quart-security 1.1.1__tar.gz → 1.3.0__tar.gz

quart_security-1.3.0/.github/workflows/ci.yml

@@ -0,0 +1,34 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+
+      - name: Install dependencies
+        run: uv sync --group dev
+
+      - name: Run Ruff
+        run: uv run ruff check .
+
+      - name: Run tests
+        run: uv run pytest -q

quart_security-1.3.0/.github/workflows/publish.yml

@@ -0,0 +1,37 @@
+name: Publish
+
+on:
+  release:
+    types:
+      - published
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    if: github.repository == 'level09/quart-security'
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/quart-security
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v6
+
+      - name: Build distributions
+        run: uv build
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

quart_security-1.3.0/.gitignore

@@ -0,0 +1,8 @@
+__pycache__/
+*.pyc
+.pytest_cache/
+.ruff_cache/
+.uv-cache/
+.venv/
+dist/
+uv.lock

{quart_security-1.1.1 → quart_security-1.3.0}/PKG-INFO

@@ -1,11 +1,10 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.1
 Name: quart-security
-Version: 1.1.1
+Version: 1.3.0
 Summary: Native async auth for Quart
 Author: quart-security maintainers
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
-License-File: LICENSE
 Requires-Dist: quart>=0.20.0
 Requires-Dist: sqlalchemy>=2.0
 Requires-Dist: libpass>=1.9
@@ -55,6 +54,7 @@ It is designed as a practical replacement path for Flask-Security style session
 - Flask-Security-style endpoint naming through `url_for_security()`
 - Signals for auth lifecycle events
 - Overridable templates under `templates/security/`
+- Datastore hooks can be implemented as async methods or simple sync methods
 
 ## Non-Goals (Current Scope)
 
@@ -130,6 +130,10 @@ For tracking / MFA / WebAuthn features:
 - `fs_webauthn_user_handle`
 - relationship/association for stored WebAuthn credentials
 
+Optional for lockout support:
+- `failed_login_count`
+- `locked_until`
+
 ## Key Configuration
 
 The extension uses `SECURITY_*` keys for migration-friendly configuration.
@@ -138,6 +142,8 @@ Core:
 - `SECURITY_PASSWORD_HASH` (default: `pbkdf2_sha512`)
 - `SECURITY_PASSWORD_SALT` (recommended)
 - `SECURITY_PASSWORD_LENGTH_MIN` (default: `12`)
+- `SECURITY_LOGIN_MAX_ATTEMPTS` (default: `5`)
+- `SECURITY_LOCKOUT_MINUTES` (default: `15`)
 - `SECURITY_REGISTERABLE`
 - `SECURITY_CHANGEABLE`
 - `SECURITY_TRACKABLE`

{quart_security-1.1.1 → quart_security-1.3.0}/README.md

@@ -28,6 +28,7 @@ It is designed as a practical replacement path for Flask-Security style session
 - Flask-Security-style endpoint naming through `url_for_security()`
 - Signals for auth lifecycle events
 - Overridable templates under `templates/security/`
+- Datastore hooks can be implemented as async methods or simple sync methods
 
 ## Non-Goals (Current Scope)
 
@@ -103,6 +104,10 @@ For tracking / MFA / WebAuthn features:
 - `fs_webauthn_user_handle`
 - relationship/association for stored WebAuthn credentials
 
+Optional for lockout support:
+- `failed_login_count`
+- `locked_until`
+
 ## Key Configuration
 
 The extension uses `SECURITY_*` keys for migration-friendly configuration.
@@ -111,6 +116,8 @@ Core:
 - `SECURITY_PASSWORD_HASH` (default: `pbkdf2_sha512`)
 - `SECURITY_PASSWORD_SALT` (recommended)
 - `SECURITY_PASSWORD_LENGTH_MIN` (default: `12`)
+- `SECURITY_LOGIN_MAX_ATTEMPTS` (default: `5`)
+- `SECURITY_LOCKOUT_MINUTES` (default: `15`)
 - `SECURITY_REGISTERABLE`
 - `SECURITY_CHANGEABLE`
 - `SECURITY_TRACKABLE`

