Password Encryption

Passwords are now encrypted in database. Thank you to Olivier Thauvin <olivier.thauvin@latmos.ipsl.fr> for bug report.

Password Encryption
Passwords are now encrypted in database. Thank you to Olivier Thauvin <olivier.thauvin@latmos.ipsl.fr> for bug report.
hitier
2 parents 57125da2 149f7875
Showing 5 changed files with 65 additions and 14 deletions Show diff stats
app/auth/models.py
app/auth/routes.py
app/commands/commands.py
resources/pdc_config.py
tests/backend_tests.py
 from pprint import pprint
-from flask_login import UserMixin, current_user
+from werkzeug.security import generate_password_hash, check_password_hash
+from flask_login import UserMixin
 from app.models import db
 #
@@ -47,8 +48,9 @@ class User(UserMixin, db.Model):
     email = db.Column(db.String(100), unique=True)
     name = db.Column(db.String(100))
     login = db.Column(db.String(100), unique=True)
-    password = db.Column(db.String(100))
     role = db.Column(db.Integer, default=0)
+    password = db.Column(db.String(128))
+    password_hash = db.Column(db.String(128))
     def __repr__(self):
         return "i: {}, n: {}, e: {}, l: {}".format(self.id, self.name, self.email, self.login)
@@ -56,7 +58,11 @@ class User(UserMixin, db.Model):
     # Set role at construction time
     def __init__(self, **kwargs):
         super(User, self).__init__(**kwargs)
-        self.set_role(kwargs['role'])
+        if ('role' in kwargs):
+            self.set_role(kwargs['role'])
+        if ('password' in kwargs):
+            self.set_password(kwargs['password'])
+            self.password = None
     def set_role(self, role):
         self.role = _checkRole(role)
@@ -68,3 +74,9 @@ class User(UserMixin, db.Model):
     def has_role_or_higher(self, role):
         role = _checkRole(role)
         return self.role and (self.role >= role)
+
+    def set_password(self, password):
+        self.password_hash = generate_password_hash(password)
+
+    def check_password(self, password):
+        return check_password_hash(self.password_hash, password)
@@ -52,7 +52,7 @@ def login_post():
     user_password = request.form.get('password')
     # user_remember = request.form.get('remember')
     user = User.query.filter_by(login=user_login).one_or_none()
-    if user and user.password == user_password:
+    if user and user.check_password(user_password):
         login_user(user)
         flash("Connection Réussie !", 'success')
         return redirect(url_for('main.index'))
@@ -12,7 +12,7 @@ from sqlalchemy.orm import Session
 from sqlalchemy import create_engine
 from app.models import db, Agent, Service, Project, Capacity, Period, Charge
-from app.auth.models import User
+from app.auth.models import User, _nameToRole
 from . import bp
@@ -199,7 +199,8 @@ def create_db():
     configure the proper database uri in the db_config.py file.
     """
     db.create_all()
-    admin = User(email='admin@nowhere.org', name='admin', login='admin', password='admin', role='admin')
+    admin = User(email='admin@nowhere.org', name='admin', login='admin', role='admin')
+    admin.set_password('admin')
     sqlite_uri = db.engine.url.__str__() if 'sqlite' in db.engine.url.__str__() else None
     try:
         db.session.add(admin)
@@ -219,12 +220,23 @@ def create_db():
 @click.argument('name')
 @click.argument('login')
 @click.argument('password')
-def user_add(email, name, login, password):
+@click.argument('role')
+def user_add(email, name, login, password, role):
     """ Add a new user in db."""
-    user = User(email=email, name=name, login=login, password=password)
+    user = User.query.filter(User.name == name).one_or_none()
+    if (user):
+        current_app.logger.error(f"user already exists {name}")
+        return
+    user = User(email=email, name=name, login=login, password=password, role=role)
     db.session.add(user)
     db.session.commit()
-    current_app.logger.info("added ", name)
+    current_app.logger.info(f"added {name}")
+
+
+@bp.cli.command('show_roles')
+def show_roles():
+    """ List all available roles for a user"""
+    print("\n".join(list(_nameToRole)))
 @bp.cli.command('user_show_all')
@@ -102,7 +102,7 @@ class DevConfig(Config):
 class TestConfig(Config):
     TESTING = True
     DEBUG = True
-    PDC_LOGS_LEVEL = 'ERROR'  # choose within  DEBUG, INFO, WARN, ERROR ( more levels in logging module )
+    PDC_LOGS_LEVEL = 'INFO'  # choose within  DEBUG, INFO, WARN, ERROR ( more levels in logging module )
     # Trying to set specific db uri from ./db_config.py
     try:
@@ -11,7 +11,8 @@ class BaseTestCase(unittest.TestCase):
         self.app = create_app(TestConfig)
         self.app_context = self.app.app_context()
         self.app_context.push()
-        # TODO: shall we always copy db from resources ?
+        # TODO: shall we always copy db from resources sqlite file ?
+        #       that would allow us to run all tests in sqlite:memory:
         # db.create_all()
         # admin = User(email='admin@nowhere.org', name='admin', login='admin', password='admin', role='admin')
         # db.session.add(admin)
@@ -48,16 +49,42 @@ class DbMgrTestCase(BaseTestCase):
 class AuthModelTestCase(BaseTestCase):
+    def skip_if_no_sqlitememory(self):
+        if 'memory' not in self.app.config['SQLALCHEMY_DATABASE_URI']:
+            self.skipTest("Needs in memory sqlite")
+
+    def get_admin(self):
+        return User.query.filter(User.name == 'admin').one()
+
+    def setUp(self):
+        BaseTestCase.setUp(self)
+        self.skip_if_no_sqlitememory()
+        db.create_all()
+        admin = User(email='admin@nowhere.org', name='admin', login='admin', role='admin')
+        db.session.add(admin)
+        db.session.commit()
+
+    def test_in_memory(self):
+        self.app.logger.info("In memory Sqlite DB for tests")
+        self.assertTrue(True)
+
     def test_setrole(self):
-        admin = User.query.filter(User.name == 'admin').one_or_none()
+        admin = self.get_admin()
         admin.set_role("ADMIN")
         db.session.commit()
-        admin = User.query.filter(User.name == 'admin').one_or_none()
+        admin = self.get_admin()
         self.assertTrue(admin is not None)
         self.assertTrue(admin.has_role("ADMIN"))
         self.assertFalse(admin.has_role("SERVICE"))
     def test_setrole_valueerror(self):
-        admin = User(email='me@nowhere.org', name='me', login='me', password='me', role='admin')
+        admin = self.get_admin()
         with self.assertRaises(ValueError) as ve:
             admin.set_role("NOSUCHROLE")
+
+    def test_setcheckpassword(self):
+        admin = self.get_admin()
+        admin.set_password("hahaha")
+        db.session.commit()
+        admin2 = self.get_admin()
+        self.assertTrue(admin2.check_password("hahaha"))