708 lines
22 KiB
Python
708 lines
22 KiB
Python
"""
|
|
FastAPI user handling (via fastapi-users)
|
|
"""
|
|
|
|
import os
|
|
from uuid import UUID, uuid4
|
|
import asyncio
|
|
|
|
from typing import Optional, List, TYPE_CHECKING, cast, Callable
|
|
|
|
from pydantic import EmailStr
|
|
|
|
from fastapi import (
|
|
Request,
|
|
HTTPException,
|
|
Depends,
|
|
APIRouter,
|
|
Body,
|
|
)
|
|
|
|
from pymongo.errors import DuplicateKeyError
|
|
from pymongo.collation import Collation
|
|
|
|
from .models import (
|
|
UserCreate,
|
|
UserUpdateEmailName,
|
|
UserUpdatePassword,
|
|
User,
|
|
UserOrgInfoOut,
|
|
UserOut,
|
|
UserRole,
|
|
InvitePending,
|
|
InviteOut,
|
|
PaginatedResponse,
|
|
FailedLogin,
|
|
)
|
|
from .pagination import DEFAULT_PAGE_SIZE, paginated_format
|
|
from .utils import is_bool
|
|
|
|
from .auth import (
|
|
init_jwt_auth,
|
|
RESET_AUD,
|
|
RESET_ALLOW_AUD,
|
|
VERIFY_AUD,
|
|
VERIFY_ALLOW_AUD,
|
|
RESET_VERIFY_TOKEN_LIFETIME_MINUTES,
|
|
verify_and_update_password,
|
|
get_password_hash,
|
|
generate_password,
|
|
generate_jwt,
|
|
decode_jwt,
|
|
)
|
|
|
|
if TYPE_CHECKING:
|
|
from .invites import InviteOps
|
|
from .emailsender import EmailSender
|
|
from .orgs import OrgOps
|
|
from .basecrawls import BaseCrawlOps
|
|
from .crawlconfigs import CrawlConfigOps
|
|
else:
|
|
InviteOps = EmailSender = OrgOps = BaseCrawlOps = CrawlConfigOps = object
|
|
|
|
|
|
# ============================================================================
|
|
# pylint: disable=raise-missing-from, too-many-public-methods, too-many-instance-attributes
|
|
class UserManager:
|
|
"""Browsertrix UserManager"""
|
|
|
|
invites: InviteOps
|
|
email: EmailSender
|
|
|
|
org_ops: OrgOps
|
|
base_crawl_ops: BaseCrawlOps
|
|
crawl_config_ops: CrawlConfigOps
|
|
|
|
def __init__(self, mdb, email, invites):
|
|
self.users = mdb.get_collection("users")
|
|
self.failed_logins = mdb.get_collection("logins")
|
|
self.email = email
|
|
self.invites = invites
|
|
|
|
self.org_ops = cast(OrgOps, None)
|
|
self.crawl_config_ops = cast(CrawlConfigOps, None)
|
|
self.base_crawl_ops = cast(BaseCrawlOps, None)
|
|
|
|
self.email_collation = Collation("en", strength=2)
|
|
|
|
self.registration_enabled = is_bool(os.environ.get("REGISTRATION_ENABLED"))
|
|
|
|
# pylint: disable=attribute-defined-outside-init
|
|
def set_ops(self, org_ops, crawl_config_ops, base_crawl_ops):
|
|
"""set org ops"""
|
|
self.org_ops = org_ops
|
|
self.crawl_config_ops = crawl_config_ops
|
|
self.base_crawl_ops = base_crawl_ops
|
|
|
|
async def init_index(self):
|
|
"""init lookup index"""
|
|
await self.users.create_index("id", unique=True)
|
|
await self.users.create_index("email", unique=True)
|
|
|
|
await self.users.create_index(
|
|
"email",
|
|
name="case_insensitive_email_index",
|
|
collation=self.email_collation,
|
|
)
|
|
|
|
# Expire failed logins object after one hour
|
|
await self.failed_logins.create_index("attempted", expireAfterSeconds=3600)
|
|
|
|
async def register(
|
|
self, create: UserCreate, request: Optional[Request] = None
|
|
) -> User:
|
|
"""override user creation to check if invite token is present"""
|
|
create.name = create.name or create.email
|
|
|
|
# if open registration not enabled, can only register with an invite
|
|
if not self.registration_enabled and not create.inviteToken:
|
|
raise HTTPException(status_code=400, detail="invite_token_required")
|
|
|
|
invite: Optional[InvitePending] = None
|
|
if create.inviteToken:
|
|
# raises if invite is invalid
|
|
invite = await self.invites.get_valid_invite(
|
|
create.inviteToken, email=create.email
|
|
)
|
|
|
|
try:
|
|
user = await self.create_user(
|
|
name=create.name,
|
|
email=create.email,
|
|
password=create.password,
|
|
is_verified=invite is not None,
|
|
)
|
|
|
|
except DuplicateKeyError:
|
|
maybe_user = await self.get_by_email(create.email)
