces /setup, new Setup.vue (email + new password + confirm), i18n EN/TH. - Tests: test_setup.py added; all suites adapted (m0/m1/routes/security/setup/e2e) PASS.
This commit is contained in:
Macky
@@ -1,7 +1,13 @@
|
||||
"""User + organization store and auth logic (JWT, password hashing, roles)."""
|
||||
"""User + organization store and auth logic (JWT, password hashing, roles).
|
||||
|
||||
Login identity is the user's `username` (stable id). `email` is an optional
|
||||
separate field that admins/users can set; the default admin must set an email
|
||||
+before first real use (enforced via `must_setup`).
|
||||
"""
|
||||
from __future__ import annotations
|
||||
|
||||
import datetime
|
||||
import re
|
||||
from pathlib import Path
|
||||
from typing import Any
|
||||
|
||||
@@ -11,6 +17,8 @@ from werkzeug.security import check_password_hash, generate_password_hash
|
||||
from ..config import Config
|
||||
from ..storage.store import JsonStore, StoreError, new_id
|
||||
|
||||
EMAIL_RE = re.compile(r"^[^@\s]+@[^@\s]+\.[^@\s]+$")
|
||||
|
||||
|
||||
class AuthError(Exception):
|
||||
pass
|
||||
@@ -32,71 +40,114 @@ class UserStore:
|
||||
return self.orgs.get(org_id)
|
||||
|
||||
# ── users ──────────────────────────────────────────────────────────
|
||||
@staticmethod
|
||||
def _norm(username: str) -> str:
|
||||
return username.strip().lower()
|
||||
|
||||
def create_user(
|
||||
self,
|
||||
*,
|
||||
org_id: str,
|
||||
email: str,
|
||||
username: str,
|
||||
password: str,
|
||||
name: str,
|
||||
role: str = "user",
|
||||
email: str | None = None,
|
||||
must_setup: bool = False,
|
||||
) -> dict[str, Any]:
|
||||
if role not in Config.ROLES:
|
||||
raise AuthError(f"invalid role: {role}")
|
||||
org = self.orgs.get(org_id)
|
||||
email = email.strip().lower()
|
||||
if not email or not password:
|
||||
raise AuthError("email and password are required")
|
||||
if self.users.get_or_none(email) is not None:
|
||||
raise AuthError("a user with this email already exists")
|
||||
self.orgs.get(org_id)
|
||||
username = self._norm(username)
|
||||
if not username or not password:
|
||||
raise AuthError("username and password are required")
|
||||
if not re.fullmatch(r"[a-zA-Z0-9_.-]{2,64}", username):
|
||||
raise AuthError("invalid username (letters/numbers/._- only, 2-64 chars)")
|
||||
if self.users.get_or_none(username) is not None:
|
||||
raise AuthError("a user with this username already exists")
|
||||
email = (email or "").strip().lower() or None
|
||||
if email:
|
||||
if not EMAIL_RE.fullmatch(email):
|
||||
raise AuthError("invalid email")
|
||||
if self.email_exists(email):
|
||||
raise AuthError("a user with this email already exists")
|
||||
user = {
|
||||
"id": email, # email = unique id/username
|
||||
"id": username,
|
||||
"username": username,
|
||||
"email": email,
|
||||
"org_id": org_id,
|
||||
"org_name": org.get("name", ""),
|
||||
"name": name.strip() or email,
|
||||
"org_name": self.orgs.get(org_id).get("name", ""),
|
||||
"name": name.strip() or username,
|
||||
"password_hash": generate_password_hash(password),
|
||||
"role": role,
|
||||
"must_setup": must_setup,
|
||||
"created_at": datetime.datetime.now(datetime.timezone.utc).isoformat(),
|
||||
"active": True,
|
||||
}
|
||||
return self.users.create(user, key=email)
|
||||
return self.users.create(user, key=username)
|
||||
|
||||
def get_user(self, email: str) -> dict[str, Any]:
|
||||
email = email.strip().lower()
|
||||
return self.users.get(email)
|
||||
def get_user(self, username: str) -> dict[str, Any]:
|
||||
return self.users.get(self._norm(username))
|
||||
|
||||
def get_user_or_none(self, email: str) -> dict[str, Any] | None:
|
||||
return self.users.get_or_none(email.strip().lower())
|
||||
def get_user_or_none(self, username: str) -> dict[str, Any] | None:
|
||||
return self.users.get_or_none(self._norm(username))
|
||||
|
||||
