291 lines
10 KiB
Python
291 lines
10 KiB
Python
import uuid
|
|
import time
|
|
import threading
|
|
from fastapi import APIRouter, HTTPException, Header, Depends, Request, Response
|
|
from fastapi.responses import JSONResponse
|
|
from pydantic import BaseModel, EmailStr
|
|
from typing import Optional
|
|
from app.models.user import get_db_connection
|
|
from app.core.auth import (
|
|
hash_password, verify_password, create_token, decode_token, seed_admin,
|
|
COOKIE_NAME, X_AUTH_HEADER,
|
|
)
|
|
|
|
router = APIRouter()
|
|
|
|
class LoginRequest(BaseModel):
|
|
username: Optional[str] = "admin"
|
|
password: str
|
|
|
|
class RegisterRequest(BaseModel):
|
|
username: str
|
|
email: str
|
|
password: str
|
|
|
|
class ChangePasswordRequest(BaseModel):
|
|
old_password: str
|
|
new_password: str
|
|
|
|
# ── Brute-force guard: in-memory per-IP failed-login limiter ──
|
|
_LOGIN_FAILURES = {} # ip -> [timestamps]
|
|
_LOGIN_LOCK = threading.Lock()
|
|
MAX_LOGIN_ATTEMPTS = 10
|
|
LOGIN_WINDOW_SEC = 900 # 15 min
|
|
LOGIN_BLOCK_SEC = 900
|
|
|
|
def _check_login_ratelimit(ip: str):
|
|
now = time.time()
|
|
with _LOGIN_LOCK:
|
|
stamps = [t for t in _LOGIN_FAILURES.get(ip, []) if now - t < LOGIN_WINDOW_SEC]
|
|
if len(stamps) >= MAX_LOGIN_ATTEMPTS:
|
|
raise HTTPException(status_code=429, detail="Quá nhiều lần đăng nhập thất bại. Vui lòng thử lại sau 15 phút.")
|
|
_LOGIN_FAILURES[ip] = stamps
|
|
|
|
def _record_login_failure(ip: str):
|
|
now = time.time()
|
|
with _LOGIN_LOCK:
|
|
stamps = _LOGIN_FAILURES.setdefault(ip, [])
|
|
stamps.append(now)
|
|
_LOGIN_FAILURES[ip] = [t for t in stamps if now - t < LOGIN_WINDOW_SEC]
|
|
|
|
def _record_login_success(ip: str):
|
|
with _LOGIN_LOCK:
|
|
_LOGIN_FAILURES.pop(ip, None)
|
|
|
|
def _set_auth_cookie(response: Response, token: str):
|
|
response.set_cookie(
|
|
COOKIE_NAME, token,
|
|
max_age=7 * 24 * 3600, httponly=True, samesite="lax",
|
|
# path="/" (default); secure flag set by proxy when behind TLS
|
|
)
|
|
|
|
def get_current_user(request: Request, authorization: Optional[str] = Header(None), x_auth_token: Optional[str] = Header(None)):
|
|
token = None
|
|
if authorization and authorization.startswith("Bearer "):
|
|
token = authorization.split(" ")[1]
|
|
elif x_auth_token:
|
|
token = x_auth_token
|
|
elif request.cookies.get(COOKIE_NAME):
|
|
token = request.cookies.get(COOKIE_NAME)
|
|
if not token:
|
|
raise HTTPException(status_code=401, detail="Thiếu Token xác thực hoặc Token không hợp lệ")
|
|
payload = decode_token(token)
|
|
if not payload:
|
|
raise HTTPException(status_code=401, detail="Token đã hết hạn hoặc không hợp lệ")
|
|
return payload
|
|
|
|
def enforce_password_changed(user: dict):
|
|
"""Bắt buộc người dùng phải đổi mật khẩu ở lần đăng nhập đầu tiên (22_CLIENT_DESK.md §4.1)."""
|
|
if user.get("must_change_password"):
|
|
raise HTTPException(
|
|
status_code=403,
|
|
detail="Tài khoản bắt buộc phải đổi mật khẩu ở lần đăng nhập đầu tiên trước khi thực hiện xử lý nhạc (HTTP 403 Forbidden)."
