Add backend foundation: database models, security, and mail processing service

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
2026-02-01 12:44:22 +00:00
parent d128e34aa7
commit 130b53d37f
15 changed files with 1597 additions and 0 deletions
@@ -0,0 +1 @@
+"""Core package"""
@@ -0,0 +1,98 @@
+"""
+Application configuration using Pydantic settings.
+Supports environment variables and .env files.
+"""
+from typing import Optional, List
+from pydantic_settings import BaseSettings, SettingsConfigDict
+from pydantic import PostgresDsn, field_validator, ValidationInfo
+
+
+class Settings(BaseSettings):
+    """Application settings loaded from environment variables"""
+    
+    model_config = SettingsConfigDict(
+        env_file=".env",
+        env_file_encoding="utf-8",
+        case_sensitive=False,
+        extra="ignore"
+    )
+    
+    # Application
+    APP_NAME: str = "POP3 Forwarder SaaS"
+    APP_VERSION: str = "2.0.0"
+    DEBUG: bool = False
+    API_V1_PREFIX: str = "/api/v1"
+    
+    # Server
+    HOST: str = "0.0.0.0"
+    PORT: int = 8000
+    
+    # Database
+    DATABASE_URL: str = "postgresql+asyncpg://user:password@localhost:5432/pop3_forwarder"
+    DATABASE_POOL_SIZE: int = 20
+    DATABASE_MAX_OVERFLOW: int = 10
+    
+    # Security
+    SECRET_KEY: str = "change-this-to-a-secure-random-secret-key-in-production"
+    ALGORITHM: str = "HS256"
+    ACCESS_TOKEN_EXPIRE_MINUTES: int = 30
+    REFRESH_TOKEN_EXPIRE_DAYS: int = 7
+    
+    # Encryption (for storing POP3/IMAP credentials)
+    ENCRYPTION_KEY: str = "change-this-to-a-secure-encryption-key"
+    
+    # OAuth2 - Google
+    GOOGLE_CLIENT_ID: Optional[str] = None
+    GOOGLE_CLIENT_SECRET: Optional[str] = None
+    GOOGLE_REDIRECT_URI: str = "http://localhost:3000/auth/callback/google"
+    
+    # CORS
+    CORS_ORIGINS: List[str] = ["http://localhost:3000", "http://localhost:8000"]
+    
+    # Stripe Payment
+    STRIPE_API_KEY: Optional[str] = None
+    STRIPE_WEBHOOK_SECRET: Optional[str] = None
+    STRIPE_PUBLISHABLE_KEY: Optional[str] = None
+    
+    # Subscription Tiers
+    TIER_FREE_MAX_ACCOUNTS: int = 1
+    TIER_BASIC_MAX_ACCOUNTS: int = 5
+    TIER_PRO_MAX_ACCOUNTS: int = 20
+    TIER_ENTERPRISE_MAX_ACCOUNTS: int = 100
+    
+    # Email Processing
+    MAX_EMAILS_PER_RUN: int = 50
+    CHECK_INTERVAL_MINUTES: int = 5
+    THROTTLE_EMAILS_PER_MINUTE: int = 10
+    
+    # Redis (for Celery and caching)
+    REDIS_URL: str = "redis://localhost:6379/0"
+    
+    # Celery
+    CELERY_BROKER_URL: str = "redis://localhost:6379/0"
+    CELERY_RESULT_BACKEND: str = "redis://localhost:6379/0"
+    
+    # Apprise (notifications)
+    APPRISE_ENABLED: bool = True
+    
+    # Logging
+    LOG_LEVEL: str = "INFO"
+    
+    # Admin
+    ADMIN_EMAIL: Optional[str] = None
+    ADMIN_PASSWORD: Optional[str] = None
+    
+    # Mail Server Presets
+    MAIL_SERVER_PRESETS_FILE: str = "app/data/mail_server_presets.json"
+    
+    @field_validator("CORS_ORIGINS", mode="before")
+    @classmethod
+    def assemble_cors_origins(cls, v: str | List[str]) -> List[str]:
+        """Parse CORS origins from environment variable"""
+        if isinstance(v, str):
+            return [i.strip() for i in v.split(",")]
+        return v
+
+
+# Global settings instance
+settings = Settings()
@@ -0,0 +1,40 @@
+"""
+Database configuration and session management.
