# /opt/docker/dev/service_finder/backend/app/services/auth_service.py import logging import uuid import re from datetime import datetime, timedelta, timezone from sqlalchemy.ext.asyncio import AsyncSession from sqlalchemy import select, and_, update from sqlalchemy.orm import joinedload from fastapi.encoders import jsonable_encoder from fastapi import HTTPException, status from app.models.identity import User, Person, UserRole, VerificationToken, Wallet, OneTimePassword from app.models import UserStats, LogSeverity from app.models.marketplace import Organization, OrganizationMember, OrgType, Branch from app.schemas.auth import UserLiteRegister, UserKYCComplete from app.core.security import get_password_hash, verify_password, generate_secure_slug from app.services.email_manager import email_manager from app.core.config import settings from app.services.config_service import config from app.services.geo_service import GeoService from app.services.security_service import security_service from app.services.gamification_service import GamificationService logger = logging.getLogger(__name__) class AuthService: @staticmethod async def _validate_password_complexity(db: AsyncSession, password: str, region_code: str = None): """ Dinamikus jelszó komplexitás ellenőrzése az admin beállítások alapján. """ # Alap beállítások lekérése min_pass = await config.get_setting(db, "auth_min_password_length", default=8) password_strict = await config.get_setting(db, "auth_password_strict", default=False) # Minimum hossz ellenőrzése if len(password) < int(min_pass): raise HTTPException( status_code=status.HTTP_400_BAD_REQUEST, detail=f"A jelszónak legalább {min_pass} karakter hosszúnak kell lennie." ) # Ha a strict mód be van kapcsolva, komplexitás ellenőrzés if password_strict and str(password_strict).lower() in ("true", "1", "yes"): # Ellenőrizzük: legalább 1 nagybetű, 1 kisbetű, 1 szám vagy speciális karakter if not re.search(r'[A-Z]', password): raise HTTPException( status_code=status.HTTP_400_BAD_REQUEST, detail="A jelszónak tartalmaznia kell legalább egy nagybetűt." ) if not re.search(r'[a-z]', password): raise HTTPException( status_code=status.HTTP_400_BAD_REQUEST, detail="A jelszónak tartalmaznia kell legalább egy kisbetűt." ) if not re.search(r'[0-9!@#$%^&*()_+\-=\[\]{};:"\\|,.<>/?]', password): raise HTTPException( status_code=status.HTTP_400_BAD_REQUEST, detail="A jelszónak tartalmaznia kell legalább egy számot vagy speciális karaktert." ) @staticmethod async def register_lite(db: AsyncSession, user_in: UserLiteRegister): """ 1. FÁZIS: Lite regisztráció dinamikus korlátokkal és Sentinel naplózással. """ try: # Paraméterek lekérése az admin felületről min_pass = await config.get_setting(db, "auth_min_password_length", default=8) default_role_name = await config.get_setting(db, "auth_default_role", default="user") reg_token_hours = await config.get_setting(db, "auth_registration_hours", region_code=user_in.region_code, default=48) # Jelszó komplexitás ellenőrzése await AuthService._validate_password_complexity(db, user_in.password, user_in.region_code) # Check if email already exists existing_user = await db.execute(select(User).where(User.email == user_in.email)) if existing_user.scalar_one_or_none(): raise HTTPException( status_code=status.HTTP_400_BAD_REQUEST, detail="Ez az email cím már regisztrálva van." ) # Meghívó keresése referral kód alapján referred_by_id = None if user_in.referred_by_code: referrer_stmt = select(User).where(User.referral_code == user_in.referred_by_code) referrer = (await db.execute(referrer_stmt)).scalar_one_or_none() if referrer: referred_by_id = referrer.id logger.info(f"User {user_in.email} referred by {referrer.email} (ID: {referrer.id})") else: logger.warning(f"Referral code '{user_in.referred_by_code}' not found, ignoring.") new_person = Person( first_name=user_in.first_name, last_name=user_in.last_name, is_active=False, # Email verification required before activation identity_docs={}, # EXPLICIT BEÁLLÍTÁS A DB HIBA ELKERÜLÉSÉRE ice_contact={}, # EXPLICIT BEÁLLÍTÁS A DB HIBA ELKERÜLÉSÉRE lifetime_xp=0, # default -1, de explicit 0 penalty_points=0, # default -1, de explicit 0 social_reputation=1.0, # default 0.0, de explicit 1.0 is_sales_agent=False, # default True, de explicit False is_ghost=False, created_at=datetime.now(timezone.utc) ) db.add(new_person) await db.flush() # Szerepkör dinamikus feloldása assigned_role = UserRole[default_role_name] if default_role_name in UserRole.