|
|
)
|
|
|
|
@router.post("/login")
|
|
async def login(req: LoginRequest, request: Request):
|
|
client_ip = request.client.host if request.client else "unknown"
|
|
_check_login_ratelimit(client_ip)
|
|
|
|
conn = get_db_connection()
|
|
cursor = conn.cursor()
|
|
|
|
username = (req.username or "").strip()
|
|
if not username:
|
|
username = "admin"
|
|
|
|
password = (req.password or "").strip()
|
|
|
|
# Case-insensitive search by username or email
|
|
cursor.execute("SELECT * FROM users WHERE LOWER(username) = LOWER(?) OR LOWER(email) = LOWER(?)", (username, username))
|
|
user = cursor.fetchone()
|
|
|
|
# Auto-heal seed_admin if admin record missing
|
|
if not user and username.lower() == "admin":
|
|
conn.close()
|
|
seed_admin()
|
|
conn = get_db_connection()
|
|
cursor = conn.cursor()
|
|
cursor.execute("SELECT * FROM users WHERE username = 'admin'")
|
|
user = cursor.fetchone()
|
|
|
|
conn.close()
|
|
|
|
if not user or not user["is_active"]:
|
|
_record_login_failure(client_ip)
|
|
raise HTTPException(status_code=400, detail="Tài khoản hoặc mật khẩu không chính xác")
|
|
|
|
if not verify_password(password, user["hashed_password"]):
|
|
_record_login_failure(client_ip)
|
|
raise HTTPException(status_code=400, detail="Tài khoản hoặc mật khẩu không chính xác")
|
|
|
|
token = create_token(user["id"], user["username"], user["role"], user["must_change_password"])
|
|
_record_login_success(client_ip)
|
|
|
|
resp = JSONResponse({
|
|
"access_token": token,
|
|
"user": {
|
|
"id": user["id"],
|
|
"username": user["username"],
|
|
"email": user["email"],
|
|
"role": user["role"],
|
|
"must_change_password": bool(user["must_change_password"])
|
|
}
|
|
})
|
|
_set_auth_cookie(resp, token)
|
|
return resp
|
|
|
|
def _validate_password_strength(password: str):
|
|
"""Minimal strength policy: >= 8 chars and not trivially common."""
|
|
if len(password) < 8:
|
|
raise HTTPException(status_code=400, detail="Mật khẩu phải có ít nhất 8 ký tự")
|
|
lowered = password.lower()
|
|
if lowered in ("admin123", "password", "12345678", "123456789", "qwerty123"):
|
|
raise HTTPException(status_code=400, detail="Mật khẩu quá dễ đoán, vui lòng chọn mật khẩu khác")
|
|
|
|
@router.post("/register")
|
|
async def register(req: RegisterRequest, request: Request):
|
|
username = req.username.strip()
|
|
email = req.email.strip()
|
|
password = req.password.strip()
|
|
_validate_password_strength(password)
|
|
|
|
conn = get_db_connection()
|
|
cursor = conn.cursor()
|
|
|
|
cursor.execute("SELECT id FROM users WHERE LOWER(username) = LOWER(?) OR LOWER(email) = LOWER(?)", (username, email))
|
|
if cursor.fetchone():
|
|
conn.close()
|
|
raise HTTPException(status_code=400, detail="Tên người dùng hoặc Email đã tồn tại")
|
|
|
|
user_id = str(uuid.uuid4())
|
|
hashed_pwd = hash_password(password)
|
|
now = time.time()
|
|
|
|
cursor.execute("""
|
|
INSERT INTO users (id, username, email, hashed_password, role, must_change_password, created_at, is_active)
|
|
VALUES (?, ?, ?, ?, 'standard', 0, ?, 1)
|
|
""", (user_id, username, email, hashed_pwd, now))
|
|
|
|
cursor.execute("""
|
|
INSERT INTO user_quotas (user_id, storage_limit_mb, max_tracks)
|
|
VALUES (?, 500, 16)
|
|
""", (user_id,))
|
|
|
|
conn.commit()
|
|
conn.close()
|
|
|
|
token = create_token(user_id, username, "standard", False)
|
|
resp = JSONResponse({
|
|
"access_token": token,
|
|
"user": {
|
|
"id": user_id,
|
|
"username": username,
|
|
"email": email,
|
|
"role": "standard",
|
|
"must_change_password": False
|
|
}
|
|
})
|
|
_set_auth_cookie(resp, token)
|
|
return resp
|
|
|
|
@router.post("/change-password")
|
|
async def change_password(req: ChangePasswordRequest, current_user: dict = Depends(get_current_user)):
|
|
user_id = current_user["user_id"]
|
|
old_pwd = req.old_password.strip()
|
|
new_pwd = req.new_password.strip()
|
|
|
|
conn = get_db_connection()
|
|
cursor = conn.cursor()
|
|
|
|
cursor.execute("SELECT hashed_password FROM users WHERE id = ?", (user_id,))
|
|
user = cursor.fetchone()
|
|
if not user or not verify_password(old_pwd, user["hashed_password"]):
|
|
conn.close()
|
|
raise HTTPException(status_code=400, detail="Mật khẩu hiện tại không chính xác")
|
|
|
|
new_hashed = hash_password(new_pwd)
|
|
cursor.execute("""
|
|
UPDATE users SET hashed_password = ?, must_change_password = 0 WHERE id = ?
