supernote 0.6.0__tar.gz → 0.6.2__tar.gz

{supernote-0.6.0 → supernote-0.6.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: supernote
-Version: 0.6.0
+Version: 0.6.2
 Summary: All-in-one toolkit for Supernote devices: parse notebooks, self-host services, access services
 Author-email: jya <jya@wizmy.net>, Allen Porter <allen.porter@gmail.com>
 License-Expression: Apache-2.0

{supernote-0.6.0 → supernote-0.6.2}/pyproject.toml

@@ -4,7 +4,7 @@ requires = ["setuptools>=77.0"]
 
 [project]
 name = "supernote"
-version = "0.6.0"
+version = "0.6.2"
 license = "Apache-2.0"
 license-files = ["LICENSE"]
 description = "All-in-one toolkit for Supernote devices: parse notebooks, self-host services, access services"

{supernote-0.6.0 → supernote-0.6.2}/supernote/server/app.py

@@ -6,12 +6,11 @@ from typing import Any, Awaitable, Callable
 
 from aiohttp import web
 
-from supernote.server.services.user import JWT_ALGORITHM
-
 from .config import ServerConfig
 from .models.base import create_error_response
 from .routes import auth, file, system
 from .services.file import FileService
+from .services.state import StateService
 from .services.storage import StorageService
 from .services.user import UserService
 
@@ -87,29 +86,27 @@ async def jwt_auth_middleware(
     if handler_func and getattr(handler_func, "is_public", False):
         return await handler(request)
 
-    # Check for x-access-token header (Supernote device) or Authorization Bearer (tests)
+    # Check for x-access-token header
     if not (token := request.headers.get("x-access-token")):
         return web.json_response(
             create_error_response("Unauthorized").to_dict(), status=401
         )
 
-    import jwt
-
-    server_config: ServerConfig = request.app["config"]
-
-    try:
-        payload = jwt.decode(
-            token, server_config.auth.secret_key, algorithms=[JWT_ALGORITHM]
-        )
-    except jwt.InvalidTokenError:
+    user_service: UserService = request.app["user_service"]
+    user = user_service.verify_token(token)
+    if not user:
         return web.json_response(
             create_error_response("Invalid token").to_dict(), status=401
         )
-    request["user"] = payload["sub"]
+
+    request["user"] = user
     return await handler(request)
 
 
-def create_app(config: ServerConfig | None = None) -> web.Application:
+def create_app(
+    config: ServerConfig | None = None,
+    state_service: StateService | None = None,
+) -> web.Application:
     if config is None:
         config = ServerConfig.load()
 
@@ -118,10 +115,13 @@ def create_app(config: ServerConfig | None = None) -> web.Application:
 
     # Initialize services
     storage_root = Path(config.storage_dir)
-    temp_root = storage_root / "temp"
-    storage_service = StorageService(storage_root, temp_root)
+    storage_service = StorageService(storage_root)
+    if state_service is None:
+        state_service = StateService(storage_service.system_dir / "state.json")
+
     app["storage_service"] = storage_service
-    app["user_service"] = UserService(config.auth)
+    app["state_service"] = state_service
+    app["user_service"] = UserService(config.auth, state_service)
     app["file_service"] = FileService(storage_service)
     app["sync_locks"] = {}  # user -> (equipment_no, expiry_time)
 

