square-authentication 7.0.0__py3-none-any.whl → 8.0.0__py3-none-any.whl

square_authentication/routes/core.py

@@ -1,4 +1,6 @@
 import copy
+import io
+import mimetypes
 import random
 import re
 import uuid
@@ -10,8 +12,11 @@ import jwt
 from fastapi import APIRouter, Header, HTTPException, status
 from fastapi.params import Query
 from fastapi.responses import JSONResponse
+from google.auth.transport import requests as google_requests
+from google.oauth2 import id_token
 from requests import HTTPError
 from square_commons import get_api_output_in_standard_format, send_email_using_mailgun
+from square_commons.api_utils import make_request
 from square_database_helper.pydantic_models import FilterConditionsV0, FiltersV0
 from square_database_structure.square import global_string_database_name
 from square_database_structure.square.authentication import global_string_schema_name
@@ -48,6 +53,11 @@ from square_authentication.configuration import (
     global_object_square_logger,
     global_object_square_database_helper,
     MAIL_GUN_API_KEY,
+    GOOGLE_AUTH_PLATFORM_CLIENT_ID,
+    NUMBER_OF_RECOVERY_CODES,
+    NUMBER_OF_DIGITS_IN_EMAIL_PASSWORD_RESET_CODE,
+    EXPIRY_TIME_FOR_EMAIL_PASSWORD_RESET_CODE_IN_SECONDS,
+    global_object_square_file_store_helper,
 )
 from square_authentication.messages import messages
 from square_authentication.pydantic_models.core import (
@@ -59,7 +69,10 @@ from square_authentication.pydantic_models.core import (
     UpdatePasswordV0,
     ResetPasswordAndLoginUsingBackupCodeV0,
     SendResetPasswordEmailV0,
+    ResetPasswordAndLoginUsingResetEmailCodeV0,
+    RegisterLoginGoogleV0,
 )
+from square_authentication.utils.core import generate_default_username_for_google_users
 from square_authentication.utils.token import get_jwt_payload
 
 router = APIRouter(
@@ -135,7 +148,7 @@ async def register_username_v0(
         local_str_user_id = local_list_response_user[0][User.user_id.name]
 
         # entry in user auth provider table
-        local_list_response_user_auth_provider = global_object_square_database_helper.insert_rows_v0(
+        global_object_square_database_helper.insert_rows_v0(
             data=[
                 {
                     UserAuthProvider.user_id.name: local_str_user_id,
@@ -145,12 +158,7 @@ async def register_username_v0(
             database_name=global_string_database_name,
             schema_name=global_string_schema_name,
             table_name=UserAuthProvider.__tablename__,
-        )[
-            "data"
-        ][
-            "main"
-        ]
-        local_str_user_id = local_list_response_user[0][User.user_id.name]
+        )
 
         # entry in user profile table
         global_object_square_database_helper.insert_rows_v0(
@@ -287,6 +295,355 @@ async def register_username_v0(
         )
 
 
+@router.post("/register_login_google/v0")
+async def register_login_google_v0(body: RegisterLoginGoogleV0):
+    app_id = body.app_id
+    google_id = body.google_id
+    assign_app_id_if_missing = body.assign_app_id_if_missing
+    was_new_user = False
+    try:
+        """
+        validation
+        """
+        # verify id token
+        id_info = id_token.verify_oauth2_token(
+            google_id,
+            google_requests.Request(),
+            GOOGLE_AUTH_PLATFORM_CLIENT_ID,
+        )
+        # validate if email is verified
+        if id_info.get("email_verified") is not True:
+            output_content = get_api_output_in_standard_format(
+                message=messages["EMAIL_NOT_VERIFIED"],
+                log="Google account email is not verified.",
+            )
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail=output_content,
+            )
+        """
+        processing
+        """
+        google_sub = id_info["sub"]
+        email = id_info.get("email")
+        given_name = id_info.get("given_name")
+        family_name = id_info.get("family_name")
+
+        profile_picture = id_info.get("picture")
+
+        # check if user exists
+        user_rows = global_object_square_database_helper.get_rows_v0(
+            database_name=global_string_database_name,
+            schema_name=global_string_schema_name,
+            table_name=UserAuthProvider.__tablename__,
+            filters=FiltersV0(
+                root={
+                    UserAuthProvider.auth_provider_user_id.name: FilterConditionsV0(
+                        eq=google_sub
+                    ),
+                    UserAuthProvider.auth_provider.name: FilterConditionsV0(
+                        eq=AuthProviderEnum.GOOGLE.value
+                    ),
+                }
+            ),
+        )["data"]["main"]
+
+        if user_rows:
+            # login
+
+            # validate if app_id is assigned to user
+            # this will also validate if app_id is valid
+            local_str_user_id = user_rows[0][User.user_id.name]
+            user_record = global_object_square_database_helper.get_rows_v0(
+                database_name=global_string_database_name,
+                schema_name=global_string_schema_name,
+                table_name=User.__tablename__,
+                filters=FiltersV0(
+                    root={User.user_id.name: FilterConditionsV0(eq=local_str_user_id)}
+                ),
+            )["data"]["main"][0]
+            username = user_record[User.user_username.name]
+            local_list_user_app_response = (
+                global_object_square_database_helper.get_rows_v0(
+                    database_name=global_string_database_name,
+                    schema_name=global_string_schema_name,
+                    table_name=UserApp.__tablename__,
+                    filters=FiltersV0(
+                        root={
+                            UserApp.user_id.name: FilterConditionsV0(
+                                eq=local_str_user_id
+                            ),
+                            UserApp.app_id.name: FilterConditionsV0(eq=app_id),
+                        }
+                    ),
+                )["data"]["main"]
+            )
+            if len(local_list_user_app_response) == 0:
+                if assign_app_id_if_missing:
+                    global_object_square_database_helper.insert_rows_v0(
+                        database_name=global_string_database_name,
+                        schema_name=global_string_schema_name,
