chelsea
f53104d947
- Fix bare imports in core/ modules to use fully-qualified paths (core.users, core.postgres) - Fix scheduler/daemon.py importing os before use - Fix verifyLoginToken returning truthy 401 on failure (security: invalid tokens were passing auth checks) - Fix api/routes/example.py passing literal True as userUUID instead of decoded JWT sub - Switch all services to python -m invocation so /app is always on sys.path - Remove orphaned sys.path.insert hacks from bot.py, commands/example.py, routes/example.py - Change API port mapping from 5000 to 8080 - Add config/.env and root .env for docker-compose variable substitution Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
59 lines
1.7 KiB
Python
59 lines
1.7 KiB
Python
import core.users as users
|
|
import core.postgres as postgres
|
|
import bcrypt
|
|
import jwt
|
|
from jwt.exceptions import ExpiredSignatureError, InvalidTokenError
|
|
import datetime
|
|
import os
|
|
|
|
|
|
def verifyLoginToken(login_token, username=False, userUUID=False):
|
|
if username:
|
|
userUUID = users.getUserUUID(username)
|
|
|
|
if userUUID:
|
|
try:
|
|
decoded_token = jwt.decode(
|
|
login_token, os.getenv("JWT_SECRET"), algorithms=["HS256"]
|
|
)
|
|
if decoded_token.get("sub") == str(userUUID):
|
|
return True
|
|
return False
|
|
except (ExpiredSignatureError, InvalidTokenError):
|
|
return False
|
|
return False
|
|
|
|
|
|
def getUserpasswordHash(userUUID):
|
|
user = postgres.select_one("users", {"id": userUUID})
|
|
if user:
|
|
pw_hash = user.get("password_hashed")
|
|
if isinstance(pw_hash, memoryview):
|
|
return bytes(pw_hash)
|
|
return pw_hash
|
|
return None
|
|
|
|
|
|
def getLoginToken(username, password):
|
|
userUUID = users.getUserUUID(username)
|
|
if userUUID:
|
|
formatted_pass = password.encode("utf-8")
|
|
users_hashed_pw = getUserpasswordHash(userUUID)
|
|
if bcrypt.checkpw(formatted_pass, users_hashed_pw):
|
|
payload = {
|
|
"sub": userUUID,
|
|
"name": users.getUserFirstName(userUUID),
|
|
"exp": datetime.datetime.utcnow() + datetime.timedelta(hours=1),
|
|
}
|
|
return jwt.encode(payload, os.getenv("JWT_SECRET"), algorithm="HS256")
|
|
return False
|
|
|
|
|
|
def unregisterUser(userUUID, password):
|
|
pw_hash = getUserpasswordHash(userUUID)
|
|
if not pw_hash:
|
|
return False
|
|
if bcrypt.checkpw(password.encode("utf-8"), pw_hash):
|
|
return users.deleteUser(userUUID)
|
|
return False
|