supernote-0.6.2/supernote/server/config.py

@@ -0,0 +1,90 @@
+import logging
+import os
+import secrets
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any
+
+import yaml
+from mashumaro.mixins.dict import DataClassDictMixin
+
+logger = logging.getLogger(__name__)
+
+
+@dataclass
+class AuthConfig(DataClassDictMixin):
+    secret_key: str = ""
+    expiration_hours: int = 24
+    users: list["UserEntry"] = field(default_factory=list)
+
+
+@dataclass
+class UserEntry(DataClassDictMixin):
+    username: str
+    password_md5: str
+    is_active: bool = True
+    display_name: str | None = None
+    email: str | None = None
+    phone: str | None = None
+    avatar: str | None = None
+    total_capacity: str = "25485312"
+
+
+@dataclass
+class ServerConfig(DataClassDictMixin):
+    host: str = "0.0.0.0"
+    port: int = 8080
+    trace_log_file: str = "data/server_trace.log"
+    storage_dir: str = "storage"
+    auth: AuthConfig = field(default_factory=AuthConfig)
+
+    @classmethod
+    def load(cls, config_dir: str | Path | None = None) -> "ServerConfig":
+        """Load configuration from directory. READ-ONLY."""
+        if config_dir is None:
+            config_dir = os.getenv("SUPERNOTE_CONFIG_DIR", "config")
+
+        config_dir_path = Path(config_dir)
+        config_file = config_dir_path / "config.yaml"
+
+        file_data: dict[str, Any] = {}
+        if config_file.exists():
+            try:
+                with open(config_file, "r") as f:
+                    file_data = yaml.safe_load(f) or {}
+            except Exception as e:
+                logger.warning(f"Failed to load config file {config_file}: {e}")
+
+        try:
+            config = cls.from_dict(file_data)
+        except Exception as e:
+            logger.warning(
+                f"Failed to parse config file {config_file}, using defaults: {e}"
+            )
+            config = cls()
+
+        # 4. JWT Secret priority: Env > Config > Random(in-memory only)
+        env_secret = os.getenv("SUPERNOTE_JWT_SECRET")
+        if env_secret:
+            config.auth.secret_key = env_secret
+
+        if not config.auth.secret_key:
+            logger.warning(
+                "No JWT secret key configured. Using a temporary in-memory key."
+            )
+            config.auth.secret_key = secrets.token_hex(32)
+
+        # Apply other env var overrides
+        if os.getenv("SUPERNOTE_HOST"):
+            config.host = os.getenv("SUPERNOTE_HOST", config.host)
+
+        if os.getenv("SUPERNOTE_PORT"):
+            try:
+                config.port = int(os.getenv("SUPERNOTE_PORT", str(config.port)))
+            except ValueError:
+                pass
+
+        if os.getenv("SUPERNOTE_STORAGE_DIR"):
+            config.storage_dir = os.getenv("SUPERNOTE_STORAGE_DIR", config.storage_dir)
+
+        return config

{supernote-0.6.0 → supernote-0.6.2}/supernote/server/services/file.py

@@ -1,7 +1,7 @@
 import logging
 import urllib.parse
 from pathlib import Path
-from typing import List, Optional
+from typing import List
 
 from ..models.base import BaseResponse
 from ..models.file import (
@@ -60,7 +60,7 @@ class FileService:
 
         return entries
 
-    def get_file_info(self, user: str, path_str: str) -> Optional[FileEntryVO]:
+    def get_file_info(self, user: str, path_str: str) -> FileEntryVO | None:
         """Get file info by path for a specific user."""
         rel_path = path_str.lstrip("/")
         target_path = self.storage_service.resolve_path(user, rel_path)
@@ -302,7 +302,7 @@ class FileService:
         """Search for files matching the keyword in user's storage."""
         results = []
         keyword_lower = keyword.lower()
-        user_root = self.storage_service.storage_root / user
+        user_root = self.storage_service.users_dir / user
 
         if not user_root.exists():
             return []