+                        table_name=UserApp.__tablename__,
+                        data=[
+                            {
+                                UserApp.user_id.name: local_str_user_id,
+                                UserApp.app_id.name: app_id,
+                            }
+                        ],
+                    )
+                else:
+                    output_content = get_api_output_in_standard_format(
+                        message=messages["GENERIC_400"],
+                        log=f"user_id {local_str_user_id}({username}) not assigned to app {app_id}.",
+                    )
+                    raise HTTPException(
+                        status_code=status.HTTP_400_BAD_REQUEST,
+                        detail=output_content,
+                    )
+        else:
+            # register
+
+            was_new_user = True
+            # check if account with same email address exists
+            profile_rows = global_object_square_database_helper.get_rows_v0(
+                database_name=global_string_database_name,
+                schema_name=global_string_schema_name,
+                table_name=UserProfile.__tablename__,
+                filters=FiltersV0(
+                    root={
+                        UserProfile.user_profile_email.name: FilterConditionsV0(
+                            eq=email
+                        )
+                    }
+                ),
+            )["data"]["main"]
+            if len(profile_rows) > 0:
+                output_content = get_api_output_in_standard_format(
+                    message=messages["ACCOUNT_WITH_EMAIL_ALREADY_EXISTS"],
+                    log=f"An account with the email {email} already exists.",
+                )
+                raise HTTPException(
+                    status_code=status.HTTP_409_CONFLICT,
+                    detail=output_content,
+                )
+            # generate a default username
+            username = generate_default_username_for_google_users(
+                family_name=family_name, given_name=given_name
+            )
+            # create user
+            user_rows = global_object_square_database_helper.insert_rows_v0(
+                database_name=global_string_database_name,
+                schema_name=global_string_schema_name,
+                table_name=User.__tablename__,
+                data=[
+                    {
+                        User.user_username.name: username,
+                    }
+                ],
+            )["data"]["main"]
+            local_str_user_id = user_rows[0][User.user_id.name]
+
+            # link to user_auth_provider
+            global_object_square_database_helper.insert_rows_v0(
+                database_name=global_string_database_name,
+                schema_name=global_string_schema_name,
+                table_name=UserAuthProvider.__tablename__,
+                data=[
+                    {
+                        UserAuthProvider.user_id.name: local_str_user_id,
+                        UserAuthProvider.auth_provider.name: AuthProviderEnum.GOOGLE.value,
+                        UserAuthProvider.auth_provider_user_id.name: google_sub,
+                    }
+                ],
+            )
+            # getting profile picture
+            if profile_picture:
+                try:
+                    profile_picture_response = make_request(
+                        "GET", profile_picture, return_type="response"
+                    )
+
+                    # finding content type and filename
+                    headers = profile_picture_response.headers
+                    content_type = headers.get(
+                        "Content-Type", "application/octet-stream"
+                    )
+                    content_disposition = headers.get("Content-Disposition", "")
+
+                    if content_disposition:
+                        match = re.search(r'filename="([^"]+)"', content_disposition)
+                        if match:
+                            filename = match.group(1)
+                        else:
+                            filename = None
+                    else:
+                        filename = None
+                    if filename is None:
+                        global_object_square_logger.logger.warning(
+                            f"user_id {local_str_user_id}'s profile picture from Google missing filename; guessing extension from Content-Type: {content_type}."
+                        )
+                        ext = (
+                            mimetypes.guess_extension(
+                                content_type.split(";")[0].strip()
+                            )
+                            or ""
+                        )
+                        filename = f"profile_photo{ext}"
+                        if not ext:
+                            filename += ".bin"
+
+                    # upload bytes to square_file_storage
+                    file_upload_response = global_object_square_file_store_helper.upload_file_using_tuple_v0(
+                        file=(
+                            filename,
+                            io.BytesIO(profile_picture_response.content),
+                            content_type,
+                        ),
+                        system_relative_path="global/users/profile_photos",
+                    )
+                    user_profile_photo_storage_token = file_upload_response["data"][
+                        "main"
+                    ]
+                except HTTPError:
+                    global_object_square_logger.logger.error(
+                        f"Failed to fetch profile picture for user_id {local_str_user_id} from google account.",
+                        exc_info=True,
+                    )
+                    user_profile_photo_storage_token = None
+                except Exception as e:
+                    global_object_square_logger.logger.error(
+                        f"Error while fetching profile picture for user_id {local_str_user_id} from google account: {str(e)}",
+                        exc_info=True,
+                    )
+                    user_profile_photo_storage_token = None
+            else:
+                global_object_square_logger.logger.warning(
+                    f"user_id {local_str_user_id} has no profile picture in google account."
