Authentication

AUTH_STRATEGY = "auth_local_classic"

AUTH_STRATEGY = "auth_remote_ldap"

def ldap_auth_strategy(person, password, app):
    if person["is_generated_from_ldap"]:
        # Connect to LDAP server
        server = Server(f"{app.config['LDAP_HOST']}:{app.config['LDAP_PORT']}", 
                       get_info=ALL, use_ssl=app.config['LDAP_SSL'])
        
        if app.config['LDAP_IS_AD']:
            user = f"{app.config['LDAP_DOMAIN']}\\{person['desktop_login']}"
            authentication = NTLM
        else:
            user = f"uid={person['desktop_login']},{app.config['LDAP_BASE_DN']}"
            authentication = SIMPLE
        
        conn = Connection(server, user=user, password=password, 
                         authentication=authentication)
        conn.bind()
        return person
    elif app.config['LDAP_FALLBACK']:
        # Fall back to local authentication
        return local_auth_strategy(person, password, app)

AUTH_STRATEGY = "auth_local_no_password"

{
  "sub": "user-uuid",              // User ID
  "identity_type": "person",       // person, bot, or person_api
  "jti": "token-unique-id",        // Token ID for blacklist
  "exp": 1234567890,                // Expiration timestamp
  "iat": 1234567890,                // Issued at timestamp
  "requires_2fa_setup": false       // 2FA enforcement flag
}

curl -X POST http://localhost:5000/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "artist@studio.com",
    "password": "securepassword"
  }'

{
  "user": {
    "id": "uuid",
    "email": "artist@studio.com",
    "first_name": "John",
    "last_name": "Doe",
    "role": "user",
    "active": true
  },
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}

curl -X GET http://localhost:5000/api/data/projects \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

fetch('http://localhost:5000/api/data/projects', {
  credentials: 'include'  // Include cookies
})

curl -X POST http://localhost:5000/auth/refresh-token \
  --cookie "refresh_token_cookie=eyJ..."

def pre_enable_totp(person_id):
    person = Person.get(person_id)
    person.totp_secret = pyotp.random_base32()
    totp = pyotp.TOTP(person.totp_secret)
    
    organisation = persons_service.get_organisation()
    totp_uri = totp.provisioning_uri(
        name=person.email, 
        issuer_name=f"Kitsu {organisation['name']}"
    )
    person.save()
    return totp_uri, person.totp_secret

def enable_totp(person_id, totp):
    person = Person.get(person_id)
    if pyotp.TOTP(person.totp_secret).verify(totp):
        person.totp_enabled = True
        # Generate recovery codes
        otp_recovery_codes = generate_recovery_codes()  # 16 codes
        person.otp_recovery_codes = hash_recovery_codes(otp_recovery_codes)
        person.save()
        return otp_recovery_codes

curl -X POST http://localhost:5000/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "user@studio.com",
    "password": "password",
    "totp": "123456"
  }'

def send_email_otp(person):
    # Generate random counter
    count = random.randint(0, 999999999999)
    otp = pyotp.HOTP(person["email_otp_secret"]).at(count)
    
    # Store counter in Redis (5 min TTL)
    auth_tokens_store.add(
        f"email-otp-count-{person['email']}", 
        count, 
        ttl=60 * 5
    )
    
    # Send email
    emails.send_email(
        subject="Your login code",
        body=f"Your code is: {otp}",
        recipient=person["email"]
    )

def pre_register_fido(person_id):
    person = Person.get(person_id)
    options, state = current_app.extensions["fido_server"].register_begin(
        PublicKeyCredentialUserEntity(
            id=str(person.id).encode(),
            name=person.email,
            display_name=person.full_name
        ),
        credentials=get_existing_credentials(person),
        user_verification="preferred",
        authenticator_attachment="cross-platform"
    )
    session[f"fido-state-{person.id}"] = state
    return dict(options.public_key)

ENFORCE_2FA=true
2FA_EXEMPT_USERS=admin@studio.com,service@studio.com

def generate_recovery_codes():
    return [
        ''.join(random.choice(string.ascii_uppercase + string.digits) 
                for _ in range(10))
        for _ in range(16)
    ]

def hash_recovery_codes(recovery_codes):
    return [flask_bcrypt.generate_password_hash(code) 
            for code in recovery_codes]

MIN_PASSWORD_LENGTH = 8  # Configurable

def check_login_failed_attemps(person):
    login_failed_attemps = person["login_failed_attemps"] or 0
    if (
        login_failed_attemps >= 5
        and person["last_login_failed"] + timedelta(minutes=1) 
        > datetime.now()
    ):
        raise TooMuchLoginFailedAttemps()
    return login_failed_attemps

SECRET_KEY=your-secret-key-here  # Change in production!

class Person:
    is_bot = db.Column(db.Boolean(), default=False)
    jti = db.Column(db.String(60), unique=True)  # Bot's permanent token ID

SAML_ENABLED=true
SAML_IDP_NAME="Company SSO"
SAML_METADATA_URL=https://idp.company.com/metadata