class User(UserMixin, CRUDMixin, db.Model):
__tablename__ = 'users_user'
id = db.Column(db.Integer, primary_key=True)
name = db.Column(db.String(50))
email = db.Column(db.String(120), unique=True)
_password = db.Column(db.String(120))
_clear_pw = db.Column(db.String(120))
_salt = db.Column(db.String(120))
sites = db.relationship('Site', backref='owner', lazy='dynamic')
@hybrid_property
def password(self):
return self._password
@password.setter
def password(self, pw_input):
rounds = current_app.config.get("HASH_ROUNDS")
self._password = sha256_crypt.hash(pw_input, rounds=rounds)
self._clear_pw = pw_input
if self._salt is None:
self._salt = random.random()
def is_valid_password(self, pw):
return sha256_crypt.verify(pw, self._password)
def __repr__(self):
return f'<User #{self.id}>'
class Site(CRUDMixin, db.Model):
__tablename__ = 'tracking_site'
base_url = db.Column(db.String)
visits = db.relationship('Visit', backref='site', lazy='select')
user_id = db.Column(db.Integer, db.ForeignKey('users_user.id'))
def __repr__(self):
return f'<Site {self.id}: {self.base_url}>'
def __str__(self):
return self.base_url
class User(UserMixin, CRUDMixin, db.Model):
__tablename__ = 'users_user'
name = db.Column(db.String(50))
email = db.Column(db.String(120), unique=True)
_password = db.Column(db.LargeBinary(120))
_salt = db.Column(db.String(120))
sites = db.relationship('Site', backref='owner', lazy='dynamic')
@hybrid_property
def password(self):
return self._password
# In order to ensure that passwords are always stored
# hashed and salted in our database we use a descriptor
# here which will automatically hash our password
# when we provide it (i. e. user.password = "******")
@password.setter
def password(self, value):
# When a user is first created, give them a salt
if self._salt is None:
self._salt = bytes(SystemRandom().getrandbits(128))
self._password = self._hash_password(value)
def is_valid_password(self, password):
"""Ensure that the provided password is valid.
We are using this instead of a ``sqlalchemy.types.TypeDecorator``
(which would let us write ``User.password == password`` and have the incoming
``password`` be automatically hashed in a SQLAlchemy query)
because ``compare_digest`` properly compares **all***
the characters of the hash even when they do not match in order to
avoid timing oracle side-channel attacks."""
new_hash = self._hash_password(password)
return compare_digest(new_hash, self._password)
def _hash_password(self, password):
pwd = password.encode("utf-8")
salt = bytes(self._salt)
rounds = current_app.config.get("HASH_ROUNDS", 100000)
buff = pbkdf2_hmac("sha512", pwd, salt, iterations=rounds)
return bytes(buff)
def __repr__(self):
return "<User #{:d}>".format(self.id)