|
|
# shouldn't happen since user should exist if we have duplicate key, but just in case!
|
|
if not maybe_user:
|
|
raise HTTPException(status_code=400, detail="user_missing")
|
|
|
|
if not await self.check_password(maybe_user, create.password):
|
|
raise HTTPException(status_code=400, detail="invalid_current_password")
|
|
|
|
user = maybe_user
|
|
|
|
default_register_org = await self.org_ops.get_default_register_org()
|
|
|
|
# if invite, add via invite path
|
|
if invite:
|
|
await self.org_ops.add_user_by_invite(
|
|
invite, user, default_org=default_register_org
|
|
)
|
|
|
|
else:
|
|
await self.org_ops.add_user_to_org(
|
|
default_register_org, user.id, UserRole.CRAWLER
|
|
)
|
|
|
|
asyncio.create_task(self.request_verify(user, request))
|
|
|
|
return user
|
|
|
|
async def get_user_info_with_orgs(self, user: User) -> UserOut:
|
|
"""return User info"""
|
|
user_orgs, _ = await self.org_ops.get_orgs_for_user(
|
|
user,
|
|
# Set high so that we get all orgs even after reducing default page size
|
|
page_size=1_000,
|
|
)
|
|
|
|
if user_orgs:
|
|
orgs = [
|
|
UserOrgInfoOut(
|
|
id=org.id,
|
|
name=org.name,
|
|
slug=org.slug,
|
|
default=org.default,
|
|
role=(
|
|
UserRole.SUPERADMIN
|
|
if user.is_superuser
|
|
else org.users.get(str(user.id))
|
|
),
|
|
)
|
|
for org in user_orgs
|
|
]
|
|
else:
|
|
orgs = []
|
|
|
|
return UserOut(
|
|
id=user.id,
|
|
email=user.email,
|
|
name=user.name,
|
|
orgs=orgs,
|
|
is_superuser=user.is_superuser,
|
|
is_verified=user.is_verified,
|
|
)
|
|
|
|
async def validate_password(self, password: str) -> None:
|
|
"""
|
|
Validate a password. raise HTTPException with status 422
|
|
if password is invalid
|
|
"""
|
|
pw_length = len(password)
|
|
if not 8 <= pw_length <= 64:
|
|
raise HTTPException(status_code=400, detail="invalid_password")
|
|
|
|
async def check_password(self, user: User, password: str) -> bool:
|
|
"""check if password is valid, also update hashed_password if needed"""
|
|
verified, updated_password_hash = verify_and_update_password(
|
|
password, user.hashed_password
|
|
)
|
|
|
|
if not verified:
|
|
return False
|
|
|
|
# Update password hash to a more robust one if needed
|
|
if updated_password_hash:
|
|
user.hashed_password = updated_password_hash
|
|
await self.users.find_one_and_update(
|
|
{"id": user.id}, {"$set": {"hashed_password": user.hashed_password}}
|
|
)
|
|
|
|
return True
|
|
|
|
async def authenticate(self, email: EmailStr, password: str) -> Optional[User]:
|
|
"""authenticate user via login form"""
|
|
user = await self.get_by_email(email)
|
|
if not user:
|
|
# Run the hasher to mitigate timing attack
|
|
# Inspired from Django: https://code.djangoproject.com/ticket/20760
|
|
get_password_hash(password)
|
|
return None
|
|
|
|
if await self.check_password(user, password):
|
|
return user
|
|
|
|
return None
|
|
|
|
async def get_user_names_by_ids(self, user_ids: List[str]) -> dict[str, str]:
|
|
"""return list of user names for given ids"""
|
|
user_uuid_ids = [UUID(id_) for id_ in user_ids]
|
|
cursor = self.users.find(
|
|
{"id": {"$in": user_uuid_ids}}, projection=["id", "name", "email"]
|
|
)
|
|
return await cursor.to_list(length=1000)
|
|
|
|
async def get_user_emails_by_ids(self):
|
|
"""return dict of user emails keyed by id"""
|
|
email_id_map = {}
|
|
async for user in self.users.find({}):
|
|
email_id_map[user["id"]] = user["email"]