{quart_security-1.1.1 → quart_security-1.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "flit_core.buildapi"
 
 [project]
 name = "quart-security"
-version = "1.1.1"
+version = "1.3.0"
 description = "Native async auth for Quart"
 readme = "README.md"
 requires-python = ">=3.11"

{quart_security-1.1.1 → quart_security-1.3.0}/quart_security/core.py

@@ -2,7 +2,6 @@
 
 from __future__ import annotations
 
-import datetime
 import secrets
 from datetime import timedelta
 
@@ -12,7 +11,7 @@ from .forms import ChangePasswordForm, LoginForm, RegisterForm
 from .password import init_password_context
 from .proxies import AnonymousUser, current_user
 from .signals import user_authenticated, user_logged_out
-from .utils import url_for_security
+from .utils import maybe_await, naive_utcnow, url_for_security
 
 
 class _SecurityConfig:
@@ -131,6 +130,8 @@ class Security:
             "SECURITY_WAN_REQUIRE_USER_VERIFICATION": True,
             "SECURITY_FRESHNESS": timedelta(minutes=60),
             "SECURITY_FRESHNESS_GRACE_PERIOD": timedelta(minutes=60),
+            "SECURITY_LOGIN_MAX_ATTEMPTS": 5,
+            "SECURITY_LOCKOUT_MINUTES": 15,
             "SECURITY_POST_LOGIN_VIEW": "/",
             "SECURITY_POST_REGISTER_VIEW": "/login",
             "SECURITY_EMAIL_SENDER": "noreply@example.com",
@@ -148,7 +149,7 @@ class Security:
             g._current_user = AnonymousUser()
             return
 
-        user = await self.datastore.find_user(fs_uniquifier=user_id)
+        user = await maybe_await(self.datastore.find_user(fs_uniquifier=user_id))
         g._current_user = user or AnonymousUser()
 
     async def login_user(self, user, fresh=True):
@@ -168,11 +169,11 @@ class Security:
         if app.config.get("SECURITY_TRACKABLE", True):
             user.last_login_at = getattr(user, "current_login_at", None)
             user.last_login_ip = getattr(user, "current_login_ip", None)
-            user.current_login_at = datetime.datetime.utcnow()
+            user.current_login_at = naive_utcnow()
             user.current_login_ip = request.remote_addr
             user.login_count = (getattr(user, "login_count", None) or 0) + 1
 
-        await self.datastore.commit()
+        await maybe_await(self.datastore.commit())
         await user_authenticated.send_async(app, user=user, authn_via="session")
 
     async def logout_user(self, user=None):

{quart_security-1.1.1 → quart_security-1.3.0}/quart_security/forms.py

@@ -63,7 +63,10 @@ class RegisterForm(QuartForm):
     password = PasswordField("Password", validators=[DataRequired()])
     password_confirm = PasswordField(
         "Confirm Password",
-        validators=[DataRequired(), EqualTo("password", message="Passwords must match")],
+        validators=[
+            DataRequired(),
+            EqualTo("password", message="Passwords must match"),
+        ],
     )
 
 
@@ -95,7 +98,10 @@ class WebAuthnRegisterForm(QuartForm):
     name = StringField("Credential Name", validators=[DataRequired()])
     usage = RadioField(
         "Usage",
-        choices=[("secondary", "Multi-factor only"), ("primary", "Passwordless sign-in")],
+        choices=[
+            ("secondary", "Multi-factor only"),
+            ("primary", "Passwordless sign-in"),
+        ],
         default="secondary",
         validators=[DataRequired()],
     )

{quart_security-1.1.1 → quart_security-1.3.0}/quart_security/templates/security/login_user.html

@@ -8,4 +8,7 @@
   {{ render_input(login_user_form.password, 'password') }}
   <button type="submit">Sign in</button>
 </form>
+{% if security.webauthn and security.wan_allow_as_first_factor %}
+<p><a href="{{ url_for_security('wan_signin') }}">Sign in with passkey</a></p>
+{% endif %}
 <p><a href="{{ url_for_security('register') }}">Create account</a></p>

