54 lines
1.4 KiB
Python
54 lines
1.4 KiB
Python
import hashlib
|
|
import hmac
|
|
import secrets
|
|
|
|
from fastapi import HTTPException, Request
|
|
from itsdangerous import BadSignature, TimestampSigner
|
|
|
|
from app.config import get_settings
|
|
|
|
COOKIE = "fb_session"
|
|
MAX_AGE = 60 * 60 * 12 # 12 h
|
|
|
|
|
|
def hash_password(pw: str, salt: str | None = None) -> str:
|
|
salt = salt or secrets.token_hex(16)
|
|
digest = hashlib.pbkdf2_hmac("sha256", pw.encode(), salt.encode(), 200_000).hex()
|
|
return f"{salt}${digest}"
|
|
|
|
|
|
def verify_password(pw: str, stored: str) -> bool:
|
|
try:
|
|
salt, digest = stored.split("$", 1)
|
|
except ValueError:
|
|
return False
|
|
return hmac.compare_digest(hash_password(pw, salt).split("$", 1)[1], digest)
|
|
|
|
|
|
def _signer() -> TimestampSigner:
|
|
return TimestampSigner(get_settings().session_secret)
|
|
|
|
|
|
def make_session_token() -> str:
|
|
return _signer().sign(b"gui").decode()
|
|
|
|
|
|
def session_valid(token: str | None) -> bool:
|
|
if not token:
|
|
return False
|
|
try:
|
|
_signer().unsign(token, max_age=MAX_AGE)
|
|
return True
|
|
except BadSignature:
|
|
return False
|
|
|
|
|
|
def require_auth(request: Request) -> None:
|
|
settings = get_settings()
|
|
header = request.headers.get("authorization", "")
|
|
if settings.api_key and header == f"Bearer {settings.api_key}":
|
|
return
|
|
if session_valid(request.cookies.get(COOKIE)):
|
|
return
|
|
raise HTTPException(status_code=401, detail="Nicht angemeldet")
|