Add phase 1: Docker setup, auth with invitations and roles
- Django 5.2 + PostgreSQL 17 via docker compose (app + db, volumes, healthcheck on /healthz, test profile running pytest against Postgres) - Custom e-mail user model with user/admin roles - Invitation-only registration with single-use, hashed, expiring links - Admin area: invitations, role changes, deactivation, password reset via one-time link or temporary password (forced change on login) - First admin created from ADMIN_EMAIL/ADMIN_PASSWORD on startup - Login rate limiting per e-mail and IP (DB-backed, worker-safe) - Proxy middleware honouring X-Forwarded-* only from TRUSTED_PROXIES, optional CLIENT_IP_HEADER (e.g. CF-Connecting-IP) - Security headers (CSP, HSTS, Permissions-Policy), secure __Host- cookies - Mobile-first German UI, CLAUDE.md, README, init-env script - 65 tests for auth, permissions, proxy handling and rate limiting Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
Kyle Dammann
@@ -0,0 +1,137 @@
|
||||
"""User and invitation management for admins (/verwaltung/)."""
|
||||
|
||||
import secrets
|
||||
from functools import wraps
|
||||
|
||||
from django.contrib import messages
|
||||
from django.core.exceptions import PermissionDenied
|
||||
from django.db import transaction
|
||||
from django.shortcuts import get_object_or_404, redirect, render
|
||||
from django.utils import timezone
|
||||
from django.views.decorators.cache import never_cache
|
||||
from django.views.decorators.http import require_POST
|
||||
|
||||
from .forms import InvitationForm
|
||||
from .models import Invitation, PasswordResetToken, User
|
||||
|
||||
|
||||
def admin_required(view):
|
||||
@wraps(view)
|
||||
def wrapper(request, *args, **kwargs):
|
||||
if not request.user.is_admin:
|
||||
raise PermissionDenied
|
||||
return view(request, *args, **kwargs)
|
||||
|
||||
return wrapper
|
||||
|
||||
|
||||
def _show_once(request, title, value, hint):
|
||||
"""Render a secret (link or temporary password) that is not stored in plain text."""
|
||||
return render(request, "accounts/admin/show_once.html", {"title": title, "value": value, "hint": hint})
|
||||
|
||||
|
||||
@admin_required
|
||||
@never_cache
|
||||
def user_list(request):
|
||||
users = User.objects.order_by("-is_active", "display_name")
|
||||
return render(request, "accounts/admin/users.html", {"users": users})
|
||||
|
||||
|
||||
USER_ACTIONS = {"make_admin", "make_user", "deactivate", "activate", "reset_link", "temp_password"}
|
||||
|
||||
|
||||
@admin_required
|
||||
@require_POST
|
||||
@never_cache
|
||||
def user_action(request, pk, action):
|
||||
if action not in USER_ACTIONS:
|
||||
raise PermissionDenied
|
||||
with transaction.atomic():
|
||||
target = get_object_or_404(User.objects.select_for_update(), pk=pk)
|
||||
|
||||
if action in {"make_user", "deactivate"}:
|
||||
if target == request.user:
|
||||
messages.error(request, "Du kannst dir selbst die Admin-Rechte nicht entziehen oder dich deaktivieren.")
|
||||
return redirect("accounts:admin_users")
|
||||
other_admins = User.objects.filter(role=User.Role.ADMIN, is_active=True).exclude(pk=target.pk)
|
||||
if target.is_admin and not other_admins.exists():
|
||||
messages.error(request, "Es muss mindestens einen aktiven Admin geben.")
|
||||
return redirect("accounts:admin_users")
|
||||
|
||||
if action == "make_admin":
|
||||
target.role = User.Role.ADMIN
|
||||
target.save(update_fields=["role"])
|
||||
messages.success(request, f"{target} ist jetzt Admin.")
|
||||
elif action == "make_user":
|
||||
target.role = User.Role.USER
|
||||
target.save(update_fields=["role"])
|
||||
messages.success(request, f"{target} ist jetzt Nutzer.")
|
||||
elif action == "deactivate":
|
||||
target.is_active = False
|
||||
target.save(update_fields=["is_active"])
|
||||
PasswordResetToken.objects.usable().filter(user=target).update(revoked_at=timezone.now())
|
||||
messages.success(request, f"{target} wurde deaktiviert. Die Rezepte bleiben erhalten.")
|
||||
elif action == "activate":
|
||||
target.is_active = True
|
||||
target.save(update_fields=["is_active"])
|
||||
messages.success(request, f"{target} wurde wieder aktiviert.")
