174 lines
6.5 KiB
Python
174 lines
6.5 KiB
Python
"""accounts — the identity service (SD-0001 §6.5).
|
|
|
|
All identity rules live here exactly once (INV-6): email normalization (INV-2); one-time
|
|
code issue/verify handled like a secret (INV-3 — hashed with the app secret as pepper,
|
|
10-minute TTL, single-use, ≤5 attempts, 60s resend cooldown); and get-or-create account.
|
|
Uniform for new vs known emails so the surface never enumerates accounts (§6.6). Imports
|
|
only app.platform (downward); takes the connection and mailer as parameters (the BFF wires
|
|
them) so the domain owns no request/transport concerns.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import hashlib
|
|
import hmac
|
|
import re
|
|
import secrets
|
|
from datetime import datetime, timedelta, timezone
|
|
|
|
import psycopg
|
|
|
|
from app.platform import config
|
|
from app.platform.mailer import Mailer, MailerError
|
|
|
|
from .errors import (
|
|
CodeExhausted,
|
|
CodeExpired,
|
|
CodeMismatch,
|
|
DeliveryFailed,
|
|
InvalidEmail,
|
|
ResendCooldown,
|
|
)
|
|
from .models import Account
|
|
|
|
# INV-3 constants — the one-time-code policy.
|
|
CODE_TTL = timedelta(minutes=10)
|
|
RESEND_COOLDOWN = timedelta(seconds=60)
|
|
MAX_ATTEMPTS = 5
|
|
_CODE_DIGITS = 6
|
|
|
|
# A pragmatic email check — rejects obvious non-addresses without an email-validator
|
|
# dependency. The provable test of an address is that the emailed code comes back (verify).
|
|
_EMAIL_RE = re.compile(r"^[^@\s]+@[^@\s]+\.[^@\s]+$")
|
|
|
|
|
|
def normalize_email(email: str) -> str:
|
|
"""Lowercase + strip — the canonical form one account is keyed by (INV-2)."""
|
|
norm = email.strip().lower()
|
|
if not _EMAIL_RE.match(norm):
|
|
raise InvalidEmail(email)
|
|
return norm
|
|
|
|
|
|
def _hash_code(code: str) -> str:
|
|
"""HMAC-SHA256 of the code, peppered by the app secret (INV-3 — hashes only, not the code)."""
|
|
key = config.session_secret().encode("utf-8")
|
|
return hmac.new(key, code.encode("utf-8"), hashlib.sha256).hexdigest()
|
|
|
|
|
|
def _now() -> datetime:
|
|
return datetime.now(timezone.utc)
|
|
|
|
|
|
def request_code(conn: psycopg.Connection, mailer: Mailer, email: str) -> None:
|
|
"""Issue a one-time code to `email` and dispatch it. Uniform for new/known emails (§6.6).
|
|
|
|
Enforces the 60s resend cooldown (INV-3 → PUC-2c). Opportunistically purges this email's
|
|
spent/expired codes. Never reveals whether the email already has an account.
|
|
"""
|
|
email = normalize_email(email)
|
|
now = _now()
|
|
|
|
last = conn.execute(
|
|
"SELECT max(created_at) FROM auth_code WHERE email = %s AND consumed_at IS NULL",
|
|
(email,),
|
|
).fetchone()[0]
|
|
if last is not None:
|
|
elapsed = now - last
|
|
if elapsed < RESEND_COOLDOWN:
|
|
retry_after_s = int((RESEND_COOLDOWN - elapsed).total_seconds()) + 1
|
|
raise ResendCooldown(retry_after_s)
|
|
|
|
# Housekeeping: drop this email's consumed/expired codes (§6.3) before issuing a fresh one.
|
|
conn.execute(
|
|
"DELETE FROM auth_code WHERE email = %s AND (consumed_at IS NOT NULL OR expires_at < %s)",
|
|
(email, now),
|
|
)
|
|
|
|
code = "".join(secrets.choice("0123456789") for _ in range(_CODE_DIGITS))
|
|
conn.execute(
|
|
"INSERT INTO auth_code (email, code_hash, expires_at) VALUES (%s, %s, %s)",
|
|
(email, _hash_code(code), now + CODE_TTL),
|
|
)
|
|
|
|
# Send BEFORE commit (ecomm#7): a refused delivery rolls the row back, so no orphan
|
|
# code blocks the 60s cooldown and the caller can honestly retry at once (INV-9).
|
|
try:
|
|
mailer.send(
|
|
to=email,
|
|
subject=f"Your ecomm code: {code}",
|
|
body=(
|
|
f"Your ecomm one-time code is {code}.\n"
|
|
f"It is valid for {int(CODE_TTL.total_seconds() // 60)} minutes.\n"
|
|
"If you didn't request this, ignore this message."