+                )
+                user_profile_photo_storage_token = None
+            # create user profile
+            global_object_square_database_helper.insert_rows_v0(
+                database_name=global_string_database_name,
+                schema_name=global_string_schema_name,
+                table_name=UserProfile.__tablename__,
+                data=[
+                    {
+                        UserProfile.user_id.name: local_str_user_id,
+                        UserProfile.user_profile_email.name: email,
+                        UserProfile.user_profile_email_verified.name: datetime.now(
+                            timezone.utc
+                        ).strftime("%Y-%m-%d %H:%M:%S.%f+00"),
+                        UserProfile.user_profile_first_name.name: given_name,
+                        UserProfile.user_profile_last_name.name: family_name,
+                        UserProfile.user_profile_photo_storage_token.name: user_profile_photo_storage_token,
+                    }
+                ],
+            )
+
+            # assign app if provided
+            if app_id is not None:
+                global_object_square_database_helper.insert_rows_v0(
+                    database_name=global_string_database_name,
+                    schema_name=global_string_schema_name,
+                    table_name=UserApp.__tablename__,
+                    data=[
+                        {
+                            UserApp.user_id.name: local_str_user_id,
+                            UserApp.app_id.name: app_id,
+                        }
+                    ],
+                )
+
+        # generate tokens
+        now = datetime.now(timezone.utc)
+        access_token_payload = {
+            "app_id": app_id,
+            "user_id": local_str_user_id,
+            "exp": now + timedelta(minutes=config_int_access_token_valid_minutes),
+        }
+        access_token_str = jwt.encode(
+            access_token_payload,
+            config_str_secret_key_for_access_token,
+        )
+
+        refresh_token_expiry = now + timedelta(
+            minutes=config_int_refresh_token_valid_minutes
+        )
+        refresh_token_payload = {
+            "app_id": app_id,
+            "user_id": local_str_user_id,
+            "exp": refresh_token_expiry,
+        }
+        refresh_token_str = jwt.encode(
+            refresh_token_payload,
+            config_str_secret_key_for_refresh_token,
+        )
+
+        # store refresh token
+        global_object_square_database_helper.insert_rows_v0(
+            database_name=global_string_database_name,
+            schema_name=global_string_schema_name,
+            table_name=UserSession.__tablename__,
+            data=[
+                {
+                    UserSession.user_id.name: local_str_user_id,
+                    UserSession.app_id.name: app_id,
+                    UserSession.user_session_refresh_token.name: refresh_token_str,
+                    UserSession.user_session_expiry_time.name: refresh_token_expiry.strftime(
+                        "%Y-%m-%d %H:%M:%S.%f+00"
+                    ),
+                }
+            ],
+        )
+        """
+        return value
+        """
+        if was_new_user:
+            message = messages["REGISTRATION_SUCCESSFUL"]
+        else:
+            message = messages["LOGIN_SUCCESSFUL"]
+        output_content = get_api_output_in_standard_format(
+            message=message,
+            data={
+                "main": {
+                    "user_id": local_str_user_id,
+                    "username": username,
+                    "app_id": app_id,
+                    "access_token": access_token_str,
+                    "refresh_token": refresh_token_str,
+                    "refresh_token_expiry_time": refresh_token_expiry.isoformat(),
+                    "was_new_user": was_new_user,
+                },
+            },
+        )
+
+        return JSONResponse(status_code=status.HTTP_200_OK, content=output_content)
+    except HTTPError as http_error:
+        global_object_square_logger.logger.error(http_error, exc_info=True)
+        return JSONResponse(
+            status_code=http_error.response.status_code,
+            content=http_error.response.text,
+        )
+    except HTTPException as http_exception:
+        global_object_square_logger.logger.error(http_exception, exc_info=True)
+        return JSONResponse(
+            status_code=http_exception.status_code, content=http_exception.detail
+        )
+    except Exception as e:
+        """
+        rollback logic
+        """
+        global_object_square_logger.logger.error(e, exc_info=True)
+        output_content = get_api_output_in_standard_format(
+            message=messages["GENERIC_500"],
+            log=str(e),
+        )
+        return JSONResponse(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            content=output_content,
+        )
+
+
 @router.get("/get_user_details/v0")
 @global_object_square_logger.auto_logger()
 async def get_user_details_v0(
@@ -649,8 +1006,8 @@ async def login_username_v0(body: LoginUsernameV0):
         )
         if len(local_list_authentication_user_response) != 1:
             output_content = get_api_output_in_standard_format(
-                message=messages["INCORRECT_USERNAME"],
-                log=f"incorrect username {username}",
+                message=messages["MALFORMED_USER"],
+                log=f"username: {username} does not have credentials set.",
             )
             raise HTTPException(
                 status_code=status.HTTP_400_BAD_REQUEST,
@@ -1340,6 +1697,17 @@ async def delete_user_v0(
         """
         main process
         """
+        # fetch user profile photo storage token
+        user_profile_storage_token = global_object_square_database_helper.get_rows_v0(
+            database_name=global_string_database_name,
+            schema_name=global_string_schema_name,
+            table_name=UserProfile.__tablename__,
+            filters=FiltersV0(
+                root={UserProfile.user_id.name: FilterConditionsV0(eq=user_id)}
+            ),
+            columns=[UserProfile.user_profile_photo_storage_token.name],
+        )["data"]["main"][0][UserProfile.user_profile_photo_storage_token.name]
