anti
9fc489258b
A stolen JWT used to survive a password reset for its full 24h. Now every session-invalidating change moves the user's tokens_valid_from cutoff to 'now', so all of that user's prior tokens 401 on next use: - self change-password, admin reset-password, role change all bump the cutoff (delete needs no bump: the row is gone, so the user lookup 401s). - Cutoff is compared against the token's iat floored to whole seconds, so a re-login in the same second as the change isn't caught by its own revocation (the cost is a <=1s grey zone on same-second-old tokens). - Per-user: changing one user never revokes another.
41 lines
1.7 KiB
Python
41 lines
1.7 KiB
Python
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
from datetime import datetime, timezone
|
|
from typing import Any, Optional
|
|
|
|
from fastapi import APIRouter, Depends, HTTPException, status
|
|
|
|
from decnet.telemetry import traced as _traced
|
|
from decnet.web.auth import ahash_password, averify_password
|
|
from decnet.web.dependencies import get_current_user_unchecked, invalidate_user_cache, repo
|
|
from decnet.web.db.models import ChangePasswordRequest, MessageResponse
|
|
|
|
router = APIRouter()
|
|
|
|
|
|
@router.post(
|
|
"/auth/change-password",
|
|
tags=["Authentication"],
|
|
response_model=MessageResponse,
|
|
responses={
|
|
400: {"description": "Bad Request (e.g. malformed JSON)"},
|
|
401: {"description": "Could not validate credentials"},
|
|
422: {"description": "Validation error"}
|
|
},
|
|
)
|
|
@_traced("api.change_password")
|
|
async def change_password(request: ChangePasswordRequest, current_user: str = Depends(get_current_user_unchecked)) -> dict[str, str]:
|
|
_user: Optional[dict[str, Any]] = await repo.get_user_by_uuid(current_user)
|
|
if not _user or not await averify_password(request.old_password, _user["password_hash"]):
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Incorrect old password",
|
|
)
|
|
|
|
_new_hash: str = await ahash_password(request.new_password)
|
|
await repo.update_user_password(current_user, _new_hash, must_change_password=False)
|
|
# Changing a password revokes every existing session for this user (incl.
|
|
# the current one): the caller's next request 401s and re-authenticates.
|
|
await repo.set_tokens_valid_from(current_user, datetime.now(timezone.utc))
|
|
invalidate_user_cache(current_user)
|
|
return {"message": "Password updated successfully"}
|