|
||||
elif action == "reset_link":
|
||||
if not target.is_active:
|
||||
messages.error(request, "Deaktivierte Nutzer können ihr Passwort nicht zurücksetzen.")
|
||||
return redirect("accounts:admin_users")
|
||||
_, link = PasswordResetToken.issue(target, created_by=request.user)
|
||||
return _show_once(
|
||||
request,
|
||||
f"Link zum Zurücksetzen für {target}",
|
||||
link,
|
||||
"Der Link ist 24 Stunden gültig und nur einmal verwendbar. Ältere Links für diesen Nutzer sind ungültig.",
|
||||
)
|
||||
elif action == "temp_password":
|
||||
if not target.is_active:
|
||||
messages.error(request, "Deaktivierte Nutzer können sich nicht anmelden.")
|
||||
return redirect("accounts:admin_users")
|
||||
password = secrets.token_urlsafe(12)
|
||||
target.set_password(password)
|
||||
target.must_change_password = True
|
||||
target.save(update_fields=["password", "must_change_password"])
|
||||
return _show_once(
|
||||
request,
|
||||
f"Temporäres Passwort für {target}",
|
||||
password,
|
||||
"Nach der Anmeldung muss sofort ein eigenes Passwort gesetzt werden. Bestehende Sitzungen wurden beendet.",
|
||||
)
|
||||
return redirect("accounts:admin_users")
|
||||
|
||||
|
||||
@admin_required
|
||||
@never_cache
|
||||
def invitation_list(request):
|
||||
form = InvitationForm(request.POST or None)
|
||||
if request.method == "POST" and form.is_valid():
|
||||
_, link = Invitation.issue(
|
||||
created_by=request.user,
|
||||
email=form.cleaned_data["email"],
|
||||
role=form.cleaned_data["role"],
|
||||
note=form.cleaned_data["note"],
|
||||
valid_days=form.cleaned_data["valid_days"],
|
||||
)
|
||||
return _show_once(
|
||||
request,
|
||||
"Neue Einladung",
|
||||
link,
|
||||
f"Schicke diesen Link an die eingeladene Person. Er ist {form.cleaned_data['valid_days']} Tage gültig "
|
||||
"und nur einmal verwendbar. Aus Sicherheitsgründen wird er nicht gespeichert und später nicht mehr angezeigt.",
|
||||
)
|
||||
invitations = Invitation.objects.select_related("created_by", "used_by")[:100]
|
||||
return render(request, "accounts/admin/invitations.html", {"form": form, "invitations": invitations})
|
||||
|
||||
|
||||
@admin_required
|
||||
@require_POST
|
||||
def invitation_revoke(request, pk):
|
||||
invitation = get_object_or_404(Invitation, pk=pk)
|
||||
if invitation.status == "open":
|
||||
invitation.revoked_at = timezone.now()
|
||||
invitation.save(update_fields=["revoked_at"])
|
||||
messages.success(request, "Einladung widerrufen.")
|
||||
return redirect("accounts:admin_invitations")
|
||||
@@ -0,0 +1,6 @@
|
||||
from django.apps import AppConfig
|
||||
|
||||
|
||||
class AccountsConfig(AppConfig):
|
||||
name = "accounts"
|
||||
verbose_name = "Konten"
|
||||
@@ -0,0 +1,107 @@
|
||||
from django import forms
|
||||
from django.contrib.auth import password_validation
|
||||
|
||||
from .models import Invitation, User, normalize_email
|
||||
|
||||
|
||||
class LoginForm(forms.Form):
|
||||
email = forms.EmailField(label="E-Mail", widget=forms.EmailInput(attrs={"autocomplete": "email", "autofocus": True}))
|
||||
password = forms.CharField(label="Passwort", strip=False, widget=forms.PasswordInput(attrs={"autocomplete": "current-password"}))
|
||||
|
||||
def clean_email(self):
|
||||
return normalize_email(self.cleaned_data["email"])
|
||||
|
||||
|
||||
class SetPasswordMixin(forms.Form):
|
||||
"""Two password fields validated with Django's password validators."""
|
||||
|
||||
password1 = forms.CharField(
|
||||
label="Neues Passwort",
|
||||
strip=False,
|
||||
widget=forms.PasswordInput(attrs={"autocomplete": "new-password"}),
|
||||
help_text="Mindestens 10 Zeichen, nicht nur Ziffern, kein gängiges Passwort.",
|
||||
)
|
||||
password2 = forms.CharField(
|
||||
label="Passwort wiederholen", strip=False, widget=forms.PasswordInput(attrs={"autocomplete": "new-password"})
|
||||
)
|
||||
|
||||
def password_user(self):
|
||||
"""User instance the new password is checked against (similarity validator)."""