+
         # delete the user.
         global_object_square_database_helper.delete_rows_v0(
             database_name=global_string_database_name,
@@ -1351,6 +1719,18 @@ async def delete_user_v0(
                 }
             ),
         )
+        # delete profile photo if exists
+        if user_profile_storage_token:
+            try:
+                global_object_square_file_store_helper.delete_file_v0(
+                    list_file_storage_token=[user_profile_storage_token]
+                )
+            except HTTPError as he:
+                global_object_square_logger.warning(
+                    f"Failed to delete user profile photo with storage token {user_profile_storage_token}. "
+                    f"Error: {he.response.text}",
+                    exc_info=True,
+                )
         """
         return value
         """
@@ -1386,6 +1766,8 @@ async def update_password_v0(
 ):
     old_password = body.old_password
     new_password = body.new_password
+    logout_other_sessions = body.logout_other_sessions
+    preserve_session_refresh_token = body.preserve_session_refresh_token
     try:
         """
         validation
@@ -1425,7 +1807,47 @@ async def update_password_v0(
                 status_code=status.HTTP_400_BAD_REQUEST,
                 detail=output_content,
             )
-
+        # check if user has SELF auth provider
+        local_list_response_user_auth_provider = (
+            global_object_square_database_helper.get_rows_v0(
+                database_name=global_string_database_name,
+                schema_name=global_string_schema_name,
+                table_name=UserAuthProvider.__tablename__,
+                filters=FiltersV0(
+                    root={
+                        UserAuthProvider.user_id.name: FilterConditionsV0(eq=user_id),
+                        UserAuthProvider.auth_provider.name: FilterConditionsV0(
+                            eq=AuthProviderEnum.SELF.value
+                        ),
+                    }
+                ),
+            )["data"]["main"]
+        )
+        if len(local_list_response_user_auth_provider) != 1:
+            output_content = get_api_output_in_standard_format(
+                message=messages["INCORRECT_AUTH_PROVIDER"],
+                log=f"user_id: {user_id} does not have {AuthProviderEnum.SELF.value} auth provider.",
+            )
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail=output_content,
+            )
+        # check if user has credentials (might not be set in case of errors in registration.)
+        local_list_response_user = global_object_square_database_helper.get_rows_v0(
+            database_name=global_string_database_name,
+            schema_name=global_string_schema_name,
+            table_name=User.__tablename__,
+            filters=FiltersV0(root={User.user_id.name: FilterConditionsV0(eq=user_id)}),
+        )["data"]["main"]
+        if len(local_list_response_user) != 1:
+            output_content = get_api_output_in_standard_format(
+                message=messages["MALFORMED_USER"],
+                log=f"user_id: {user_id} does not have credentials.",
+            )
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail=output_content,
+            )
         # validate password
         local_dict_user = local_list_authentication_user_response[0]
         if not (
@@ -1444,18 +1866,49 @@ async def update_password_v0(
                 status_code=status.HTTP_400_BAD_REQUEST,
                 detail=output_content,
             )
-        """
-        main process
-        """
-        # update the password
-        local_str_hashed_password = bcrypt.hashpw(
-            new_password.encode("utf-8"), bcrypt.gensalt()
-        ).decode("utf-8")
-        global_object_square_database_helper.edit_rows_v0(
-            database_name=global_string_database_name,
-            schema_name=global_string_schema_name,
-            table_name=UserCredential.__tablename__,
-            filters=FiltersV0(
+        # check if provided refresh token is valid
+        if preserve_session_refresh_token:
+            local_dict_token_payload = get_jwt_payload(
+                preserve_session_refresh_token, config_str_secret_key_for_refresh_token
+            )
+            local_list_response_user_session = global_object_square_database_helper.get_rows_v0(
+                database_name=global_string_database_name,
+                schema_name=global_string_schema_name,
+                table_name=UserSession.__tablename__,
+                filters=FiltersV0(
+                    root={
+                        UserSession.user_id.name: FilterConditionsV0(eq=user_id),
+                        UserSession.user_session_refresh_token.name: FilterConditionsV0(
+                            eq=preserve_session_refresh_token
+                        ),
+                    }
+                ),
+            )[
+                "data"
+            ][
+                "main"
+            ]
+            if len(local_list_response_user_session) != 1:
+                output_content = get_api_output_in_standard_format(
+                    message=messages["INCORRECT_REFRESH_TOKEN"],
+                    log=f"incorrect refresh token: {preserve_session_refresh_token}.",
+                )
+                raise HTTPException(
+                    status_code=status.HTTP_400_BAD_REQUEST,
+                    detail=output_content,
+                )
+        """
+        main process
+        """
+        # update the password
+        local_str_hashed_password = bcrypt.hashpw(
+            new_password.encode("utf-8"), bcrypt.gensalt()
+        ).decode("utf-8")
+        global_object_square_database_helper.edit_rows_v0(
+            database_name=global_string_database_name,
+            schema_name=global_string_schema_name,
+            table_name=UserCredential.__tablename__,
+            filters=FiltersV0(
                 root={
                     UserCredential.user_id.name: FilterConditionsV0(eq=user_id),
                 }
@@ -1464,6 +1917,34 @@ async def update_password_v0(
                 UserCredential.user_credential_hashed_password.name: local_str_hashed_password,
             },
         )
+        if logout_other_sessions:
+            if preserve_session_refresh_token:
+                # delete all sessions for user except the one with the given refresh token
+                global_object_square_database_helper.delete_rows_v0(
