e95c732c6f
Until now an admin created an account, the password appeared once on screen,
and that was the only copy. Gitea's Forgot password answers "Account recovery
is disabled because no email is set up", because this server has never been
able to send mail. Every route a member had to a password of their own was
closed, which made the members area unusable by anyone not standing next to the
owner.
Now: the admin enters a username and an email, the server creates the Gitea
account with a random password nobody ever sees — the admin included — and the
member is emailed a link to a Viena Latina page where they choose their own.
The same mechanism gives "¿Olvidaste tu contraseña?" that works, replacing
Gitea's dead page. Nobody leaves the site for either, which is possible because
PATCH /admin/users/{username} accepts a password.
A link is enough to take an account, so it is treated as a credential: single
use, short-lived, stored only as a SHA-256, and invalidated when a newer one is
issued so an older email stops working. SHA-256 rather than a password hash
because these are 32 random bytes, not something a person chose — there is no
dictionary to slow down. Recovery answers identically for a known and an
unknown address, or the form becomes a way to enumerate members one address at
a time, and stops after three tries so it cannot be used to mail-bomb somebody
using this server's reputation.
Rejecting a password deliberately does not spend the token. A typo must not
lock somebody out of an account they have never reached.
If the mail fails the admin is shown the link instead. The account exists
either way, so the difference is between a delayed invitation and a person who
simply never gets in.
Found while testing: the rate limit did not work at all. created_at is written
by SQLite as "2026-09-25 15:00:00" and I compared it against Python's
"2026-09-25T15:00:00+00:00"; a space sorts before T, so every row looked older
than any threshold and the limit silently never fired. It is now compared
inside SQLite, where the format and the clock are the same one.
Also drops two tabs from the sign-in page: OpenID, which nobody here will use,
and Register, which contradicted DISABLE_REGISTRATION and invited people to try
something the server then refused.
Verified: 126 checks. Tokens are hashed at rest, work once, expire, die when
reissued, and are refused for a suspended member; a short password and a Gitea
rejection both leave the link usable; recovery is indistinguishable for known
and unknown addresses and stops at three; creating a member emails them and
shows no password; a failed send surfaces the link.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NizVpJ2dwzCbjCrTLCjeHn
106 lines
3.5 KiB
Python
106 lines
3.5 KiB
Python
"""One-time links for setting a password.
|
|
|
|
Used for two things that are the same mechanism with different clocks: the
|
|
invitation a new member gets, and the reset an existing one asks for.
|
|
|
|
A token is a bearer credential — whoever holds it can set the password on that
|
|
account — so the rules are deliberately strict: single use, short-lived, and
|
|
only ever stored as a hash.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import hashlib
|
|
import secrets
|
|
from datetime import datetime, timedelta, timezone
|
|
|
|
from .db import get_db
|
|
|
|
INVITE_LIFETIME = timedelta(days=7)
|
|
RESET_LIFETIME = timedelta(hours=1)
|
|
|
|
# How many resets one member may ask for before the rest are quietly dropped.
|
|
# Without this, the "forgot password" form is a way to mail-bomb somebody using
|
|
# your server's good name.
|
|
RESET_WINDOW = timedelta(minutes=15)
|
|
RESET_LIMIT = 3
|
|
|
|
|
|
def _hash(token: str) -> str:
|
|
return hashlib.sha256(token.encode("utf-8")).hexdigest()
|
|
|
|
|
|
def _now() -> datetime:
|
|
return datetime.now(timezone.utc)
|
|
|
|
|
|
def issue(member_id: int, purpose: str) -> str:
|
|
"""Create a token, store its hash, return the token itself — once.
|
|
|
|
Any earlier unused token for the same member and purpose is marked used.
|
|
A member who asks for a second reset should not leave a first one lying in
|
|
an inbox, still working.
|
|
"""
|
|
lifetime = INVITE_LIFETIME if purpose == "invite" else RESET_LIFETIME
|
|
token = secrets.token_urlsafe(32)
|
|
db = get_db()
|
|
db.execute(
|
|
"""UPDATE invites SET used_at = datetime('now')
|
|
WHERE member_id = ? AND purpose = ? AND used_at IS NULL""",
|
|
(member_id, purpose),
|
|
)
|
|
db.execute(
|
|
"""INSERT INTO invites (member_id, token_hash, purpose, expires_at)
|
|
VALUES (?, ?, ?, ?)""",
|
|
(member_id, _hash(token), purpose, (_now() + lifetime).isoformat()),
|
|
)
|
|
return token
|
|
|
|
|
|
def rate_limited(member_id: int) -> bool:
|
|
"""Compared entirely inside SQLite, on purpose.
|
|
|
|
`created_at` is written by SQLite's own `datetime('now')`, which formats as
|
|
`2026-09-25 15:00:00` — a space, no offset. Python's `.isoformat()` produces
|
|
`2026-09-25T15:00:00+00:00`. Compared as strings, a space sorts before `T`,
|
|
so every stored row looks older than any Python-generated threshold and the
|
|
limit silently never fires. Letting SQLite compare its own format to its own
|
|
clock keeps the two conventions from ever meeting.
|
|
"""
|
|
row = get_db().execute(
|
|
"""SELECT COUNT(*) AS n FROM invites
|
|
WHERE member_id = ? AND purpose = 'reset'
|
|
AND created_at > datetime('now', ?)""",
|
|
(member_id, f"-{int(RESET_WINDOW.total_seconds() // 60)} minutes"),
|
|
).fetchone()
|
|
return row["n"] >= RESET_LIMIT
|
|
|
|
|
|
def lookup(token: str):
|
|
"""The member this token belongs to, or None if it is no good.
|
|
|
|
One return value for every kind of failure — unknown, used, expired — so a
|
|
caller cannot accidentally tell the holder which it was.
|
|
"""
|
|
if not token:
|
|
return None
|
|
row = get_db().execute(
|
|
"""SELECT i.id AS invite_id, i.purpose, i.expires_at, m.*
|
|
FROM invites i JOIN members m ON m.id = i.member_id
|
|
WHERE i.token_hash = ? AND i.used_at IS NULL""",
|
|
(_hash(token),),
|
|
).fetchone()
|
|
if row is None:
|
|
return None
|
|
if datetime.fromisoformat(row["expires_at"]) <= _now():
|
|
return None
|
|
if not row["active"] or row["role"] == "tombstone":
|
|
return None
|
|
return row
|
|
|
|
|
|
def consume(invite_id: int) -> None:
|
|
get_db().execute(
|
|
"UPDATE invites SET used_at = datetime('now') WHERE id = ?", (invite_id,)
|
|
)
|