Refactor/security split 20220303

datameta/alembic/versions/20211029_98911b881230.py

@@ -0,0 +1,37 @@
+"""added failed_login_attempt tracking
+
+Revision ID: 98911b881230
+Revises: 7fdc829db18d
+Create Date: 2021-10-29 15:01:29.844727
+
+"""
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision = '98911b881230'
+down_revision = '6a9f0bec38e6'
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.create_table(
+        'loginattempts',
+        sa.Column('id', sa.Integer(), nullable=False),
+        sa.Column('uuid', postgresql.UUID(as_uuid=True), nullable=False),
+        sa.Column('user_id', sa.Integer(), nullable=False),
+        sa.Column('timestamp', sa.DateTime(), nullable=False),
+        sa.ForeignKeyConstraint(['user_id'], ['users.id'], name=op.f('fk_loginattempts_user_id_users')),
+        sa.PrimaryKeyConstraint('id', name=op.f('pk_loginattempts')),
+        sa.UniqueConstraint('uuid', name=op.f('uq_loginattempts_uuid'))
+    )
+    # ### end Alembic commands ###
+
+
+def downgrade():
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.drop_table('loginattempts')
+    # ### end Alembic commands ###

datameta/api/apikeys.py

@@ -18,7 +18,7 @@
 from typing import Optional, List
 from .. import models
 from .. import security
-from ..security import authz
+from ..security import authz, tokenz
 from pyramid.httpexceptions import HTTPOk, HTTPUnauthorized, HTTPForbidden
 from ..resource import resource_by_id, get_identifier
 from ..errors import get_validation_error
@@ -95,8 +95,8 @@ def generate_api_key(request: Request, user: models.User, label: str, expires: O
     """
     Generate API Token and store unsalted hash in db.
     """
-    token = security.generate_token()
-    token_hash = security.hash_token(token)
+    token = tokenz.generate_token()
+    token_hash = tokenz.hash_token(token)
 
     db = request.dbsession
     apikey = models.ApiKey(

datameta/api/appsettings.py

@@ -23,8 +23,7 @@
 from .. import resource, security, errors
 from ..security import authz
 from ..resource import resource_by_id
-from ..settings import get_setting_value_type
-import datetime
+from ..settings import get_setting_value_type, set_setting, SettingUpdateError
 
 
 @dataclass
@@ -89,43 +88,11 @@ def put(request: Request):
         raise HTTPForbidden()
 
     target_setting = resource_by_id(db, ApplicationSetting, settings_id)
-
-    temp, value_type = get_setting_value_type(target_setting)
     value = request.openapi_validated.body["value"]
 
-    if value_type == 'int':
-        try:
-            value_int = int(value)
-        except ValueError:
-            raise errors.get_validation_error(["You have to provide an integer."])
-
-        target_setting.int_value = value_int
-
-    elif value_type == 'string':
-        target_setting.str_value = value
-
-    elif value_type == 'float':
-        try:
-            value_float = float(value)
-        except ValueError:
-            raise errors.get_validation_error(["You have to provide a float."])
-
-        target_setting.float_value = value_float
-
-    elif value_type == 'date':
-        try:
-            datetime.datetime.strptime(value, "%Y-%m-%d")
-        except ValueError:
-            raise errors.get_validation_error(["The date value has to specified in the form '%Y-%m-%d'."])
-
-        target_setting.date_value = value
-
-    elif value_type == 'time':
-        try:
-            datetime.datetime.strptime(value, "%H:%M:%S")
-        except ValueError:
-            raise errors.get_validation_error(["The time value has to specified in the form '%H:%M:%S'."])
-
-        target_setting.date_value = value
+    try:
+        set_setting(db, target_setting.key, value)
+    except SettingUpdateError as e:
+        raise errors.get_validation_error([str(e)])
 
     return HTTPNoContent()

datameta/api/download.py

@@ -18,6 +18,7 @@
 from pyramid.response import FileResponse
 from datetime import datetime
 from .. import security, models, storage
+from ..security import tokenz
 from ..resource import get_identifier
 from .files import access_file_by_user
 from sqlalchemy import and_
@@ -75,7 +76,7 @@ def download_by_token(request: Request) -> HTTPOk:
     Usage: /download/{download_token}
     """
     token = request.matchdict['token']
-    hashed_token = security.hash_token(token)
+    hashed_token = tokenz.hash_token(token)
 
     # get download token from db
     db = request.dbsession

datameta/api/password.py

@@ -17,7 +17,7 @@
 from pyramid.view import view_config
 
 from .. import security, errors
-from ..security import authz
+from ..security import authz, tokenz, pwdz
 from ..models import User
 from datetime import datetime
 
@@ -41,7 +41,7 @@ def put(request):
     token = None
     if request_id == '0':
         # Try to find the token
-        token = security.get_password_reset_token(db, request_credential)
+        token = tokenz.get_password_reset_token(db, request_credential)
         if token is None:
             raise HTTPNotFound()  # 404 Token not found
 
@@ -64,16 +64,16 @@ def put(request):
             raise HTTPForbidden()  # 403 User ID not found, hidden from the user intentionally
 
