stkit 17.0.0__py3-none-any.whl

stk/user/models.py

@@ -0,0 +1,308 @@
+import dataclasses
+import secrets
+import string
+from datetime import datetime
+from uuid import uuid4
+
+from quart import g
+from quart_security import RoleMixin, SecurityState, UserMixin, hash_password
+from quart_security.password import hash_password_async
+from sqlalchemy import (
+    JSON,
+    Boolean,
+    Column,
+    DateTime,
+    ForeignKey,
+    Integer,
+    LargeBinary,
+    String,
+    Table,
+    UniqueConstraint,
+    delete,
+    select,
+)
+from sqlalchemy.orm import declared_attr, relationship
+
+from stk.extensions import Base
+
+SecurityState.__table__.to_metadata(Base.metadata)
+
+roles_users = Table(
+    "roles_users",
+    Base.metadata,
+    Column("user_id", Integer, ForeignKey("user.id"), primary_key=True),
+    Column("role_id", Integer, ForeignKey("role.id"), primary_key=True),
+)
+
+
+@dataclasses.dataclass
+class Role(Base, RoleMixin):
+    __tablename__ = "role"
+
+    id = Column(Integer, primary_key=True)
+    name = Column(String(80), unique=True, nullable=True)
+    description = Column(String(255), nullable=True)
+
+    def to_dict(self) -> dict:
+        return {"id": self.id, "name": self.name, "description": self.description}
+
+    def from_dict(self, json_dict):
+        self.name = json_dict.get("name", self.name)
+        self.description = json_dict.get("description", self.description)
+        return self
+
+
+@dataclasses.dataclass
+class User(Base, UserMixin):
+    __tablename__ = "user"
+
+    id = Column(Integer, primary_key=True)
+    username = Column(String(255), unique=True, nullable=True)
+    fs_uniquifier = Column(
+        String(255), unique=True, nullable=False, default=lambda: uuid4().hex
+    )
+    name = Column(String(255), nullable=True)
+    created_at = Column(DateTime, default=datetime.now, nullable=False)
+    email = Column(String(255), unique=True, nullable=False)
+    password = Column(String(255), nullable=False)
+    password_set = Column(Boolean, default=True, nullable=False)
+    active = Column(Boolean, default=False, nullable=True)
+
+    roles = relationship(
+        "Role", secondary=roles_users, backref="users", lazy="selectin"
+    )
+
+    # account lockout
+    failed_login_count = Column(Integer, default=0, nullable=False)
+    locked_until = Column(DateTime, nullable=True)
+
+    confirmed_at = Column(DateTime, nullable=True)
+    last_login_at = Column(DateTime, nullable=True)
+    current_login_at = Column(DateTime, nullable=True)
+    last_login_ip = Column(String(255), nullable=True)
+    current_login_ip = Column(String(255), nullable=True)
+    login_count = Column(Integer, nullable=True)
+
+    # web authn
+    fs_webauthn_user_handle = Column(String(64), unique=True, nullable=True)
+    tf_phone_number = Column(String(64), nullable=True)
+    tf_primary_method = Column(String(140), nullable=True)
+    tf_totp_secret = Column(String(255), nullable=True)
+    mf_recovery_codes = Column(JSON, nullable=True)
+
+    @declared_attr
+    def webauthn(cls):
+        return relationship(
+            "WebAuthn", backref="users", cascade="all, delete", lazy="selectin"
+        )
+
+    @property
+    def display_name(self):
+        return self.name or self.email
+
+    @property
+    def has_usable_password(self):
+        return self.password_set
+
+    def to_dict(self):
+        return {
+            "id": self.id,
+            "active": self.active,
+            "name": self.name,
+            "email": self.email,
+            "roles": [role.to_dict() for role in self.roles],
+        }
+
+    async def from_dict(self, json_dict):
+        self.name = json_dict.get("name", self.name)
+        self.username = json_dict.get("username", self.username)
+        self.email = json_dict.get("email", self.email)
+        if "password" in json_dict:
+            self.password = await hash_password_async(json_dict["password"])
+            self.password_set = True
+            self.fs_uniquifier = uuid4().hex
+        if "roles" in json_dict:
+            role_ids = [r.get("id") for r in json_dict["roles"]]
+            result = await g.db_session.execute(
+                select(Role).where(Role.id.in_(role_ids))
+            )
+            self.roles = list(result.scalars().all())
+        self.active = json_dict.get("active", self.active)
+        return self
+
+    def __str__(self) -> str:
+        return f"{self.id}"
+
+    def __repr__(self) -> str:
+        return f"<User {self.id}: {self.email}>"
+
+    @staticmethod
+    def random_password(length=32):
+        alphabet = string.ascii_letters + string.digits + string.punctuation
+        password = "".join(secrets.choice(alphabet) for i in range(length))
+        return hash_password(password)
+
+    async def logout_other_sessions(self, current_session_token=None):
+        await Session.deactivate_user_sessions(
+            self.id, exclude_token=current_session_token
+        )
+
