def Login(self, request, context):
"""
Does the first step of the Login flow.
The user is searched for using their id, username, or email.
If the user does not exist, returns a LOGIN_NO_SUCH_USER.
If the user has a password, returns NEED_PASSWORD.
If the user exists but does not have a password, generates a login token, send it in the email and returns SENT_LOGIN_EMAIL.
"""
logging.debug(f"Attempting login for {request.user=}")
with session_scope(self._Session) as session:
# Gets user by one of id/username/email or None if not found
user = get_user_by_field(session, request.user)
if user:
if user.hashed_password is not None:
logging.debug(f"Found user with password")
return auth_pb2.LoginRes(next_step=auth_pb2.LoginRes.LoginStep.NEED_PASSWORD)
else:
logging.debug(f"Found user without password, sending login email")
login_token, expiry_text = new_login_token(session, user)
send_login_email(user, login_token, expiry_text)
return auth_pb2.LoginRes(next_step=auth_pb2.LoginRes.LoginStep.SENT_LOGIN_EMAIL)
else: # user not found
logging.debug(f"Didn't find user")
return auth_pb2.LoginRes(next_step=auth_pb2.LoginRes.LoginStep.INVALID_USER)
def Authenticate(self, request, context):
"""
Authenticates a classic password based login request.
request.user can be any of id/username/email
"""
logging.debug(f"Logging in with {request.user=}, password=*******")
with session_scope(self._Session) as session:
user = get_user_by_field(session, request.user)
if user:
logging.debug(f"Found user")
if not user.hashed_password:
logging.debug(f"User doesn't have a password!")
context.abort(grpc.StatusCode.FAILED_PRECONDITION, "User does not have a password")
if verify_password(user.hashed_password, request.password):
logging.debug(f"Right password")
# correct password
token = self._create_session(session, user)
return auth_pb2.AuthRes(token=token)
else:
logging.debug(f"Wrong password")
# wrong password
context.abort(grpc.StatusCode.UNAUTHENTICATED, "Invalid username or password")
else: # user not found
logging.debug(f"Didn't find user")
# do about as much work as if the user was found, reduces timing based username enumeration attacks
hash_password(request.password)
context.abort(grpc.StatusCode.UNAUTHENTICATED, "Invalid username or password")
def Authenticate(self, request, context):
"""
Authenticates a classic password based login request.
request.user can be any of id/username/email
"""
logger.debug(f"Logging in with {request.user=}, password=*******")
with session_scope() as session:
user = get_user_by_field(session, request.user)
if user:
logger.debug(f"Found user")
if not user.hashed_password:
logger.debug(f"User doesn't have a password!")
context.abort(grpc.StatusCode.FAILED_PRECONDITION, errors.NO_PASSWORD)
if verify_password(user.hashed_password, request.password):
logger.debug(f"Right password")
# correct password
token, expiry = self._create_session(context, session, user, request.remember_device)
context.send_initial_metadata(
[
("set-cookie", create_session_cookie(token, expiry)),
]
)
return auth_pb2.AuthRes(jailed=user.is_jailed)
else:
logger.debug(f"Wrong password")
# wrong password
context.abort(grpc.StatusCode.NOT_FOUND, errors.INVALID_USERNAME_OR_PASSWORD)
else: # user not found
logger.debug(f"Didn't find user")
# do about as much work as if the user was found, reduces timing based username enumeration attacks
hash_password(request.password)
context.abort(grpc.StatusCode.NOT_FOUND, errors.INVALID_USERNAME_OR_PASSWORD)
def GetUser(self, request, context):
with session_scope(self._Session) as session:
user = get_user_by_field(session, request.user)
if not user:
context.abort(grpc.StatusCode.NOT_FOUND, "No such user.")
return api_pb2.User(
username=user.username,
name=user.name,
city=user.city,
verification=user.verification,
community_standing=user.community_standing,
num_references=0,
gender=user.gender,
age=user.age,
color=user.color,
joined=Timestamp_from_datetime(user.display_joined),
last_active=Timestamp_from_datetime(user.display_last_active),
occupation=user.occupation,
about_me=user.about_me,
about_place=user.about_place,
languages=user.languages.split("|") if user.languages else [],
countries_visited=user.countries_visited.split("|")
if user.countries_visited else [],
countries_lived=user.countries_lived.split("|")
if user.countries_lived else [],
friends=get_friends_status(session, context.user_id, user.id),
)
def SendFriendRequest(self, request, context):
with session_scope(self._Session) as session:
from_user = session.query(User).filter(
User.id == context.user_id).one_or_none()
if not from_user:
context.abort(grpc.StatusCode.NOT_FOUND, "User not found.")
to_user = get_user_by_field(session, request.user)
if not to_user:
context.abort(grpc.StatusCode.NOT_FOUND, "User not found.")
if get_friends_status(
session, from_user.id,
to_user.id) != api_pb2.User.FriendshipStatus.NOT_FRIENDS:
context.abort(
grpc.StatusCode.FAILED_PRECONDITION,
"Can't send friend request. Already friends or pending.")
