Ben Stull
79a447c77b
Two informational findings from the Session-0026 audit, both framework-internal defense-in-depth. No operator action: no migration, no schema/config/overlay change, no deployment-facing surface. - I3: guard the dead text/html branch in email_envelope.build_envelope. No send path passes body_html; the unused branch would emit HTML built from possibly-unescaped user content (C1 stored-XSS class in the mail channel). Passing body_html now raises NotImplementedError; the arg is kept for documented future symmetry, enabling HTML mail becomes a deliberate escape-then-unguard change. - I4: make turnstile.verify_token async. The sync httpx.post ran inside the async /auth/otc/request handler, blocking the event loop up to the 10s timeout on a slow CloudFlare call. It now awaits httpx.AsyncClient via a narrow _siteverify_post seam (tests patch the seam, not the shared AsyncClient). The sole caller (main.py) now awaits it. Tests: full backend suite 365 passed. Added a coroutine-contract unit test for verify_token and flipped the email_envelope HTML test to assert the guard. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
595 lines
26 KiB
Python
595 lines
26 KiB
Python
"""FastAPI entrypoint.
|
|
|
|
Wires the §17 routers, the OAuth callbacks, the webhook receiver, and
|
|
the background reconciler. Per §4.2, single process, colocated SQLite —
|
|
no need for a separate worker.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import logging
|
|
import os
|
|
import secrets
|
|
from contextlib import asynccontextmanager
|
|
|
|
from fastapi import APIRouter, FastAPI, HTTPException, Request, Response
|
|
from fastapi.responses import JSONResponse, RedirectResponse
|
|
from pydantic import BaseModel, Field
|
|
from starlette.middleware.sessions import SessionMiddleware
|
|
|
|
from . import (
|
|
api as api_routes,
|
|
auth,
|
|
cache,
|
|
db,
|
|
device_trust as device_trust_mod,
|
|
digest,
|
|
email_otc,
|
|
hygiene,
|
|
invites as invites_mod,
|
|
otc,
|
|
passcode as passcode_mod,
|
|
providers as providers_mod,
|
|
ratelimit,
|
|
turnstile,
|
|
webhooks,
|
|
)
|
|
from .bot import Bot
|
|
from .config import load_config
|
|
from .gitea import Gitea
|
|
|
|
logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(name)s %(message)s")
|
|
log = logging.getLogger("rfc_app")
|
|
|
|
|
|
class OtcRequestBody(BaseModel):
|
|
email: str = Field(min_length=3, max_length=320)
|
|
# v0.12.0 / roadmap item #10: CloudFlare Turnstile token from the
|
|
# frontend widget. Optional in the body so a deployment that has
|
|
# not yet wired the Turnstile site key (or a dev environment with
|
|
# the widget intentionally skipped) still routes through the same
|
|
# endpoint; the backend turnstile.verify_token call decides whether
|
|
# to admit the request based on `TURNSTILE_REQUIRED` + presence of
|
|
# the secret.
|
|
turnstile_token: str | None = Field(default=None, max_length=4096)
|
|
|
|
|
|
class OtcVerifyBody(BaseModel):
|
|
email: str = Field(min_length=3, max_length=320)
|
|
code: str = Field(min_length=1, max_length=16)
|
|
# v0.11.0 — "trust this device for 30 days" checkbox on the Login.jsx
|
|
# OTC step. When true and verify succeeds, the server issues a fresh
|
|
# device-trust row and sets the `rfc_device_trust` cookie on the
|
|
# response. Defaults to false so existing clients that don't send
|
|
# the flag continue to behave the way they did pre-v0.11.0.
|
|
trust_device: bool = False
|
|
|
|
|
|
class PasscodeSetBody(BaseModel):
|
|
passcode: str = Field(min_length=1, max_length=64)
|
|
|
|
|
|
class PasscodeVerifyBody(BaseModel):
|
|
email: str = Field(min_length=3, max_length=320)
|
|
passcode: str = Field(min_length=1, max_length=64)
|
|
# v0.11.0 — same trust-device opt-in as the OTC verify body.
|
|
trust_device: bool = False
|
|
|
|
|
|
class InviteClaimBody(BaseModel):
|
|
"""v0.17.0 / roadmap item #16 — claim an admin-issued invite token.