+    def get_active_sessions(self):
+        return [s for s in self.sessions if s.is_active]
+
+    @property
+    def two_factor_devices(self):
+        devices = []
+        if self.tf_primary_method:
+            devices.append(
+                {"type": self.tf_primary_method, "name": "Authenticator App"}
+            )
+        if self.webauthn:
+            for wan in self.webauthn:
+                devices.append(
+                    {"type": "webauthn", "name": wan.name, "usage": wan.usage}
+                )
+        return devices
+
+
+class WebAuthn(Base):
+    __tablename__ = "web_authn"
+
+    id = Column(Integer, primary_key=True)
+    credential_id = Column(LargeBinary(1024), index=True, nullable=False, unique=True)
+    public_key = Column(LargeBinary(1024), nullable=False)
+    sign_count = Column(Integer, default=0, nullable=False)
+    transports = Column(JSON, nullable=True)
+    extensions = Column(String(255), nullable=True)
+    lastuse_datetime = Column(DateTime, nullable=False)
+    name = Column(String(64), nullable=False)
+    usage = Column(String(64), nullable=False)
+    backup_state = Column(Boolean, nullable=False)
+    device_type = Column(String(64), nullable=False)
+
+    @declared_attr
+    def user_id(cls):
+        return Column(
+            String(64),
+            ForeignKey("user.fs_webauthn_user_handle", ondelete="CASCADE"),
+            nullable=False,
+        )
+
+    def get_user_mapping(self):
+        return {"fs_webauthn_user_handle": self.user_id}
+
+
+class OAuth(Base):
+    __tablename__ = "oauth"
+
+    id = Column(Integer, primary_key=True)
+    provider = Column(String(50), nullable=False)
+    provider_user_id = Column(String(256), nullable=False)
+    token = Column(JSON, nullable=True)
+    created_at = Column(DateTime, default=datetime.now, nullable=False)
+    user_id = Column(Integer, ForeignKey("user.id"), nullable=False)
+    user = relationship(
+        "User",
+        backref="oauth_accounts",
+        lazy="selectin",
+    )
+
+    __table_args__ = (
+        UniqueConstraint("provider", "provider_user_id", name="uq_oauth_provider_user"),
+    )
+
+
+class Activity(Base):
+    __tablename__ = "activity"
+
+    id = Column(Integer, primary_key=True)
+    user_id = Column(Integer, ForeignKey("user.id"), nullable=False, index=True)
+    action = Column(String(255), nullable=False)
+    data = Column(JSON, nullable=True)
+    created_at = Column(DateTime, default=datetime.now, nullable=False, index=True)
+
+    @classmethod
+    async def register(cls, user_id, action, data=None):
+        activity = cls(user_id=user_id, action=action, data=data)
+        g.db_session.add(activity)
+        return activity
+
+
+class Session(Base):
+    __tablename__ = "user_sessions"
+
+    id = Column(Integer, primary_key=True)
+    user_id = Column(Integer, ForeignKey("user.id"), nullable=False, index=True)
+    user = relationship("User", backref="sessions", lazy="selectin")
+
+    session_token = Column(String(255), unique=True, nullable=False)
+    last_active = Column(DateTime, default=datetime.now)
+    expires_at = Column(DateTime, nullable=True)
+    ip_address = Column(String(255), nullable=True)
+
+    meta = Column(JSON, nullable=True)
+
+    is_active = Column(Boolean, default=True, index=True)
+    created_at = Column(DateTime, default=datetime.now, nullable=False)
+
+    def to_dict(self):
+        return {
+            "id": self.id,
+            "user_id": self.user_id,
+            "last_active": self.last_active.isoformat() if self.last_active else None,
+            "expires_at": self.expires_at.isoformat() if self.expires_at else None,
+            "ip_address": self.ip_address,
+            "meta": self.meta,
+            "is_active": self.is_active,
+            "created_at": self.created_at.isoformat() if self.created_at else None,
+        }
+
+    @classmethod
+    async def create_session(cls, user_id, session_token, ip_address=None, meta=None):
+        result = await g.db_session.execute(
+            select(cls).filter_by(session_token=session_token)
+        )
+        existing = result.scalar_one_or_none()
+        if existing:
+            existing.user_id = user_id
+            existing.ip_address = ip_address
+            existing.meta = meta
+            existing.is_active = True
+            existing.last_active = datetime.now()
+            g.db_session.add(existing)
+            return existing
+
+        session_record = cls(
+            user_id=user_id,
+            session_token=session_token,
+            ip_address=ip_address,
+            meta=meta,
+            is_active=True,
+        )
+        g.db_session.add(session_record)
+        return session_record
+
+    @classmethod
+    async def deactivate_user_sessions(cls, user_id, exclude_token=None):
+        tokens = select(cls.session_token).where(cls.user_id == user_id)
+        if exclude_token:
+            tokens = tokens.where(cls.session_token != exclude_token)