supernote-0.6.2/supernote/server/services/state.py

@@ -0,0 +1,107 @@
+import logging
+import time
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Dict, List, Optional, cast
+
+from mashumaro.mixins.json import DataClassJSONMixin
+
+logger = logging.getLogger(__name__)
+
+
+@dataclass
+class SessionState(DataClassJSONMixin):
+    token: str
+    username: str
+    equipment_no: Optional[str] = None
+    created_at: float = field(default_factory=time.time)
+    last_active_at: float = field(default_factory=time.time)
+
+
+@dataclass
+class UserState(DataClassJSONMixin):
+    username: str
+    devices: List[str] = field(default_factory=list)
+
+
+@dataclass
+class SystemState(DataClassJSONMixin):
+    users: Dict[str, UserState] = field(default_factory=dict)
+    sessions: Dict[str, SessionState] = field(default_factory=dict)
+
+
+class StateService:
+    def __init__(self, state_file: Path) -> None:
+        self.state_file = state_file
+        self._state = self._load()
+
+    def _load(self) -> SystemState:
+        if not self.state_file.exists():
+            return SystemState()
+        try:
+            with open(self.state_file, "r") as f:
+                return SystemState.from_json(f.read())
+        except Exception as e:
+            logger.error(f"Failed to load state file {self.state_file}: {e}")
+            return SystemState()
+
+    def save(self) -> None:
+        try:
+            self.state_file.parent.mkdir(parents=True, exist_ok=True)
+            with open(self.state_file, "w") as f:
+                f.write(cast(str, self._state.to_json()))
+        except Exception as e:
+            logger.error(f"Failed to save state file {self.state_file}: {e}")
+
+    # User State Methods
+    def get_user_state(self, username: str) -> UserState:
+        if username not in self._state.users:
+            self._state.users[username] = UserState(username=username)
+        return self._state.users[username]
+
+    def add_device(self, username: str, equipment_no: str) -> None:
+        user_state = self.get_user_state(username)
+        if equipment_no not in user_state.devices:
+            user_state.devices.append(equipment_no)
+            self.save()
+
+    def remove_device(self, equipment_no: str) -> None:
+        found = False
+        for user_state in self._state.users.values():
+            if equipment_no in user_state.devices:
+                user_state.devices.remove(equipment_no)
+                found = True
+        if found:
+            self.save()
+
+    # Session Management
+    def create_session(
+        self, token: str, username: str, equipment_no: str | None = None
+    ) -> None:
+        session = SessionState(
+            token=token, username=username, equipment_no=equipment_no
+        )
+        self._state.sessions[token] = session
+        self.save()
+
+    def get_session(self, token: str) -> SessionState | None:
+        session = self._state.sessions.get(token)
+        if session:
+            session.last_active_at = time.time()
+            # We don't necessarily save on every activity to avoid disk thrashing,
+            # but maybe we should if persistence is critical.
+            # For now, let's just update memory.
+        return session
+
+    def prune_sessions(self, max_idle_seconds: int) -> None:
+        now = time.time()
+        to_remove = [
+            token
+            for token, session in self._state.sessions.items()
+            if now - session.last_active_at > max_idle_seconds
+        ]
+        if to_remove:
+            for token in to_remove:
+                del self._state.sessions[token]
+            self.save()
+            logger.info(f"Pruned {len(to_remove)} idle sessions")

{supernote-0.6.0 → supernote-0.6.2}/supernote/server/services/storage.py

@@ -10,14 +10,18 @@ logger = logging.getLogger(__name__)
 
 
 class StorageService:
-    def __init__(self, storage_root: Path, temp_root: Path):
-        self.storage_root = storage_root
-        self.temp_root = temp_root
+    def __init__(self, root_dir: Path):
+        self.root_dir = root_dir
+        self.users_dir = root_dir / "users"
+        self.temp_dir = root_dir / "temp"
+        self.system_dir = root_dir / "system"
         self._ensure_directories()
 
     def _ensure_directories(self) -> None:
-        self.storage_root.mkdir(parents=True, exist_ok=True)
-        self.temp_root.mkdir(parents=True, exist_ok=True)
+        self.root_dir.mkdir(parents=True, exist_ok=True)
+        self.users_dir.mkdir(parents=True, exist_ok=True)
+        self.temp_dir.mkdir(parents=True, exist_ok=True)
+        self.system_dir.mkdir(parents=True, exist_ok=True)
 
     def get_file_md5(self, path: Path) -> str:
         """Calculate MD5 of a file."""
@@ -39,23 +43,23 @@ class StorageService:
 
     def get_storage_usage(self, user: str) -> int:
         """Get total storage usage for a specific user."""
-        return self.get_dir_size(self.storage_root / user)
+        return self.get_dir_size(self.users_dir / user)
 
     def resolve_path(self, user: str, rel_path: str) -> Path:
         """Resolve a relative path to an absolute path in user's storage."""
         # Remove leading slash to make it relative
         clean_rel_path = rel_path.lstrip("/")
-        return self.storage_root / user / clean_rel_path
+        return self.users_dir / user / clean_rel_path
 