|
|
|
|
The frontend `/invites/claim?token=…` page reads the token from
|
|
the URL and POSTs it here. The body bound matches the
|
|
`secrets.token_urlsafe(32)` output shape (~43 URL-safe chars);
|
|
the upper bound stays generous in case `TOKEN_BYTES` is ever
|
|
raised. The token-shape is opaque to this layer — `invites.claim`
|
|
bcrypt-checks it against the active candidate set.
|
|
"""
|
|
token: str = Field(min_length=1, max_length=512)
|
|
# v0.11.0-style opt-in: the claim flow's "trust this device" gesture
|
|
# is bundled here so the invitee can land trusted on first sign-in
|
|
# without an extra roundtrip. Defaults to false so the gesture is
|
|
# explicit (the frontend modal renders a checkbox alongside the
|
|
# claim CTA).
|
|
trust_device: bool = False
|
|
|
|
|
|
@asynccontextmanager
|
|
async def lifespan(app: FastAPI):
|
|
config = load_config()
|
|
db.run_migrations(config)
|
|
db.init(config)
|
|
gitea = Gitea(config)
|
|
bot = Bot(gitea)
|
|
reconciler = cache.Reconciler(config, gitea)
|
|
digest_sched = digest.DigestScheduler()
|
|
hygiene_sched = hygiene.HygieneScheduler(config=config, bot=bot)
|
|
|
|
# §18 carryover: the multi-provider LLM abstraction. Provider
|
|
# construction can fail (missing key, wrong env value) — if it does,
|
|
# the rest of the app still serves; chat endpoints surface a clear
|
|
# 503 instead of crashing the process.
|
|
try:
|
|
providers = providers_mod.load_from_config(config)
|
|
except Exception:
|
|
log.exception("provider construction failed; chat will be disabled")
|
|
providers = {}
|
|
|
|
app.state.config = config
|
|
app.state.gitea = gitea
|
|
app.state.bot = bot
|
|
app.state.reconciler = reconciler
|
|
app.state.providers = providers
|
|
|
|
app.include_router(_oauth_router(config))
|
|
app.include_router(api_routes.make_router(config, gitea, bot, providers))
|
|
app.include_router(webhooks.make_router(config, gitea))
|
|
|
|
reconciler.start()
|
|
digest_sched.start()
|
|
hygiene_sched.start()
|
|
log.info("RFC app started — meta repo %s/%s", config.gitea_org, config.meta_repo)
|
|
try:
|
|
yield
|
|
finally:
|
|
await hygiene_sched.stop()
|
|
await digest_sched.stop()
|
|
await reconciler.stop()
|
|
await gitea.close()
|
|
|
|
|
|
def create_app() -> FastAPI:
|
|
# The secret key is required at app construction (SessionMiddleware
|
|
# is added before lifespan runs), so we read just that one value
|
|
# eagerly via load_config(). Everything else waits for lifespan.
|
|
config = load_config()
|
|
app = FastAPI(lifespan=lifespan)
|
|
# v0.25.0 (audit 0026 M4): the session cookie is the primary 30-day
|
|
# auth credential and must carry `Secure` in production so it never
|
|
# travels cleartext. Default to Secure; a dev box serving over plain
|
|
# http opts out with SESSION_COOKIE_SECURE=false. Production (OHM is
|
|
# HTTPS-only with an HTTP->HTTPS 301) leaves this unset → Secure on.
|
|
session_secure = os.environ.get("SESSION_COOKIE_SECURE", "true").strip().lower() not in (
|
|
"0", "false", "no", "off",
|
|
)
|
|
app.add_middleware(
|
|
SessionMiddleware,
|
|
secret_key=config.secret_key,
|
|
session_cookie="rfc_session",
|
|
max_age=60 * 60 * 24 * 30,
|
|
https_only=session_secure,
|
|
)
|
|
return app
|
|
|
|
|
|
app = create_app()
|
|
|
|
|
|
def _set_device_trust_cookie(response: Response, cookie_value: str) -> None:
|
|
"""Attach the v0.11.0 device-trust cookie to the response.