{quart_security-1.1.1 → quart_security-1.3.0}/quart_security/templates/security/wan_signin.html

@@ -4,13 +4,10 @@
 <h1>Sign In with Passkey</h1>
 
 {% if not credential_options %}
-<form method="post" action="{{ url_for_security('wan_signin') }}" id="wan-signin-form">
+<form method="post" action="{{ url_for_security('wan_signin') }}" id="wan-discoverable-form">
   {{ wan_signin_form.hidden_tag() }}
-  {{ render_input(wan_signin_form.identity) }}
-  <label style="display: block; margin-bottom: 0.75rem;">
-    {{ wan_signin_form.remember }} {{ wan_signin_form.remember.label.text }}
-  </label>
-  <button type="submit">Continue</button>
+  <input type="hidden" name="identity" value="">
+  <button type="submit">Sign in with passkey</button>
 </form>
 <p><a href="{{ url_for_security('login') }}">Back to password login</a></p>
 {% else %}

quart_security-1.3.0/quart_security/utils.py

@@ -0,0 +1,25 @@
+"""Utility helpers."""
+
+from __future__ import annotations
+
+import datetime
+import inspect
+
+from quart import url_for
+
+
+def url_for_security(endpoint, **kwargs):
+    """Flask-Security-compatible helper for endpoint URLs."""
+    return url_for(f"security.{endpoint}", **kwargs)
+
+
+async def maybe_await(value):
+    """Await values when needed while supporting sync extension hooks."""
+    if inspect.isawaitable(value):
+        return await value
+    return value
+
+
+def naive_utcnow() -> datetime.datetime:
+    """Return a naive UTC datetime while avoiding utcnow() deprecations."""
+    return datetime.datetime.now(datetime.UTC).replace(tzinfo=None)

{quart_security-1.1.1 → quart_security-1.3.0}/quart_security/views.py

@@ -32,7 +32,7 @@ from .forms import (
 from .password import hash_password, validate_password, verify_password
 from .proxies import _security, current_user
 from .signals import password_changed, tf_profile_changed, user_registered
-from .utils import url_for_security
+from .utils import maybe_await, naive_utcnow, url_for_security
 
 security_bp = Blueprint("security", __name__, template_folder="templates")
 
@@ -58,15 +58,15 @@ def _resolve_redirect(config_key: str, fallback_endpoint: str) -> str:
 
 
 async def _find_user(**kwargs):
-    return await _security.datastore.find_user(**kwargs)
+    return await maybe_await(_security.datastore.find_user(**kwargs))
 
 
 async def _create_user(**kwargs):
-    return await _security.datastore.create_user(**kwargs)
+    return await maybe_await(_security.datastore.create_user(**kwargs))
 
 
 async def _commit():
-    await _security.datastore.commit()
+    await maybe_await(_security.datastore.commit())
 
 
 async def _enforce_csrf(submitted_token: str | None = None):
@@ -125,7 +125,7 @@ def _webauthn_rp_name() -> str:
 def _set_wan_state(key: str, **payload):
     session[key] = {
         "payload": payload,
-        "issued_at": int(datetime.datetime.utcnow().timestamp()),
+        "issued_at": int(naive_utcnow().timestamp()),
     }
 
