anti
e967aaabfb
Locust @task(2) hammers /auth/login in steady state on top of the on_start burst. After caching the uuid-keyed user lookup and every other read endpoint, login alone accounted for 47% of total _execute at 500c/u — pure DB queueing on SELECT users WHERE username=?. 5s TTL, positive hits only (misses bypass so a freshly-created user can log in immediately). Password verify still runs against the cached hash, so security is unchanged — the only staleness window is: a changed password accepts the old password for up to 5s until invalidate_user_cache fires (it's called on every write).
48 lines
1.6 KiB
Python
48 lines
1.6 KiB
Python
from datetime import timedelta
|
|
from typing import Any, Optional
|
|
|
|
from fastapi import APIRouter, HTTPException, status
|
|
|
|
from decnet.telemetry import traced as _traced
|
|
from decnet.web.auth import (
|
|
ACCESS_TOKEN_EXPIRE_MINUTES,
|
|
averify_password,
|
|
create_access_token,
|
|
)
|
|
from decnet.web.dependencies import get_user_by_username_cached
|
|
from decnet.web.db.models import LoginRequest, Token
|
|
|
|
router = APIRouter()
|
|
|
|
|
|
@router.post(
|
|
"/auth/login",
|
|
response_model=Token,
|
|
tags=["Authentication"],
|
|
responses={
|
|
400: {"description": "Bad Request (e.g. malformed JSON)"},
|
|
401: {"description": "Incorrect username or password"},
|
|
422: {"description": "Validation error"}
|
|
},
|
|
)
|
|
@_traced("api.login")
|
|
async def login(request: LoginRequest) -> dict[str, Any]:
|
|
_user: Optional[dict[str, Any]] = await get_user_by_username_cached(request.username)
|
|
if not _user or not await averify_password(request.password, _user["password_hash"]):
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Incorrect username or password",
|
|
headers={"WWW-Authenticate": "Bearer"},
|
|
)
|
|
|
|
_access_token_expires: timedelta = timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES)
|
|
# Token uses uuid instead of sub
|
|
_access_token: str = create_access_token(
|
|
data={"uuid": _user["uuid"]}, expires_delta=_access_token_expires
|
|
)
|
|
return {
|
|
"access_token": _access_token,
|
|
"token_type": "bearer", # nosec B105 — OAuth2 token type, not a password
|
|
"must_change_password": bool(_user.get("must_change_password", False))
|
|
}
|