__members__ else UserRole.USER # Referral kód generálása referral_code = generate_secure_slug(8).upper() new_user = User( email=user_in.email, hashed_password=get_password_hash(user_in.password), person_id=new_person.id, role=assigned_role, is_active=False, # Email verification required before activation is_deleted=False, region_code=user_in.region_code, preferred_language=user_in.lang, subscription_plan='FREE', # --- EXPLICIT DEFAULT ÉRTÉKEK A DB HIBA ELKERÜLÉSÉRE --- is_vip=True, # Changed to True to force inclusion in INSERT preferred_currency="HUF", scope_level="individual", custom_permissions={}, referral_code=referral_code, referred_by_id=referred_by_id, created_at=datetime.now(timezone.utc) ) db.add(new_user) await db.flush() # Verifikációs token token_val = uuid.uuid4() db.add(VerificationToken( token=token_val, user_id=new_user.id, token_type="registration", expires_at=datetime.now(timezone.utc) + timedelta(hours=int(reg_token_hours)) )) # Sentinel Audit Log await security_service.log_event( db, user_id=new_user.id, action="USER_REGISTER_LITE", severity=LogSeverity.info, target_type="User", target_id=str(new_user.id), new_data={"email": user_in.email} ) await db.commit() # Email küldés a beállított template alapján verification_link = f"{settings.FRONTEND_BASE_URL}/verify?token={token_val}" email_result = await email_manager.send_email( recipient=user_in.email, template_key="reg", variables={"first_name": user_in.first_name, "link": verification_link}, lang=user_in.lang ) # Check if email sending failed - LOG but don't crash registration if email_result and email_result.get("status") == "error": logger.error(f"Email sending failed for {user_in.email}: {email_result.get('message')}") # Don't raise exception - registration should succeed even if email fails # Just log the error and continue else: logger.info(f"Email sent successfully to {user_in.email}") return new_user except Exception as e: await db.rollback() logger.error(f"Lite Reg Error: {e}") raise e @staticmethod async def complete_kyc(db: AsyncSession, user_id: int, kyc_in: UserKYCComplete): """ 2. FÁZIS: Teljes profil és Gamification inicializálás. """ try: stmt = select(User).options(joinedload(User.person)).where(User.id == user_id) user = (await db.execute(stmt)).scalar_one_or_none() if not user: return None # Dinamikus beállítások (Soha ne legyen kódba vésve!) org_tpl = await config.get_setting(db, "org_naming_template", default="{last_name} Flotta") base_cur = await config.get_setting(db, "finance_default_currency", region_code=user.region_code, default="HUF") kyc_reward = await config.get_setting(db, "gamification_kyc_bonus", default=500) # Címkezelés (GeoService hívás) addr_id = await GeoService.get_or_create_full_address( db, zip_code=kyc_in.address_zip, city=kyc_in.address_city, street_name=kyc_in.address_street_name, street_type=kyc_in.address_street_type, house_number=kyc_in.address_house_number, parcel_id=kyc_in.address_hrsz ) # Person adatok dúsítása p = user.person # --- SHADOW IDENTITY CHECK --- if kyc_in.birth_date: shadow_stmt = select(Person).where( and_( Person.last_name == p.last_name, Person.first_name == p.first_name, Person.birth_date == kyc_in.birth_date, Person.id != p.id # Ne a jelenlegit találja meg ) ) shadow_person = (await db.execute(shadow_stmt)).scalar_one_or_none() else: shadow_person = None if shadow_person: logger.info(f"Shadow Identity megtalálva a {user.id} userhez: Person ID {shadow_person.id}") user.person_id = shadow_person.id # Frissítjük a megtalált Person rekordot a KYC adatokkal if kyc_in.first_name: shadow_person.first_name = kyc_in.first_name if kyc_in.last_name: shadow_person.last_name = kyc_in.last_name shadow_person.mothers_last_name = kyc_in.mothers_last_name shadow_person.mothers_first_name = kyc_in.mothers_first_name shadow_person.birth_place = kyc_in.birth_place shadow_person.phone = kyc_in.phone_number shadow_person.address_id = addr_id shadow_person.identity_docs = jsonable_encoder(kyc_in.identity_docs) shadow_person.is_active = True # Inaktiváljuk/töröljük a megárvult eredeti Person-t p.is_active = False p.is_ghost = True p = shadow_person else: if kyc_in.first_name: p.first_name = kyc_in.first_name if kyc_in.last_name: p.last_name = kyc_in.last_name p.mothers_last_name = kyc_in.mothers_last_name p.mothers_first_name = kyc_in.mothers_first_name p.birth_place = kyc_in.birth_place p.birth_date = kyc_in.birth_date p.phone = kyc_in.phone_number p.address_id = addr_id p.identity_docs = jsonable_encoder(kyc_in.identity_docs) p.is_active = True # --- SHADOW CHECK VÉGE --- # Dinamikus szervezet generálás # Naming convention: "{last_name} {first_name} - Privát Garázs (#{user_id})" org_full_name = f"{p.last_name} {p.first_name} - Privát Garázs (#{user.id})" new_org = Organization( full_name=org_full_name, name=org_full_name, folder_slug=generate_secure_slug(12), org_type=OrgType.individual, owner_id=user.id, is_active=True, status="verified", country_code=user.region_code, # --- EXPLICIT IDŐBÉLYEGEK A DB HIBA ELKERÜLÉSÉRE --- first_registered_at=datetime.now(timezone.utc), current_lifecycle_started_at=datetime.now(timezone.utc), created_at=datetime.now(timezone.utc), subscription_plan="FREE", base_asset_limit=1, purchased_extra_slots=0, notification_settings={}, external_integration_config={}, is_ownership_transferable=True ) db.add(new_org) await db.flush() # Infrastruktúra elemek db.add(Branch(organization_id=new_org.id, address_id=addr_id, name="Home Base", is_main=True)) db.add(OrganizationMember( organization_id=new_org.id, user_id=user.id, person_id=user.person_id, role="OWNER", is_permanent=True, is_verified=True, status="active" )) db.add(Wallet(user_id=user.id, currency=kyc_in.preferred_currency or base_cur)) # db.add(UserStats(user_id=user.id)) # GamificationService kezeli user.is_active = True user.folder_slug = generate_secure_slug(12) # Set user's scope_id to the new personal organization ID user.scope_id = str(new_org.id) # Update region_code from KYC form (EU country selection) if kyc_in.region_code: user.region_code = kyc_in.region_code # Gamification XP jóváírás (commit=False, mert a külső metódus kezeli a tranzakciót) # A pontérték a point_rules táblából jön (action_key='KYC_VERIFICATION') await GamificationService.award_points(db, user_id=user.id, amount=0, reason="KYC_VERIFICATION", commit=False, action_key="KYC_VERIFICATION") # P2P Referral XP a meghívónak (ha van referred_by_id) if user.referred_by_id: # A pontérték a point_rules táblából jön (action_key='P2P_REFERRAL_SUCCESS') await GamificationService.award_points( db, user_id=user.referred_by_id, amount=0, reason="P2P_REFERRAL_SUCCESS", commit=False, action_key="P2P_REFERRAL_SUCCESS" ) logger.info(f"P2P XP awarded to referrer ID {user.referred_by_id} for user {user.id}") await db.commit() return user except Exception as e: await db.rollback() logger.error(f"KYC Error: {e}") raise e @staticmethod async def authenticate(db: AsyncSession, email: str, password: str): """ Felhasználó hitelesítése. """ stmt = select(User).where(and_(User.email == email, User.is_deleted == False)) res = await db.execute(stmt) user = res.scalar_one_or_none() if user and verify_password(password, user.hashed_password): return user return None @staticmethod async def verify_email(db: AsyncSession, token_str: str): """ Email megerősítés. Visszaadja az aktivált User objektumot sikeres verifikáció után (Magic Link támogatás). """ try: token_uuid = uuid.UUID(token_str) stmt = select(VerificationToken).where(and_( VerificationToken.token == token_uuid, VerificationToken.is_used == False, VerificationToken.expires_at > datetime.now(timezone.utc) )) token = (await db.execute(stmt)).scalar_one_or_none() if not token: return None token.is_used = True # Activate user user_stmt = select(User).where(User.id == token.user_id) user = (await db.execute(user_stmt)).scalar_one_or_none() if not user: return None user.is_active = True # Activate person - FIX: Use User.person_id instead of Person.user_id # Person.user_id is a separate FK that may be NULL if user.person_id: person_stmt = select(Person).where(Person.id == user.person_id) person = (await db.execute(person_stmt)).scalar_one_or_none() if person: person.is_active = True # Also set the back-reference so Person.user_id is consistent person.user_id = user.id await db.commit() return user # Return the activated User object except Exception as e: logger.error(f"Email verification error: {e}") return None @staticmethod async def initiate_password_reset(db: AsyncSession, email: str): """ Elfelejtett jelszó folyamat indítása. """ stmt = select(User).where(and_(User.email == email, User.is_deleted == False)) user = (await db.execute(stmt)).scalar_one_or_none() if not user: return "not_found" # Ha a felhasználó létezik, de inaktív, dobjunk hibát if not user.is_active: logger.warning(f"Password reset requested for inactive user: {email}") raise HTTPException( status_code=status.HTTP_400_BAD_REQUEST, detail="AUTH.USER_INACTIVE" ) # Dinamikus lejárat az adminból reset_h = await config.get_setting(db, "auth_password_reset_hours", region_code=user.region_code, default=2) token_val = uuid.uuid4() db.add(VerificationToken( token=token_val, user_id=user.id, token_type="password_reset", expires_at=datetime.now(timezone.utc) + timedelta(hours=int(reset_h)) )) link = f"{settings.FRONTEND_BASE_URL}/reset-password?token={token_val}" # Mock email sending: log the reset link to console instead of sending real email logger.info(f"*** MOCK EMAIL *** Password reset for {email}") logger.info(f"*** MOCK EMAIL *** Reset link: {link}") logger.info(f"*** MOCK EMAIL *** Token: {token_val}") # Try to send real email, but don't crash if SMTP is unavailable try: result = await email_manager.send_email( recipient=email, template_key="pwd_reset", variables={"link": link}, lang=user.preferred_language ) logger.info(f"Email küldés eredménye (password reset): {result}") if result and result.get("status") == "error": logger.warning(f"Password reset email sending failed (non-critical): {result.get('message')}") except Exception as e: logger.warning(f"Password reset email sending exception (non-critical): {e}") await db.commit() return "success" @staticmethod async def reset_password(db: AsyncSession, email: str, token_str: str, new_password: str): """ Jelszó tényleges megváltoztatása token alapján. """ try: token_uuid = uuid.UUID(token_str) stmt = select(VerificationToken).join(User).where(and_( User.email == email, VerificationToken.token == token_uuid, VerificationToken.token_type == "password_reset", VerificationToken.is_used == False, VerificationToken.expires_at > datetime.now(timezone.utc) )) token_rec = (await db.execute(stmt)).scalar_one_or_none() if not token_rec: return False # Jelszó komplexitás ellenőrzése user_stmt = select(User).where(User.id == token_rec.user_id) user = (await db.execute(user_stmt)).scalar_one() await AuthService._validate_password_complexity(db, new_password, user.region_code) user.hashed_password = get_password_hash(new_password) token_rec.is_used = True await db.commit() return True except HTTPException: raise except Exception as e: logger.error(f"Password reset error: {e}") return False @staticmethod async def _generate_otp_code() -> str: """Generate a random 6-digit OTP code.""" import random return f"{random.randint(0, 999999):06d}" @staticmethod async def request_account_restore(db: AsyncSession, email: str): """ 30 napos fiókvisszaállítás: OTP kérés. Megkeresi a törölt felhasználót az eredeti email alapján. Ha 30 napon belül van a törlés, generál 6-jegyű kódot. Ha 30 napon TÚL van, jelzi, hogy új regisztráció szükséges. """ try: # Search for deleted user by checking if email exists in deleted prefix pattern stmt = select(User).where( User.email.like(f"%{email}"), User.is_deleted == True ) result = await db.execute(stmt) user = result.scalar_one_or_none() if not user: return {"status": "not_found", "message": "Nem található törölt fiók ezzel az email címmel."} # Check if within 30-day window if user.deleted_at: days_since_deletion = (datetime.now(timezone.utc) - user.deleted_at).days else: days_since_deletion = 0 if days_since_deletion > 30: return { "status": "expired", "message": "A fiók véglegesen megsemmisült. Kérjük, regisztráljon újra ugyanazzal az email címmel.", "can_re_register": True, "original_email": email } # Generate 6-digit OTP code code = await AuthService._generate_otp_code() expires_at = datetime.now(timezone.utc) + timedelta(minutes=15) # Store OTP otp = OneTimePassword( email=email, code=code, otp_type="restore", extra_data={"user_id": user.id}, expires_at=expires_at ) db.add(otp) await db.commit() # Mock email sending: log the OTP code to console instead of sending real email logger.info(f"*** MOCK EMAIL *** OTP Code for {email}: {code}") logger.info(f"*** MOCK EMAIL *** Expires at: {expires_at.isoformat()}") return { "status": "otp_sent", "message": "Egy 6-jegyű visszaállítási kódot küldtünk az email címére.", "expires_at": expires_at.isoformat() } except Exception as e: await db.rollback() logger.error(f"Account restore request error for {email}: {e}") return {"status": "error", "message": "Hiba történt a visszaállítási kód generálása során."