|
|
|
|
HttpOnly + Secure + SameSite=Lax + 30-day Max-Age + Path=/. As of
|
|
v0.25.0 (audit 0026 M1) the value is `IssueOutcome.cookie_value` —
|
|
"<row_id>.<raw_token>" — so `device_trust.lookup` can read one indexed
|
|
row instead of scanning; server-side storage remains the bcrypt hash
|
|
of the token half only. The cookie is "essential" per the v0.13.0
|
|
cookie-consent contract (it is part of authentication), so we set it
|
|
regardless of the user's analytics / other-cookies choice.
|
|
|
|
Secure=True means the cookie is only ever sent over HTTPS — the
|
|
device-trust cookie holds a 30-day credential and must never travel
|
|
cleartext. (The session cookie now also defaults to Secure; see M4 in
|
|
`create_app`.)
|
|
"""
|
|
response.set_cookie(
|
|
key=device_trust_mod.COOKIE_NAME,
|
|
value=cookie_value,
|
|
max_age=device_trust_mod.COOKIE_MAX_AGE_SECONDS,
|
|
path="/",
|
|
secure=True,
|
|
httponly=True,
|
|
samesite="lax",
|
|
)
|
|
|
|
|
|
def _clear_device_trust_cookie(response: Response) -> None:
|
|
"""Delete the device-trust cookie on the response.
|
|
|
|
Used when the framework detects a presented cookie that is
|
|
expired, revoked, or otherwise stale — the next request from
|
|
this device will not carry a dead token.
|
|
"""
|
|
response.delete_cookie(
|
|
key=device_trust_mod.COOKIE_NAME,
|
|
path="/",
|
|
secure=True,
|
|
httponly=True,
|
|
samesite="lax",
|
|
)
|
|
|
|
|
|
def _oauth_router(config) -> APIRouter:
|
|
router = APIRouter()
|
|
|
|
@router.get("/auth/login")
|
|
async def login(request: Request):
|
|
state = auth.new_state()
|
|
request.session[auth.SESSION_STATE_KEY] = state
|
|
return RedirectResponse(auth.authorization_url(config, state))
|
|
|
|
@router.get("/auth/callback")
|
|
async def callback(request: Request, code: str = "", state: str = ""):
|
|
if not code:
|
|
raise HTTPException(400, "Missing code")
|
|
stored_state = request.session.get(auth.SESSION_STATE_KEY)
|
|
if not stored_state or not secrets.compare_digest(stored_state, state):
|
|
raise HTTPException(400, "Invalid state")
|
|
token_data = await auth.exchange_code(config, code)
|
|
access_token = token_data.get("access_token")
|
|
if not access_token:
|
|
raise HTTPException(400, "Token exchange failed")
|
|
profile = await auth.fetch_user_profile(config, access_token)
|
|
if not auth.is_allowed_sign_in(profile):
|
|
# Private-beta gate: clear any partial OAuth state and bounce to
|
|
# the public /beta-pending page. The session is left empty so the
|
|
# rejected viewer continues as anonymous read-only.
|
|
request.session.pop(auth.SESSION_STATE_KEY, None)
|
|
return RedirectResponse("/beta-pending")
|
|
user = auth.provision_user(config, profile)
|
|
auth.store_session(request, user)
|
|
return RedirectResponse("/")
|
|
|
|
@router.get("/auth/logout")
|
|
async def logout(request: Request):
|
|
request.session.clear()
|
|
return RedirectResponse("/")
|
|
|
|
# ---------------------------------------------------------------
|
|
# v0.7.0: email + one-time-code sign-in (§6.2).
|
|
#
|
|
# Replaces the OAuth gesture as the primary human-auth path. The
|
|
# /auth/callback handler above remains functional as a fallback;
|
|
# the new UI no longer surfaces it. A future release retires the
|
|
# OAuth path entirely once every active user has signed in at
|
|
# least once via OTC.
|
|
# ---------------------------------------------------------------
|
|
|
|
@router.post("/auth/otc/request")
|
|
async def otc_request(body: OtcRequestBody, request: Request):
