Colin Maudry
62 lines
1.7 KiB
Python
62 lines
1.7 KiB
Python
import hashlib
|
|
import secrets
|
|
from datetime import datetime, timedelta, timezone
|
|
|
|
from src.auth import db
|
|
|
|
VERIFICATION_TTL_HOURS = 24
|
|
RESET_TTL_HOURS = 1
|
|
|
|
|
|
def hash_token(plain: str) -> str:
|
|
return hashlib.sha256(plain.encode("utf-8")).hexdigest()
|
|
|
|
|
|
def _expires_at(hours: int) -> str:
|
|
return (datetime.now(timezone.utc) + timedelta(hours=hours)).isoformat()
|
|
|
|
|
|
def create_verification_token(
|
|
user_id: int, expires_in_hours: int = VERIFICATION_TTL_HOURS
|
|
) -> str:
|
|
plain = secrets.token_urlsafe(32)
|
|
db.create_email_verification_token(
|
|
hash_token(plain), user_id, _expires_at(expires_in_hours)
|
|
)
|
|
return plain
|
|
|
|
|
|
def consume_verification_token(plain: str) -> int | None:
|
|
row = db.find_email_verification_token(hash_token(plain))
|
|
if row is None:
|
|
return None
|
|
user_id = row["user_id"]
|
|
db.delete_email_verification_tokens_for_user(user_id)
|
|
return user_id
|
|
|
|
|
|
def create_password_reset_token(
|
|
user_id: int, expires_in_hours: int = RESET_TTL_HOURS
|
|
) -> str:
|
|
db.delete_password_reset_tokens_for_user(user_id)
|
|
plain = secrets.token_urlsafe(32)
|
|
db.create_password_reset_token(
|
|
hash_token(plain), user_id, _expires_at(expires_in_hours)
|
|
)
|
|
return plain
|
|
|
|
|
|
def consume_password_reset_token(plain: str) -> int | None:
|
|
row = db.find_password_reset_token(hash_token(plain))
|
|
if row is None:
|
|
return None
|
|
user_id = row["user_id"]
|
|
db.delete_password_reset_tokens_for_user(user_id)
|
|
return user_id
|
|
|
|
|
|
def validate_password_reset_token(plain: str) -> int | None:
|
|
"""Check token without consuming (used to render the reset form)."""
|
|
row = db.find_password_reset_token(hash_token(plain))
|
|
return row["user_id"] if row else None
|