+                    database_name=global_string_database_name,
+                    schema_name=global_string_schema_name,
+                    table_name=UserSession.__tablename__,
+                    filters=FiltersV0(
+                        root={
+                            UserSession.user_id.name: FilterConditionsV0(eq=user_id),
+                            UserSession.user_session_refresh_token.name: FilterConditionsV0(
+                                ne=preserve_session_refresh_token
+                            ),
+                        }
+                    ),
+                )
+            else:
+                # delete all sessions for user
+                global_object_square_database_helper.delete_rows_v0(
+                    database_name=global_string_database_name,
+                    schema_name=global_string_schema_name,
+                    table_name=UserSession.__tablename__,
+                    filters=FiltersV0(
+                        root={
+                            UserSession.user_id.name: FilterConditionsV0(eq=user_id),
+                        }
+                    ),
+                )
         """
         return value
         """
@@ -1710,6 +2191,28 @@ async def update_user_recovery_methods_v0(
             )
 
         # logic for removing recovery_methods
+        remove_old_backup_codes = (
+            RecoveryMethodEnum.BACKUP_CODE.value in recovery_methods_to_remove
+        )
+        old_backup_code_hashes = None
+        if remove_old_backup_codes:
+            # delete existing backup codes if any
+            old_backup_code_hashes = global_object_square_database_helper.get_rows_v0(
+                database_name=global_string_database_name,
+                schema_name=global_string_schema_name,
+                table_name=UserVerificationCode.__tablename__,
+                filters=FiltersV0(
+                    root={
+                        UserVerificationCode.user_id.name: FilterConditionsV0(
+                            eq=user_id
+                        ),
+                        UserVerificationCode.user_verification_code_type.name: FilterConditionsV0(
+                            eq=VerificationCodeTypeEnum.BACKUP_CODE_RECOVERY.value
+                        ),
+                    }
+                ),
+                columns=[UserVerificationCode.user_verification_code_hash.name],
+            )["data"]["main"]
         global_object_square_database_helper.delete_rows_v0(
             database_name=global_string_database_name,
             schema_name=global_string_schema_name,
@@ -1723,6 +2226,22 @@ async def update_user_recovery_methods_v0(
                 }
             ),
         )
+        if remove_old_backup_codes and old_backup_code_hashes:
+            global_object_square_database_helper.delete_rows_v0(
+                database_name=global_string_database_name,
+                schema_name=global_string_schema_name,
+                table_name=UserVerificationCode.__tablename__,
+                filters=FiltersV0(
+                    root={
+                        UserVerificationCode.user_verification_code_hash.name: FilterConditionsV0(
+                            in_=[
+                                x[UserVerificationCode.user_verification_code_hash.name]
+                                for x in old_backup_code_hashes
+                            ]
+                        ),
+                    }
+                ),
+            )
 
         """
         return value
@@ -1826,11 +2345,27 @@ async def generate_account_backup_codes_v0(
         """
         main process
         """
+        # delete existing backup codes if any
+        old_backup_code_hashes = global_object_square_database_helper.get_rows_v0(
+            database_name=global_string_database_name,
+            schema_name=global_string_schema_name,
+            table_name=UserVerificationCode.__tablename__,
+            filters=FiltersV0(
+                root={
+                    UserVerificationCode.user_id.name: FilterConditionsV0(eq=user_id),
+                    UserVerificationCode.user_verification_code_type.name: FilterConditionsV0(
+                        eq=VerificationCodeTypeEnum.BACKUP_CODE_RECOVERY.value
+                    ),
+                }
+            ),
+            columns=[UserVerificationCode.user_verification_code_hash.name],
+        )["data"]["main"]
+
         # generate backup codes
         backup_codes = []
         db_data = []
 
-        for i in range(10):
+        for i in range(NUMBER_OF_RECOVERY_CODES):
             backup_code = str(uuid.uuid4())
             backup_codes.append(backup_code)
             # hash the backup code
@@ -1851,7 +2386,21 @@ async def generate_account_backup_codes_v0(
             table_name=UserVerificationCode.__tablename__,
             data=db_data,
         )
-
+        global_object_square_database_helper.delete_rows_v0(
+            database_name=global_string_database_name,
+            schema_name=global_string_schema_name,
+            table_name=UserVerificationCode.__tablename__,
+            filters=FiltersV0(
+                root={
+                    UserVerificationCode.user_verification_code_hash.name: FilterConditionsV0(
+                        in_=[
+                            x[UserVerificationCode.user_verification_code_hash.name]
+                            for x in old_backup_code_hashes
+                        ]
+                    ),
+                }
+            ),
+        )
         """
         return value
         """
@@ -1893,6 +2442,7 @@ async def reset_password_and_login_using_backup_code_v0(
     username = body.username
     new_password = body.new_password
     app_id = body.app_id
+    logout_other_sessions = body.logout_other_sessions
     try:
         """
         validation
@@ -1918,6 +2468,31 @@ async def reset_password_and_login_using_backup_code_v0(
                 detail=output_content,
             )
         user_id = local_list_authentication_user_response[0][User.user_id.name]
+        # check if user has SELF auth provider
+        local_list_response_user_auth_provider = (
+            global_object_square_database_helper.get_rows_v0(
+                database_name=global_string_database_name,
+                schema_name=global_string_schema_name,
+                table_name=UserAuthProvider.__tablename__,
+                filters=FiltersV0(
+                    root={