|
|
# v0.25.0 (audit 0026 H1/L2): per-IP brake at the cheapest point,
|
|
# before the Turnstile network call or any bcrypt/SMTP work.
|
|
if not ratelimit.otc_request_limiter.allow(ratelimit.client_key(request)):
|
|
raise HTTPException(429, "Too many requests; please wait a few minutes")
|
|
# v0.12.0 / roadmap item #10: gate the request on a successful
|
|
# Turnstile siteverify before the bcrypt hash + SMTP send. The
|
|
# check runs first so a failed challenge spends no rate budget
|
|
# and produces no envelope. When the operator has not wired the
|
|
# secret AND TURNSTILE_REQUIRED=false (the default), the gate
|
|
# opens — see `backend/app/turnstile.py` for the full matrix.
|
|
client_ip = request.client.host if request.client else None
|
|
ts = await turnstile.verify_token(body.turnstile_token, client_ip=client_ip)
|
|
if not ts.ok:
|
|
if ts.reason == "misconfigured":
|
|
# TURNSTILE_REQUIRED=true but the secret is unset. This
|
|
# is an operator/config problem, not a client problem;
|
|
# surface as 500 so the operator notices in their logs
|
|
# rather than blaming the user's browser.
|
|
raise HTTPException(500, "auth misconfigured")
|
|
# missing-token / failed / network → uniform 400 so the
|
|
# response does not enumerate which leg of the challenge
|
|
# broke. The reason is in the server logs.
|
|
raise HTTPException(400, "verification failed")
|
|
|
|
outcome = otc.request_code(body.email)
|
|
if outcome.reason == "cooldown":
|
|
# Loud failure per the rate-limit primitive — the abuse
|
|
# surface should be visible to clients hammering /request.
|
|
raise HTTPException(429, "Wait before requesting another code")
|
|
if outcome.sent and outcome.code is not None:
|
|
email_otc.send_otc_email(body.email.strip(), outcome.code)
|
|
# 202 regardless of allowlist/invalid — don't leak which
|
|
# emails are recognized.
|
|
return {"ok": True}
|
|
|
|
@router.post("/auth/otc/verify")
|
|
async def otc_verify(body: OtcVerifyBody, request: Request, response: Response):
|
|
# v0.25.0 (audit 0026 H1): per-IP brake against fan-out guessing,
|
|
# plus the per-email lockout enforced inside otc.verify_code.
|
|
ip = ratelimit.client_key(request)
|
|
if not ratelimit.verify_limiter.allow(ip):
|
|
raise HTTPException(429, "Too many attempts; please wait a few minutes")
|
|
result = otc.verify_code(body.email, body.code)
|
|
if result.reason == "locked":
|
|
raise HTTPException(
|
|
423,
|
|
{
|
|
"detail": "Too many failed attempts; wait a few minutes or request a new code",
|
|
"locked_until": result.locked_until,
|
|
},
|
|
)
|
|
if not result.ok or result.user is None:
|
|
raise HTTPException(400, "Invalid or expired code")
|
|
# Legit sign-in: clear this IP's window so a user who fat-fingered
|
|
# a couple of codes isn't left throttled.
|
|
ratelimit.verify_limiter.reset(ip)
|
|
auth.store_session(request, result.user)
|
|
# v0.8.0: surface `needs_profile` so the Login.jsx surface can
|
|
# decide whether to advance to the first/last/why capture step
|
|
# or jump straight to "/". `needs_profile=true` iff the user
|
|
# is `permission_state='pending'` AND the row has no profile
|
|
# fields yet — a fresh OTC user. Grandfathered users
|
|
# (`permission_state='granted'`) and pending users who already
|
|
# captured their fields both read as false.
|
|
row = db.conn().execute(
|
|
"SELECT first_name, last_name, beta_request_reason FROM users WHERE id = ?",
|
|
(result.user.user_id,),
|
|
).fetchone()
|
|
first_name = (row["first_name"] if row else None) or ""
|
|
last_name = (row["last_name"] if row else None) or ""
|
|
beta_request_reason = (row["beta_request_reason"] if row else None) or ""
|
|
needs_profile = (
|
|
result.user.permission_state == "pending"
|
|
and not first_name
|
|
and not last_name
|
|
and not beta_request_reason
|
|
)