|
||||
return None
|
||||
|
||||
def clean(self):
|
||||
cleaned = super().clean()
|
||||
p1, p2 = cleaned.get("password1"), cleaned.get("password2")
|
||||
if p1 and p2 and p1 != p2:
|
||||
self.add_error("password2", "Die Passwörter stimmen nicht überein.")
|
||||
elif p1:
|
||||
try:
|
||||
password_validation.validate_password(p1, self.password_user())
|
||||
except forms.ValidationError as error:
|
||||
self.add_error("password1", error)
|
||||
return cleaned
|
||||
|
||||
|
||||
class RegistrationForm(SetPasswordMixin):
|
||||
email = forms.EmailField(label="E-Mail", widget=forms.EmailInput(attrs={"autocomplete": "email"}))
|
||||
display_name = forms.CharField(label="Anzeigename", max_length=80, widget=forms.TextInput(attrs={"autocomplete": "nickname"}))
|
||||
|
||||
field_order = ["email", "display_name", "password1", "password2"]
|
||||
|
||||
def __init__(self, *args, invitation: Invitation, **kwargs):
|
||||
super().__init__(*args, **kwargs)
|
||||
self.invitation = invitation
|
||||
if invitation.email:
|
||||
self.fields["email"].initial = invitation.email
|
||||
self.fields["email"].disabled = True
|
||||
|
||||
def clean_email(self):
|
||||
email = normalize_email(self.invitation.email or self.cleaned_data["email"])
|
||||
if User.objects.filter(email=email).exists():
|
||||
raise forms.ValidationError("Für diese E-Mail-Adresse gibt es bereits ein Konto.")
|
||||
return email
|
||||
|
||||
def password_user(self):
|
||||
return User(email=self.cleaned_data.get("email", ""), display_name=self.cleaned_data.get("display_name", ""))
|
||||
|
||||
|
||||
class UserPasswordForm(SetPasswordMixin):
|
||||
def __init__(self, *args, user, **kwargs):
|
||||
super().__init__(*args, **kwargs)
|
||||
self.user = user
|
||||
|
||||
def password_user(self):
|
||||
return self.user
|
||||
|
||||
|
||||
class PasswordChangeForm(UserPasswordForm):
|
||||
old_password = forms.CharField(
|
||||
label="Aktuelles Passwort", strip=False, widget=forms.PasswordInput(attrs={"autocomplete": "current-password"})
|
||||
)
|
||||
field_order = ["old_password", "password1", "password2"]
|
||||
|
||||
def clean_old_password(self):
|
||||
password = self.cleaned_data["old_password"]
|
||||
if not self.user.check_password(password):
|
||||
raise forms.ValidationError("Das aktuelle Passwort ist falsch.")
|
||||
return password
|
||||
|
||||
|
||||
class ProfileForm(forms.ModelForm):
|
||||
class Meta:
|
||||
model = User
|
||||
fields = ["display_name"]
|
||||
|
||||
|
||||
class InvitationForm(forms.ModelForm):
|
||||
valid_days = forms.IntegerField(label="Gültig (Tage)", min_value=1, max_value=60, initial=7)
|
||||
|
||||
class Meta:
|
||||
model = Invitation
|
||||
fields = ["email", "role", "note"]
|
||||
|
||||
def clean_email(self):
|
||||
email = normalize_email(self.cleaned_data["email"])
|
||||
if email and User.objects.filter(email=email).exists():
|
||||
raise forms.ValidationError("Für diese E-Mail-Adresse gibt es bereits ein Konto.")
|
||||
return email
|
||||
@@ -0,0 +1,35 @@
|
||||
import os
|
||||
|
||||
from django.contrib.auth.password_validation import validate_password
|
||||
from django.core.exceptions import ValidationError
|
||||
from django.core.management.base import BaseCommand, CommandError
|
||||
|
||||
from accounts.models import User, normalize_email
|
||||
|
||||
|
||||
class Command(BaseCommand):
|
||||
help = (
|
||||
"Legt den ersten Admin aus ADMIN_EMAIL/ADMIN_PASSWORD an, falls diese E-Mail noch kein Konto hat. "
|
||||
"Bestehende Konten werden nie verändert."
|
||||
)
|
||||
|
||||
def handle(self, *args, **options):
|
||||
email = normalize_email(os.environ.get("ADMIN_EMAIL", ""))
|
||||
password = os.environ.get("ADMIN_PASSWORD", "")
|
||||
name = os.environ.get("ADMIN_NAME", "").strip() or "Admin"
|
||||
|
||||
if not email:
|
||||
if not User.objects.filter(role=User.Role.ADMIN).exists():
|
||||
self.stderr.write("Warnung: Es gibt noch keinen Admin. Setze ADMIN_EMAIL und ADMIN_PASSWORD in .env.")