     def resolve_temp_path(self, user: str, filename: str) -> Path:
         """Resolve a filename to an absolute path in user's temp storage."""
-        return self.temp_root / user / filename
+        return self.temp_dir / user / filename
 
     def is_safe_path(self, user: str, path: Path) -> bool:
         """Check if path is within user's storage root to prevent traversal."""
         try:
             resolved_path = path.resolve()
-            user_root_abs = (self.storage_root / user).resolve()
+            user_root_abs = (self.users_dir / user).resolve()
             return str(resolved_path).startswith(str(user_root_abs))
         except Exception:
             return False
@@ -153,7 +157,7 @@ class StorageService:
 
     def get_path_from_id(self, user: str, file_id: int) -> str | None:
         """Find relative path from ID by scanning user's storage."""
-        user_root = self.storage_root / user
+        user_root = self.users_dir / user
         if not user_root.exists():
             return None
 
@@ -235,7 +239,7 @@ class StorageService:
 
     def get_trash_dir(self, user: str) -> Path:
         """Get the trash directory path for a user."""
-        return self.storage_root / user / ".trash"
+        return self.users_dir / user / ".trash"
 
     def ensure_trash_dir(self, user: str) -> None:
         """Ensure trash directory exists for a user."""
@@ -284,7 +288,7 @@ class StorageService:
         self, user: str, trash_rel_path: str, original_rel_path: str
     ) -> None:
         """Restore file/folder from user's trash."""
-        trash_path = (self.storage_root / user) / trash_rel_path
+        trash_path = (self.users_dir / user) / trash_rel_path
         if not trash_path.exists():
             raise FileNotFoundError(f"Trash item {trash_rel_path} not found")
 
@@ -297,7 +301,7 @@ class StorageService:
 
     def delete_from_trash(self, user: str, trash_rel_path: str) -> None:
         """Permanently delete item from user's trash."""
-        trash_path = (self.storage_root / user) / trash_rel_path
+        trash_path = (self.users_dir / user) / trash_rel_path
         if not trash_path.exists():
             return
 

