def verify_email(token):
''' creates a email_token_hash and sends email with token to user (assumes login=email), idempotent (could be use for resend)'''
user_id = User.decode_email_token(token)
user = User.get(user_id)
if not user or not user.email_token_hash:
raise NotFoundException(
message='Invalid verification. Please try again.')
bcrypt.check_password_hash(user.email_token_hash, token)
with session_scope(db.session):
user.email_validation_date = datetime.utcnow()
return {
'status': 'success',
'message': 'Successful email verification.',
}
def post(self):
post_data = api.payload
response_object = {'status': 'fail', 'message': 'Invalid payload'}
if not post_data:
return response_object, HTTPStatus.BAD_REQUEST
email = post_data.get('email')
password = post_data.get('password')
try:
user = Users.query.filter_by(email=email).first()
if user and bcrypt.check_password_hash(user.password, password):
auth_token = user.encode_auth_token(user.id)
if auth_token:
response_object = {
'status': 'success',
'message': 'Successfully logged in',
'auth_token': auth_token.decode()
}
return response_object, HTTPStatus.OK
else:
response_object['message'] = 'User does not exist'
return response_object, HTTPStatus.NOT_FOUND
except Exception as e:
api.logger.error(e)
response_object['message'] = 'Try again.'
return response_object, HTTPStatus.INTERNAL_SERVER_ERROR
def login_user():
post_data = request.get_json()
response_object = {'status': 'fail', 'message': 'Invalid payload'}
if not post_data:
return jsonify(response_object), HTTPStatus.BAD_REQUEST
username = post_data.get('username')
password = post_data.get('password')
try:
user = Users.query.filter_by(username=username).first()
if user and bcrypt.check_password_hash(user.password, password):
auth_token = user.encode_auth_token(user.id)
if auth_token:
response_object = {
'status': 'success',
'message': 'Successfully logged in',
'auth_token': auth_token.decode()
}
return jsonify(response_object), HTTPStatus.OK
else:
response_object['message'] = 'User does not exist'
return jsonify(response_object), HTTPStatus.NOT_FOUND
except Exception as e:
log.error(e)
response_object['message'] = 'Try again.'
return jsonify(response_object), HTTPStatus.INTERNAL_SERVER_ERROR
def set_standalone_user(user_id: int):
''' changes user password when logged in'''
post_data = request.get_json()
if not post_data:
raise InvalidPayload()
username = post_data.get('username')
pw_old = post_data.get('old_password')
pw_new = post_data.get('new_password')
if not username or not pw_old or not pw_new:
raise InvalidPayload()
# fetch the user data
user = User.get(user_id)
if not user.fb_id:
raise NotFoundException(
message='Must be a facebook user login. Please try again.')
# fetch the user data
user = User.get(user_id)
if not bcrypt.check_password_hash(user.password, pw_old):
raise NotFoundException(message='Invalid password. Please try again.')
if not User.first(User.username == username):
with session_scope(db.session):
user.username = username
user.password = bcrypt.generate_password_hash(
pw_new, current_app.config.get('BCRYPT_LOG_ROUNDS')).decode()
return {
'status': 'success',
'message': 'Successfully changed password.',
}
else:
raise BusinessException(
message=
'Sorry. That username already exists, choose another username')
def password_reset():
''' reset user password (assumes login=email)'''
post_data = request.get_json()
if not post_data:
raise InvalidPayload()
token = post_data.get('token')
pw_new = post_data.get('password')
if not token or not pw_new:
raise InvalidPayload()
# fetch the user data
user_id = User.decode_password_token(token)
user = User.get(user_id)
if not user or not user.token_hash or not bcrypt.check_password_hash(
user.token_hash, token):
raise NotFoundException(message='Invalid reset. Please try again.')
with session_scope(db.session):
user.password = bcrypt.generate_password_hash(
pw_new, current_app.config.get('BCRYPT_LOG_ROUNDS')).decode()
user.token_hash = None
return {
'status': 'success',
'message': 'Successfully reset password.',
}
def authenticate(cls, email, password):
found_user = cls.query.filter_by(email=email).first()
if found_user:
authenticated_user = bcrypt.check_password_hash(
found_user.password, password)
if authenticated_user:
# Return the user in the event we want to store information in the session
return found_user
return False
def login_user():
# get post data
post_data = request.get_json()
if not post_data:
raise InvalidPayload()
email = post_data.get('email')
password = post_data.get('password')
if not password:
raise InvalidPayload()
user = User.first_by(email=email)
if user and bcrypt.check_password_hash(user.password, password):
# register device if needed
if all(x in request.headers for x in [
Constants.HttpHeaders.DEVICE_ID,
Constants.HttpHeaders.DEVICE_TYPE
]):
device_id = request.headers.get(Constants.HttpHeaders.DEVICE_ID)
device_type = request.headers.get(
Constants.HttpHeaders.DEVICE_TYPE)
with session_scope(db.session):
Device.create_or_update(device_id=device_id,
device_type=device_type,
user=user)
auth_token = user.encode_auth_token()
return {
'status': 'success',
'message': 'Successfully logged in.',
'auth_token': auth_token
}
else:
# user is not logged in, set False to device.active
if Constants.HttpHeaders.DEVICE_ID in request.headers:
device_id = request.headers.get(Constants.HttpHeaders.DEVICE_ID)
device = Device.first_by(device_id=device_id)
if device:
with session_scope(db.session):
device.active = False
raise NotFoundException(message='User does not exist.')
def password_change(user_id: int):
''' changes user password when logged in'''
post_data = request.get_json()
if not post_data:
raise InvalidPayload()
pw_old = post_data.get('old_password')
pw_new = post_data.get('new_password')
if not pw_old or not pw_new:
raise InvalidPayload()
# fetch the user data
user = User.get(user_id)
if not bcrypt.check_password_hash(user.password, pw_old):
raise BusinessException(message='Invalid password. Please try again.')
with session_scope(db.session):
user.password = bcrypt.generate_password_hash(
pw_new, current_app.config.get('BCRYPT_LOG_ROUNDS')).decode()
return {
'status': 'success',
'message': 'Successfully changed password.',
}
def check_password(self, value):
"""Check password."""
return bcrypt.check_password_hash(self.password, value)