 
@@ -137,7 +137,7 @@ def _pop_wan_state(key: str, max_age_seconds: int = 300) -> dict | None:
     payload = state.get("payload")
     if not isinstance(issued_at, int) or not isinstance(payload, dict):
         return None
-    age = int(datetime.datetime.utcnow().timestamp()) - issued_at
+    age = int(naive_utcnow().timestamp()) - issued_at
     if age < 0 or age > max_age_seconds:
         return None
     return payload
@@ -146,7 +146,7 @@ def _pop_wan_state(key: str, max_age_seconds: int = 300) -> dict | None:
 async def _list_webauthn_credentials(user, usage: str | None = None):
     getter = getattr(_security.datastore, "get_webauthn_credentials", None)
     if getter:
-        return await getter(user, usage=usage)
+        return await maybe_await(getter(user, usage=usage))
     credentials = list(getattr(user, "webauthn", None) or [])
     if usage:
         credentials = [
@@ -160,7 +160,7 @@ async def _list_webauthn_credentials(user, usage: str | None = None):
 async def _find_webauthn_credential(credential_id: bytes, user=None):
     finder = getattr(_security.datastore, "find_webauthn_credential", None)
     if finder:
-        return await finder(credential_id, user=user)
+        return await maybe_await(finder(credential_id, user=user))
 
     candidates = list(getattr(user, "webauthn", None) or []) if user else []
     for credential in candidates:
@@ -172,14 +172,14 @@ async def _find_webauthn_credential(credential_id: bytes, user=None):
 async def _create_webauthn_credential(user, **kwargs):
     creator = getattr(_security.datastore, "create_webauthn_credential", None)
     if creator:
-        return await creator(user, **kwargs)
+        return await maybe_await(creator(user, **kwargs))
     raise RuntimeError("Datastore does not implement create_webauthn_credential")
 
 
 async def _delete_webauthn_credential(user, credential):
     deleter = getattr(_security.datastore, "delete_webauthn_credential", None)
     if deleter:
-        return await deleter(user, credential)
+        return await maybe_await(deleter(user, credential))
 
     user_credentials = getattr(user, "webauthn", None)
     if user_credentials is not None and credential in user_credentials:
@@ -200,6 +200,21 @@ def _extract_webauthn_credential_id(credential_payload: dict | None) -> bytes |
         return None
 
 
+def _extract_webauthn_user_handle(credential_payload: dict | None) -> str | None:
+    if not isinstance(credential_payload, dict):
+        return None
+    response = credential_payload.get("response")
+    if not isinstance(response, dict):
+        return None
+    user_handle = response.get("userHandle")
+    if not isinstance(user_handle, str) or not user_handle:
+        return None
+    try:
+        return wan.base64url_to_bytes(user_handle).decode("utf-8")
+    except Exception:
+        return None
+
+
 async def _extract_webauthn_credential_payload():
     payload = await request.get_json(silent=True)
     if isinstance(payload, dict):
@@ -253,11 +268,33 @@ async def login():
 
     if _is_post() and form.validate():
         user = await _find_user(email=_normalize_email(form.email.data))
+
+        # Account lockout check
+        if user and hasattr(user, "locked_until") and user.locked_until:
+            if datetime.datetime.now() < user.locked_until:
+                await flash("Account temporarily locked. Try again later.", "error")
+                return await render_template(
+                    "security/login_user.html", login_user_form=form
+                )
+            # Lock expired, reset
+            user.failed_login_count = 0
+            user.locked_until = None
+            await _commit()
+
         if (
             user
             and getattr(user, "active", True)
             and verify_password(form.password.data, user.password)
         ):
+            # Reset failed attempts on success
+            if (
+                hasattr(user, "failed_login_count")
+                and (user.failed_login_count or 0) > 0
+            ):
+                user.failed_login_count = 0
+                user.locked_until = None
+                await _commit()
+
             if current_app.config.get("SECURITY_TWO_FACTOR") and getattr(
                 user, "tf_primary_method", None
             ):
@@ -267,6 +304,17 @@ async def login():
             await _security.login_user(user)
             return redirect(_resolve_redirect("SECURITY_POST_LOGIN_VIEW", "login"))
 
