quart-security 1.1.0__tar.gz → 1.2.1__tar.gz

{quart_security-1.1.0 → quart_security-1.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: quart-security
-Version: 1.1.0
+Version: 1.2.1
 Summary: Native async auth for Quart
 Author: quart-security maintainers
 Requires-Python: >=3.11
@@ -55,6 +55,7 @@ It is designed as a practical replacement path for Flask-Security style session
 - Flask-Security-style endpoint naming through `url_for_security()`
 - Signals for auth lifecycle events
 - Overridable templates under `templates/security/`
+- Datastore hooks can be implemented as async methods or simple sync methods
 
 ## Non-Goals (Current Scope)
 
@@ -130,6 +131,10 @@ For tracking / MFA / WebAuthn features:
 - `fs_webauthn_user_handle`
 - relationship/association for stored WebAuthn credentials
 
+Optional for lockout support:
+- `failed_login_count`
+- `locked_until`
+
 ## Key Configuration
 
 The extension uses `SECURITY_*` keys for migration-friendly configuration.
@@ -138,6 +143,8 @@ Core:
 - `SECURITY_PASSWORD_HASH` (default: `pbkdf2_sha512`)
 - `SECURITY_PASSWORD_SALT` (recommended)
 - `SECURITY_PASSWORD_LENGTH_MIN` (default: `12`)
+- `SECURITY_LOGIN_MAX_ATTEMPTS` (default: `5`)
+- `SECURITY_LOCKOUT_MINUTES` (default: `15`)
 - `SECURITY_REGISTERABLE`
 - `SECURITY_CHANGEABLE`
 - `SECURITY_TRACKABLE`

{quart_security-1.1.0 → quart_security-1.2.1}/README.md

@@ -28,6 +28,7 @@ It is designed as a practical replacement path for Flask-Security style session
 - Flask-Security-style endpoint naming through `url_for_security()`
 - Signals for auth lifecycle events
 - Overridable templates under `templates/security/`
+- Datastore hooks can be implemented as async methods or simple sync methods
 
 ## Non-Goals (Current Scope)
 
@@ -103,6 +104,10 @@ For tracking / MFA / WebAuthn features:
 - `fs_webauthn_user_handle`
 - relationship/association for stored WebAuthn credentials
 
+Optional for lockout support:
+- `failed_login_count`
+- `locked_until`
+
 ## Key Configuration
 
 The extension uses `SECURITY_*` keys for migration-friendly configuration.
@@ -111,6 +116,8 @@ Core:
 - `SECURITY_PASSWORD_HASH` (default: `pbkdf2_sha512`)
 - `SECURITY_PASSWORD_SALT` (recommended)
 - `SECURITY_PASSWORD_LENGTH_MIN` (default: `12`)
+- `SECURITY_LOGIN_MAX_ATTEMPTS` (default: `5`)
+- `SECURITY_LOCKOUT_MINUTES` (default: `15`)
 - `SECURITY_REGISTERABLE`
 - `SECURITY_CHANGEABLE`
 - `SECURITY_TRACKABLE`

{quart_security-1.1.0 → quart_security-1.2.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "flit_core.buildapi"
 
 [project]
 name = "quart-security"
-version = "1.1.0"
+version = "1.2.1"
 description = "Native async auth for Quart"
 readme = "README.md"
 requires-python = ">=3.11"

{quart_security-1.1.0 → quart_security-1.2.1}/quart_security/core.py

@@ -2,7 +2,6 @@
 
 from __future__ import annotations
 
-import datetime
 import secrets
 from datetime import timedelta
 
@@ -12,7 +11,7 @@ from .forms import ChangePasswordForm, LoginForm, RegisterForm
 from .password import init_password_context
 from .proxies import AnonymousUser, current_user
 from .signals import user_authenticated, user_logged_out
-from .utils import url_for_security
+from .utils import maybe_await, naive_utcnow, url_for_security
 
 
 class _SecurityConfig:
@@ -88,6 +87,10 @@ class Security:
             async def _security_load_user():
                 await self.load_user()
 