supernote-0.6.2/supernote/server/services/user.py

@@ -0,0 +1,156 @@
+import hashlib
+import logging
+import secrets
+import time
+from typing import Optional, cast
+
+import jwt
+
+from ..config import AuthConfig, UserEntry
+from ..models.auth import LoginResult, UserVO
+from .state import StateService
+
+logger = logging.getLogger(__name__)
+
+JWT_ALGORITHM = "HS256"
+
+
+class UserService:
+    def __init__(self, config: AuthConfig, state_service: StateService):
+        self._config = config
+        self._state_service = state_service
+        self._random_codes: dict[
+            str, tuple[str, str]
+        ] = {}  # account -> (code, timestamp)
+
+    @property
+    def _users(self) -> list[UserEntry]:
+        return self._config.users
+
+    def list_users(self) -> list[UserEntry]:
+        return list(self._users)
+
+    def check_user_exists(self, account: str) -> bool:
+        return any(u.username == account for u in self._users)
+
+    def generate_random_code(self, account: str) -> tuple[str, str]:
+        """Generate a random code for login challenge."""
+        random_code = secrets.token_hex(4)  # 8 chars
+        timestamp = str(int(time.time() * 1000))
+        self._random_codes[account] = (random_code, timestamp)
+        return random_code, timestamp
+
+    def _get_user(self, account: str) -> UserEntry | None:
+        for user in self._users:
+            if user.username == account:
+                return user
+        return None
+
+    def verify_password(self, account: str, password: str) -> bool:
+        user = self._get_user(account)
+        if not user or not user.is_active:
+            return False
+        hash_hex = hashlib.md5(password.encode()).hexdigest()
+        return bool(hash_hex == user.password_md5)
+
+    def verify_login_hash(self, account: str, client_hash: str, timestamp: str) -> bool:
+        user = self._get_user(account)
+        if not user or not user.is_active:
+            return False
+
+        code_tuple = self._random_codes.get(account)
+        if not code_tuple or code_tuple[1] != timestamp:
+            return False
+
+        random_code = code_tuple[0]
+        concat = user.password_md5 + random_code
+        expected_hash = hashlib.sha256(concat.encode()).hexdigest()
+
+        return expected_hash == client_hash
+
+    def login(
+        self,
+        account: str,
+        password_hash: str,
+        timestamp: str,
+        equipment_no: Optional[str] = None,
+    ) -> LoginResult | None:
+        user = self._get_user(account)
+        if not user or not user.is_active:
+            return None
+
+        if not self.verify_login_hash(account, password_hash, timestamp):
+            return None
+
+        # Check binding status from StateService
+        user_state = self._state_service.get_user_state(account)
+        bound_devices = user_state.devices
+        is_bind = "Y" if bound_devices else "N"
+        is_bind_equipment = (
+            "Y" if equipment_no and equipment_no in bound_devices else "N"
+        )
+
+        payload = {
+            "sub": account,
+            "equipment_no": equipment_no or "",
+            "iat": int(time.time()),
+            "exp": int(time.time()) + (self._config.expiration_hours * 3600),
+        }
+        token = jwt.encode(payload, self._config.secret_key, algorithm=JWT_ALGORITHM)
+
+        # Persist session in StateService
+        self._state_service.create_session(token, account, equipment_no)
+
+        return LoginResult(
+            token=token,
+            is_bind=is_bind,
+            is_bind_equipment=is_bind_equipment,
+        )
+
+    def verify_token(self, token: str) -> str | None:
+        """Verify token against persisted sessions and JWT signature."""
+        try:
+            # 1. Check if session exists in memory/state
+            session = self._state_service.get_session(token)
+            if not session:
+                logger.warning("Session not found in state: %s", token[:10])
+                return None
+
+            # 2. Decode and verify JWT
+            payload = jwt.decode(
+                token, self._config.secret_key, algorithms=[JWT_ALGORITHM]
+            )
+            return cast(str, payload.get("sub"))
+        except jwt.PyJWTError as e:
+            logger.warning("Token verification failed: %s", e)
+            return None
+
+    def get_user_profile(self, account: str) -> UserVO | None:
+        """Get user profile from static config."""
+        user = self._get_user(account)
+        if not user:
+            return None
+
+        return UserVO(
+            user_name=user.display_name or account,
+            email=user.email or account,
+            phone=user.phone or "",
+            country_code="1",
+            total_capacity=user.total_capacity,
+            file_server="0",
+            avatars_url=user.avatar or "",
+            birthday="",
+            sex="",
+        )
+
+    def bind_equipment(self, account: str, equipment_no: str) -> bool:
+        """Bind a device to the user account using StateService."""
+        if not self.check_user_exists(account):
+            return False
+        self._state_service.add_device(account, equipment_no)
+        return True
+
+    def unlink_equipment(self, equipment_no: str) -> bool:
+        """Unlink a device from all users using StateService."""
+        self._state_service.remove_device(equipment_no)
+        return True

{supernote-0.6.0 → supernote-0.6.2}/supernote.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: supernote
-Version: 0.6.0
+Version: 0.6.2
 Summary: All-in-one toolkit for Supernote devices: parse notebooks, self-host services, access services
 Author-email: jya <jya@wizmy.net>, Allen Porter <allen.porter@gmail.com>
 License-Expression: Apache-2.0

{supernote-0.6.0 → supernote-0.6.2}/supernote.egg-info/SOURCES.txt

@@ -43,5 +43,6 @@ supernote/server/routes/file.py
 supernote/server/routes/system.py
 supernote/server/services/__init__.py
 supernote/server/services/file.py
+supernote/server/services/state.py
 supernote/server/services/storage.py
 supernote/server/services/user.py