|
|
# v0.11.0 — opt-in device trust. The checkbox lives on the
|
|
# Login.jsx OTC step; when true, the server mints a fresh
|
|
# device-trust row and sets the long-lived cookie. The cookie
|
|
# is "essential" per the v0.13.0 consent contract (it is part
|
|
# of authentication, not analytics) so it lands regardless of
|
|
# the user's analytics / other-cookies choice. We capture the
|
|
# User-Agent at issuance so the /settings/devices surface can
|
|
# render a rough device label.
|
|
if body.trust_device:
|
|
ua = request.headers.get("user-agent", "")
|
|
outcome = device_trust_mod.issue(result.user.user_id, ua)
|
|
_set_device_trust_cookie(response, outcome.cookie_value)
|
|
return {
|
|
"ok": True,
|
|
"user": {
|
|
"id": result.user.user_id,
|
|
"display_name": result.user.display_name,
|
|
"email": result.user.email,
|
|
"role": result.user.role,
|
|
"permission_state": result.user.permission_state,
|
|
},
|
|
"needs_profile": needs_profile,
|
|
}
|
|
|
|
# ---------------------------------------------------------------
|
|
# v0.10.0: user-set passcodes after OTC (§6.2, roadmap item #8).
|
|
#
|
|
# After a successful OTC sign-in, a contributor may set a passcode
|
|
# and use email + passcode for subsequent sign-ins. OTC remains the
|
|
# forgot-passcode fallback — a verify failure beyond 5 consecutive
|
|
# attempts locks the passcode path for 15 minutes; the OTC path is
|
|
# unaffected by the lockout.
|
|
# ---------------------------------------------------------------
|
|
|
|
@router.get("/auth/passcode/check")
|
|
async def passcode_check(request: Request, email: str = ""):
|
|
"""Does this email have a passcode set? Anonymous endpoint —
|
|
the Login.jsx flow calls this after the user types their email
|
|
to decide whether to render a passcode input or fall back to
|
|
OTC. We surface only the boolean; lockout state, the hash, and
|
|
the set-at stamp are not leaked here.
|
|
|
|
v0.25.0 (audit 0026 L3): per-IP rate limit so the has-passcode
|
|
boolean can't be bulk-harvested to enumerate accounts."""
|
|
if not ratelimit.check_limiter.allow(ratelimit.client_key(request)):
|
|
raise HTTPException(429, "Too many requests; please wait a few minutes")
|
|
status = passcode_mod.passcode_status(email)
|
|
return {"has_passcode": status.has_passcode}
|
|
|
|
@router.post("/auth/passcode/set")
|
|
async def passcode_set(body: PasscodeSetBody, request: Request):
|
|
"""Set or replace the signed-in user's passcode. Requires an
|
|
active session (OTC- or passcode-authenticated)."""
|
|
user = auth.require_user(request)
|
|
try:
|
|
passcode_mod.set_passcode(user.user_id, body.passcode)
|
|
except passcode_mod.PasscodeValidationError as e:
|
|
raise HTTPException(422, str(e))
|
|
return {"ok": True}
|
|
|
|
@router.delete("/auth/passcode")
|
|
async def passcode_delete(request: Request):
|
|
"""Remove the signed-in user's passcode. The user is back to
|
|
OTC-only on next sign-in."""
|
|
user = auth.require_user(request)
|
|
passcode_mod.clear_passcode(user.user_id)
|
|
return {"ok": True}
|
|
|
|
@router.post("/auth/passcode/verify")
|
|
async def passcode_verify(body: PasscodeVerifyBody, request: Request, response: Response):
|
|
"""Sign in with email + passcode. Returns the standard session
|
|
payload on success; HTTP 423 with `locked_until` when the
|
|
account is in the lockout window; HTTP 400 for every other
|
|
failure (the wrong-vs-unknown distinction is intentionally
|
|
collapsed so a probing client cannot enumerate emails).
|
|
|
|
v0.11.0: the body's `trust_device` flag, if true, mints a
|
|
fresh device-trust row and sets the long-lived cookie. Same
|
|
opt-in contract as `/auth/otc/verify`."""