+        # Track failed login
+        if user and hasattr(user, "failed_login_count"):
+            user.failed_login_count = (user.failed_login_count or 0) + 1
+            max_attempts = current_app.config.get("SECURITY_LOGIN_MAX_ATTEMPTS", 5)
+            lockout_minutes = current_app.config.get("SECURITY_LOCKOUT_MINUTES", 15)
+            if user.failed_login_count >= max_attempts:
+                user.locked_until = datetime.datetime.now() + datetime.timedelta(
+                    minutes=lockout_minutes
+                )
+            await _commit()
+
         await flash("Invalid email or password", "error")
 
     return await render_template("security/login_user.html", login_user_form=form)
@@ -309,7 +357,7 @@ async def register():
 
         user = await _create_user(**user_kwargs)
         if hasattr(user, "confirmed_at"):
-            user.confirmed_at = datetime.datetime.utcnow()
+            user.confirmed_at = naive_utcnow()
 
         await _commit()
         await user_registered.send_async(current_app._get_current_object(), user=user)
@@ -429,16 +477,12 @@ async def two_factor_setup():
                 current_user.tf_primary_method = "authenticator"
                 session.pop("tf_pending_secret", None)
 
-                if current_app.config.get(
-                    "SECURITY_MULTI_FACTOR_RECOVERY_CODES", True
-                ):
+                if current_app.config.get("SECURITY_MULTI_FACTOR_RECOVERY_CODES", True):
                     if not getattr(current_user, "mf_recovery_codes", None):
                         count = current_app.config.get(
                             "SECURITY_MULTI_FACTOR_RECOVERY_CODES_N", 3
                         )
-                        current_user.mf_recovery_codes = generate_recovery_codes(
-                            count
-                        )
+                        current_user.mf_recovery_codes = generate_recovery_codes(count)
 
                 await _commit()
                 await tf_profile_changed.send_async(
@@ -505,8 +549,10 @@ async def two_factor_token_validation():
         if token and getattr(user, "tf_totp_secret", None):
             valid = verify_totp(user.tf_totp_secret, token)
 
-        if not valid and token and current_app.config.get(
-            "SECURITY_MULTI_FACTOR_RECOVERY_CODES", True
+        if (
+            not valid
+            and token
+            and current_app.config.get("SECURITY_MULTI_FACTOR_RECOVERY_CODES", True)
         ):
             codes = list(getattr(user, "mf_recovery_codes", None) or [])
             ok, remaining = verify_recovery_code(token, codes)
@@ -553,7 +599,9 @@ async def mf_recovery_codes():
         codes = generate_recovery_codes(count)
         current_user.mf_recovery_codes = codes
         await _commit()
-        await tf_profile_changed.send_async(current_app._get_current_object(), user=current_user)
+        await tf_profile_changed.send_async(
+            current_app._get_current_object(), user=current_user
+        )
         await flash("Recovery codes regenerated.", "success")
     elif request.args.get("show_codes"):
         codes = list(getattr(current_user, "mf_recovery_codes", None) or [])
@@ -656,6 +704,7 @@ async def wan_register():
             rp_name=_webauthn_rp_name(),
             challenge=challenge,
             existing_credentials=registered_credentials,
+            discoverable=(requested_usage == "primary"),
         )
         credential_options = wan.options_to_json_dict(options)
 
@@ -724,7 +773,7 @@ async def wan_register_response():
         usage=state.get("usage", "secondary"),
         backup_state=verification.get("backup_state", False),
         device_type=verification.get("device_type") or "single_device",
-        lastuse_datetime=datetime.datetime.utcnow(),
+        lastuse_datetime=naive_utcnow(),
     )
     await _commit()
 
@@ -743,46 +792,13 @@ async def wan_signin():
     response_form = await QuartForm.from_formdata()
 
     credential_options = None
+
     if _is_post():
         await _enforce_csrf(getattr(form, "_submitted_csrf", None))
-        identity = _normalize_email(form.identity.data)
-        if not identity:
-            await flash("Email is required.", "error")
-            return await render_template(
-                "security/wan_signin.html",
-                wan_signin_form=form,
-                wan_signin_response_form=response_form,
-                credential_options=None,
-            )
-
-        user = await _find_user(email=identity)
-        if user is None or not getattr(user, "active", True):
-            await flash("Unable to authenticate with passkey.", "error")
-            return await render_template(
-                "security/wan_signin.html",
-                wan_signin_form=form,
-                wan_signin_response_form=response_form,
-                credential_options=None,
-            )
-
-        credentials = await _list_webauthn_credentials(user)
-        credentials = [
-            credential
-            for credential in credentials
-            if getattr(credential, "usage", "secondary") in {"primary", "first"}
-        ]
-        if not credentials:
-            await flash("No passkey is configured for passwordless sign-in.", "error")
-            return await render_template(
-                "security/wan_signin.html",
-                wan_signin_form=form,
-                wan_signin_response_form=response_form,
-                credential_options=None,
-            )
 