+        await g.db_session.execute(
+            delete(SecurityState).where(SecurityState.token.in_(tokens))
+        )
+        stmt = (
+            cls.__table__.update()
+            .where(cls.user_id == user_id)
+            .where(cls.is_active == True)  # noqa: E712
+        )
+        if exclude_token:
+            stmt = stmt.where(cls.session_token != exclude_token)
+        stmt = stmt.values(is_active=False)
+        await g.db_session.execute(stmt)
+
+
+class RateLimitWindow(Base):
+    __tablename__ = "rate_limit_window"
+    key = Column(String(160), primary_key=True)
+    count = Column(Integer, nullable=False)
+    expires_at = Column(Integer, nullable=False, index=True)

stk/user/views.py

@@ -0,0 +1,339 @@
+import datetime
+import logging
+from uuid import uuid4
+
+import orjson as json
+from quart import Blueprint, Response, current_app, g, render_template, request, session
+from quart_security import (
+    auth_required,
+    current_user,
+    password_changed,
+    roles_required,
+    tf_profile_changed,
+    user_authenticated,
+    user_logged_out,
+)
+from sqlalchemy import func, select
+
+from stk.security import check_password_policy
+from stk.user.models import Activity, Role, Session, User
+
+log = logging.getLogger(__name__)
+
+bp_user = Blueprint("users", __name__, static_folder="../static")
+
+PER_PAGE = 25
+
+
+@bp_user.before_request
+@auth_required("session")
+@roles_required("admin")
+async def before_request():
+    pass
+
+
+@bp_user.route("/users/")
+async def users():
+    result = await g.db_session.execute(select(Role))
+    roles = [r.to_dict() for r in result.scalars().all()]
+    return await render_template("cms/users.html", roles=roles)
+
+
+@bp_user.route("/api/users")
+async def api_user():
+    page = request.args.get("page", 1, type=int)
+    per_page = request.args.get("per_page", PER_PAGE, type=int)
+
+    query = select(User)
+    count_result = await g.db_session.execute(select(func.count()).select_from(User))
+    total = count_result.scalar()
+
+    result = await g.db_session.execute(
+        query.offset((page - 1) * per_page).limit(per_page)
+    )
+    items = [user.to_dict() for user in result.scalars().all()]
+
+    response_data = {"items": items, "total": total, "perPage": per_page}
+    return Response(json.dumps(response_data), content_type="application/json")
+
+
+@bp_user.post("/api/user/")
+async def api_user_create():
+    json_data = await request.json
+    user_data = json_data.get("item", {})
+    if "password" in user_data:
+        await check_password_policy(user_data["password"])
+    user = User()
+    await user.from_dict(user_data)
+    user.confirmed_at = datetime.datetime.now()
+    g.db_session.add(user)
+    try:
+        await g.db_session.flush()
+        await g.db_session.refresh(user, ["roles"])
+        await Activity.register(current_user.id, "User Create", user.to_dict())
+        await g.db_session.commit()
+        return {"message": "User successfully created!"}
+    except Exception:
+        await g.db_session.rollback()
+        log.exception("Error creating user")
+        return {"message": "Error creating user"}, 412
+
+
+@bp_user.post("/api/user/<int:id>")
+async def api_user_update(id):
+    user = await g.db_session.get(User, id)
+    if user is None:
+        return {"message": "User not found"}, 404
+    json_data = await request.json
+    user_data = json_data.get("item", {})
+    if "password" in user_data:
+        await check_password_policy(user_data["password"])
+    old_user_data = user.to_dict()
+    try:
+        await user.from_dict(user_data)
+        await g.db_session.flush()
+        await g.db_session.refresh(user, ["roles"])
+        await Activity.register(
+            current_user.id,
+            "User Update",
+            {"old": old_user_data, "new": user.to_dict()},
+        )
+        await g.db_session.commit()
+        return {"message": "User successfully updated!"}
+    except Exception:
+        await g.db_session.rollback()
+        log.exception("Error updating user")
+        return {"message": "Error updating user"}, 412
+
+
+@bp_user.post("/api/user/<int:id>/reset-password")
+async def api_user_reset_password(id):
+    user = await g.db_session.get(User, id)
+    if user is None:
+        return {"message": "User not found"}, 404
+    json_data = await request.json
+    password = json_data.get("password", "")
+    await check_password_policy(password)
+    from quart_security.password import hash_password_async
+
+    try:
+        user.password = await hash_password_async(password)
+        user.password_set = True
+        user.fs_uniquifier = uuid4().hex
+        await Activity.register(
+            current_user.id,
+            "Admin Password Reset",
+            {"target_user": user.email},
+        )
+        await g.db_session.commit()
+        return {"message": "Password reset successfully"}
+    except Exception:
+        await g.db_session.rollback()