|
||||
return
|
||||
if User.objects.filter(email=email).exists():
|
||||
return
|
||||
if not password:
|
||||
raise CommandError("ADMIN_EMAIL ist gesetzt, aber ADMIN_PASSWORD fehlt.")
|
||||
try:
|
||||
validate_password(password)
|
||||
except ValidationError as error:
|
||||
raise CommandError("ADMIN_PASSWORD ist zu schwach: " + " ".join(error.messages)) from error
|
||||
|
||||
User.objects.create_admin(email=email, password=password, display_name=name)
|
||||
self.stdout.write(f"Admin {email} angelegt. ADMIN_PASSWORD kann jetzt aus .env entfernt werden.")
|
||||
@@ -0,0 +1,17 @@
|
||||
from django.shortcuts import redirect
|
||||
from django.urls import reverse
|
||||
|
||||
|
||||
class ForcePasswordChangeMiddleware:
|
||||
"""After an admin set a temporary password, the user must choose a new one first."""
|
||||
|
||||
def __init__(self, get_response):
|
||||
self.get_response = get_response
|
||||
|
||||
def __call__(self, request):
|
||||
user = request.user
|
||||
if user.is_authenticated and user.must_change_password:
|
||||
allowed = {reverse("accounts:password_change"), reverse("accounts:logout"), reverse("core:healthz")}
|
||||
if request.path not in allowed:
|
||||
return redirect("accounts:password_change")
|
||||
return self.get_response(request)
|
||||
@@ -0,0 +1,79 @@
|
||||
# Generated by Django 5.2.18 on 2026-10-30 20:07
|
||||
|
||||
import django.db.models.deletion
|
||||
import django.db.models.functions.text
|
||||
import django.utils.timezone
|
||||
from django.conf import settings
|
||||
from django.db import migrations, models
|
||||
|
||||
|
||||
class Migration(migrations.Migration):
|
||||
|
||||
initial = True
|
||||
|
||||
dependencies = [
|
||||
]
|
||||
|
||||
operations = [
|
||||
migrations.CreateModel(
|
||||
name='User',
|
||||
fields=[
|
||||
('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
|
||||
('password', models.CharField(max_length=128, verbose_name='password')),
|
||||
('last_login', models.DateTimeField(blank=True, null=True, verbose_name='last login')),
|
||||
('email', models.EmailField(max_length=254, unique=True, verbose_name='E-Mail')),
|
||||
('display_name', models.CharField(max_length=80, verbose_name='Anzeigename')),
|
||||
('role', models.CharField(choices=[('user', 'Nutzer'), ('admin', 'Admin')], default='user', max_length=10, verbose_name='Rolle')),
|
||||
('is_active', models.BooleanField(default=True, verbose_name='Aktiv')),
|
||||
('must_change_password', models.BooleanField(default=False)),
|
||||
('date_joined', models.DateTimeField(default=django.utils.timezone.now, verbose_name='Registriert am')),
|
||||
],
|
||||
options={
|
||||
'verbose_name': 'Nutzer',
|
||||
'verbose_name_plural': 'Nutzer',
|
||||
'ordering': ['display_name'],
|
||||
'constraints': [models.UniqueConstraint(django.db.models.functions.text.Lower('email'), name='user_email_ci_unique')],
|
||||
},
|
||||
),
|
||||
migrations.CreateModel(
|
||||
name='Invitation',
|
||||
fields=[
|
||||
('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
|
||||
('token_hash', models.CharField(editable=False, max_length=64, unique=True)),
|
||||
('created_at', models.DateTimeField(auto_now_add=True)),
|
||||
('expires_at', models.DateTimeField()),
|
||||
('used_at', models.DateTimeField(blank=True, null=True)),
|
||||
('revoked_at', models.DateTimeField(blank=True, null=True)),
|
||||
('email', models.EmailField(blank=True, help_text='Wenn gesetzt, kann nur diese Adresse sich registrieren.', max_length=254, verbose_name='E-Mail (optional)')),
|
||||
('role', models.CharField(choices=[('user', 'Nutzer'), ('admin', 'Admin')], default='user', max_length=10, verbose_name='Rolle')),
|
||||
('note', models.CharField(blank=True, help_text='Nur für dich, z. B. für wen die Einladung ist.', max_length=120, verbose_name='Notiz')),
|
||||
('created_by', models.ForeignKey(null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='+', to=settings.AUTH_USER_MODEL)),
|
||||