|
|
""", (new_hashed, user_id))
|
|
|
|
conn.commit()
|
|
|
|
cursor.execute("SELECT * FROM users WHERE id = ?", (user_id,))
|
|
updated_user = cursor.fetchone()
|
|
conn.close()
|
|
|
|
new_token = create_token(updated_user["id"], updated_user["username"], updated_user["role"], False)
|
|
resp = JSONResponse({
|
|
"message": "Đổi mật khẩu thành công!",
|
|
"access_token": new_token
|
|
})
|
|
_set_auth_cookie(resp, new_token)
|
|
return resp
|
|
|
|
@router.get("/profile")
|
|
async def get_profile(current_user: dict = Depends(get_current_user)):
|
|
user_id = current_user["user_id"]
|
|
conn = get_db_connection()
|
|
cursor = conn.cursor()
|
|
|
|
cursor.execute("""
|
|
SELECT u.id, u.username, u.email, u.role, u.must_change_password, q.storage_limit_mb, q.max_tracks
|
|
FROM users u
|
|
LEFT JOIN user_quotas q ON u.id = q.user_id
|
|
WHERE u.id = ?
|
|
""", (user_id,))
|
|
row = cursor.fetchone()
|
|
|
|
cursor.execute("SELECT SUM(size_bytes) as total_used FROM projects WHERE user_id = ?", (user_id,))
|
|
used_row = cursor.fetchone()
|
|
used_bytes = used_row["total_used"] if used_row and used_row["total_used"] else 0
|
|
used_mb = round(used_bytes / (1024 * 1024), 2)
|
|
|
|
conn.close()
|
|
|
|
if not row:
|
|
raise HTTPException(status_code=404, detail="Không tìm thấy thông tin tài khoản")
|
|
|
|
return {
|
|
"id": row["id"],
|
|
"username": row["username"],
|
|
"email": row["email"],
|
|
"role": row["role"],
|
|
"must_change_password": bool(row["must_change_password"]),
|
|
"quota": {
|
|
"storage_limit_mb": row["storage_limit_mb"] or 500,
|
|
"used_mb": used_mb,
|
|
"max_tracks": row["max_tracks"] or 16
|
|
}
|
|
}
|
|
|
|
|
|
@router.get("/first-time")
|
|
async def auth_first_time():
|
|
# "Lần đăng nhập đầu" = tài khoản admin vẫn dùng mật khẩu MẶC ĐỊNH
|
|
# (chưa từng đổi). Sau khi đổi lần đầu → first_time = false → UI xóa
|
|
# gợi ý username/mật khẩu (Tùy chọn - Admin có thể bỏ trống, lần đầu:
|
|
# admin123, nút Điền nhanh).
|
|
try:
|
|
conn = get_db_connection()
|
|
try:
|
|
cur = conn.cursor()
|
|
cur.execute(
|
|
"SELECT id, hashed_password, must_change_password FROM users "
|
|
"WHERE LOWER(role) = 'admin' ORDER BY created_at ASC LIMIT 1"
|
|
)
|
|
row = cur.fetchone()
|
|
finally:
|
|
conn.close()
|
|
if not row:
|
|
return {"first_time": True}
|
|
still_default = False
|
|
try:
|
|
still_default = verify_password("admin123", row["hashed_password"])
|
|
except Exception:
|
|
still_default = False
|
|
return {"first_time": bool(row["must_change_password"]) and still_default}
|
|
except Exception:
|
|
return {"first_time": True}
|