copilot-swe-agent[bot]
5fd0914b07
passlib 1.7.4 is incompatible with bcrypt>=5.0.0. When passlib initializes its bcrypt backend, it calls detect_wrap_bug() with a >72-byte test password. bcrypt 5.0.0 raises ValueError for such passwords, crashing the initialization before any user code runs. Fix: replace passlib[bcrypt] with direct bcrypt==4.3.0 usage: - security.py: use bcrypt.hashpw()/checkpw() instead of CryptContext - requirements.txt: replace passlib[bcrypt]==1.7.4 with bcrypt==4.3.0 Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com> Agent-Logs-Url: https://github.com/christianlouis/pop_puller_to_gmail/sessions/a2327bbe-cc06-4c1f-9010-380fb0fd7d67
136 lines
4.3 KiB
Python
136 lines
4.3 KiB
Python
"""
|
|
Security utilities for encryption, hashing, and token generation.
|
|
"""
|
|
|
|
import hashlib
|
|
import secrets
|
|
from datetime import datetime, timedelta
|
|
from typing import Optional, Dict, Any
|
|
import bcrypt
|
|
from jose import JWTError, jwt
|
|
from cryptography.fernet import Fernet
|
|
from cryptography.hazmat.primitives import hashes
|
|
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
|
|
import base64
|
|
|
|
from app.core.config import settings
|
|
|
|
|
|
def verify_password(plain_password: str, hashed_password: str) -> bool:
|
|
"""Verify a password against its hash"""
|
|
return bcrypt.checkpw(
|
|
plain_password.encode("utf-8"), hashed_password.encode("utf-8")
|
|
)
|
|
|
|
|
|
def get_password_hash(password: str) -> str:
|
|
"""Generate password hash"""
|
|
return bcrypt.hashpw(password.encode("utf-8"), bcrypt.gensalt()).decode("utf-8")
|
|
|
|
|
|
def create_access_token(
|
|
data: Dict[str, Any], expires_delta: Optional[timedelta] = None
|
|
) -> str:
|
|
"""Create JWT access token"""
|
|
to_encode = data.copy()
|
|
|
|
if expires_delta:
|
|
expire = datetime.utcnow() + expires_delta
|
|
else:
|
|
expire = datetime.utcnow() + timedelta(
|
|
minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES
|
|
)
|
|
|
|
to_encode.update({"exp": expire, "type": "access"})
|
|
encoded_jwt = jwt.encode(
|
|
to_encode, settings.SECRET_KEY, algorithm=settings.ALGORITHM
|
|
)
|
|
return encoded_jwt
|
|
|
|
|
|
def create_refresh_token(data: Dict[str, Any]) -> str:
|
|
"""Create JWT refresh token"""
|
|
to_encode = data.copy()
|
|
expire = datetime.utcnow() + timedelta(days=settings.REFRESH_TOKEN_EXPIRE_DAYS)
|
|
to_encode.update({"exp": expire, "type": "refresh"})
|
|
encoded_jwt = jwt.encode(
|
|
to_encode, settings.SECRET_KEY, algorithm=settings.ALGORITHM
|
|
)
|
|
return encoded_jwt
|
|
|
|
|
|
def decode_token(token: str) -> Optional[Dict[str, Any]]:
|
|
"""Decode and validate JWT token"""
|
|
try:
|
|
payload = jwt.decode(
|
|
token, settings.SECRET_KEY, algorithms=[settings.ALGORITHM]
|
|
)
|
|
return payload
|
|
except JWTError:
|
|
return None
|
|
|
|
|
|
def generate_random_token(length: int = 32) -> str:
|
|
"""Generate a secure random token"""
|
|
return secrets.token_urlsafe(length)
|
|
|
|
|
|
class CredentialEncryption:
|
|
"""Handles encryption/decryption of sensitive credentials (POP3/IMAP passwords)"""
|
|
|
|
def __init__(self, key: Optional[str] = None, user_id: Optional[int] = None):
|
|
"""
|
|
Initialize encryption with a key.
|
|
If no key provided, uses the one from settings.
|
|
In production, use a unique salt per user for enhanced security.
|
|
|
|
Args:
|
|
key: Encryption key (defaults to settings.ENCRYPTION_KEY)
|
|
user_id: Optional user ID for per-user salt generation
|
|
"""
|
|
if key is None:
|
|
key = settings.ENCRYPTION_KEY
|
|
|
|
# Generate salt - unique per user for enhanced security
|
|
if user_id is not None:
|
|
salt = hashlib.sha256(f"pop3fwd_usr_{user_id}".encode()).digest()[:16]
|
|
else:
|
|
# Default salt for system-wide operations (use with caution)
|
|
salt = b"pop3_forwarder_0"
|
|
|
|
# Derive a proper Fernet key from the provided key
|
|
kdf = PBKDF2HMAC(
|
|
algorithm=hashes.SHA256(),
|
|
length=32,
|
|
salt=salt,
|
|
iterations=100000,
|
|
)
|
|
key_bytes = key.encode("utf-8")
|
|
derived_key = base64.urlsafe_b64encode(kdf.derive(key_bytes))
|
|
self.fernet = Fernet(derived_key)
|
|
|
|
def encrypt(self, plain_text: str) -> str:
|
|
"""Encrypt a string and return base64-encoded ciphertext"""
|
|
encrypted = self.fernet.encrypt(plain_text.encode("utf-8"))
|
|
return base64.b64encode(encrypted).decode("utf-8")
|
|
|
|
def decrypt(self, encrypted_text: str) -> str:
|
|
"""Decrypt a base64-encoded ciphertext"""
|
|
encrypted_bytes = base64.b64decode(encrypted_text.encode("utf-8"))
|
|
decrypted = self.fernet.decrypt(encrypted_bytes)
|
|
return decrypted.decode("utf-8")
|
|
|
|
|
|
# Global encryption instance
|
|
credential_encryptor = CredentialEncryption()
|
|
|
|
|
|
def encrypt_credential(credential: str) -> str:
|
|
"""Convenience function to encrypt a credential"""
|
|
return credential_encryptor.encrypt(credential)
|
|
|
|
|
|
def decrypt_credential(encrypted_credential: str) -> str:
|
|
"""Convenience function to decrypt a credential"""
|
|
return credential_encryptor.decrypt(encrypted_credential)
|