def by_email(self, email: str) -> dict[str, Any] | None:
|
||||
email = (email or "").strip().lower()
|
||||
if not email:
|
||||
return None
|
||||
for u in self.users.all():
|
||||
if u.get("email") and u["email"] == email:
|
||||
return u
|
||||
return None
|
||||
|
||||
def email_exists(self, email: str) -> bool:
|
||||
return self.by_email(email) is not None
|
||||
|
||||
def list_users(self, *, org_id: str | None = None) -> list[dict[str, Any]]:
|
||||
users = self.users.all()
|
||||
if org_id:
|
||||
users = [u for u in users if u.get("org_id") == org_id]
|
||||
# Redact password hash
|
||||
for u in users:
|
||||
u.pop("password_hash", None)
|
||||
return users
|
||||
|
||||
def set_active(self, email: str, active: bool) -> dict[str, Any]:
|
||||
return self.users.update(email.strip().lower(), active=active)
|
||||
def set_active(self, username: str, active: bool) -> dict[str, Any]:
|
||||
return self.users.update(self._norm(username), active=active)
|
||||
|
||||
def set_role(self, email: str, role: str) -> dict[str, Any]:
|
||||
def set_role(self, username: str, role: str) -> dict[str, Any]:
|
||||
if role not in Config.ROLES:
|
||||
raise AuthError(f"invalid role: {role}")
|
||||
return self.users.update(email.strip().lower(), role=role)
|
||||
return self.users.update(self._norm(username), role=role)
|
||||
|
||||
def set_password(self, email: str, new_password: str) -> dict[str, Any]:
|
||||
def set_password(self, username: str, new_password: str) -> dict[str, Any]:
|
||||
if not new_password:
|
||||
raise AuthError("password is required")
|
||||
return self.users.update(
|
||||
email.strip().lower(),
|
||||
self._norm(username),
|
||||
password_hash=generate_password_hash(new_password),
|
||||
)
|
||||
|
||||
def set_email(self, username: str, email: str) -> dict[str, Any]:
|
||||
email = (email or "").strip().lower()
|
||||
if not EMAIL_RE.fullmatch(email):
|
||||
raise AuthError("invalid email")
|
||||
existing = self.by_email(email)
|
||||
if existing and existing["id"] != self._norm(username):
|
||||
raise AuthError("a user with this email already exists")
|
||||
return self.users.update(self._norm(username), email=email)
|
||||
|
||||
def complete_setup(self, username: str, email: str, new_password: str) -> dict[str, Any]:
|
||||
"""First-time admin setup: set email + password, clear must_setup."""
|
||||
if not new_password or len(new_password) < 4:
|
||||
raise AuthError("password must be at least 4 characters")
|
||||
self.set_email(username, email)
|
||||
self.set_password(username, new_password)
|
||||
return self.users.update(self._norm(username), must_setup=False)
|
||||
|
||||
# ── auth ───────────────────────────────────────────────────────────
|
||||
def verify(self, email: str, password: str) -> dict[str, Any]:
|
||||
user = self.get_user_or_none(email)
|
||||
def verify(self, username: str, password: str) -> dict[str, Any]:
|
||||
user = self.get_user_or_none(username)
|
||||
if not user or not user.get("active", True):
|
||||
raise AuthError("invalid credentials")
|
||||
if not check_password_hash(user["password_hash"], password):
|
||||
@@ -106,7 +157,7 @@ class UserStore:
|
||||
def issue_token(self, user: dict[str, Any]) -> str:
|
||||
now = datetime.datetime.now(datetime.timezone.utc)
|
||||
payload = {
|
||||
"sub": user["email"],
|
||||
"sub": user.get("username") or user.get("id"),
|
||||
"org_id": user["org_id"],
|
||||
"role": user["role"],
|
||||
"iat": now,
|
||||
@@ -116,9 +167,7 @@ class UserStore:
|
||||
|
||||
def decode_token(self, token: str) -> dict[str, Any]:
|
||||
try:
|
||||
return jwt.decode(
|
||||
token, Config.SECRET_KEY, algorithms=[Config.JWT_ALGO]
|
||||
)
|
||||
return jwt.decode(token, Config.SECRET_KEY, algorithms=[Config.JWT_ALGO])
|
||||
except jwt.PyJWTError as exc:
|
||||
raise AuthError("invalid or expired token") from exc
|
||||
|
||||
|
||||
Reference in New Issue
Block a user