bvandeusenandClaude Opus 4.8
3c76b50a9c
Native clients (Tauri/Android) authenticate sync with a long-lived device bearer token, alongside the existing web session cookie. Backend: - security.py: generate_token() (secrets.token_urlsafe) + hash_token() (SHA-256 — device tokens are already high-entropy, so no slow KDF; keeps per-request bearer auth cheap). Only the hash is stored. - device_tokens table (migration 0016): id, user_id, token_hash (unique), name, created_at, last_used_at. - login_required now accepts `Authorization: Bearer <token>` OR the session cookie. Session path stays DB-free (fast); bearer path looks up the token hash, sets g.user_id, and stamps last_used_at. - Endpoints: POST /api/auth/device-login (public; email+password → token, the native first-link flow), POST /api/auth/devices (session/bearer → token, web "link a device"), GET /api/auth/devices (list), DELETE /api/auth/devices/<id> (revoke). All owner-scoped; token shown once. Frontend: - Per-user (not admin) /account view "Linked devices": create a token (one-time reveal + copy), list devices (name, linked/last-synced), revoke with confirm. Top-bar device icon for all users; devices Pinia store. Tests (DB-free): token hash determinism + uniqueness; device endpoints auth-guard (401 without auth, before DB); device-login input validation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm
31 lines
1021 B
Python
31 lines
1021 B
Python
from thoughtsync.security import generate_token, hash_password, hash_token, verify_password
|
|
|
|
|
|
def test_password_roundtrip():
|
|
h = hash_password("correct horse battery staple")
|
|
assert verify_password("correct horse battery staple", h)
|
|
assert not verify_password("wrong password", h)
|
|
|
|
|
|
def test_hash_token_deterministic():
|
|
t = generate_token()
|
|
# Lookup hash is deterministic (same token → same hash) and SHA-256 hex (64 chars).
|
|
assert hash_token(t) == hash_token(t)
|
|
assert len(hash_token(t)) == 64
|
|
# Different tokens hash differently.
|
|
assert hash_token(t) != hash_token(generate_token())
|
|
|
|
|
|
def test_generate_token_unique():
|
|
assert generate_token() != generate_token()
|
|
assert len(generate_token()) >= 32
|
|
|
|
|
|
def test_password_hash_is_salted():
|
|
# Same input hashes differently each time (random salt).
|
|
assert hash_password("same-input") != hash_password("same-input")
|
|
|
|
|
|
def test_verify_rejects_garbage_hash():
|
|
assert not verify_password("whatever", "not-a-bcrypt-hash")
|