added password hashing and ensured admin user exists #8
@@ -34,10 +34,10 @@ def _ensure_admin_user() -> None:
|
||||
"""Create or update admin user from environment variables."""
|
||||
from baby_monitor.models.db.user import User
|
||||
from baby_monitor.utils.password import hash_password
|
||||
|
||||
|
||||
admin_username = os.getenv("ADMIN_USERNAME")
|
||||
admin_password = os.getenv("ADMIN_PASSWORD")
|
||||
|
||||
|
||||
if not admin_username:
|
||||
raise RuntimeError(
|
||||
"ADMIN_USERNAME environment variable is required but not set"
|
||||
@@ -46,16 +46,14 @@ def _ensure_admin_user() -> None:
|
||||
raise RuntimeError(
|
||||
"ADMIN_PASSWORD environment variable is required but not set"
|
||||
)
|
||||
|
||||
|
||||
db = SessionLocal()
|
||||
try:
|
||||
# Check if admin user exists
|
||||
admin_user = db.query(User).filter(
|
||||
User.username == admin_username
|
||||
).first()
|
||||
|
||||
admin_user = db.query(User).filter(User.username == admin_username).first()
|
||||
|
||||
hashed_pw = hash_password(admin_password)
|
||||
|
||||
|
||||
if admin_user:
|
||||
# Update existing admin user's password and ensure admin flag
|
||||
admin_user.hashed_password = hashed_pw # type: ignore[assignment]
|
||||
@@ -84,7 +82,7 @@ def init_db() -> None:
|
||||
# Ensure data directory exists
|
||||
DATA_DIR.mkdir(parents=True, exist_ok=True)
|
||||
Base.metadata.create_all(bind=engine)
|
||||
|
||||
|
||||
# Create admin user if it doesn't exist
|
||||
_ensure_admin_user()
|
||||
|
||||
|
||||
@@ -42,7 +42,7 @@ class InMemoryTokenRepository(TokenRepositoryInterface):
|
||||
|
||||
def cleanup_expired(self) -> None:
|
||||
"""Remove expired tokens."""
|
||||
now = datetime.utcnow()
|
||||
now = datetime.now(UTC)
|
||||
expired_tokens = [
|
||||
token for token, (_, expiry) in self._tokens.items() if now > expiry
|
||||
]
|
||||
|
||||
@@ -80,16 +80,12 @@ def login(
|
||||
# Check if user exists in database
|
||||
user = user_repo.get_by_username(credentials.username)
|
||||
if not user:
|
||||
raise HTTPException(
|
||||
status_code=401, detail="Invalid username or password"
|
||||
)
|
||||
|
||||
raise HTTPException(status_code=401, detail="Invalid username or password")
|
||||
|
||||
# Verify password using bcrypt
|
||||
if not verify_password(credentials.password, user["hashed_password"]):
|
||||
raise HTTPException(
|
||||
status_code=401, detail="Invalid username or password"
|
||||
)
|
||||
|
||||
raise HTTPException(status_code=401, detail="Invalid username or password")
|
||||
|
||||
# Generate a secure random token
|
||||
access_token = secrets.token_urlsafe(32)
|
||||
token_repo.store(access_token, user_id=user["id"], ttl=3600)
|
||||
|
||||
Reference in New Issue
Block a user