|
|
),
|
|
)
|
|
except MailerError as exc:
|
|
conn.rollback()
|
|
raise DeliveryFailed(str(exc)) from exc
|
|
conn.commit()
|
|
|
|
|
|
def verify(conn: psycopg.Connection, email: str, code: str) -> tuple[Account, bool]:
|
|
"""Verify a code and resolve the account. Returns (account, created).
|
|
|
|
Consumes the live code transactionally (single-use, INV-3): wrong codes spend an attempt
|
|
(PUC-2a) until MAX_ATTEMPTS invalidates it (CodeExhausted); expired/absent codes raise
|
|
CodeExpired (PUC-2b). On success the code is consumed and the account is got-or-created
|
|
by normalized email (INV-2). Account creation IS email verification (the address
|
|
provably received the code).
|
|
"""
|
|
email = normalize_email(email)
|
|
now = _now()
|
|
|
|
row = conn.execute(
|
|
"SELECT id, code_hash, expires_at, attempts FROM auth_code "
|
|
"WHERE email = %s AND consumed_at IS NULL "
|
|
"ORDER BY created_at DESC LIMIT 1 FOR UPDATE",
|
|
(email,),
|
|
).fetchone()
|
|
if row is None:
|
|
conn.commit()
|
|
raise CodeExpired(email) # nothing live to verify — offer a fresh code
|
|
code_id, code_hash, expires_at, attempts = row
|
|
|
|
if expires_at < now:
|
|
conn.commit()
|
|
raise CodeExpired(email)
|
|
|
|
if not hmac.compare_digest(code_hash, _hash_code(code)):
|
|
attempts += 1
|
|
if attempts >= MAX_ATTEMPTS:
|
|
conn.execute(
|
|
"UPDATE auth_code SET attempts = %s, consumed_at = %s WHERE id = %s",
|
|
(attempts, now, code_id),
|
|
)
|
|
conn.commit()
|
|
raise CodeExhausted(email)
|
|
conn.execute("UPDATE auth_code SET attempts = %s WHERE id = %s", (attempts, code_id))
|
|
conn.commit()
|
|
raise CodeMismatch(attempts_remaining=MAX_ATTEMPTS - attempts)
|
|
|
|
# Correct: consume the code and get-or-create the account in the same transaction.
|
|
conn.execute("UPDATE auth_code SET consumed_at = %s WHERE id = %s", (now, code_id))
|
|
account, created = _get_or_create_account(conn, email)
|
|
conn.commit()
|
|
return account, created
|
|
|
|
|
|
def _get_or_create_account(conn: psycopg.Connection, email: str) -> tuple[Account, bool]:
|
|
"""Insert the account if absent; return (account, created). Race-safe via the unique index."""
|
|
inserted = conn.execute(
|
|
"INSERT INTO account (email) VALUES (%s) ON CONFLICT (email) DO NOTHING RETURNING id",
|
|
(email,),
|
|
).fetchone()
|
|
if inserted is not None:
|
|
return Account(id=inserted[0], email=email), True
|
|
existing = conn.execute("SELECT id FROM account WHERE email = %s", (email,)).fetchone()
|
|
return Account(id=existing[0], email=email), False
|
|
|
|
|
|
def get_account(conn: psycopg.Connection, account_id: int) -> Account | None:
|
|
"""Load an account by id (for the signed-in `/me`)."""
|
|
row = conn.execute("SELECT id, email FROM account WHERE id = %s", (account_id,)).fetchone()
|
|
return Account(id=row[0], email=row[1]) if row else None
|