326 lines
11 KiB
Python
326 lines
11 KiB
Python
import re
|
|
from datetime import date, datetime, timedelta, timezone
|
|
from uuid import UUID
|
|
|
|
import jwt
|
|
from fastapi import APIRouter, Depends, HTTPException, status
|
|
from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
|
|
from pwdlib import PasswordHash
|
|
from pydantic import EmailStr, TypeAdapter, ValidationError
|
|
from sqlalchemy import or_, select
|
|
from sqlalchemy.exc import IntegrityError
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
|
|
from app.config import get_settings
|
|
from app.database import get_postgres_session
|
|
from app.models import Account
|
|
from app.schemas import (
|
|
AccountRegister,
|
|
AccountRead,
|
|
AuthResponse,
|
|
InviteAcceptRequest,
|
|
InvitePreview,
|
|
LoginRequest,
|
|
PasswordChangeRequest,
|
|
)
|
|
from app.services.member_invitations import get_valid_invitation
|
|
from app.services.domain_policy import assert_company_domain_allowed
|
|
from app.services.domain_provisioning import account_is_domain_owner
|
|
from app.services.domain_provisioning import (
|
|
get_domain_by_name,
|
|
provision_mail_domain,
|
|
)
|
|
|
|
router = APIRouter(prefix="/auth", tags=["authentication"])
|
|
password_hash = PasswordHash.recommended()
|
|
dummy_password_hash = password_hash.hash("Agmail timing protection value")
|
|
bearer_scheme = HTTPBearer(auto_error=False)
|
|
settings = get_settings()
|
|
email_adapter = TypeAdapter(EmailStr)
|
|
domain_pattern = re.compile(
|
|
r"^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+"
|
|
r"[a-z]{2,63}$"
|
|
)
|
|
|
|
|
|
def normalize_phone(value: str) -> str:
|
|
prefix = "+" if value.strip().startswith("+") else ""
|
|
return prefix + "".join(character for character in value if character.isdigit())
|
|
|
|
|
|
def validate_password(value: str) -> None:
|
|
if not (
|
|
re.search(r"[a-z]", value)
|
|
and re.search(r"[A-Z]", value)
|
|
and re.search(r"\d", value)
|
|
):
|
|
raise HTTPException(
|
|
status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
|
|
detail="Password must include uppercase, lowercase, and a number.",
|
|
)
|
|
|
|
|
|
def build_email(payload: AccountRegister) -> tuple[str, str | None]:
|
|
domain = settings.platform_domain
|
|
company_domain = None
|
|
|
|
if payload.account_type == "company":
|
|
if not payload.company_domain:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
|
|
detail="Company domain is required for company accounts.",
|
|
)
|
|
try:
|
|
domain = assert_company_domain_allowed(
|
|
payload.company_domain,
|
|
settings.platform_domain,
|
|
)
|
|
except ValueError as error:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
|
|
detail=str(error),
|
|
) from error
|
|
company_domain = domain
|
|
|
|
email = f"{payload.email_name.lower()}@{domain}"
|
|
try:
|
|
return str(email_adapter.validate_python(email)), company_domain
|
|
except ValidationError as error:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
|
|
detail="The resulting email address is invalid.",
|
|
) from error
|
|
|
|
|
|
def create_access_token(account: Account) -> str:
|
|
expires_at = datetime.now(timezone.utc) + timedelta(
|
|
minutes=settings.access_token_minutes
|
|
)
|
|
return jwt.encode(
|
|
{"sub": str(account.id), "email": account.email, "exp": expires_at},
|
|
settings.jwt_secret,
|
|
algorithm="HS256",
|
|
)
|
|
|
|
|
|
async def account_read(
|
|
session: AsyncSession,
|
|
account: Account,
|
|
) -> AccountRead:
|
|
is_owner = await account_is_domain_owner(
|
|
session,
|
|
account.id,
|
|
account.company_domain,
|
|
)
|
|
return AccountRead.model_validate(account).model_copy(
|
|
update={"is_domain_owner": is_owner},
|
|
)
|
|
|
|
|
|
async def get_current_account(
|
|
credentials: HTTPAuthorizationCredentials | None = Depends(bearer_scheme),
|
|
session: AsyncSession = Depends(get_postgres_session),
|
|
) -> Account:
|
|
unauthorized = HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Your session is invalid or has expired.",
|
|
headers={"WWW-Authenticate": "Bearer"},
|
|
)
|
|
if credentials is None or credentials.scheme.lower() != "bearer":
|
|
raise unauthorized
|
|
|
|
try:
|
|
claims = jwt.decode(
|
|
credentials.credentials,
|
|
settings.jwt_secret,
|
|
algorithms=["HS256"],
|
|
options={"require": ["sub", "exp"]},
|
|
)
|
|
account_id = UUID(claims["sub"])
|
|
except (jwt.PyJWTError, KeyError, TypeError, ValueError):
|
|
raise unauthorized
|
|
|
|
account = await session.get(Account, account_id)
|
|
if account is None:
|
|
raise unauthorized
|
|
return account
|
|
|
|
|
|
@router.post(
|
|
"/register",
|
|
response_model=AuthResponse,
|
|
status_code=status.HTTP_201_CREATED,
|
|
)
|
|
async def register(
|
|
payload: AccountRegister,
|
|
session: AsyncSession = Depends(get_postgres_session),
|
|
) -> AuthResponse:
|
|
if payload.date_of_birth >= date.today():
|
|
raise HTTPException(
|
|
status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
|
|
detail="Date of birth must be in the past.",
|
|
)
|
|
validate_password(payload.password)
|
|
email, company_domain = build_email(payload)
|
|
phone_number = normalize_phone(payload.phone_number)
|
|
|
|
existing = await session.scalar(
|
|
select(Account).where(
|
|
or_(Account.email == email, Account.phone_number == phone_number)
|
|
)
|
|
)
|
|
if existing:
|
|
detail = (
|
|
"That email address is already registered."