supernote-0.6.0/supernote/server/config.py

@@ -1,159 +0,0 @@
-import logging
-import os
-import secrets
-from dataclasses import dataclass, field
-from pathlib import Path
-from typing import Any
-
-import yaml
-from mashumaro.mixins.dict import DataClassDictMixin
-
-logger = logging.getLogger(__name__)
-
-
-@dataclass
-class AuthConfig(DataClassDictMixin):
-    secret_key: str = ""
-    expiration_hours: int = 24
-    users_file: str = "users.yaml"
-
-
-@dataclass
-class UserEntry(DataClassDictMixin):
-    username: str
-    password_md5: str
-    is_active: bool = True
-    devices: list[str] = field(default_factory=list)
-    profile: dict[str, Any] = field(default_factory=dict)
-    mobile: str | None = None
-    email: str | None = None
-    avatar: str | None = None
-    signature: str | None = None
-
-
-@dataclass
-class UsersConfig(DataClassDictMixin):
-    users: list[UserEntry] = field(default_factory=list)
-
-    @classmethod
-    def load(cls, path: str | Path) -> "UsersConfig":
-        path = Path(path)
-        if not path.exists():
-            return cls()
-        try:
-            with open(path, "r") as f:
-                data = yaml.safe_load(f) or {}
-            return cls.from_dict(data)
-        except Exception as e:
-            logger.warning(f"Failed to load users file {path}: {e}")
-            return cls()
-
-    def save(self, path: str | Path) -> None:
-        path = Path(path)
-        if not path.parent.exists():
-            path.parent.mkdir(parents=True, exist_ok=True)
-        with open(path, "w") as f:
-            yaml.safe_dump(self.to_dict(), f, default_flow_style=False)
-
-
-@dataclass
-class ServerConfig(DataClassDictMixin):
-    host: str = "0.0.0.0"
-    port: int = 8080
-    trace_log_file: str = "data/server_trace.log"
-    storage_dir: str = "storage"
-    auth: AuthConfig = field(default_factory=AuthConfig)
-
-    @classmethod
-    def load(cls, config_dir: str | Path | None = None) -> "ServerConfig":
-        """Load configuration from directory."""
-        # 1. Determine config directory
-        if config_dir is None:
-            config_dir = os.getenv("SUPERNOTE_CONFIG_DIR", "config")
-
-        config_dir_path = Path(config_dir)
-        config_file = config_dir_path / "config.yaml"
-
-        # 2. Load from YAML if exists
-        file_data: dict[str, Any] = {}
-        if file_exists := config_file.exists():
-            try:
-                with open(config_file, "r") as f:
-                    file_data = yaml.safe_load(f) or {}
-            except Exception as e:
-                logger.warning(f"Failed to load config file {config_file}: {e}")
-
-        # 3. Create config object using mashumaro
-        try:
-            config = cls.from_dict(file_data)
-        except Exception as e:
-            logger.warning(
-                f"Failed to parse config file {config_file}, using defaults: {e}"
-            )
-            config = cls()
-
-        # Resolve users_file relative to config_dir if it's just a filename (not already a path)
-        users_path = Path(config.auth.users_file)
-        if not users_path.is_absolute() and len(users_path.parts) == 1:
-            config.auth.users_file = str(config_dir_path / users_path)
-
-        # 4. Generate secret if missing AND not provided by env var
-        env_secret = os.getenv("SUPERNOTE_JWT_SECRET")
-        secret_generated = False
-
-        if not config.auth.secret_key and not env_secret:
-            logger.warning("No JWT secret key configured. Generating a new random key.")
-            config.auth.secret_key = secrets.token_hex(32)
-            secret_generated = True
-
-        # 5. Save config if it was missing or if we generated a secret
-        if not file_exists or secret_generated:
-            try:
-                # Ensure directory exists
-                if not config_file.parent.exists():
-                    config_file.parent.mkdir(parents=True, exist_ok=True)
-
-                # Prepare config for saving (restore relative paths if possible)
-                config_to_save = cls.from_dict(config.to_dict())
-                try:
-                    users_path_abs = Path(config.auth.users_file)
-                    if users_path_abs.is_absolute() and users_path_abs.is_relative_to(
-                        config_dir_path
-                    ):
-                        config_to_save.auth.users_file = str(
-                            users_path_abs.relative_to(config_dir_path)
-                        )
-                except ValueError:
-                    pass
-
-                with open(config_file, "w") as f:
-                    yaml.safe_dump(
-                        config_to_save.to_dict(), f, default_flow_style=False
-                    )
-
-                if secret_generated:
-                    logger.info(
-                        f"Saved new configuration with generated secret to {config_file}"
-                    )
-                else:
-                    logger.info(f"Created default configuration file at {config_file}")
-            except Exception as e:
-                logger.warning(f"Failed to save configuration to {config_file}: {e}")
-
-        # 6. Apply env var override (runtime only, not saved)
-        if env_secret:
-            config.auth.secret_key = env_secret
-
-        if os.getenv("SUPERNOTE_HOST"):
-            config.host = os.getenv("SUPERNOTE_HOST", config.host)
-
-        if os.getenv("SUPERNOTE_PORT"):
-            try:
-                config.port = int(os.getenv("SUPERNOTE_PORT", str(config.port)))
-            except ValueError:
-                pass
-
-        if os.getenv("SUPERNOTE_STORAGE_DIR"):
-            config.storage_dir = os.getenv("SUPERNOTE_STORAGE_DIR", config.storage_dir)
-
-        return config