+"""
+from sqlalchemy.ext.asyncio import create_async_engine, AsyncSession, async_sessionmaker
+from sqlalchemy.orm import declarative_base
+from app.core.config import settings
+
+# Create async engine
+engine = create_async_engine(
+    settings.DATABASE_URL,
+    echo=settings.DEBUG,
+    pool_size=settings.DATABASE_POOL_SIZE,
+    max_overflow=settings.DATABASE_MAX_OVERFLOW,
+    pool_pre_ping=True,
+)
+
+# Create async session factory
+async_session_maker = async_sessionmaker(
+    engine,
+    class_=AsyncSession,
+    expire_on_commit=False,
+    autocommit=False,
+    autoflush=False,
+)
+
+# Base class for models
+Base = declarative_base()
+
+
+async def get_db() -> AsyncSession:
+    """Dependency for getting async database session"""
+    async with async_session_maker() as session:
+        try:
+            yield session
+            await session.commit()
+        except Exception:
+            await session.rollback()
+            raise
+        finally:
+            await session.close()
@@ -0,0 +1,133 @@
+"""
+Authentication dependencies for FastAPI.
+"""
+from typing import Optional
+from fastapi import Depends, HTTPException, status
+from fastapi.security import OAuth2PasswordBearer, HTTPBearer, HTTPAuthorizationCredentials
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy import select
+
+from app.core.database import get_db
+from app.core.security import decode_token
+from app.models.database_models import User
+
+# OAuth2 scheme for token authentication
+oauth2_scheme = OAuth2PasswordBearer(tokenUrl=f"/api/v1/auth/login", auto_error=False)
+http_bearer = HTTPBearer(auto_error=False)
+
+
+async def get_current_user(
+    token: Optional[str] = Depends(oauth2_scheme),
+    credentials: Optional[HTTPAuthorizationCredentials] = Depends(http_bearer),
+    db: AsyncSession = Depends(get_db)
+) -> User:
+    """
+    Get current authenticated user from JWT token.
+    Supports both OAuth2 password bearer and HTTP Bearer authentication.
+    """
+    # Get token from either source
+    auth_token = token or (credentials.credentials if credentials else None)
+    
+    if not auth_token:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Not authenticated",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+    
+    # Decode token
+    payload = decode_token(auth_token)
+    if not payload:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid authentication credentials",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+    
+    # Verify token type
+    token_type = payload.get("type")
+    if token_type != "access":
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid token type",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+    
+    # Get user ID from token
+    user_id: Optional[int] = payload.get("sub")
+    if user_id is None:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid token payload",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+    
+    # Fetch user from database
+    result = await db.execute(select(User).where(User.id == user_id))
+    user = result.scalar_one_or_none()
+    
+    if user is None:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="User not found",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+    
+    if not user.is_active:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="User account is inactive"
+        )
+    
+    return user
+
+
+async def get_current_active_user(
+    current_user: User = Depends(get_current_user),
+) -> User:
+    """Get current active user"""
+    if not current_user.is_active:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Inactive user"
+        )
+    return current_user
+
+
+async def get_current_superuser(
+    current_user: User = Depends(get_current_user),
+) -> User:
+    """Get current superuser"""
+    if not current_user.is_superuser:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Not enough permissions"
+        )
+    return current_user
+
+
+def check_subscription_tier(required_tier: str):
+    """
+    Dependency factory to check if user has required subscription tier.
+    Returns a dependency function.
+    """
+    tier_hierarchy = {
+        "free": 0,
+        "basic": 1,
+        "pro": 2,
+        "enterprise": 3
+    }
+    
+    async def check_tier(current_user: User = Depends(get_current_active_user)) -> User:
+        user_tier_level = tier_hierarchy.get(current_user.subscription_tier.value, 0)
+        required_tier_level = tier_hierarchy.get(required_tier, 0)
+        
+        if user_tier_level < required_tier_level:
+            raise HTTPException(
+                status_code=status.HTTP_402_PAYMENT_REQUIRED,
+                detail=f"This feature requires {required_tier} subscription or higher"
+            )
+        
+        return current_user
+    
+    return check_tier
@@ -0,0 +1,113 @@
+"""
+Security utilities for encryption, hashing, and token generation.