('used_by', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='+', to=settings.AUTH_USER_MODEL)),
|
||||
],
|
||||
options={
|
||||
'verbose_name': 'Einladung',
|
||||
'verbose_name_plural': 'Einladungen',
|
||||
'ordering': ['-created_at'],
|
||||
'abstract': False,
|
||||
},
|
||||
),
|
||||
migrations.CreateModel(
|
||||
name='PasswordResetToken',
|
||||
fields=[
|
||||
('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
|
||||
('token_hash', models.CharField(editable=False, max_length=64, unique=True)),
|
||||
('created_at', models.DateTimeField(auto_now_add=True)),
|
||||
('expires_at', models.DateTimeField()),
|
||||
('used_at', models.DateTimeField(blank=True, null=True)),
|
||||
('revoked_at', models.DateTimeField(blank=True, null=True)),
|
||||
('created_by', models.ForeignKey(null=True, on_delete=django.db.models.deletion.SET_NULL, related_name='+', to=settings.AUTH_USER_MODEL)),
|
||||
('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='reset_tokens', to=settings.AUTH_USER_MODEL)),
|
||||
],
|
||||
options={
|
||||
'verbose_name': 'Passwort-Reset',
|
||||
'verbose_name_plural': 'Passwort-Resets',
|
||||
'ordering': ['-created_at'],
|
||||
'abstract': False,
|
||||
},
|
||||
),
|
||||
]
|
||||
@@ -0,0 +1,156 @@
|
||||
from datetime import timedelta
|
||||
|
||||
from django.conf import settings
|
||||
from django.contrib.auth.base_user import AbstractBaseUser, BaseUserManager
|
||||
from django.db import models
|
||||
from django.db.models.functions import Lower
|
||||
from django.urls import reverse
|
||||
from django.utils import timezone
|
||||
|
||||
from .tokens import hash_token, new_token
|
||||
|
||||
|
||||
def normalize_email(email):
|
||||
return (email or "").strip().lower()
|
||||
|
||||
|
||||
class UserManager(BaseUserManager):
|
||||
def create_user(self, email, password=None, display_name="", role="user", **extra):
|
||||
email = normalize_email(email)
|
||||
if not email:
|
||||
raise ValueError("E-Mail-Adresse fehlt.")
|
||||
user = self.model(email=email, display_name=display_name or email.split("@")[0], role=role, **extra)
|
||||
user.set_password(password)
|
||||
user.save(using=self._db)
|
||||
return user
|
||||
|
||||
def create_admin(self, email, password=None, display_name="", **extra):
|
||||
return self.create_user(email, password, display_name, role=User.Role.ADMIN, **extra)
|
||||
|
||||
def get_by_natural_key(self, email):
|
||||
return self.get(email=normalize_email(email))
|
||||
|
||||
|
||||
class User(AbstractBaseUser):
|
||||
class Role(models.TextChoices):
|
||||
USER = "user", "Nutzer"
|
||||
ADMIN = "admin", "Admin"
|
||||
|
||||
email = models.EmailField("E-Mail", unique=True)
|
||||
display_name = models.CharField("Anzeigename", max_length=80)
|
||||
role = models.CharField("Rolle", max_length=10, choices=Role.choices, default=Role.USER)
|
||||
is_active = models.BooleanField("Aktiv", default=True)
|
||||
must_change_password = models.BooleanField(default=False)
|
||||
date_joined = models.DateTimeField("Registriert am", default=timezone.now)
|
||||
|
||||
objects = UserManager()
|
||||
|
||||
USERNAME_FIELD = "email"
|
||||
EMAIL_FIELD = "email"
|
||||
REQUIRED_FIELDS = ["display_name"]
|
||||
|
||||
class Meta:
|
||||
verbose_name = "Nutzer"
|
||||
verbose_name_plural = "Nutzer"
|
||||
ordering = ["display_name"]
|
||||
constraints = [models.UniqueConstraint(Lower("email"), name="user_email_ci_unique")]
|
||||
|
||||
def __str__(self):
|
||||
return self.display_name
|
||||
|
||||
def save(self, *args, **kwargs):
|
||||
self.email = normalize_email(self.email)
|
||||
super().save(*args, **kwargs)
|
||||
|
||||
@property
|
||||
def is_admin(self):
|
||||
return self.is_active and self.role == self.Role.ADMIN
|
||||
|
||||
|
||||
class TokenQuerySet(models.QuerySet):
|
||||
def usable(self):
|
||||
return self.filter(used_at__isnull=True, revoked_at__isnull=True, expires_at__gt=timezone.now())
|
||||
|
||||
def get_usable(self, raw_token):
|
||||
"""Return the usable token object for a raw token, or None."""