         challenge = secrets.token_bytes(32)
         options = await wan.begin_authentication(
-            credentials,
+            [],
             rp_id=_webauthn_rp_id(),
             challenge=challenge,
         )
@@ -790,7 +806,6 @@ async def wan_signin():
         _set_wan_state(
             "wan_signin_state",
             challenge=wan.bytes_to_base64url(challenge),
-            user_id=user.get_id(),
             remember=bool(form.remember.data),
         )
 
@@ -815,18 +830,29 @@ async def wan_signin_response():
         await flash("Passkey sign-in expired. Please try again.", "error")
         return redirect(url_for_security("wan_signin"))
 
-    user = await _find_user(fs_uniquifier=state.get("user_id"))
-    if user is None:
-        await flash("Unable to find user for passkey sign-in.", "error")
-        return redirect(url_for_security("wan_signin"))
-
     credential_payload = await _extract_webauthn_credential_payload()
     credential_id = _extract_webauthn_credential_id(credential_payload)
     if not credential_payload or credential_id is None:
         await flash("Invalid passkey response payload.", "error")
         return redirect(url_for_security("wan_signin"))
 
-    stored_credential = await _find_webauthn_credential(credential_id, user=user)
+    stored_credential = await _find_webauthn_credential(credential_id, user=None)
+    if stored_credential is None:
+        await flash("Passkey not recognized.", "error")
+        return redirect(url_for_security("wan_signin"))
+
+    credential_user_id = getattr(stored_credential, "user_id", None)
+    user_handle = _extract_webauthn_user_handle(credential_payload)
+    lookup_handle = credential_user_id or user_handle
+    if not lookup_handle:
+        await flash("Unable to identify user from passkey.", "error")
+        return redirect(url_for_security("wan_signin"))
+
+    user = await _find_user(fs_webauthn_user_handle=lookup_handle)
+    if user is None or not getattr(user, "active", True):
+        await flash("Unable to find user for passkey sign-in.", "error")
+        return redirect(url_for_security("wan_signin"))
+
     if stored_credential is None:
         await flash("Passkey not recognized.", "error")
         return redirect(url_for_security("wan_signin"))
@@ -848,7 +874,7 @@ async def wan_signin_response():
 
     stored_credential.sign_count = int(new_sign_count)
     if hasattr(stored_credential, "lastuse_datetime"):
-        stored_credential.lastuse_datetime = datetime.datetime.utcnow()
+        stored_credential.lastuse_datetime = naive_utcnow()
 
     session.permanent = bool(state.get("remember"))
     await _security.login_user(user)
@@ -930,7 +956,9 @@ async def wan_verify_response():
         await flash("Invalid passkey response payload.", "error")
         return redirect(url_for_security("wan_verify"))
 
-    stored_credential = await _find_webauthn_credential(credential_id, user=current_user)
+    stored_credential = await _find_webauthn_credential(
+        credential_id, user=current_user
+    )
     if stored_credential is None:
         await flash("Passkey not recognized.", "error")
         return redirect(url_for_security("wan_verify"))
@@ -952,7 +980,7 @@ async def wan_verify_response():
 
     stored_credential.sign_count = int(new_sign_count)
     if hasattr(stored_credential, "lastuse_datetime"):
-        stored_credential.lastuse_datetime = datetime.datetime.utcnow()
+        stored_credential.lastuse_datetime = naive_utcnow()
 
     session["_fresh"] = True
     await _commit()