1867a1aac8
Root cause of 'wrong password' right after logout->login (no redeploy): after first-run setup sets an email, users naturally type their EMAIL in the login field, but verify() only looked up by USERNAME -> user not found -> 'invalid credentials' shown as wrong password. Now verify(ident) = get_user_or_none(username) OR by_email(ident). Verified: login by username (200) and by email (200) both work with the new password. Tests: m0/setup/e2e all pass.
180 lines
7.2 KiB
Python
180 lines
7.2 KiB
Python
"""User + organization store and auth logic (JWT, password hashing, roles).
|
|
|
|
Login identity is the user's `username` (stable id). `email` is an optional
|
|
separate field that admins/users can set; the default admin must set an email
|
|
+before first real use (enforced via `must_setup`).
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import datetime
|
|
import re
|
|
from pathlib import Path
|
|
from typing import Any
|
|
|
|
import jwt
|
|
from werkzeug.security import check_password_hash, generate_password_hash
|
|
|
|
from ..config import Config
|
|
from ..storage.store import JsonStore, StoreError, new_id
|
|
|
|
EMAIL_RE = re.compile(r"^[^@\s]+@[^@\s]+\.[^@\s]+$")
|
|
|
|
|
|
class AuthError(Exception):
|
|
pass
|
|
|
|
|
|
class UserStore:
|
|
def __init__(self, data_dir: Path) -> None:
|
|
self.users = JsonStore(data_dir / "users")
|
|
self.orgs = JsonStore(data_dir / "orgs")
|
|
|
|
# ── org ────────────────────────────────────────────────────────────
|
|
def create_org(self, name: str, *, org_id: str | None = None) -> dict[str, Any]:
|
|
return self.orgs.create(
|
|
{"name": name, "id": org_id or new_id("org")},
|
|
key=org_id or new_id("org"),
|
|
)
|
|
|
|
def get_org(self, org_id: str) -> dict[str, Any]:
|
|
return self.orgs.get(org_id)
|
|
|
|
# ── users ──────────────────────────────────────────────────────────
|
|
@staticmethod
|
|
def _norm(username: str) -> str:
|
|
return username.strip().lower()
|
|
|
|
def create_user(
|
|
self,
|
|
*,
|
|
org_id: str,
|
|
username: str,
|
|
password: str,
|
|
name: str,
|
|
role: str = "user",
|
|
email: str | None = None,
|
|
must_setup: bool = False,
|
|
) -> dict[str, Any]:
|
|
if role not in Config.ROLES:
|
|
raise AuthError(f"invalid role: {role}")
|
|
self.orgs.get(org_id)
|
|
username = self._norm(username)
|
|
if not username or not password:
|
|
raise AuthError("username and password are required")
|
|
if not re.fullmatch(r"[a-zA-Z0-9_.-]{2,64}", username):
|
|
raise AuthError("invalid username (letters/numbers/._- only, 2-64 chars)")
|
|
if self.users.get_or_none(username) is not None:
|
|
raise AuthError("a user with this username already exists")
|
|
email = (email or "").strip().lower() or None
|
|
if email:
|
|
if not EMAIL_RE.fullmatch(email):
|
|
raise AuthError("invalid email")
|
|
if self.email_exists(email):
|
|
raise AuthError("a user with this email already exists")
|
|
user = {
|
|
"id": username,
|
|
"username": username,
|
|
"email": email,
|
|
"org_id": org_id,
|
|
"org_name": self.orgs.get(org_id).get("name", ""),
|
|
"name": name.strip() or username,
|
|
"password_hash": generate_password_hash(password),
|
|
"role": role,
|
|
"must_setup": must_setup,
|
|
"created_at": datetime.datetime.now(datetime.timezone.utc).isoformat(),
|
|
"active": True,
|
|
}
|
|
return self.users.create(user, key=username)
|
|
|
|
def get_user(self, username: str) -> dict[str, Any]:
|
|
return self.users.get(self._norm(username))
|
|
|
|
def get_user_or_none(self, username: str) -> dict[str, Any] | None:
|
|
return self.users.get_or_none(self._norm(username))
|
|
|
|
def by_email(self, email: str) -> dict[str, Any] | None:
|
|
email = (email or "").strip().lower()
|
|
if not email:
|
|
return None
|
|
for u in self.users.all():
|
|
if u.get("email") and u["email"] == email:
|
|
return u
|
|
return None
|
|
|
|
def email_exists(self, email: str) -> bool:
|
|
return self.by_email(email) is not None
|
|
|
|
def list_users(self, *, org_id: str | None = None) -> list[dict[str, Any]]:
|
|
users = self.users.all()
|
|
if org_id:
|
|
users = [u for u in users if u.get("org_id") == org_id]
|
|
for u in users:
|
|
u.pop("password_hash", None)
|
|
return users
|
|
|
|
def set_active(self, username: str, active: bool) -> dict[str, Any]:
|
|
return self.users.update(self._norm(username), active=active)
|
|
|
|
def set_role(self, username: str, role: str) -> dict[str, Any]:
|
|
if role not in Config.ROLES:
|
|
raise AuthError(f"invalid role: {role}")
|
|
return self.users.update(self._norm(username), role=role)
|
|
|
|
def set_password(self, username: str, new_password: str) -> dict[str, Any]:
|
|
if not new_password:
|
|
raise AuthError("password is required")
|
|
return self.users.update(
|
|
self._norm(username),
|
|
password_hash=generate_password_hash(new_password),
|
|
)
|
|
|
|
def set_email(self, username: str, email: str) -> dict[str, Any]:
|
|
email = (email or "").strip().lower()
|
|
if not EMAIL_RE.fullmatch(email):
|
|
raise AuthError("invalid email")
|
|
existing = self.by_email(email)
|
|
if existing and existing["id"] != self._norm(username):
|
|
raise AuthError("a user with this email already exists")
|
|
return self.users.update(self._norm(username), email=email)
|
|
|
|
def complete_setup(self, username: str, email: str, new_password: str) -> dict[str, Any]:
|
|
"""First-time admin setup: set email + password, clear must_setup."""
|
|
if not new_password or len(new_password) < 4:
|
|
raise AuthError("password must be at least 4 characters")
|
|
self.set_email(username, email)
|
|
self.set_password(username, new_password)
|
|
return self.users.update(self._norm(username), must_setup=False)
|
|
|
|
# ── auth ───────────────────────────────────────────────────────────
|
|
def verify(self, ident: str, password: str) -> dict[str, Any]:
|
|
# Resolve by EITHER username OR email (the login form doesn't distinguish,
|
|
# and users naturally type their email after setup). Fall back to username.
|
|
user = self.get_user_or_none(ident) or self.by_email(ident)
|
|
if not user or not user.get("active", True):
|
|
raise AuthError("invalid credentials")
|
|
if not check_password_hash(user["password_hash"], password):
|
|
raise AuthError("invalid credentials")
|
|
return user
|
|
|
|
def issue_token(self, user: dict[str, Any]) -> str:
|
|
now = datetime.datetime.now(datetime.timezone.utc)
|
|
payload = {
|
|
"sub": user.get("username") or user.get("id"),
|
|
"org_id": user["org_id"],
|
|
"role": user["role"],
|
|
"iat": now,
|
|
"exp": now + datetime.timedelta(hours=Config.JWT_EXPIRES_HOURS),
|
|
}
|
|
return jwt.encode(payload, Config.SECRET_KEY, algorithm=Config.JWT_ALGO)
|
|
|
|
def decode_token(self, token: str) -> dict[str, Any]:
|
|
try:
|
|
return jwt.decode(token, Config.SECRET_KEY, algorithms=[Config.JWT_ALGO])
|
|
except jwt.PyJWTError as exc:
|
|
raise AuthError("invalid or expired token") from exc
|
|
|
|
def public_user(self, user: dict[str, Any]) -> dict[str, Any]:
|
|
u = dict(user)
|
|
u.pop("password_hash", None)
|
|
return u
|