+                        UserAuthProvider.user_id.name: FilterConditionsV0(eq=user_id),
+                        UserAuthProvider.auth_provider.name: FilterConditionsV0(
+                            eq=AuthProviderEnum.SELF.value
+                        ),
+                    }
+                ),
+            )["data"]["main"]
+        )
+        if len(local_list_response_user_auth_provider) != 1:
+            output_content = get_api_output_in_standard_format(
+                message=messages["INCORRECT_AUTH_PROVIDER"],
+                log=f"user_id: {user_id} does not have {AuthProviderEnum.SELF.value} auth provider.",
+            )
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail=output_content,
+            )
         # check if user has recovery method enabled
         local_list_response_user_recovery_methods = global_object_square_database_helper.get_rows_v0(
             database_name=global_string_database_name,
@@ -2057,6 +2632,18 @@ async def reset_password_and_login_using_backup_code_v0(
                 ).strftime("%Y-%m-%d %H:%M:%S.%f+00"),
             },
         )
+        if logout_other_sessions:
+            # delete all sessions for user
+            global_object_square_database_helper.delete_rows_v0(
+                database_name=global_string_database_name,
+                schema_name=global_string_schema_name,
+                table_name=UserSession.__tablename__,
+                filters=FiltersV0(
+                    root={
+                        UserSession.user_id.name: FilterConditionsV0(eq=user_id),
+                    }
+                ),
+            )
         # generate access token and refresh token
         local_dict_access_token_payload = {
             "app_id": app_id,
@@ -2098,7 +2685,7 @@ async def reset_password_and_login_using_backup_code_v0(
         return value
         """
         output_content = get_api_output_in_standard_format(
-            message=messages["GENERIC_CREATION_SUCCESSFUL"],
+            message=messages["GENERIC_ACTION_SUCCESSFUL"],
             data={
                 "main": {
                     "user_id": user_id,
@@ -2134,7 +2721,6 @@ async def send_reset_password_email_v0(
     body: SendResetPasswordEmailV0,
 ):
     username = body.username
-    app_id = body.app_id
     try:
         """
         validation
@@ -2160,6 +2746,31 @@ async def send_reset_password_email_v0(
                 detail=output_content,
             )
         user_id = local_list_authentication_user_response[0][User.user_id.name]
+        # check if user has SELF auth provider
+        local_list_response_user_auth_provider = (
+            global_object_square_database_helper.get_rows_v0(
+                database_name=global_string_database_name,
+                schema_name=global_string_schema_name,
+                table_name=UserAuthProvider.__tablename__,
+                filters=FiltersV0(
+                    root={
+                        UserAuthProvider.user_id.name: FilterConditionsV0(eq=user_id),
+                        UserAuthProvider.auth_provider.name: FilterConditionsV0(
+                            eq=AuthProviderEnum.SELF.value
+                        ),
+                    }
+                ),
+            )["data"]["main"]
+        )
+        if len(local_list_response_user_auth_provider) != 1:
+            output_content = get_api_output_in_standard_format(
+                message=messages["INCORRECT_AUTH_PROVIDER"],
+                log=f"user_id: {user_id} does not have {AuthProviderEnum.SELF.value} auth provider.",
+            )
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail=output_content,
+            )
         # check if user has recovery method enabled
         local_list_response_user_recovery_methods = global_object_square_database_helper.get_rows_v0(
             database_name=global_string_database_name,
@@ -2218,14 +2829,17 @@ async def send_reset_password_email_v0(
         """
         main process
         """
-        # create 6 digit verification code
-        verification_code = random.randint(100000, 999999)
+        verification_code = random.randint(
+            10 ** (NUMBER_OF_DIGITS_IN_EMAIL_PASSWORD_RESET_CODE - 1),
+            10**NUMBER_OF_DIGITS_IN_EMAIL_PASSWORD_RESET_CODE - 1,
+        )
         # hash the verification code
         hashed_verification_code = bcrypt.hashpw(
             str(verification_code).encode("utf-8"), bcrypt.gensalt()
         ).decode("utf-8")
-        # expire the verification code after 10 minutes
-        expires_at = datetime.now(timezone.utc) + timedelta(minutes=10)
+        expires_at = datetime.now(timezone.utc) + timedelta(
+            seconds=EXPIRY_TIME_FOR_EMAIL_PASSWORD_RESET_CODE_IN_SECONDS
+        )
         # add verification code to UserVerification code table
         global_object_square_database_helper.insert_rows_v0(
             database_name=global_string_database_name,
@@ -2261,7 +2875,7 @@ async def send_reset_password_email_v0(
             to_email=user_profile_data[UserProfile.user_profile_email.name],
             to_name=user_to_name,
             subject="Password Reset Verification Code",
-            body=f"Your Password Reset verification code is {verification_code}. It will expire in 10 minutes.",
+            body=f"Your Password Reset verification code is {verification_code}. It will expire in {EXPIRY_TIME_FOR_EMAIL_PASSWORD_RESET_CODE_IN_SECONDS/60} minutes.",
             api_key=MAIL_GUN_API_KEY,
             domain_name="thepmsquare.com",
         )
@@ -2312,3 +2926,322 @@ async def send_reset_password_email_v0(
         return JSONResponse(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, content=output_content
         )
+
+
+@router.post("/reset_password_and_login_using_reset_email_code/v0")
+@global_object_square_logger.auto_logger()
+async def reset_password_and_login_using_reset_email_code_v0(
+    body: ResetPasswordAndLoginUsingResetEmailCodeV0,
+):
+    reset_email_code = body.reset_email_code
+    username = body.username
+    new_password = body.new_password
+    app_id = body.app_id
+    logout_other_sessions = body.logout_other_sessions
+    try:
+        """
+        validation
+        """
+        # validate username
+        local_list_authentication_user_response = (
+            global_object_square_database_helper.get_rows_v0(
+                database_name=global_string_database_name,
+                schema_name=global_string_schema_name,
