100 lines
4.5 KiB
Python
100 lines
4.5 KiB
Python
from app import db, login_manager
|
|
from flask_login import UserMixin
|
|
from werkzeug.security import generate_password_hash, check_password_hash
|
|
from app.utils.time_utils import now_eastern
|
|
|
|
@login_manager.user_loader
|
|
def load_user(user_id):
|
|
from app import db
|
|
return db.session.get(User, int(user_id))
|
|
|
|
class User(UserMixin, db.Model):
|
|
__tablename__ = 'users'
|
|
|
|
id = db.Column(db.Integer, primary_key=True)
|
|
username = db.Column(db.String(100), unique=True, nullable=False, index=True)
|
|
full_name = db.Column(db.String(150), nullable=True)
|
|
email = db.Column(db.String(255), unique=True, nullable=False, index=True)
|
|
password_hash = db.Column(db.String(255), nullable=False)
|
|
role = db.Column(
|
|
# Phase 11 migration complete — 'supervisor' removed from both the DB
|
|
# ENUM and this Python-side declaration. Director is the canonical role.
|
|
db.Enum('admin', 'director', 'inspector', 'project_manager', 'customer', 'auditor'),
|
|
nullable=False
|
|
)
|
|
created_at = db.Column(db.DateTime, default=now_eastern)
|
|
active = db.Column(db.Boolean, default=True, nullable=False)
|
|
|
|
# ── Customer password-setup workflow ──────────────────────────────────
|
|
# password_set: False for newly created customer accounts until they
|
|
# complete the set-password flow via emailed link.
|
|
# Always True for internal users created via UserForm.
|
|
password_set = db.Column(db.Boolean, nullable=False, default=True)
|
|
set_password_token = db.Column(db.String(64), nullable=True, index=True)
|
|
set_password_token_expires = db.Column(db.DateTime, nullable=True)
|
|
|
|
# Relationships
|
|
inspections = db.relationship('Inspection', backref='inspector', lazy='dynamic')
|
|
|
|
# ── Flask-Login integration ────────────────────────────────────────────
|
|
# Override UserMixin.is_active so that disabled accounts are rejected
|
|
# automatically by login_required and login_user() without any extra code.
|
|
@property
|
|
def is_active(self):
|
|
return self.active
|
|
|
|
def set_password(self, password):
|
|
self.password_hash = generate_password_hash(password)
|
|
|
|
def check_password(self, password):
|
|
return check_password_hash(self.password_hash, password)
|
|
|
|
@property
|
|
def display_name(self):
|
|
"""Return full name if set, otherwise fall back to username."""
|
|
return self.full_name.strip() if self.full_name and self.full_name.strip() else self.username
|
|
|
|
def generate_set_password_token(self, expires_hours=72):
|
|
"""Create a one-time set-password token valid for `expires_hours` hours."""
|
|
import secrets
|
|
from datetime import timedelta
|
|
self.set_password_token = secrets.token_hex(32) # 64 hex chars
|
|
self.set_password_token_expires = now_eastern() + timedelta(hours=expires_hours)
|
|
return self.set_password_token
|
|
|
|
def clear_set_password_token(self):
|
|
"""Invalidate the token after use."""
|
|
self.set_password_token = None
|
|
self.set_password_token_expires = None
|
|
|
|
@staticmethod
|
|
def verify_set_password_token(token):
|
|
"""Return the User whose token matches, or None if invalid/expired.
|
|
|
|
The final token comparison uses hmac.compare_digest so that the
|
|
comparison runs in constant time regardless of how many characters
|
|
match, preventing timing-based token enumeration attacks.
|
|
"""
|
|
import hmac
|
|
if not token:
|
|
return None
|
|
# Primary lookup is via DB index — compare_digest is a defense-in-depth
|
|
# guard applied after the row is retrieved to harden the string comparison.
|
|
user = User.query.filter_by(set_password_token=token).first()
|
|
if user is None:
|
|
return None
|
|
if user.set_password_token_expires is None:
|
|
return None
|
|
if now_eastern() > user.set_password_token_expires:
|
|
return None
|
|
# Constant-time comparison — prevents timing oracle on the stored token.
|
|
# Wrapped in try/except to guard against unexpected type mismatches.
|
|
try:
|
|
if not hmac.compare_digest(user.set_password_token, token):
|
|
return None
|
|
except (TypeError, ValueError):
|
|
return None
|
|
return user
|
|
|
|
def __repr__(self):
|
|
return f'<User {self.username}>' |