         # Only changing the user's own password is allowed
-        if not authz.update_user_password(auth_user, target_user) or not security.check_password_by_hash(request_credential, auth_user.pwhash):
+        if not authz.update_user_password(auth_user, target_user) or not pwdz.check_password_by_hash(request_credential, auth_user.pwhash):
             raise HTTPForbidden()  # 403 Not authorized to change this user's password
 
     # Verify the password quality
-    error = security.verify_password(db, auth_user.id, request_newPassword)
+    error = pwdz.verify_password(db, auth_user.id, request_newPassword)
     if error:
         raise errors.get_validation_error([error])
 
     # Set the new password
-    auth_user.pwhash = security.register_password(db, auth_user.id, request_newPassword)
+    auth_user.pwhash = pwdz.register_password(db, auth_user.id, request_newPassword)
 
     # Delete the password token if any
     if token:

datameta/api/ui/admin.py

@@ -18,6 +18,7 @@
 from ...models import User, Group, RegRequest
 from ...settings import get_setting
 from ... import email, security, siteid, errors
+from ...security import tokenz
 from ...resource import resource_by_id, get_identifier
 from sqlalchemy.exc import IntegrityError
 
@@ -98,7 +99,7 @@ def v_admin_put_request(request):
         db.delete(reg_req)
 
         # Obtain a new token
-        _, clear_token = security.get_new_password_reset_token(db, new_user)
+        _, clear_token = tokenz.get_new_password_reset_token(db, new_user)
 
         # Generate the token url
         token_url = request.route_url('setpass', token = clear_token)

datameta/api/ui/forgot.py

@@ -14,7 +14,8 @@
 
 from pyramid.view import view_config
 
-from ... import security, email
+from ... import email
+from ...security import tokenz
 from ...settings import get_setting
 
 import re
@@ -51,7 +52,7 @@ def v_forgot_api(request):
         return { 'success' : False, 'error' : 'MALFORMED_EMAIL' }
 
     try:
-        db_token_obj, clear_token = security.get_new_password_reset_token_from_email(db, req_email)
+        db_token_obj, clear_token = tokenz.get_new_password_reset_token_from_email(db, req_email)
     except KeyError:
         # User not found
         log.debug(f"DURING RECOVERY TOKEN REQUEST: USER COULD NOT BE RESOLVED FROM EMAIL: {req_email}")

datameta/api/upload.py

@@ -18,7 +18,8 @@
 import webob
 import logging
 from datetime import datetime
-from .. import resource, models, storage, security
+from .. import resource, models, storage
+from ..security import tokenz
 
 log = logging.getLogger(__name__)
 
@@ -53,7 +54,7 @@ def post(request) -> HTTPNoContent:
     db_file = resource.resource_by_id(db, models.File, req_file_id)
 
     # Validate access token match
-    db_file = db_file if db_file and req_token and db_file.upload_expires > datetime.now() and db_file.access_token == security.hash_token(req_token) else None
+    db_file = db_file if db_file and req_token and db_file.upload_expires > datetime.now() and db_file.access_token == tokenz.hash_token(req_token) else None
 
     if db_file is None:  # Includes token mismatch
         raise HTTPNotFound(json=None)

datameta/defaults/appsettings.yaml

@@ -41,7 +41,6 @@ template_welcome_token:
 
             Best regards,
             The Support Team
-            },
 
 subject_reject:
   str_value : Your registration request was rejected
@@ -85,6 +84,9 @@ logo_html:
 user_agreement:
   str_value: ""
 
+security_max_failed_login_attempts:
+  int_value: 5
+
 security_password_minimum_length:
   int_value: 10
 

datameta/models/__init__.py

@@ -36,7 +36,8 @@
         DownloadToken,
         Service,
         ServiceExecution,
-        UsedPassword
+        LoginAttempt,
+        UsedPassword,
         )
 
 # run configure_mappers after defining all of the models to ensure

datameta/models/db.py

@@ -91,6 +91,17 @@ class User(Base):
     services             = relationship('Service', secondary=user_service_table, back_populates='users')
     service_executions   = relationship('ServiceExecution', back_populates='user')
     used_passwords       = relationship('UsedPassword', back_populates='user')
+    login_attempts       = relationship("LoginAttempt", back_populates='user', cascade="all, delete-orphan")
+
+
+class LoginAttempt(Base):
+    __tablename__    = 'loginattempts'
+    id               = Column(Integer, primary_key=True)
+    uuid             = Column(UUID(as_uuid=True), unique=True, default=uuid.uuid4, nullable=False)
+    user_id          = Column(Integer, ForeignKey('users.id'), nullable=False)
+    timestamp        = Column(DateTime, nullable=False)
+    # Relationships
+    user             = relationship('User', back_populates='login_attempts')
 
 
 class ApiKey(Base):

datameta/scripts/initialize_db.py

@@ -18,7 +18,8 @@
 from pyramid.paster import bootstrap, setup_logging
 from sqlalchemy.exc import OperationalError
 
-from ..security import register_password, hash_token
+from ..security.pwdz import register_password
+from ..security.tokenz import hash_token
 from ..models import User, Group, MetaDatum, DateTimeMode, ApiKey