+            @app.before_websocket
+            async def _security_load_user_ws():
+                await self.load_user()
+
             app.extensions["quart_security_load_user_registered"] = True
 
         app.jinja_env.globals.setdefault("url_for_security", url_for_security)
@@ -127,6 +130,8 @@ class Security:
             "SECURITY_WAN_REQUIRE_USER_VERIFICATION": True,
             "SECURITY_FRESHNESS": timedelta(minutes=60),
             "SECURITY_FRESHNESS_GRACE_PERIOD": timedelta(minutes=60),
+            "SECURITY_LOGIN_MAX_ATTEMPTS": 5,
+            "SECURITY_LOCKOUT_MINUTES": 15,
             "SECURITY_POST_LOGIN_VIEW": "/",
             "SECURITY_POST_REGISTER_VIEW": "/login",
             "SECURITY_EMAIL_SENDER": "noreply@example.com",
@@ -144,7 +149,7 @@ class Security:
             g._current_user = AnonymousUser()
             return
 
-        user = await self.datastore.find_user(fs_uniquifier=user_id)
+        user = await maybe_await(self.datastore.find_user(fs_uniquifier=user_id))
         g._current_user = user or AnonymousUser()
 
     async def login_user(self, user, fresh=True):
@@ -164,11 +169,11 @@ class Security:
         if app.config.get("SECURITY_TRACKABLE", True):
             user.last_login_at = getattr(user, "current_login_at", None)
             user.last_login_ip = getattr(user, "current_login_ip", None)
-            user.current_login_at = datetime.datetime.utcnow()
+            user.current_login_at = naive_utcnow()
             user.current_login_ip = request.remote_addr
             user.login_count = (getattr(user, "login_count", None) or 0) + 1
 
-        await self.datastore.commit()
+        await maybe_await(self.datastore.commit())
         await user_authenticated.send_async(app, user=user, authn_via="session")
 
     async def logout_user(self, user=None):

{quart_security-1.1.0 → quart_security-1.2.1}/quart_security/forms.py

@@ -63,7 +63,10 @@ class RegisterForm(QuartForm):
     password = PasswordField("Password", validators=[DataRequired()])
     password_confirm = PasswordField(
         "Confirm Password",
-        validators=[DataRequired(), EqualTo("password", message="Passwords must match")],
+        validators=[
+            DataRequired(),
+            EqualTo("password", message="Passwords must match"),
+        ],
     )
 
 
@@ -95,7 +98,10 @@ class WebAuthnRegisterForm(QuartForm):
     name = StringField("Credential Name", validators=[DataRequired()])
     usage = RadioField(
         "Usage",
-        choices=[("secondary", "Multi-factor only"), ("primary", "Passwordless sign-in")],
+        choices=[
+            ("secondary", "Multi-factor only"),
+            ("primary", "Passwordless sign-in"),
+        ],
         default="secondary",
         validators=[DataRequired()],
     )

quart_security-1.2.1/quart_security/utils.py

@@ -0,0 +1,25 @@
+"""Utility helpers."""
+
+from __future__ import annotations
+
+import datetime
+import inspect
+
+from quart import url_for
+
+
+def url_for_security(endpoint, **kwargs):
+    """Flask-Security-compatible helper for endpoint URLs."""
+    return url_for(f"security.{endpoint}", **kwargs)
+
+
+async def maybe_await(value):
+    """Await values when needed while supporting sync extension hooks."""
+    if inspect.isawaitable(value):
+        return await value
+    return value
+
+
+def naive_utcnow() -> datetime.datetime:
+    """Return a naive UTC datetime while avoiding utcnow() deprecations."""
+    return datetime.datetime.now(datetime.UTC).replace(tzinfo=None)

{quart_security-1.1.0 → quart_security-1.2.1}/quart_security/views.py

@@ -32,7 +32,7 @@ from .forms import (
 from .password import hash_password, validate_password, verify_password
 from .proxies import _security, current_user
 from .signals import password_changed, tf_profile_changed, user_registered
-from .utils import url_for_security
+from .utils import maybe_await, naive_utcnow, url_for_security
 
 security_bp = Blueprint("security", __name__, template_folder="templates")
 
@@ -58,15 +58,15 @@ def _resolve_redirect(config_key: str, fallback_endpoint: str) -> str:
 
 
 async def _find_user(**kwargs):
-    return await _security.datastore.find_user(**kwargs)
+    return await maybe_await(_security.datastore.find_user(**kwargs))
 
 
 async def _create_user(**kwargs):
-    return await _security.datastore.create_user(**kwargs)
+    return await maybe_await(_security.datastore.create_user(**kwargs))
 
 
 async def _commit():
-    await _security.datastore.commit()
+    await maybe_await(_security.datastore.commit())
 
 
 async def _enforce_csrf(submitted_token: str | None = None):
@@ -125,7 +125,7 @@ def _webauthn_rp_name() -> str:
 def _set_wan_state(key: str, **payload):
     session[key] = {
         "payload": payload,
-        "issued_at": int(datetime.datetime.utcnow().timestamp()),
+        "issued_at": int(naive_utcnow().timestamp()),
     }
 