|
|
# v0.25.0 (audit 0026 H1): per-IP brake in front of the per-account
|
|
# passcode lockout, so fan-out across emails is throttled too.
|
|
ip = ratelimit.client_key(request)
|
|
if not ratelimit.verify_limiter.allow(ip):
|
|
raise HTTPException(429, "Too many attempts; please wait a few minutes")
|
|
result = passcode_mod.verify_passcode(body.email, body.passcode)
|
|
if result.reason == "locked":
|
|
raise HTTPException(
|
|
423,
|
|
{
|
|
"detail": "Too many failed attempts; sign in with a one-time code instead",
|
|
"locked_until": result.locked_until,
|
|
},
|
|
)
|
|
if not result.ok or result.user is None:
|
|
raise HTTPException(400, "Invalid passcode")
|
|
ratelimit.verify_limiter.reset(ip)
|
|
auth.store_session(request, result.user)
|
|
if body.trust_device:
|
|
ua = request.headers.get("user-agent", "")
|
|
outcome = device_trust_mod.issue(result.user.user_id, ua)
|
|
_set_device_trust_cookie(response, outcome.cookie_value)
|
|
return {
|
|
"ok": True,
|
|
"user": {
|
|
"id": result.user.user_id,
|
|
"display_name": result.user.display_name,
|
|
"email": result.user.email,
|
|
"role": result.user.role,
|
|
},
|
|
}
|
|
|
|
# ---------------------------------------------------------------
|
|
# v0.17.0: admin-create user + invite claim (§6.1, roadmap item #16).
|
|
#
|
|
# The admin-create surface lives at POST /api/admin/users (see
|
|
# api_admin.py); this endpoint is the corresponding claim path the
|
|
# invitee hits when they click the link in their invite email.
|
|
# The frontend route `/invites/claim?token=…` reads the token from
|
|
# the URL and POSTs it here.
|
|
#
|
|
# The claim itself is the first-sign-in for the invitee: clicking
|
|
# the unique token in the email is proof of email control per the
|
|
# roadmap, so this endpoint skips the OTC step entirely on first
|
|
# sign-in. The session cookie lands; the response tells the
|
|
# frontend whether to route to passcode-set (if v0.10.0 passcode
|
|
# flow is in play and the user has not yet set a passcode) or to
|
|
# home.
|
|
#
|
|
# The endpoint is anonymous-reachable: the entire point is to
|
|
# establish the session, so we do not gate it on `require_user`.
|
|
# The trust-device opt-in mirrors the v0.11.0 OTC/passcode verify
|
|
# contract (the body's `trust_device` flag, when true, mints a
|
|
# fresh device-trust row on the same response so the invitee
|
|
# lands trusted on their first device).
|
|
# ---------------------------------------------------------------
|
|
|
|
@router.post("/api/invites/claim")
|
|
async def invites_claim(body: InviteClaimBody, request: Request, response: Response):
|
|
result = invites_mod.claim(body.token)
|
|
if result.reason == "expired":
|
|
# The token's TTL window passed without a claim. HTTP 410
|
|
# (Gone) so the frontend can render a "this invite has
|
|
# expired — please contact the admin for a fresh one"
|
|
# message distinct from the generic invalid-token shape.
|
|
raise HTTPException(410, "This invite has expired")
|
|
if result.reason == "claimed":
|
|
# The token was already consumed. HTTP 410 for the same
|
|
# reason — the row is dead either way.
|
|
raise HTTPException(410, "This invite has already been claimed")
|
|
if not result.ok or result.user is None:
|
|
# 'unknown' / 'invalid' — the token does not match any
|
|
# active invite row. HTTP 400 so it reads distinct from
|
|
# the dead-token shape above.
|
|
raise HTTPException(400, "Invalid invite token")
|
|
|
|
# Establish the session. From here on the invitee is signed
|
|
# in as the pre-provisioned user row carrying their
|
|
# pre-assigned role.
|
|
auth.store_session(request, result.user)