|
||||
if not raw_token:
|
||||
return None
|
||||
return self.usable().filter(token_hash=hash_token(raw_token)).first()
|
||||
|
||||
|
||||
class OneTimeToken(models.Model):
|
||||
token_hash = models.CharField(max_length=64, unique=True, editable=False)
|
||||
created_at = models.DateTimeField(auto_now_add=True)
|
||||
expires_at = models.DateTimeField()
|
||||
used_at = models.DateTimeField(null=True, blank=True)
|
||||
revoked_at = models.DateTimeField(null=True, blank=True)
|
||||
|
||||
objects = TokenQuerySet.as_manager()
|
||||
|
||||
class Meta:
|
||||
abstract = True
|
||||
ordering = ["-created_at"]
|
||||
|
||||
@property
|
||||
def status(self):
|
||||
if self.used_at:
|
||||
return "used"
|
||||
if self.revoked_at:
|
||||
return "revoked"
|
||||
if self.expires_at <= timezone.now():
|
||||
return "expired"
|
||||
return "open"
|
||||
|
||||
@property
|
||||
def status_label(self):
|
||||
return {"used": "verwendet", "revoked": "widerrufen", "expired": "abgelaufen", "open": "offen"}[self.status]
|
||||
|
||||
|
||||
class Invitation(OneTimeToken):
|
||||
email = models.EmailField("E-Mail (optional)", blank=True, help_text="Wenn gesetzt, kann nur diese Adresse sich registrieren.")
|
||||
role = models.CharField("Rolle", max_length=10, choices=User.Role.choices, default=User.Role.USER)
|
||||
note = models.CharField("Notiz", max_length=120, blank=True, help_text="Nur für dich, z. B. für wen die Einladung ist.")
|
||||
created_by = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.SET_NULL, null=True, related_name="+")
|
||||
used_by = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.SET_NULL, null=True, blank=True, related_name="+")
|
||||
|
||||
class Meta(OneTimeToken.Meta):
|
||||
verbose_name = "Einladung"
|
||||
verbose_name_plural = "Einladungen"
|
||||
|
||||
@classmethod
|
||||
def issue(cls, created_by, email="", role=User.Role.USER, note="", valid_days=None):
|
||||
"""Create an invitation and return (invitation, absolute_link). The link is not stored."""
|
||||
raw, token_hash = new_token()
|
||||
days = valid_days or settings.INVITATION_VALID_DAYS
|
||||
invitation = cls.objects.create(
|
||||
token_hash=token_hash,
|
||||
email=normalize_email(email),
|
||||
role=role,
|
||||
note=note,
|
||||
created_by=created_by,
|
||||
expires_at=timezone.now() + timedelta(days=days),
|
||||
)
|
||||
return invitation, settings.APP_BASE_URL + reverse("accounts:register", args=[raw])
|
||||
|
||||
|
||||
class PasswordResetToken(OneTimeToken):
|
||||
user = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.CASCADE, related_name="reset_tokens")
|
||||
created_by = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.SET_NULL, null=True, related_name="+")
|
||||
|
||||
class Meta(OneTimeToken.Meta):
|
||||
verbose_name = "Passwort-Reset"
|
||||
verbose_name_plural = "Passwort-Resets"
|
||||
|
||||
@classmethod
|
||||
def issue(cls, user, created_by):
|
||||
"""Create a reset link for a user. Earlier open links for that user are revoked."""
|
||||
now = timezone.now()
|
||||
cls.objects.usable().filter(user=user).update(revoked_at=now)
|
||||
raw, token_hash = new_token()
|
||||
token = cls.objects.create(
|
||||
token_hash=token_hash,
|
||||
user=user,
|
||||
created_by=created_by,
|
||||
expires_at=now + timedelta(hours=settings.PASSWORD_RESET_VALID_HOURS),
|
||||
)
|
||||
return token, settings.APP_BASE_URL + reverse("accounts:password_reset", args=[raw])
|
||||
@@ -0,0 +1,18 @@
|
||||
"""One-time tokens for invitation and password-reset links.
|
||||
|
||||
Only a SHA-256 hash is stored, so a database leak does not expose usable links.
|
||||
The raw token exists only in the link shown to the admin once.
|
||||
"""
|
||||
|
||||
import hashlib
|
||||
import secrets
|
||||
|
||||
|
||||
def new_token():
|
||||
"""Return (raw_token, token_hash)."""