+"""
+import secrets
+from datetime import datetime, timedelta
+from typing import Optional, Dict, Any
+from jose import JWTError, jwt
+from passlib.context import CryptContext
+from cryptography.fernet import Fernet
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2
+import base64
+
+from app.core.config import settings
+
+
+# Password hashing context
+pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
+
+
+def verify_password(plain_password: str, hashed_password: str) -> bool:
+    """Verify a password against its hash"""
+    return pwd_context.verify(plain_password, hashed_password)
+
+
+def get_password_hash(password: str) -> str:
+    """Generate password hash"""
+    return pwd_context.hash(password)
+
+
+def create_access_token(data: Dict[str, Any], expires_delta: Optional[timedelta] = None) -> str:
+    """Create JWT access token"""
+    to_encode = data.copy()
+    
+    if expires_delta:
+        expire = datetime.utcnow() + expires_delta
+    else:
+        expire = datetime.utcnow() + timedelta(minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES)
+    
+    to_encode.update({"exp": expire, "type": "access"})
+    encoded_jwt = jwt.encode(to_encode, settings.SECRET_KEY, algorithm=settings.ALGORITHM)
+    return encoded_jwt
+
+
+def create_refresh_token(data: Dict[str, Any]) -> str:
+    """Create JWT refresh token"""
+    to_encode = data.copy()
+    expire = datetime.utcnow() + timedelta(days=settings.REFRESH_TOKEN_EXPIRE_DAYS)
+    to_encode.update({"exp": expire, "type": "refresh"})
+    encoded_jwt = jwt.encode(to_encode, settings.SECRET_KEY, algorithm=settings.ALGORITHM)
+    return encoded_jwt
+
+
+def decode_token(token: str) -> Optional[Dict[str, Any]]:
+    """Decode and validate JWT token"""
+    try:
+        payload = jwt.decode(token, settings.SECRET_KEY, algorithms=[settings.ALGORITHM])
+        return payload
+    except JWTError:
+        return None
+
+
+def generate_random_token(length: int = 32) -> str:
+    """Generate a secure random token"""
+    return secrets.token_urlsafe(length)
+
+
+class CredentialEncryption:
+    """Handles encryption/decryption of sensitive credentials (POP3/IMAP passwords)"""
+    
+    def __init__(self, key: Optional[str] = None):
+        """
+        Initialize encryption with a key.
+        If no key provided, uses the one from settings.
+        """
+        if key is None:
+            key = settings.ENCRYPTION_KEY
+        
+        # Derive a proper Fernet key from the provided key
+        kdf = PBKDF2(
+            algorithm=hashes.SHA256(),
+            length=32,
+            salt=b'pop3_forwarder_salt',  # In production, use unique salt per user
+            iterations=100000,
+        )
+        key_bytes = key.encode('utf-8')
+        derived_key = base64.urlsafe_b64encode(kdf.derive(key_bytes))
+        self.fernet = Fernet(derived_key)
+    
+    def encrypt(self, plain_text: str) -> str:
+        """Encrypt a string and return base64-encoded ciphertext"""
+        encrypted = self.fernet.encrypt(plain_text.encode('utf-8'))
+        return base64.b64encode(encrypted).decode('utf-8')
+    
+    def decrypt(self, encrypted_text: str) -> str:
+        """Decrypt a base64-encoded ciphertext"""
+        encrypted_bytes = base64.b64decode(encrypted_text.encode('utf-8'))
+        decrypted = self.fernet.decrypt(encrypted_bytes)
+        return decrypted.decode('utf-8')
+
+
+# Global encryption instance
+credential_encryptor = CredentialEncryption()
+
+
+def encrypt_credential(credential: str) -> str:
+    """Convenience function to encrypt a credential"""
+    return credential_encryptor.encrypt(credential)
+
+
+def decrypt_credential(encrypted_credential: str) -> str:
+    """Convenience function to decrypt a credential"""
+    return credential_encryptor.decrypt(encrypted_credential)