+        log.exception("Error resetting password")
+        return {"message": "Error resetting password"}, 412
+
+
+@bp_user.route("/api/user/<int:id>", methods=["DELETE"])
+async def api_user_delete(id):
+    user = await g.db_session.get(User, id)
+    if user is None:
+        return {"message": "User not found"}, 404
+    user_data = user.to_dict()
+    try:
+        await g.db_session.delete(user)
+        await Activity.register(current_user.id, "User Delete", user_data)
+        await g.db_session.commit()
+        return {"message": "User successfully deleted!"}
+    except Exception:
+        await g.db_session.rollback()
+        log.exception("Error deleting user")
+        return {"message": "Error deleting user"}, 412
+
+
+@bp_user.route("/roles/")
+async def roles():
+    return await render_template("cms/roles.html")
+
+
+@bp_user.route("/api/roles", methods=["GET"])
+async def api_roles():
+    page = request.args.get("page", 1, type=int)
+    per_page = request.args.get("per_page", PER_PAGE, type=int)
+
+    count_result = await g.db_session.execute(select(func.count()).select_from(Role))
+    total = count_result.scalar()
+
+    result = await g.db_session.execute(
+        select(Role).offset((page - 1) * per_page).limit(per_page)
+    )
+    items = [role.to_dict() for role in result.scalars().all()]
+
+    response_data = {"items": items, "total": total, "perPage": per_page}
+    return Response(json.dumps(response_data), content_type="application/json")
+
+
+@bp_user.route("/api/role/", methods=["POST"])
+async def api_role_create():
+    json_data = await request.json
+    role_data = json_data.get("item", {})
+    role = Role()
+    role.from_dict(role_data)
+    g.db_session.add(role)
+    try:
+        await g.db_session.flush()
+        await Activity.register(current_user.id, "Role Create", role.to_dict())
+        await g.db_session.commit()
+        return {"message": "Role successfully created!"}
+    except Exception:
+        await g.db_session.rollback()
+        log.exception("Error creating role")
+        return {"message": "Error creating role"}, 412
+
+
+@bp_user.post("/api/role/<int:id>")
+async def api_role_update(id):
+    role = await g.db_session.get(Role, id)
+    if role is None:
+        return {"message": "Role not found"}, 404
+    old_role_data = role.to_dict()
+    json_data = await request.json
+    role_data = json_data.get("item", {})
+    try:
+        role.from_dict(role_data)
+        await Activity.register(
+            current_user.id,
+            "Role Update",
+            {"old": old_role_data, "new": role.to_dict()},
+        )
+        await g.db_session.commit()
+        return {"message": "Role successfully updated!"}
+    except Exception:
+        await g.db_session.rollback()
+        log.exception("Error updating role")
+        return {"message": "Error updating role"}, 412
+
+
+@bp_user.route("/api/role/<int:id>", methods=["DELETE"])
+async def api_role_delete(id):
+    role = await g.db_session.get(Role, id)
+    if role is None:
+        return {"message": "Role not found"}, 404
+    role_data = role.to_dict()
+    try:
+        await g.db_session.delete(role)
+        await Activity.register(current_user.id, "Role Delete", role_data)
+        await g.db_session.commit()
+        return {"message": "Role successfully deleted!"}
+    except Exception:
+        await g.db_session.rollback()
+        log.exception("Error deleting role")
+        return {"message": "Error deleting role"}, 412
+
+
+@bp_user.route("/activities/")
+async def activities():
+    return await render_template("cms/activities.html")
+
+
+@bp_user.route("/api/activities")
+async def api_activities():
+    page = request.args.get("page", 1, type=int)
+    per_page = request.args.get("per_page", PER_PAGE, type=int)
+
+    count_result = await g.db_session.execute(
+        select(func.count()).select_from(Activity)
+    )
+    total = count_result.scalar()
+
+    result = await g.db_session.execute(
+        select(Activity, User)
+        .outerjoin(User, Activity.user_id == User.id)
+        .order_by(Activity.created_at.desc())
+        .offset((page - 1) * per_page)
+        .limit(per_page)
+    )
+
+    items = []
+    for activity, user in result.all():
+        items.append(
+            {
+                "id": activity.id,
+                "user": user.display_name if user else f"User ID: {activity.user_id}",
+                "action": activity.action,
+                "data": activity.data,
+                "created_at": activity.created_at.strftime("%Y-%m-%d %H:%M:%S"),
+            }
+        )
+
+    response_data = {"items": items, "total": total, "perPage": per_page}
+    return Response(json.dumps(response_data), content_type="application/json")
+
+
+# --- Signal Handlers ---
+
+
+@user_authenticated.connect
+async def user_authenticated_handler(app, user, authn_via, **extra_args):
+    """Handle user authentication - create session record and check for new IP."""