 
@@ -137,7 +137,7 @@ def _pop_wan_state(key: str, max_age_seconds: int = 300) -> dict | None:
     payload = state.get("payload")
     if not isinstance(issued_at, int) or not isinstance(payload, dict):
         return None
-    age = int(datetime.datetime.utcnow().timestamp()) - issued_at
+    age = int(naive_utcnow().timestamp()) - issued_at
     if age < 0 or age > max_age_seconds:
         return None
     return payload
@@ -146,7 +146,7 @@ def _pop_wan_state(key: str, max_age_seconds: int = 300) -> dict | None:
 async def _list_webauthn_credentials(user, usage: str | None = None):
     getter = getattr(_security.datastore, "get_webauthn_credentials", None)
     if getter:
-        return await getter(user, usage=usage)
+        return await maybe_await(getter(user, usage=usage))
     credentials = list(getattr(user, "webauthn", None) or [])
     if usage:
         credentials = [
@@ -160,7 +160,7 @@ async def _list_webauthn_credentials(user, usage: str | None = None):
 async def _find_webauthn_credential(credential_id: bytes, user=None):
     finder = getattr(_security.datastore, "find_webauthn_credential", None)
     if finder:
-        return await finder(credential_id, user=user)
+        return await maybe_await(finder(credential_id, user=user))
 
     candidates = list(getattr(user, "webauthn", None) or []) if user else []
     for credential in candidates:
@@ -172,14 +172,14 @@ async def _find_webauthn_credential(credential_id: bytes, user=None):
 async def _create_webauthn_credential(user, **kwargs):
     creator = getattr(_security.datastore, "create_webauthn_credential", None)
     if creator:
-        return await creator(user, **kwargs)
+        return await maybe_await(creator(user, **kwargs))
     raise RuntimeError("Datastore does not implement create_webauthn_credential")
 
 
 async def _delete_webauthn_credential(user, credential):
     deleter = getattr(_security.datastore, "delete_webauthn_credential", None)
     if deleter:
-        return await deleter(user, credential)
+        return await maybe_await(deleter(user, credential))
 
     user_credentials = getattr(user, "webauthn", None)
     if user_credentials is not None and credential in user_credentials:
@@ -253,11 +253,33 @@ async def login():
 
     if _is_post() and form.validate():
         user = await _find_user(email=_normalize_email(form.email.data))
+
+        # Account lockout check
+        if user and hasattr(user, "locked_until") and user.locked_until:
+            if datetime.datetime.now() < user.locked_until:
+                await flash("Account temporarily locked. Try again later.", "error")
+                return await render_template(
+                    "security/login_user.html", login_user_form=form
+                )
+            # Lock expired, reset
+            user.failed_login_count = 0
+            user.locked_until = None
+            await _commit()
+
         if (
             user
             and getattr(user, "active", True)
             and verify_password(form.password.data, user.password)
         ):
+            # Reset failed attempts on success
+            if (
+                hasattr(user, "failed_login_count")
+                and (user.failed_login_count or 0) > 0
+            ):
+                user.failed_login_count = 0
+                user.locked_until = None
+                await _commit()
+
             if current_app.config.get("SECURITY_TWO_FACTOR") and getattr(
                 user, "tf_primary_method", None
             ):
@@ -267,6 +289,17 @@ async def login():
             await _security.login_user(user)
             return redirect(_resolve_redirect("SECURITY_POST_LOGIN_VIEW", "login"))
 