|
||||
raw = secrets.token_urlsafe(32)
|
||||
return raw, hash_token(raw)
|
||||
|
||||
|
||||
def hash_token(raw):
|
||||
return hashlib.sha256(raw.encode()).hexdigest()
|
||||
@@ -0,0 +1,18 @@
|
||||
from django.urls import path
|
||||
|
||||
from . import admin_views, views
|
||||
|
||||
app_name = "accounts"
|
||||
|
||||
urlpatterns = [
|
||||
path("anmelden/", views.login_view, name="login"),
|
||||
path("abmelden/", views.logout_view, name="logout"),
|
||||
path("einladung/<str:token>/", views.register, name="register"),
|
||||
path("passwort-zuruecksetzen/<str:token>/", views.password_reset, name="password_reset"),
|
||||
path("konto/", views.profile, name="profile"),
|
||||
path("konto/passwort/", views.password_change, name="password_change"),
|
||||
path("verwaltung/nutzer/", admin_views.user_list, name="admin_users"),
|
||||
path("verwaltung/nutzer/<int:pk>/<str:action>/", admin_views.user_action, name="admin_user_action"),
|
||||
path("verwaltung/einladungen/", admin_views.invitation_list, name="admin_invitations"),
|
||||
path("verwaltung/einladungen/<int:pk>/widerrufen/", admin_views.invitation_revoke, name="admin_invitation_revoke"),
|
||||
]
|
||||
@@ -0,0 +1,156 @@
|
||||
from datetime import timedelta
|
||||
|
||||
from django.conf import settings
|
||||
from django.contrib import messages
|
||||
from django.contrib.auth import authenticate, login, logout, update_session_auth_hash
|
||||
from django.contrib.auth.decorators import login_not_required
|
||||
from django.db import transaction
|
||||
from django.shortcuts import redirect, render
|
||||
from django.utils import timezone
|
||||
from django.utils.http import url_has_allowed_host_and_scheme
|
||||
from django.views.decorators.cache import never_cache
|
||||
from django.views.decorators.debug import sensitive_post_parameters
|
||||
from django.views.decorators.http import require_POST
|
||||
|
||||
from core import ratelimit
|
||||
|
||||
from .forms import LoginForm, PasswordChangeForm, ProfileForm, RegistrationForm, UserPasswordForm
|
||||
from .models import Invitation, PasswordResetToken, User
|
||||
|
||||
|
||||
def _login_limits(request, email):
|
||||
ip = request.META.get("REMOTE_ADDR", "unknown")
|
||||
return [
|
||||
(f"login:ip:{ip}", settings.LOGIN_MAX_FAILURES_PER_IP),
|
||||
(f"login:email:{email}", settings.LOGIN_MAX_FAILURES_PER_EMAIL),
|
||||
]
|
||||
|
||||
|
||||
def _safe_next(request):
|
||||
target = request.POST.get("next") or request.GET.get("next") or ""
|
||||
if url_has_allowed_host_and_scheme(target, allowed_hosts={request.get_host()}, require_https=request.is_secure()):
|
||||
return target
|
||||
return settings.LOGIN_REDIRECT_URL
|
||||
|
||||
|
||||
@login_not_required
|
||||
@sensitive_post_parameters("password")
|
||||
@never_cache
|
||||
def login_view(request):
|
||||
if request.user.is_authenticated:
|
||||
return redirect("core:home")
|
||||
form = LoginForm(request.POST or None)
|
||||
status = 200
|
||||
if request.method == "POST" and form.is_valid():
|
||||
email = form.cleaned_data["email"]
|
||||
window = timedelta(minutes=settings.LOGIN_LOCKOUT_MINUTES)
|
||||
limits = _login_limits(request, email)
|
||||
if any(ratelimit.is_limited(key, limit, window) for key, limit in limits):
|
||||
form.add_error(
|
||||
None,
|
||||
f"Zu viele fehlgeschlagene Anmeldeversuche. Bitte versuche es in "
|
||||
f"{settings.LOGIN_LOCKOUT_MINUTES} Minuten erneut.",
|
||||
)
|
||||
status = 429
|
||||
else:
|
||||
user = authenticate(request, email=email, password=form.cleaned_data["password"])
|
||||
if user is not None:
|
||||
ratelimit.reset(limits[1][0])
|
||||
login(request, user)
|
||||
return redirect(_safe_next(request))
|
||||
for key, limit in limits:
|
||||
ratelimit.hit(key, limit, window)
|
||||
# Same message for unknown e-mail, wrong password and deactivated accounts.
|
||||
form.add_error(None, "E-Mail oder Passwort ist falsch.")