|
|
|
|
# v0.11.0 — opt-in device trust on the claim response. Same
|
|
# contract as OTC/passcode verify: when the body's flag is
|
|
# true, the server mints a fresh device-trust row and sets
|
|
# the long-lived cookie, so the invitee skips the email step
|
|
# on subsequent visits to the same browser.
|
|
if body.trust_device:
|
|
ua = request.headers.get("user-agent", "")
|
|
outcome = device_trust_mod.issue(result.user.user_id, ua)
|
|
_set_device_trust_cookie(response, outcome.cookie_value)
|
|
|
|
# Has the user already set a passcode? (Could only happen via
|
|
# an admin pre-population path that doesn't exist yet, but
|
|
# the response shape mirrors `/api/auth/me` so the frontend
|
|
# can read it without a second call.) If `needs_passcode` is
|
|
# true and v0.10.0 passcode flow is in play, the frontend
|
|
# routes to /settings/notifications#sign-in to set a passcode
|
|
# immediately; otherwise it routes to /.
|
|
row = db.conn().execute(
|
|
"SELECT passcode_hash FROM users WHERE id = ?",
|
|
(result.user.user_id,),
|
|
).fetchone()
|
|
has_passcode = bool(row and row["passcode_hash"])
|
|
|
|
return {
|
|
"ok": True,
|
|
"user": {
|
|
"id": result.user.user_id,
|
|
"display_name": result.user.display_name,
|
|
"email": result.user.email,
|
|
"role": result.user.role,
|
|
"permission_state": result.user.permission_state,
|
|
},
|
|
# Roadmap §16: the claim flow skips OTC entirely; the
|
|
# natural next step is passcode-set (so the invitee can
|
|
# sign back in without needing an email roundtrip on their
|
|
# second visit). The frontend uses this hint to decide
|
|
# whether to route to the passcode-set screen or to home.
|
|
"needs_passcode": not has_passcode,
|
|
}
|
|
|
|
# ---------------------------------------------------------------
|
|
# v0.11.0: trust device for 30 days (§6.2, roadmap item #9).
|
|
#
|
|
# The /auth/device-trust/start endpoint resolves a presented
|
|
# `rfc_device_trust` cookie. If it matches a non-expired,
|
|
# non-revoked row, the session is re-established and the client
|
|
# is told to skip OTC/passcode entry. A stale cookie (expired or
|
|
# revoked) is cleared on the response. A miss is structurally
|
|
# silent — the client falls back to the email step.
|
|
#
|
|
# The endpoint is anonymous-reachable: a returning visitor with
|
|
# the cookie hits this before the email step. We do not gate it
|
|
# on a session because the entire point is to establish one.
|
|
# ---------------------------------------------------------------
|
|
|
|
@router.post("/auth/device-trust/start")
|
|
async def device_trust_start(request: Request):
|
|
"""Sign in via a presented device-trust cookie.
|
|
|
|
On a hit, re-establishes the session in the cookie store and
|
|
returns a user payload shaped like /auth/otc/verify (minus
|
|
`needs_profile`, which a returning device-trust user is
|
|
structurally past — they signed in at least once before).
|
|
On a miss, returns 401 + clears the stale cookie. An
|
|
'unknown' miss (cookie present but no row matches) also
|
|
clears, since the token is dead to the server either way.
|
|
|
|
Note on response construction: we return a `JSONResponse`
|
|
directly rather than raising `HTTPException` on the miss
|
|
path because FastAPI's exception handler builds a new
|
|
response from scratch and would drop any `set_cookie` /
|
|
`delete_cookie` calls. The hand-built `JSONResponse` lets
|
|
us attach the cookie-clear header alongside the 401.
|
|
"""
|
|
raw = request.cookies.get(device_trust_mod.COOKIE_NAME, "")
|
|
if not raw:
|
|
return JSONResponse({"detail": "No device trust"}, status_code=401)
|
|
outcome = device_trust_mod.lookup(raw)
|
|
if not outcome.ok or outcome.user is None:
|
|
# Clear the stale cookie so subsequent requests don't
|
|
# keep replaying a dead token. We surface 401 in all
|
|
# cases so a probing client can't tell "your row was
|
|
# revoked" from "this token never existed".
|
|
response = JSONResponse({"detail": "Device trust invalid"}, status_code=401)
|
|
_clear_device_trust_cookie(response)
|
|
return response
|
|
auth.store_session(request, outcome.user)
|
|
return {
|
|
"ok": True,
|
|
"user": {
|
|
"id": outcome.user.user_id,
|
|
"display_name": outcome.user.display_name,
|
|
"email": outcome.user.email,
|
|
"role": outcome.user.role,
|
|
"permission_state": outcome.user.permission_state,
|
|
},
|
|
}
|
|
|
|
return router
|