|
|
if existing.email == email
|
|
else "That phone number is already registered."
|
|
)
|
|
raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail=detail)
|
|
|
|
account = Account(
|
|
account_type=payload.account_type,
|
|
email=email,
|
|
first_name=payload.first_name.strip(),
|
|
last_name=payload.last_name.strip(),
|
|
date_of_birth=payload.date_of_birth,
|
|
phone_number=phone_number,
|
|
company_domain=company_domain,
|
|
org_role="owner" if company_domain else "user",
|
|
member_status="active",
|
|
password_hash=password_hash.hash(payload.password),
|
|
)
|
|
session.add(account)
|
|
try:
|
|
await session.flush()
|
|
if company_domain:
|
|
existing_domain = await get_domain_by_name(session, company_domain)
|
|
if existing_domain is None:
|
|
await provision_mail_domain(
|
|
session,
|
|
domain_name=company_domain,
|
|
domain_type="company",
|
|
account_id=account.id,
|
|
)
|
|
await session.commit()
|
|
except IntegrityError as error:
|
|
await session.rollback()
|
|
raise HTTPException(
|
|
status_code=status.HTTP_409_CONFLICT,
|
|
detail="An account with those details already exists.",
|
|
) from error
|
|
await session.refresh(account)
|
|
return AuthResponse(
|
|
access_token=create_access_token(account),
|
|
account=await account_read(session, account),
|
|
)
|
|
|
|
|
|
@router.post("/login", response_model=AuthResponse)
|
|
async def login(
|
|
payload: LoginRequest,
|
|
session: AsyncSession = Depends(get_postgres_session),
|
|
) -> AuthResponse:
|
|
account = await session.scalar(
|
|
select(Account).where(Account.email == str(payload.email).lower())
|
|
)
|
|
password_is_valid = password_hash.verify(
|
|
payload.password,
|
|
account.password_hash if account is not None else dummy_password_hash,
|
|
)
|
|
if account is None or not password_is_valid:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Incorrect email or password.",
|
|
)
|
|
if account.member_status == "invited":
|
|
raise HTTPException(
|
|
status_code=status.HTTP_403_FORBIDDEN,
|
|
detail="Accept your invitation email to set your password before signing in.",
|
|
)
|
|
return AuthResponse(
|
|
access_token=create_access_token(account),
|
|
account=await account_read(session, account),
|
|
)
|
|
|
|
|
|
@router.get("/invites/{token}", response_model=InvitePreview)
|
|
async def preview_invite(
|
|
token: str,
|
|
session: AsyncSession = Depends(get_postgres_session),
|
|
) -> InvitePreview:
|
|
try:
|
|
invitation, account = await get_valid_invitation(session, token)
|
|
except ValueError as error:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_404_NOT_FOUND,
|
|
detail=str(error),
|
|
) from error
|
|
|
|
manager_name = "Your administrator"
|
|
if account.created_by_id:
|
|
manager = await session.get(Account, account.created_by_id)
|
|
if manager is not None:
|
|
manager_name = f"{manager.first_name} {manager.last_name}".strip()
|
|
|
|
return InvitePreview(
|
|
work_email=account.email,
|
|
first_name=account.first_name,
|
|
organization=account.company_domain or settings.platform_domain,
|
|
invited_by=manager_name,
|
|
expires_at=invitation.expires_at,
|
|
)
|
|
|
|
|
|
@router.post("/invites/{token}/accept", response_model=AuthResponse)
|
|
async def accept_invite(
|
|
token: str,
|
|
payload: InviteAcceptRequest,
|
|
session: AsyncSession = Depends(get_postgres_session),
|
|
) -> AuthResponse:
|
|
validate_password(payload.password)
|
|
try:
|
|
invitation, account = await get_valid_invitation(session, token)
|
|
except ValueError as error:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_404_NOT_FOUND,
|
|
detail=str(error),
|
|
) from error
|
|
|
|
account.password_hash = password_hash.hash(payload.password)
|
|
account.member_status = "active"
|
|
account.must_change_password = False
|
|
invitation.used_at = datetime.now(timezone.utc)
|
|
await session.commit()
|
|
await session.refresh(account)
|
|
return AuthResponse(
|
|
access_token=create_access_token(account),
|
|
account=await account_read(session, account),
|
|
)
|
|
|
|
|
|
@router.post("/change-password", response_model=AccountRead)
|
|
async def change_password(
|
|
payload: PasswordChangeRequest,
|
|
account: Account = Depends(get_current_account),
|
|
session: AsyncSession = Depends(get_postgres_session),
|
|
) -> AccountRead:
|
|
validate_password(payload.new_password)
|
|
if not password_hash.verify(payload.current_password, account.password_hash):
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Current password is incorrect.",
|
|
)
|
|
account.password_hash = password_hash.hash(payload.new_password)
|
|
account.must_change_password = False
|
|
if account.member_status == "invited":
|
|
account.member_status = "active"
|
|
await session.commit()
|
|
return await account_read(session, account)
|
|
|
|
|
|
@router.get("/me", response_model=AccountRead)
|
|
async def get_me(
|
|
account: Account = Depends(get_current_account),
|
|
session: AsyncSession = Depends(get_postgres_session),
|
|
) -> AccountRead:
|
|
return await account_read(session, account)
|