+                table_name=User.__tablename__,
+                filters=FiltersV0(
+                    root={User.user_username.name: FilterConditionsV0(eq=username)}
+                ),
+            )["data"]["main"]
+        )
+        if len(local_list_authentication_user_response) != 1:
+            output_content = get_api_output_in_standard_format(
+                message=messages["INCORRECT_USERNAME"],
+                log=f"incorrect username: {username}.",
+            )
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail=output_content,
+            )
+        user_id = local_list_authentication_user_response[0][User.user_id.name]
+        # check if user has SELF auth provider
+        local_list_response_user_auth_provider = (
+            global_object_square_database_helper.get_rows_v0(
+                database_name=global_string_database_name,
+                schema_name=global_string_schema_name,
+                table_name=UserAuthProvider.__tablename__,
+                filters=FiltersV0(
+                    root={
+                        UserAuthProvider.user_id.name: FilterConditionsV0(eq=user_id),
+                        UserAuthProvider.auth_provider.name: FilterConditionsV0(
+                            eq=AuthProviderEnum.SELF.value
+                        ),
+                    }
+                ),
+            )["data"]["main"]
+        )
+        if len(local_list_response_user_auth_provider) != 1:
+            output_content = get_api_output_in_standard_format(
+                message=messages["INCORRECT_AUTH_PROVIDER"],
+                log=f"user_id: {user_id} does not have {AuthProviderEnum.SELF.value} auth provider.",
+            )
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail=output_content,
+            )
+        # check if user has recovery method enabled
+        local_list_response_user_recovery_methods = global_object_square_database_helper.get_rows_v0(
+            database_name=global_string_database_name,
+            schema_name=global_string_schema_name,
+            table_name=UserRecoveryMethod.__tablename__,
+            filters=FiltersV0(
+                root={
+                    UserRecoveryMethod.user_id.name: FilterConditionsV0(eq=user_id),
+                    UserRecoveryMethod.user_recovery_method_name.name: FilterConditionsV0(
+                        eq=RecoveryMethodEnum.EMAIL.value
+                    ),
+                }
+            ),
+        )[
+            "data"
+        ][
+            "main"
+        ]
+        if len(local_list_response_user_recovery_methods) != 1:
+            output_content = get_api_output_in_standard_format(
+                message=messages["RECOVERY_METHOD_NOT_ENABLED"],
+                log=f"user_id: {user_id} does not have email recovery method enabled.",
+            )
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail=output_content,
+            )
+        # check if user has email in profile
+        user_profile_response = global_object_square_database_helper.get_rows_v0(
+            database_name=global_string_database_name,
+            schema_name=global_string_schema_name,
+            table_name=UserProfile.__tablename__,
+            filters=FiltersV0(
+                root={UserProfile.user_id.name: FilterConditionsV0(eq=user_id)}
+            ),
+            apply_filters=True,
+        )
+        user_profile_data = user_profile_response["data"]["main"][0]
+        if not user_profile_data.get(UserProfile.user_profile_email.name):
+            output_content = get_api_output_in_standard_format(
+                message=messages["GENERIC_MISSING_REQUIRED_FIELD"],
+                log="user seems to have email recovery method enabled, but does not have email in profile.",
+            )
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail=output_content,
+            )
+        # check if email is verified.
+        if not user_profile_data.get(UserProfile.user_profile_email_verified.name):
+            output_content = get_api_output_in_standard_format(
+                message=messages["EMAIL_NOT_VERIFIED"],
+                log="email is not verified.",
+            )
+            return JSONResponse(status_code=status.HTTP_200_OK, content=output_content)
+        # validate if user is assigned to the app.
+        # not checking [skipping] if the app exists, as it is not required for this endpoint.
+        local_list_response_user_app = global_object_square_database_helper.get_rows_v0(
+            database_name=global_string_database_name,
+            schema_name=global_string_schema_name,
+            table_name=UserApp.__tablename__,
+            filters=FiltersV0(
+                root={
+                    UserApp.user_id.name: FilterConditionsV0(eq=user_id),
+                    UserApp.app_id.name: FilterConditionsV0(eq=app_id),
+                }
+            ),
+        )["data"]["main"]
+        if len(local_list_response_user_app) == 0:
+            output_content = get_api_output_in_standard_format(
+                message=messages["GENERIC_400"],
+                log=f"user_id: {user_id} is not assigned to app_id: {app_id}.",
+            )
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail=output_content,
+            )
+        """
+        main process
+        """
+        # validate email reset code
+        local_list_response_user_verification_code = global_object_square_database_helper.get_rows_v0(
+            database_name=global_string_database_name,
+            schema_name=global_string_schema_name,
+            table_name=UserVerificationCode.__tablename__,
+            filters=FiltersV0(
+                root={
+                    UserVerificationCode.user_id.name: FilterConditionsV0(eq=user_id),
+                    UserVerificationCode.user_verification_code_type.name: FilterConditionsV0(
+                        eq=VerificationCodeTypeEnum.EMAIL_RECOVERY.value
+                    ),
+                    UserVerificationCode.user_verification_code_expires_at.name: FilterConditionsV0(
+                        gte=datetime.now(timezone.utc).strftime(
+                            "%Y-%m-%d %H:%M:%S.%f+00"
+                        )
+                    ),
+                    UserVerificationCode.user_verification_code_used_at.name: FilterConditionsV0(
+                        is_null=True
+                    ),
+                }
+            ),
