Pouzor
a56204a5f2
All settings (auth credentials, scanner ranges, status_checker interval) now live in a single .env file via pydantic-settings. config.yml and config.yml.example are deleted. - Settings: add auth_username, auth_password_hash, scanner_ranges, status_checker_interval; add load_overrides()/save_overrides() for persisting runtime changes to data/scan_config.json - auth.py: read credentials directly from settings - scan.py: read ranges/interval from settings; write-back via save_overrides() - scheduler.py: read interval directly from settings - main.py: call settings.load_overrides() at startup - docker-compose.yml: remove config.yml volume mount, add new env vars - conftest.py: set settings fields directly instead of writing a temp config.yml
32 lines
1.0 KiB
Python
32 lines
1.0 KiB
Python
import hmac
|
|
|
|
from fastapi import APIRouter, HTTPException, status
|
|
from pydantic import BaseModel
|
|
|
|
from app.core.config import settings
|
|
from app.core.security import create_access_token, verify_password
|
|
|
|
router = APIRouter()
|
|
|
|
|
|
class LoginRequest(BaseModel):
|
|
username: str
|
|
password: str
|
|
|
|
|
|
class TokenResponse(BaseModel):
|
|
access_token: str
|
|
token_type: str = "bearer"
|
|
|
|
|
|
@router.post("/login", response_model=TokenResponse)
|
|
async def login(body: LoginRequest) -> TokenResponse:
|
|
# Always run both checks to prevent timing-based username enumeration.
|
|
# hmac.compare_digest is constant-time; verify_password (bcrypt) always runs.
|
|
username_ok = hmac.compare_digest(body.username, settings.auth_username)
|
|
password_ok = verify_password(body.password, settings.auth_password_hash)
|
|
if not username_ok or not password_ok:
|
|
raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid credentials")
|
|
token = create_access_token(body.username)
|
|
return TokenResponse(access_token=token)
|