|
|
return email_id_map
|
|
|
|
async def get_superuser(self) -> Optional[User]:
|
|
"""return current superuser, if any"""
|
|
user_data = await self.users.find_one({"is_superuser": True})
|
|
if not user_data:
|
|
return None
|
|
|
|
return User(**user_data)
|
|
|
|
async def create_super_user(self) -> None:
|
|
"""Initialize a super user from env vars"""
|
|
email = os.environ.get("SUPERUSER_EMAIL")
|
|
password = os.environ.get("SUPERUSER_PASSWORD")
|
|
name = os.environ.get("SUPERUSER_NAME", "admin")
|
|
if not email:
|
|
print("No superuser defined", flush=True)
|
|
return
|
|
|
|
if not password:
|
|
password = generate_password()
|
|
|
|
superuser = await self.get_superuser()
|
|
if superuser:
|
|
if str(superuser.email) != email:
|
|
await self.update_email_name(superuser, EmailStr(email), name)
|
|
print("Superuser email updated")
|
|
|
|
if not await self.check_password(superuser, password):
|
|
await self._update_password(superuser, password)
|
|
print("Superuser password updated")
|
|
|
|
return
|
|
|
|
try:
|
|
res = await self.create_user(
|
|
name=name, email=email, password=password, is_superuser=True
|
|
)
|
|
print(f"Super user {email} created", flush=True)
|
|
print(res, flush=True)
|
|
except DuplicateKeyError as exc:
|
|
print(exc)
|
|
print(f"User {email} already exists", flush=True)
|
|
|
|
async def request_verify(
|
|
self, user: User, request: Optional[Request] = None
|
|
) -> None:
|
|
"""start verifying user, if not already verified"""
|
|
if user.is_verified:
|
|
raise HTTPException(status_code=400, detail="verify_user_already_verified")
|
|
|
|
token_data = {
|
|
"user_id": str(user.id),
|
|
"email": user.email,
|
|
"aud": VERIFY_AUD,
|
|
}
|
|
token = generate_jwt(
|
|
token_data,
|
|
RESET_VERIFY_TOKEN_LIFETIME_MINUTES,
|
|
)
|
|
|
|
self.email.send_user_validation(
|
|
user.email, token, dict(request.headers) if request else None
|
|
)
|
|
|
|
# pylint: disable=too-many-arguments
|
|
async def create_user(
|
|
self,
|
|
name: str,
|
|
email: str,
|
|
password: Optional[str] = None,
|
|
is_superuser=False,
|
|
is_verified=False,
|
|
) -> User:
|
|
"""create new user in db"""
|
|
|
|
if not email:
|
|
raise HTTPException(status_code=400, detail="missing_user_email")
|
|
|
|
if not password:
|
|
password = generate_password()
|
|
|
|
await self.validate_password(password)
|
|
|
|
hashed_password = get_password_hash(password)
|
|
|
|
id_ = uuid4()
|
|
|
|
user = User(
|
|
id=id_,
|
|
email=email,
|
|
name=name,
|
|
hashed_password=hashed_password,
|
|
is_superuser=is_superuser,
|
|
is_verified=is_verified,
|
|
)
|
|
|
|
await self.users.insert_one(user.dict())
|
|
|
|
return user
|
|
|
|
async def get_by_id(self, _id: UUID) -> Optional[User]:
|
|
"""get user by unique id"""
|
|
user = await self.users.find_one({"id": _id})
|
|
|
|
if not user:
|
|
return None
|
|
|
|
return User(**user)
|
|
|
|
async def get_by_email(self, email: str) -> Optional[User]:
|
|
"""get user by email"""
|
|
user = await self.users.find_one(
|
|
{"email": email}, collation=self.email_collation
|
|
)
|
|
if not user:
|
|
return None
|
|
|
|
return User(**user)
|
|
|
|
async def verify(self, token: str) -> None:
|
|
"""validate verification request token"""
|
|
exc = HTTPException(
|
|
status_code=400,
|
|
detail="verify_user_bad_token",
|
|
)
|
|
|
|
try:
|
|
data = decode_jwt(token, audience=VERIFY_ALLOW_AUD)