+        # Track failed login
+        if user and hasattr(user, "failed_login_count"):
+            user.failed_login_count = (user.failed_login_count or 0) + 1
+            max_attempts = current_app.config.get("SECURITY_LOGIN_MAX_ATTEMPTS", 5)
+            lockout_minutes = current_app.config.get("SECURITY_LOCKOUT_MINUTES", 15)
+            if user.failed_login_count >= max_attempts:
+                user.locked_until = datetime.datetime.now() + datetime.timedelta(
+                    minutes=lockout_minutes
+                )
+            await _commit()
+
         await flash("Invalid email or password", "error")
 
     return await render_template("security/login_user.html", login_user_form=form)
@@ -309,7 +342,7 @@ async def register():
 
         user = await _create_user(**user_kwargs)
         if hasattr(user, "confirmed_at"):
-            user.confirmed_at = datetime.datetime.utcnow()
+            user.confirmed_at = naive_utcnow()
 
         await _commit()
         await user_registered.send_async(current_app._get_current_object(), user=user)
@@ -429,16 +462,12 @@ async def two_factor_setup():
                 current_user.tf_primary_method = "authenticator"
                 session.pop("tf_pending_secret", None)
 
-                if current_app.config.get(
-                    "SECURITY_MULTI_FACTOR_RECOVERY_CODES", True
-                ):
+                if current_app.config.get("SECURITY_MULTI_FACTOR_RECOVERY_CODES", True):
                     if not getattr(current_user, "mf_recovery_codes", None):
                         count = current_app.config.get(
                             "SECURITY_MULTI_FACTOR_RECOVERY_CODES_N", 3
                         )
-                        current_user.mf_recovery_codes = generate_recovery_codes(
-                            count
-                        )
+                        current_user.mf_recovery_codes = generate_recovery_codes(count)
 
                 await _commit()
                 await tf_profile_changed.send_async(
@@ -505,8 +534,10 @@ async def two_factor_token_validation():
         if token and getattr(user, "tf_totp_secret", None):
             valid = verify_totp(user.tf_totp_secret, token)
 
-        if not valid and token and current_app.config.get(
-            "SECURITY_MULTI_FACTOR_RECOVERY_CODES", True
+        if (
+            not valid
+            and token
+            and current_app.config.get("SECURITY_MULTI_FACTOR_RECOVERY_CODES", True)
         ):
             codes = list(getattr(user, "mf_recovery_codes", None) or [])
             ok, remaining = verify_recovery_code(token, codes)
@@ -553,7 +584,9 @@ async def mf_recovery_codes():
         codes = generate_recovery_codes(count)
         current_user.mf_recovery_codes = codes
         await _commit()
-        await tf_profile_changed.send_async(current_app._get_current_object(), user=current_user)
+        await tf_profile_changed.send_async(
+            current_app._get_current_object(), user=current_user
+        )
         await flash("Recovery codes regenerated.", "success")
     elif request.args.get("show_codes"):
         codes = list(getattr(current_user, "mf_recovery_codes", None) or [])
@@ -724,7 +757,7 @@ async def wan_register_response():
         usage=state.get("usage", "secondary"),
         backup_state=verification.get("backup_state", False),
         device_type=verification.get("device_type") or "single_device",
-        lastuse_datetime=datetime.datetime.utcnow(),
+        lastuse_datetime=naive_utcnow(),
     )
     await _commit()
 
@@ -848,7 +881,7 @@ async def wan_signin_response():
 
     stored_credential.sign_count = int(new_sign_count)
     if hasattr(stored_credential, "lastuse_datetime"):
-        stored_credential.lastuse_datetime = datetime.datetime.utcnow()
+        stored_credential.lastuse_datetime = naive_utcnow()
 
     session.permanent = bool(state.get("remember"))
     await _security.login_user(user)
@@ -930,7 +963,9 @@ async def wan_verify_response():
         await flash("Invalid passkey response payload.", "error")
         return redirect(url_for_security("wan_verify"))
 
-    stored_credential = await _find_webauthn_credential(credential_id, user=current_user)
+    stored_credential = await _find_webauthn_credential(
+        credential_id, user=current_user
+    )
     if stored_credential is None:
         await flash("Passkey not recognized.", "error")
         return redirect(url_for_security("wan_verify"))
@@ -952,7 +987,7 @@ async def wan_verify_response():
 
     stored_credential.sign_count = int(new_sign_count)
     if hasattr(stored_credential, "lastuse_datetime"):
-        stored_credential.lastuse_datetime = datetime.datetime.utcnow()
+        stored_credential.lastuse_datetime = naive_utcnow()
 
     session["_fresh"] = True
     await _commit()

quart_security-1.1.0/quart_security/utils.py

@@ -1,8 +0,0 @@
-"""Utility helpers."""
-
-from quart import url_for
-
-
-def url_for_security(endpoint, **kwargs):
-    """Flask-Security-compatible helper for endpoint URLs."""
-    return url_for(f"security.{endpoint}", **kwargs)