+    session_data = {
+        "user_id": user.id,
+        "session_token": session["_id"],
+        "ip_address": request.remote_addr,
+        "meta": {
+            "browser": request.user_agent.browser,
+            "browser_version": request.user_agent.version,
+            "os": request.user_agent.platform,
+            "device": request.user_agent.string,
+        },
+    }
+
+    await Session.create_session(**session_data)
+    await g.db_session.commit()
+
+    if user.last_login_ip and user.current_login_ip != user.last_login_ip:
+        await Activity.register(
+            user.id,
+            "Login from new IP",
+            {"old_ip": user.last_login_ip, "new_ip": user.current_login_ip},
+        )
+        await g.db_session.commit()
+
+    if current_app.config.get("DISABLE_MULTIPLE_SESSIONS", False):
+        await user.logout_other_sessions(session_data["session_token"])
+        await g.db_session.commit()
+
+
+@password_changed.connect
+async def after_password_change(sender, user, **extra_args):
+    """Log password change and mark password as user-set."""
+    user.password_set = True
+    g.db_session.add(user)
+    await Activity.register(user.id, "Password Changed", {"email": user.email})
+    await g.db_session.commit()
+
+
+@tf_profile_changed.connect
+async def after_tf_profile_change(sender, user, **extra_args):
+    """Log 2FA profile changes."""
+    await Activity.register(
+        user.id,
+        "Two-Factor Profile Changed",
+        {"email": user.email, "method": user.tf_primary_method},
+    )
+    await g.db_session.commit()
+
+
+@user_logged_out.connect
+async def user_logged_out_handler(app, user, **extra_args):
+    """Clear session on logout."""
+    token = session.get("_id")
+    if token:
+        stmt = (
+            Session.__table__.update()
+            .where(Session.session_token == token)
+            .where(Session.is_active == True)  # noqa: E712
+            .values(is_active=False)
+        )
+        await g.db_session.execute(stmt)
+        await g.db_session.commit()
+    session.clear()

stk/utils/email.py

@@ -0,0 +1,32 @@
+"""Async email utilities using aiosmtplib."""
+
+from email.message import EmailMessage
+
+import aiosmtplib
+from quart import current_app
+
+
+async def send_email(subject, recipient, body, html=None, sender=None):
+    """Send an email asynchronously using aiosmtplib."""
+    app = current_app._get_current_object()
+    sender = sender or app.config.get("SECURITY_EMAIL_SENDER", "noreply@localhost")
+    if isinstance(sender, tuple):
+        sender = f"{sender[0]} <{sender[1]}>"
+
+    msg = EmailMessage()
+    msg["Subject"] = subject
+    msg["From"] = str(sender)
+    msg["To"] = recipient
+    msg.set_content(body)
+    if html:
+        msg.add_alternative(html, subtype="html")
+
+    await aiosmtplib.send(
+        msg,
+        hostname=app.config.get("MAIL_SERVER", "localhost"),
+        port=app.config.get("MAIL_PORT", 465),
+        username=app.config.get("MAIL_USERNAME"),
+        password=app.config.get("MAIL_PASSWORD"),
+        use_tls=app.config.get("MAIL_USE_SSL", False),
+        start_tls=app.config.get("MAIL_USE_TLS", False),
+    )