|
|
except:
|
|
raise exc
|
|
|
|
try:
|
|
user_id = data["user_id"]
|
|
email = data["email"]
|
|
except KeyError:
|
|
raise exc
|
|
|
|
user = await self.get_by_email(email)
|
|
if not user:
|
|
raise exc
|
|
|
|
try:
|
|
user_uuid = UUID(user_id)
|
|
except ValueError:
|
|
raise exc
|
|
|
|
if user_uuid != user.id:
|
|
raise exc
|
|
|
|
if user.is_verified:
|
|
raise HTTPException(
|
|
status_code=400,
|
|
detail="verify_user_already_verified",
|
|
)
|
|
|
|
user.is_verified = True
|
|
await self.update_verified(user)
|
|
|
|
async def forgot_password(
|
|
self, user: User, request: Optional[Request] = None
|
|
) -> None:
|
|
"""start forgot password reset request"""
|
|
token_data = {
|
|
"user_id": str(user.id),
|
|
"aud": RESET_AUD,
|
|
}
|
|
token = generate_jwt(
|
|
token_data,
|
|
RESET_VERIFY_TOKEN_LIFETIME_MINUTES,
|
|
)
|
|
|
|
print(f"User {user.id} has forgot their password. Reset token: {token}")
|
|
self.email.send_user_forgot_password(
|
|
user.email, token, request and request.headers
|
|
)
|
|
|
|
async def reset_password(self, token: str, password: str) -> None:
|
|
"""reset password to new password given reset token"""
|
|
try:
|
|
data = decode_jwt(token, audience=RESET_ALLOW_AUD)
|
|
except:
|
|
raise HTTPException(
|
|
status_code=400,
|
|
detail="reset_password_bad_token",
|
|
)
|
|
|
|
user_id = data["user_id"]
|
|
|
|
try:
|
|
user_uuid = UUID(user_id)
|
|
except ValueError:
|
|
raise HTTPException(
|
|
status_code=400,
|
|
detail="reset_password_bad_token",
|
|
)
|
|
|
|
user = await self.get_by_id(user_uuid)
|
|
if user:
|
|
await self._update_password(user, password)
|
|
|
|
async def change_password(
|
|
self, user_update: UserUpdatePassword, user: User
|
|
) -> None:
|
|
"""Change password after checking existing password"""
|
|
if not await self.check_password(user, user_update.password):
|
|
raise HTTPException(status_code=400, detail="invalid_current_password")
|
|
|
|
await self._update_password(user, user_update.newPassword)
|
|
|
|
async def change_email_name(
|
|
self, user_update: UserUpdateEmailName, user: User
|
|
) -> None:
|
|
"""Change email and/or name, if specified, throw if neither is specified"""
|
|
if not user_update.email and not user_update.name:
|
|
raise HTTPException(status_code=400, detail="no_updates_specified")
|
|
|
|
await self.update_email_name(user, user_update.email, user_update.name)
|
|
|
|
if user_update.name:
|
|
await self.base_crawl_ops.update_usernames(user.id, user_update.name)
|
|
await self.crawl_config_ops.update_usernames(user.id, user_update.name)
|
|
|
|
async def update_verified(self, user: User) -> None:
|
|
"""Update verified status for user"""
|
|
await self.users.find_one_and_update(
|
|
{"id": user.id}, {"$set": {"is_verified": user.is_verified}}
|
|
)
|
|
|
|
async def update_email_name(
|
|
self, user: User, email: Optional[EmailStr], name: Optional[str]
|
|
) -> None:
|
|
"""Update email for user"""
|
|
query: dict[str, str] = {}
|
|
if email:
|
|
query["email"] = str(email)
|
|
if name:
|
|
query["name"] = name
|
|
|
|
try:
|
|
await self.users.find_one_and_update({"id": user.id}, {"$set": query})
|
|
except DuplicateKeyError:
|
|
raise HTTPException(status_code=400, detail="user_already_exists")
|
|
|
|
async def _update_password(self, user: User, new_password: str) -> None:
|
|
"""Update hashed_password for user, overwriting previous password hash
