diff options
Diffstat (limited to 'api/auth')
| -rw-r--r-- | api/auth/login.py | 14 | ||||
| -rw-r--r-- | api/auth/login_token.py | 4 | ||||
| -rw-r--r-- | api/auth/signup.py | 26 | ||||
| -rw-r--r-- | api/auth/token.py | 28 |
4 files changed, 36 insertions, 36 deletions
diff --git a/api/auth/login.py b/api/auth/login.py index 4ae1650..94752d9 100644 --- a/api/auth/login.py +++ b/api/auth/login.py @@ -16,22 +16,22 @@ def index(): # return malformed request if email or password is missing if not email or \ - not password: + not password: return "", 400 # resolve user_id from username or email user_id = None user_id = user_id or cursor.execute( - "select user_id from users where email = ?", [email] + "select user_id from users where email = ?", [email] ).fetchone() user_id = user_id or cursor.execute( - "select user_id from users where lower(username) = lower(?)", [email] + "select user_id from users where lower(username) = lower(?)", [email] ).fetchone() if user_id == None: return "", 401 # check the password passwd = cursor.execute( - "select password_hash from users where user_id = ?", [user_id[0]] + "select password_hash from users where user_id = ?", [user_id[0]] ).fetchone() check = passwords.check_password(password, passwd[0]) if not check: return "", 401 @@ -43,9 +43,9 @@ def index(): # make response with the set_cookie header res = make_response("", 200) res.set_cookie( - "token", - new_token["token"], - expires=int(new_token["expirationDate"] / 1000) + "token", + new_token["token"], + expires=int(new_token["expirationDate"] / 1000) ) return res diff --git a/api/auth/login_token.py b/api/auth/login_token.py index bb67c4f..b5b1579 100644 --- a/api/auth/login_token.py +++ b/api/auth/login_token.py @@ -7,8 +7,8 @@ from auth.token import validate_token, hash_token def token_login(token): hashed = hash_token({"token": token, "expirationDate": 0}) user_id = cursor.execute( - "select user_id from users where valid_tokens like ?", - [f"%{hashed['token']}%"] + "select user_id from users where valid_tokens like ?", + [f"%{hashed['token']}%"] ).fetchone() return None if not user_id else user_id[0] diff --git a/api/auth/signup.py b/api/auth/signup.py index f9a1af5..5e74076 100644 --- a/api/auth/signup.py +++ b/api/auth/signup.py @@ -16,7 +16,7 @@ def validate_username(username): def validate_email(email): #TODO: use node_modules/email-validator/index.js return len(email) > 1 and \ - "@" in email + "@" in email # checks if the password is safe (regex explanation in pages/register.tsx) @@ -40,26 +40,26 @@ def index(): # return 400 (malformed request) if any of the required data is missing if not username or \ - not email or \ - not password: + not email or \ + not password: return "", 400 # return 403 (forbidden) if any of the required data is invalid if not validate_username(username) or \ - not validate_email(email) or \ - not validate_password(password): + not validate_email(email) or \ + not validate_password(password): return {"error": "form_data_invalid"}, 403 # check if username is taken if cursor.execute( - "select username from users where lower(username) = lower(?)", - [username] + "select username from users where lower(username) = lower(?)", + [username] ).fetchone(): return {"error": "username_taken"}, 403 # check if email is taken if cursor.execute("select email from users where email = ?", - [email]).fetchone(): + [email]).fetchone(): return {"error": "email_taken"}, 403 # create new user_id, hash password and note timestamp @@ -69,8 +69,8 @@ def index(): # write new user to database and commit cursor.execute( - "insert into users values (?, ?, ?, NULL, NULL, ?, ?, \"[]\", FALSE, \"user\", \"{}\", \"online\") ", - (user_id, username, email, password_hash, registered) + "insert into users values (?, ?, ?, NULL, NULL, ?, ?, \"[]\", FALSE, \"user\", \"{}\", \"online\") ", + (user_id, username, email, password_hash, registered) ) connection.commit() @@ -81,9 +81,9 @@ def index(): # create a flask response object to add the set-cookie header to res = make_response("", 200) res.set_cookie( - "token", - new_token["token"], - expires=int(new_token["expirationDate"] / 1000) + "token", + new_token["token"], + expires=int(new_token["expirationDate"] / 1000) ) return res diff --git a/api/auth/token.py b/api/auth/token.py index d75c91b..e94b014 100644 --- a/api/auth/token.py +++ b/api/auth/token.py @@ -8,32 +8,32 @@ import time # get valid token hashes for a given user_id def valid_tokens(user_id): tokens = json.loads( - cursor.execute( - "select valid_tokens from users where user_id = ?", [user_id] - ).fetchone()[0] + cursor.execute( + "select valid_tokens from users where user_id = ?", [user_id] + ).fetchone()[0] ) # return only tokens that aren't expired return [ - token for token in tokens - if token["expirationDate"] > int(time.time() * 1000) + token for token in tokens + if token["expirationDate"] > int(time.time() * 1000) ] def validate_token(user_id, token): tokens = valid_tokens(user_id) return hashlib.sha256(str(token).encode()).hexdigest() in [ - t["token"] for t in tokens - if t["expirationDate"] > int(time.time() * 1000) + t["token"] for t in tokens + if t["expirationDate"] > int(time.time() * 1000) ] def modify_tokens(user_id, formatted_token, remove): temp_tokens = valid_tokens(user_id) temp_tokens.remove(formatted_token - ) if remove else temp_tokens.append(formatted_token) + ) if remove else temp_tokens.append(formatted_token) cursor.execute( - "update users set valid_tokens = ? where user_id = ?", - [json.dumps(temp_tokens), user_id] + "update users set valid_tokens = ? where user_id = ?", + [json.dumps(temp_tokens), user_id] ) connection.commit() @@ -48,13 +48,13 @@ def revoke_token(user_id, formatted_token): def hash_token(token): return { - "token": hashlib.sha256(str(token["token"]).encode()).hexdigest(), - "expirationDate": token["expirationDate"] + "token": hashlib.sha256(str(token["token"]).encode()).hexdigest(), + "expirationDate": token["expirationDate"] } def generate_token(): return { - "token": secrets.token_hex(128), - "expirationDate": int(time.time() * 1000) + (24 * 60 * 60 * 1000) + "token": secrets.token_hex(128), + "expirationDate": int(time.time() * 1000) + (24 * 60 * 60 * 1000) } |