Secured password handling #70

kdb-bot/src/bot_api/controller/auth_controller.py

@@ -56,7 +56,7 @@ class AuthController:
         return jsonify(result.to_dict())
 
     @Route.get(f'{BasePath}/users/get/<email>')
-    @Route.authorize(role=AuthRoleEnum.admin)
+    @Route.authorize
     async def get_user_from_email(self, email: str) -> Response:
         result = await self._auth_service.get_auth_user_by_email_async(email)
         return jsonify(result.to_dict())

kdb-bot/src/bot_api/service/auth_service.py

@@ -63,8 +63,8 @@ class AuthService(AuthServiceABC):
         return mail
 
     @staticmethod
-    def _hash_sha256(password: str) -> str:
-        return hashlib.sha256(password.encode('utf-8')).hexdigest()
+    def _hash_sha256(password: str, salt: str) -> str:
+        return hashlib.sha256(f'{password}{salt}'.encode('utf-8')).hexdigest()
 
     @staticmethod
     def _is_email_valid(email: str) -> bool:
@@ -188,8 +188,9 @@ class AuthService(AuthServiceABC):
         if db_user is not None:
             raise ServiceException(ServiceErrorCode.InvalidUser, 'User already exists')
 
-        user_dto.password = self._hash_sha256(user_dto.password)
         user = AUT.to_db(user_dto)
+        user.password_salt = uuid.uuid4()
+        user.password = self._hash_sha256(user_dto.password, user.password_salt)
         if not self._is_email_valid(user.email):
             raise ServiceException(ServiceErrorCode.InvalidData, 'Invalid E-Mail address')
 
@@ -244,17 +245,18 @@ class AuthService(AuthServiceABC):
         # hash passwords in DTOs
         if update_user_dto.auth_user.password is not None and update_user_dto.auth_user.password != '':
             is_existing_password_set = True
-            update_user_dto.auth_user.password = self._hash_sha256(update_user_dto.auth_user.password)
+            update_user_dto.auth_user.password = self._hash_sha256(update_user_dto.auth_user.password, user.password_salt)
 
         if update_user_dto.auth_user.password != user.password:
             raise ServiceException(ServiceErrorCode.InvalidUser, 'Wrong password')
 
         if update_user_dto.new_auth_user.password is not None and update_user_dto.new_auth_user.password != '':
             is_new_password_set = True
-            update_user_dto.new_auth_user.password = self._hash_sha256(update_user_dto.new_auth_user.password)
+            update_user_dto.new_auth_user.password = self._hash_sha256(update_user_dto.new_auth_user.password, user.password_salt)
 
         # update password
         if is_existing_password_set and is_new_password_set and update_user_dto.auth_user.password != update_user_dto.new_auth_user.password:
+            user.password_salt = uuid.uuid4()
             user.password = update_user_dto.new_auth_user.password
 
         self._auth_users.update_auth_user(user)
@@ -301,7 +303,8 @@ class AuthService(AuthServiceABC):
 
         # update password
         if update_user_dto.change_password and update_user_dto.auth_user.password != update_user_dto.new_auth_user.password:
-            user.password = self._hash_sha256(update_user_dto.new_auth_user.password)
+            user.password_salt = uuid.uuid4()
+            user.password = self._hash_sha256(update_user_dto.new_auth_user.password, user.password_salt)
 
         # update role
         if user.auth_role == update_user_dto.auth_user.auth_role and user.auth_role != update_user_dto.new_auth_user.auth_role:
@@ -350,7 +353,7 @@ class AuthService(AuthServiceABC):
         if db_user is None:
             raise ServiceException(ServiceErrorCode.InvalidUser, f'User not found')
 
-        user_dto.password = self._hash_sha256(user_dto.password)
+        user_dto.password = self._hash_sha256(user_dto.password, db_user.password_salt)
         if db_user.password != user_dto.password:
             raise ServiceException(ServiceErrorCode.InvalidUser, 'Wrong password')
 
@@ -432,5 +435,5 @@ class AuthService(AuthServiceABC):
         if user.password is None or rp_dto.password == '':
             raise ServiceException(ServiceErrorCode.InvalidData, f'Password not set')
 
-        user.password = self._hash_sha256(rp_dto.password)
+        user.password = self._hash_sha256(rp_dto.password, user.password_salt)
         self._db.save_changes()

kdb-bot/src/bot_api/transformer/auth_user_transformer.py

@@ -18,6 +18,7 @@ class AuthUserTransformer(TransformerABC):
             None,
             None,
             None,
+            None,
             datetime.now(tz=timezone.utc),
             AuthRoleEnum.normal if dto.auth_role is None else AuthRoleEnum(dto.auth_role),
             dto.user_id,
@@ -31,7 +32,7 @@ class AuthUserTransformer(TransformerABC):
             db.first_name,
             db.last_name,
             db.email,
-            db.password,
+            '',
             db.confirmation_id,
             db.auth_role,
             db.user_id