|
|
|
|
Internal method, use change_password() for password verification first
|
|
|
|
Method also ensures user is not locked after password change
|
|
"""
|
|
await self.validate_password(new_password)
|
|
hashed_password = get_password_hash(new_password)
|
|
if hashed_password == user.hashed_password:
|
|
return
|
|
user.hashed_password = hashed_password
|
|
await self.users.find_one_and_update(
|
|
{"id": user.id},
|
|
{"$set": {"hashed_password": hashed_password}},
|
|
)
|
|
await self.reset_failed_logins(user.email)
|
|
|
|
async def reset_failed_logins(self, email: str) -> None:
|
|
"""Reset consecutive failed login attempts by deleting FailedLogin object"""
|
|
await self.failed_logins.delete_one(
|
|
{"email": email}, collation=self.email_collation
|
|
)
|
|
|
|
async def inc_failed_logins(self, email: str) -> None:
|
|
"""Inc consecutive failed login attempts for user by 1
|
|
|
|
If a FailedLogin object doesn't already exist, create it
|
|
"""
|
|
failed_login = FailedLogin(id=uuid4(), email=email)
|
|
|
|
await self.failed_logins.find_one_and_update(
|
|
{"email": email},
|
|
{
|
|
"$setOnInsert": failed_login.to_dict(exclude={"count", "attempted"}),
|
|
"$set": {"attempted": failed_login.dict(include={"attempted"})},
|
|
"$inc": {"count": 1},
|
|
},
|
|
upsert=True,
|
|
collation=self.email_collation,
|
|
)
|
|
|
|
async def get_failed_logins_count(self, email: str) -> int:
|
|
"""Get failed login attempts for user, falling back to 0"""
|
|
failed_login = await self.failed_logins.find_one(
|
|
{"email": email}, collation=self.email_collation
|
|
)
|
|
if not failed_login:
|
|
return 0
|
|
return failed_login.get("count", 0)
|
|
|
|
|
|
# ============================================================================
|
|
def init_user_manager(mdb, emailsender, invites):
|
|
"""
|
|
Load users table and init /users routes
|
|
"""
|
|
|
|
return UserManager(mdb, emailsender, invites)
|
|
|
|
|
|
# ============================================================================
|
|
# pylint: disable=too-many-locals, raise-missing-from
|
|
def init_users_api(app, user_manager: UserManager):
|
|
"""init fastapi_users"""
|
|
|
|
auth_jwt_router, current_active_user, shared_secret_or_active_user = init_jwt_auth(
|
|
user_manager
|
|
)
|
|
|
|
app.include_router(
|
|
auth_jwt_router,
|
|
prefix="/auth/jwt",
|
|
tags=["auth"],
|
|
)
|
|
|
|
app.include_router(
|
|
init_auth_router(user_manager),
|
|
prefix="/auth",
|
|
tags=["auth"],
|
|
)
|
|
|
|
app.include_router(
|
|
init_users_router(current_active_user, user_manager),
|
|
prefix="/users",
|
|
tags=["users"],
|
|
)
|
|
|
|
return current_active_user, shared_secret_or_active_user
|
|
|
|
|
|
# ============================================================================
|
|
def init_auth_router(user_manager: UserManager) -> APIRouter:
|
|
"""/auth router"""
|
|
|
|
auth_router = APIRouter()
|
|
|
|
@auth_router.post("/register", status_code=201, response_model=UserOut)
|
|
async def register(request: Request, create: UserCreate):
|
|
user = await user_manager.register(create, request=request)
|
|
return await user_manager.get_user_info_with_orgs(user)
|
|
|
|
@auth_router.post(
|
|
"/forgot-password",
|
|
status_code=202,
|
|
)
|
|
async def forgot_password(
|
|
request: Request,
|
|
email: EmailStr = Body(..., embed=True),
|
|
):
|
|
user = await user_manager.get_by_email(email)