supernote-0.6.0/supernote/server/services/user.py

@@ -1,225 +0,0 @@
-import hashlib
-import logging
-import secrets
-import time
-from typing import Optional
-
-import jwt
-
-from ..config import AuthConfig, UserEntry, UsersConfig
-from ..models.auth import LoginResult, UserVO
-
-logger = logging.getLogger(__name__)
-
-JWT_ALGORITHM = "HS256"
-
-
-class UserService:
-    def __init__(self, config: AuthConfig):
-        self._config = config
-        self._users_config = UsersConfig.load(config.users_file)
-        self._random_codes: dict[
-            str, tuple[str, str]
-        ] = {}  # account -> (code, timestamp)
-
-    @property
-    def _users(self) -> list[UserEntry]:
-        return self._users_config.users
-
-    def list_users(self) -> list[UserEntry]:
-        return list(self._users)
-
-    @staticmethod
-    def create_user_entry(username: str, password: str) -> UserEntry:
-        """Create a new UserEntry with hashed password."""
-        password_md5 = hashlib.md5(password.encode()).hexdigest()
-        return UserEntry(
-            username=username,
-            password_md5=password_md5,
-            is_active=True,
-            devices=[],
-            profile={},
-        )
-
-    def add_user(self, username: str, password: str) -> bool:
-        """Add a new user to the in-memory config. Does NOT save to disk."""
-        if any(u.username == username for u in self._users):
-            return False
-        new_user = self.create_user_entry(username, password)
-        self._users.append(new_user)
-        return True
-
-    def save(self) -> None:
-        """Save the current users configuration to disk."""
-        self._users_config.save(self._config.users_file)
-
-    def deactivate_user(self, username: str) -> bool:
-        """Deactivate a user in-memory. Does NOT save to disk."""
-        for user in self._users:
-            if user.username == username:
-                user.is_active = False
-                return True
-        return False
-
-    def check_user_exists(self, account: str) -> bool:
-        return any(u.username == account for u in self._users)
-
-    def generate_random_code(self, account: str) -> tuple[str, str]:
-        """Generate a random code for login challenge."""
-        random_code = secrets.token_hex(4)  # 8 chars
-        timestamp = str(int(time.time() * 1000))
-        # Only allow one active code per account at a time
-        self._random_codes[account] = (random_code, timestamp)
-        return random_code, timestamp
-
-    def _get_user(self, account: str) -> UserEntry | None:
-        for user in self._users:
-            if user.username == account:
-                return user
-        return None
-
-    def verify_password(self, account: str, password: str) -> bool:
-        user = self._get_user(account)
-        if not user or not user.is_active:
-            logger.info("User not found or inactive: %s", account)
-            return False
-        if not user.password_md5:
-            logger.info("MD5 password hash not found for user: %s", account)
-            return False
-        # Compute md5(password) and compare
-        password_bytes = password.encode()
-        hash_hex = hashlib.md5(password_bytes).hexdigest()
-        return bool(hash_hex == user.password_md5)
-
-    def verify_login_hash(self, account: str, client_hash: str, timestamp: str) -> bool:
-        user = self._get_user(account)
-        if not user or not user.is_active:
-            logger.info("User not found or inactive: %s", account)
-            return False
-
-        code_tuple = self._random_codes.get(account)
-        if not code_tuple or code_tuple[1] != timestamp:
-            logger.warning(
-                "Random code not found or timestamp mismatch for %s", account
-            )
-            return False
-        random_code = code_tuple[0]
-
-        if not user.password_md5:
-            logger.info("MD5 password hash not found for user: %s", account)
-            return False
-
-        # Compute expected hash: sha256(password_md5 + random_code)
-        concat = user.password_md5 + random_code