+            columns=[UserVerificationCode.user_verification_code_hash.name],
+            order_by=[
+                "-" + UserVerificationCode.user_verification_code_created_at.name
+            ],
+            limit=1,
+        )[
+            "data"
+        ][
+            "main"
+        ]
+        if len(local_list_response_user_verification_code) != 1:
+            output_content = get_api_output_in_standard_format(
+                message=messages["INCORRECT_VERIFICATION_CODE"],
+                log=f"incorrect reset_email_code: {reset_email_code} for user_id: {user_id}.",
+            )
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail=output_content,
+            )
+        latest_hashed_verification_code = local_list_response_user_verification_code[0][
+            UserVerificationCode.user_verification_code_hash.name
+        ]
+
+        if not bcrypt.checkpw(
+            reset_email_code.encode("utf-8"),
+            latest_hashed_verification_code.encode("utf-8"),
+        ):
+            output_content = get_api_output_in_standard_format(
+                message=messages["INCORRECT_VERIFICATION_CODE"],
+                log=f"incorrect reset_email_code: {reset_email_code} for user_id: {user_id}.",
+            )
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail=output_content,
+            )
+
+        # hash the new password
+        local_str_hashed_password = bcrypt.hashpw(
+            new_password.encode("utf-8"), bcrypt.gensalt()
+        ).decode("utf-8")
+        # update the password
+        global_object_square_database_helper.edit_rows_v0(
+            database_name=global_string_database_name,
+            schema_name=global_string_schema_name,
+            table_name=UserCredential.__tablename__,
+            filters=FiltersV0(
+                root={
+                    UserCredential.user_id.name: FilterConditionsV0(eq=user_id),
+                }
+            ),
+            data={
+                UserCredential.user_credential_hashed_password.name: local_str_hashed_password,
+            },
+        )
+        # mark the email code as used
+        global_object_square_database_helper.edit_rows_v0(
+            database_name=global_string_database_name,
+            schema_name=global_string_schema_name,
+            table_name=UserVerificationCode.__tablename__,
+            filters=FiltersV0(
+                root={
+                    UserVerificationCode.user_id.name: FilterConditionsV0(eq=user_id),
+                    UserVerificationCode.user_verification_code_type.name: FilterConditionsV0(
+                        eq=VerificationCodeTypeEnum.EMAIL_RECOVERY.value
+                    ),
+                    UserVerificationCode.user_verification_code_hash.name: FilterConditionsV0(
+                        eq=latest_hashed_verification_code
+                    ),
+                }
+            ),
+            data={
+                UserVerificationCode.user_verification_code_used_at.name: datetime.now(
+                    timezone.utc
+                ).strftime("%Y-%m-%d %H:%M:%S.%f+00"),
+            },
+        )
+        if logout_other_sessions:
+            # delete all sessions for user
+            global_object_square_database_helper.delete_rows_v0(
+                database_name=global_string_database_name,
+                schema_name=global_string_schema_name,
+                table_name=UserSession.__tablename__,
+                filters=FiltersV0(
+                    root={
+                        UserSession.user_id.name: FilterConditionsV0(eq=user_id),
+                    }
+                ),
+            )
+        # generate access token and refresh token
+        local_dict_access_token_payload = {
+            "app_id": app_id,
+            "user_id": user_id,
+            "exp": datetime.now(timezone.utc)
+            + timedelta(minutes=config_int_access_token_valid_minutes),
+        }
+        local_str_access_token = jwt.encode(
+            local_dict_access_token_payload, config_str_secret_key_for_access_token
+        )
+        local_object_refresh_token_expiry_time = datetime.now(timezone.utc) + timedelta(
+            minutes=config_int_refresh_token_valid_minutes
+        )
+        local_dict_refresh_token_payload = {
+            "app_id": app_id,
+            "user_id": user_id,
+            "exp": local_object_refresh_token_expiry_time,
+        }
+        local_str_refresh_token = jwt.encode(
+            local_dict_refresh_token_payload, config_str_secret_key_for_refresh_token
+        )
+        # insert the refresh token in the database
+        global_object_square_database_helper.insert_rows_v0(
+            database_name=global_string_database_name,
+            schema_name=global_string_schema_name,
+            table_name=UserSession.__tablename__,
+            data=[
+                {
+                    UserSession.user_id.name: user_id,
+                    UserSession.app_id.name: app_id,
+                    UserSession.user_session_refresh_token.name: local_str_refresh_token,
+                    UserSession.user_session_expiry_time.name: local_object_refresh_token_expiry_time.strftime(
+                        "%Y-%m-%d %H:%M:%S.%f+00"
+                    ),
+                }
+            ],
+        )
+        """
+        return value
+        """
+        output_content = get_api_output_in_standard_format(
+            message=messages["GENERIC_ACTION_SUCCESSFUL"],
+            data={
+                "main": {
+                    "user_id": user_id,
+                    "access_token": local_str_access_token,
+                    "refresh_token": local_str_refresh_token,
+                }
+            },
+        )
+
+        return JSONResponse(status_code=status.HTTP_200_OK, content=output_content)
+    except HTTPException as http_exception:
+        global_object_square_logger.logger.error(http_exception, exc_info=True)
+        return JSONResponse(
+            status_code=http_exception.status_code, content=http_exception.detail
+        )
+    except Exception as e:
+        """
+        rollback logic
+        """
+        global_object_square_logger.logger.error(e, exc_info=True)
+        output_content = get_api_output_in_standard_format(
+            message=messages["GENERIC_500"],
+            log=str(e),
+        )
+        return JSONResponse(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, content=output_content
+        )