|
||||
status = 400
|
||||
return render(request, "accounts/login.html", {"form": form, "next": request.GET.get("next", "")}, status=status)
|
||||
|
||||
|
||||
@require_POST
|
||||
def logout_view(request):
|
||||
logout(request)
|
||||
return redirect(settings.LOGOUT_REDIRECT_URL)
|
||||
|
||||
|
||||
@login_not_required
|
||||
@sensitive_post_parameters("password1", "password2")
|
||||
@never_cache
|
||||
def register(request, token):
|
||||
invitation = Invitation.objects.get_usable(token)
|
||||
if invitation is None:
|
||||
return render(request, "accounts/link_invalid.html", {"kind": "Einladungslink"}, status=404)
|
||||
if request.user.is_authenticated:
|
||||
return render(request, "accounts/already_logged_in.html", status=409)
|
||||
|
||||
form = RegistrationForm(request.POST or None, invitation=invitation)
|
||||
if request.method == "POST" and form.is_valid():
|
||||
with transaction.atomic():
|
||||
# Re-check under a row lock so one link cannot create two accounts.
|
||||
invitation = Invitation.objects.select_for_update().usable().filter(pk=invitation.pk).first()
|
||||
if invitation is None:
|
||||
return render(request, "accounts/link_invalid.html", {"kind": "Einladungslink"}, status=404)
|
||||
user = User.objects.create_user(
|
||||
email=form.cleaned_data["email"],
|
||||
password=form.cleaned_data["password1"],
|
||||
display_name=form.cleaned_data["display_name"],
|
||||
role=invitation.role,
|
||||
)
|
||||
invitation.used_at = timezone.now()
|
||||
invitation.used_by = user
|
||||
invitation.save(update_fields=["used_at", "used_by"])
|
||||
login(request, user, backend="django.contrib.auth.backends.ModelBackend")
|
||||
messages.success(request, "Willkommen im Kochbuch!")
|
||||
return redirect("core:home")
|
||||
return render(request, "accounts/register.html", {"form": form, "invitation": invitation})
|
||||
|
||||
|
||||
@login_not_required
|
||||
@sensitive_post_parameters("password1", "password2")
|
||||
@never_cache
|
||||
def password_reset(request, token):
|
||||
reset = PasswordResetToken.objects.get_usable(token)
|
||||
if reset is None or not reset.user.is_active:
|
||||
return render(request, "accounts/link_invalid.html", {"kind": "Link zum Zurücksetzen"}, status=404)
|
||||
|
||||
form = UserPasswordForm(request.POST or None, user=reset.user)
|
||||
if request.method == "POST" and form.is_valid():
|
||||
with transaction.atomic():
|
||||
reset = PasswordResetToken.objects.select_for_update().usable().filter(pk=reset.pk).first()
|
||||
if reset is None:
|
||||
return render(request, "accounts/link_invalid.html", {"kind": "Link zum Zurücksetzen"}, status=404)
|
||||
user = reset.user
|
||||
user.set_password(form.cleaned_data["password1"])
|
||||
user.must_change_password = False
|
||||
user.save(update_fields=["password", "must_change_password"])
|
||||
reset.used_at = timezone.now()
|
||||
reset.save(update_fields=["used_at"])
|
||||
login(request, user, backend="django.contrib.auth.backends.ModelBackend")
|
||||
messages.success(request, "Dein Passwort wurde geändert.")
|
||||
return redirect("core:home")
|
||||
return render(request, "accounts/password_reset.html", {"form": form, "reset_user": reset.user})
|
||||
|
||||
|
||||
@never_cache
|
||||
def profile(request):
|
||||
form = ProfileForm(request.POST or None, instance=request.user)
|
||||
if request.method == "POST" and form.is_valid():
|
||||
form.save()
|
||||
messages.success(request, "Profil gespeichert.")
|
||||
return redirect("accounts:profile")
|
||||
return render(request, "accounts/profile.html", {"form": form})
|
||||
|
||||
|
||||
@sensitive_post_parameters("old_password", "password1", "password2")
|
||||
@never_cache
|
||||
def password_change(request):
|
||||
user = request.user
|
||||
form_class = UserPasswordForm if user.must_change_password else PasswordChangeForm
|
||||
form = form_class(request.POST or None, user=user)
|
||||
if request.method == "POST" and form.is_valid():
|
||||
user.set_password(form.cleaned_data["password1"])
|
||||
user.must_change_password = False
|
||||
user.save(update_fields=["password", "must_change_password"])
|
||||
update_session_auth_hash(request, user)
|
||||
messages.success(request, "Dein Passwort wurde geändert.")
|
||||
return redirect("core:home")
|
||||
return render(request, "accounts/password_change.html", {"form": form, "forced": user.must_change_password})
|
||||
Reference in New Issue
Block a user