|
|
if not user:
|
|
return None
|
|
|
|
await user_manager.forgot_password(user, request)
|
|
return {"success": True}
|
|
|
|
@auth_router.post(
|
|
"/reset-password",
|
|
)
|
|
async def reset_password(
|
|
# request: Request,
|
|
token: str = Body(...),
|
|
password: str = Body(...),
|
|
):
|
|
await user_manager.reset_password(token, password)
|
|
return {"success": True}
|
|
|
|
@auth_router.post("/request-verify-token", status_code=202)
|
|
async def request_verify_token(
|
|
request: Request,
|
|
email: EmailStr = Body(..., embed=True),
|
|
):
|
|
user = await user_manager.get_by_email(email)
|
|
if user:
|
|
await user_manager.request_verify(user, request)
|
|
|
|
return {"success": True}
|
|
|
|
@auth_router.post("/verify")
|
|
async def verify(
|
|
token: str = Body(..., embed=True),
|
|
):
|
|
await user_manager.verify(token)
|
|
return {"success": True}
|
|
|
|
return auth_router
|
|
|
|
|
|
# ============================================================================
|
|
def init_users_router(
|
|
current_active_user: Callable, user_manager: UserManager
|
|
) -> APIRouter:
|
|
"""/users routes"""
|
|
users_router = APIRouter()
|
|
|
|
@users_router.get("/me", tags=["users"], response_model=UserOut)
|
|
async def current_user_with_org_info(user: User = Depends(current_active_user)):
|
|
"""/users/me with orgs user belongs to."""
|
|
return await user_manager.get_user_info_with_orgs(user)
|
|
|
|
@users_router.put("/me/password-change", tags=["users"])
|
|
async def update_my_password(
|
|
user_update: UserUpdatePassword,
|
|
user: User = Depends(current_active_user),
|
|
):
|
|
"""update password, requires current password"""
|
|
await user_manager.change_password(user_update, user)
|
|
return {"updated": True}
|
|
|
|
@users_router.patch("/me", tags=["users"])
|
|
async def update_my_email_and_name(
|
|
user_update: UserUpdateEmailName,
|
|
user: User = Depends(current_active_user),
|
|
):
|
|
"""update password, requires current password"""
|
|
await user_manager.change_email_name(user_update, user)
|
|
return {"updated": True}
|
|
|
|
@users_router.get("/me/invite/{token}", tags=["invites"], response_model=InviteOut)
|
|
async def get_existing_user_invite_info(
|
|
token: UUID, user: User = Depends(current_active_user)
|
|
):
|
|
invite = await user_manager.invites.get_valid_invite(
|
|
token, email=None, userid=user.id
|
|
)
|
|
|
|
return await user_manager.invites.get_invite_out(invite, user_manager, True)
|
|
|
|
@users_router.get("/invite/{token}", tags=["invites"], response_model=InviteOut)
|
|
async def get_invite_info(token: UUID, email: str):
|
|
invite = await user_manager.invites.get_valid_invite(token, email)
|
|
|
|
return await user_manager.invites.get_invite_out(invite, user_manager, True)
|
|
|
|
# pylint: disable=invalid-name
|
|
@users_router.get("/invites", tags=["invites"], response_model=PaginatedResponse)
|
|
async def get_pending_invites(
|
|
user: User = Depends(current_active_user),
|
|
pageSize: int = DEFAULT_PAGE_SIZE,
|
|
page: int = 1,
|
|
):
|
|
if not user.is_superuser:
|
|
raise HTTPException(status_code=403, detail="not_allowed")
|
|
|
|
pending_invites, total = await user_manager.invites.get_pending_invites(
|
|
user_manager, page_size=pageSize, page=page
|
|
)
|
|
return paginated_format(pending_invites, total, page, pageSize)
|
|
|
|
return users_router
|