# Race condition!
friend_relationship = FriendRelationship(
from_user=from_user,
to_user=to_user,
status=FriendStatus.pending,
)
session.add(friend_relationship)
return empty_pb2.Empty()
def GetUser(self, request, context):
with session_scope() as session:
user = get_user_by_field(session, request.user)
if not user:
context.abort(grpc.StatusCode.NOT_FOUND, errors.USER_NOT_FOUND)
return user_model_to_pb(user, session, context)
def ResetPassword(self, request, context):
"""
If the user does not exist, do nothing.
If the user exists, we send them an email. If they have a password, clicking that email will remove the password.
If they don't have a password, it sends them an email saying someone tried to reset the password but there was none.
Note that as long as emails are send synchronously, this is far from constant time regardless of output.
"""
with session_scope() as session:
user = get_user_by_field(session, request.user)
if user:
password_reset_token, expiry_text = new_password_reset_token(session, user)
send_password_reset_email(user, password_reset_token, expiry_text)
else: # user not found
logger.debug(f"Didn't find user")
return empty_pb2.Empty()
def add_dummy_users():
try:
logger.info(f"Adding dummy users")
with session_scope() as session:
with open("src/data/dummy_users.json", "r") as file:
data = json.loads(file.read())
for user in data["users"]:
new_user = User(
username=user["username"],
email=user["email"],
hashed_password=hash_password(user["password"])
if user["password"] else None,
name=user["name"],
city=user["location"]["city"],
geom=create_coordinate(user["location"]["lat"],
user["location"]["lng"]),
geom_radius=user["location"]["radius"],
verification=user["verification"],
community_standing=user["community_standing"],
birthdate=date(year=user["birthdate"]["year"],
month=user["birthdate"]["month"],
day=user["birthdate"]["day"]),
gender=user["gender"],
languages="|".join(user["languages"]),
occupation=user["occupation"],
about_me=user["about_me"],
about_place=user["about_place"],
countries_visited="|".join(user["countries_visited"]),
countries_lived="|".join(user["countries_lived"]),
hosting_status=hostingstatus2sql[HostingStatus.Value(
user["hosting_status"])]
if "hosting_status" in user else None,
)
session.add(new_user)
session.commit()
for username1, username2 in data["friendships"]:
friend_relationship = FriendRelationship(
from_user_id=get_user_by_field(session, username1).id,
to_user_id=get_user_by_field(session, username2).id,
status=FriendStatus.accepted,
)
session.add(friend_relationship)
session.commit()
for reference in data["references"]:
reference_type = (ReferenceType.HOSTED
if reference["type"] == "hosted" else
(ReferenceType.SURFED if reference["type"]
== "surfed" else ReferenceType.FRIEND))
new_reference = Reference(
from_user_id=get_user_by_field(session,
reference["from"]).id,
to_user_id=get_user_by_field(session, reference["to"]).id,
reference_type=reference_type,
text=reference["text"],
rating=reference["rating"],
was_safe=reference["was_safe"],
)
session.add(new_reference)
session.commit()
for group_chat in data["group_chats"]:
# Create the chat
creator = group_chat["creator"]
conversation = Conversation()
session.add(conversation)
chat = GroupChat(
conversation=conversation,
title=group_chat["title"],
creator_id=get_user_by_field(session, creator).id,
is_dm=group_chat["is_dm"],
)
session.add(chat)
for participant in group_chat["participants"]:
subscription = GroupChatSubscription(
user_id=get_user_by_field(session,
participant["username"]).id,
group_chat=chat,
role=GroupChatRole.admin if participant["username"]
== creator else GroupChatRole.participant,
joined=parser.isoparse(participant["joined"]),
)
session.add(subscription)
for message in group_chat["messages"]:
session.add(
Message(
message_type=MessageType.text,
conversation=chat.conversation,
author_id=get_user_by_field(
session, message["author"]).id,
time=parser.isoparse(message["time"]),
text=message["message"],
))
session.commit()
except IntegrityError:
logger.error("Failed to insert dummy users, is it already inserted?")