-        expected_hash = hashlib.sha256(concat.encode()).hexdigest()
-
-        if expected_hash == client_hash:
-            return True
-        logger.info("Login hash mismatch for user: %s", account)
-        return False
-
-    def login(
-        self,
-        account: str,
-        password_hash: str,
-        timestamp: str,
-        equipment_no: Optional[str] = None,
-    ) -> LoginResult | None:
-        """Login user and return token and status info.
-
-        Args:
-          account: User account (email/phone)
-          password_hash: Hashed password provided by client
-          timestamp: Timestamp used in hash
-          equipment_no: Equipment number (optional)
-
-        Returns:
-          LoginResult if login is successful, None otherwise.
-        """
-        user = self._get_user(account)
-        if not user or not user.is_active:
-            # TODO: Raise exceptions so we can return a useful error message
-            # to the web APIs.
-            logger.warning("Login failed: user not found or inactive: %s", account)
-            return None
-        code_tuple = self._random_codes.get(account)
-        if not code_tuple or code_tuple[1] != timestamp:
-            logger.warning(
-                "Login failed: random code missing or timestamp mismatch for %s",
-                account,
-            )
-            return None
-        if not self.verify_login_hash(account, password_hash, timestamp):
-            logger.warning("Login failed: invalid password hash for %s", account)
-            return None
-
-        # Check binding status
-        bound_devices = user.devices
-        is_bind = "Y" if bound_devices else "N"
-        is_bind_equipment = "N"
-        if equipment_no and equipment_no in bound_devices:
-            is_bind_equipment = "Y"
-
-        payload = {
-            "sub": account,
-            "equipment_no": equipment_no or "",
-            "iat": int(time.time()),
-            "exp": int(time.time()) + (self._config.expiration_hours * 3600),
-        }
-        token = jwt.encode(payload, self._config.secret_key, algorithm=JWT_ALGORITHM)
-
-        return LoginResult(
-            token=token,
-            is_bind=is_bind,
-            is_bind_equipment=is_bind_equipment,
-        )
-
-    def get_user_profile(self, account: str) -> UserVO | None:
-        """Get user profile."""
-        user = self._get_user(account)
-        if not user:
-            return None
-
-        # Default profile values
-        username = user.username
-        profile = user.profile
-
-        return UserVO(
-            user_name=profile.get("user_name", username),
-            email=user.email or profile.get("email", username),
-            phone=user.mobile or profile.get("phone", ""),
-            country_code=profile.get("country_code", "1"),
-            total_capacity=profile.get("total_capacity", "25485312"),
-            file_server=profile.get("file_server", "0"),
-            avatars_url=user.avatar or profile.get("avatars_url", ""),
-            birthday=profile.get("birthday", ""),
-            sex=profile.get("sex", ""),
-        )
-
-    def bind_equipment(self, account: str, equipment_no: str) -> bool:
-        """Bind a device to the user account."""
-        logger.info("Binding equipment %s to user %s", equipment_no, account)
-        user = self._get_user(account)
-        if not user:
-            logger.warning("User not found for binding: %s", account)
-            return False
-
-        if equipment_no not in user.devices:
-            user.devices.append(equipment_no)
-            self._users_config.save(self._config.users_file)
-
-        return True
-
-    def unlink_equipment(self, equipment_no: str) -> bool:
-        """Unlink a device from all users (or specifically one if we knew context)."""
-        logger.info("Unlinking equipment %s", equipment_no)
-        found = False
-        for user in self._users:
-            if equipment_no in user.devices:
-                user.devices.remove(equipment_no)
-                found = True
-
-        if found:
-            self._users_config.save(self._config.users_file)
-
-        return True