} @staticmethod async def verify_account_restore(db: AsyncSession, email: str, code: str): """ OTP kód ellenőrzése és fiók visszaállítása. """ now = datetime.now(timezone.utc) # Find valid OTP stmt = select(OneTimePassword).where( OneTimePassword.email == email, OneTimePassword.code == code, OneTimePassword.otp_type == "restore", OneTimePassword.is_used == False, OneTimePassword.expires_at > now ).order_by(OneTimePassword.created_at.desc()).limit(1) result = await db.execute(stmt) otp = result.scalar_one_or_none() if not otp: return {"status": "invalid", "message": "Érvénytelen vagy lejárt kód."} # Mark OTP as used otp.is_used = True # Find the deleted user user_id = otp.extra_data.get("user_id") if otp.extra_data else None if not user_id: return {"status": "error", "message": "Hiba a fiók azonosításában."} stmt = select(User).where(User.id == user_id) result = await db.execute(stmt) user = result.scalar_one_or_none() if not user: return {"status": "error", "message": "Felhasználó nem található."} # Restore the account user.is_deleted = False user.is_active = True user.deleted_at = None # Restore original email (remove deleted_ prefix) # The email format is: deleted_{id}_{timestamp}_{original_email} if user.email.startswith("deleted_"): parts = user.email.split("_", 3) if len(parts) == 4: user.email = parts[3] await security_service.log_event( db, user_id=user.id, action="USER_ACCOUNT_RESTORE", severity=LogSeverity.info, target_type="User", target_id=str(user.id), new_data={"restored_via": "otp", "email": user.email} ) await db.commit() return {"status": "success", "message": "Fiók sikeresen visszaállítva."} @staticmethod async def check_is_last_admin(db: AsyncSession, user_id: int) -> bool: """ Ellenőrzi, hogy a felhasználó az egyetlen aktív admin bármelyik szervezetében. Visszaadja: is_last_admin: bool """ try: from app.models.marketplace.organization import OrganizationMember, OrgUserRole # Find organizations where user is ADMIN or OWNER stmt = select(OrganizationMember.organization_id).where( OrganizationMember.user_id == user_id, OrganizationMember.role.in_([OrgUserRole.ADMIN, OrgUserRole.OWNER]) ) result = await db.execute(stmt) org_ids = [row[0] for row in result.all()] if not org_ids: return False # For each org, check if there are other active admins/owners for org_id in org_ids: stmt = select(OrganizationMember).where( OrganizationMember.organization_id == org_id, OrganizationMember.role.in_([OrgUserRole.ADMIN, OrgUserRole.OWNER]), OrganizationMember.user_id != user_id ) result = await db.execute(stmt) other_admins = result.scalars().all() if not other_admins: # This org has no other admin - user is last admin here return True return False except HTTPException: raise except Exception as e: logger.error(f"check_is_last_admin error: {e}") return False @staticmethod async def resend_verification(db: AsyncSession, email: str): """ Aktiváló e-mail újraküldése. Ellenőrzi, hogy a felhasználó létezik, de még nem aktív (is_active == False), generál egy új verifikációs tokent, és kiküldi az e-mailt. """ # Eager load person relationship to avoid async lazy-load issue stmt = select(User).options(joinedload(User.person)).where( and_(User.email == email, User.is_deleted == False) ) user = (await db.execute(stmt)).unique().scalar_one_or_none() if not user: # Ne áruljuk el, hogy létezik-e az email — biztonsági okokból mindig sikert adunk logger.info(f"Resend verification requested for non-existent email: {email}") return "not_found" if user.is_active: logger.info(f"Resend verification requested for already active user: {email}") return "already_active" # Dinamikus lejárat az adminból reg_token_hours = await config.get_setting(db, "auth_registration_hours", region_code=user.region_code, default=48) token_val = uuid.uuid4() db.add(VerificationToken( token=token_val, user_id=user.id, token_type="registration", expires_at=datetime.now(timezone.utc) + timedelta(hours=int(reg_token_hours)) )) # Email küldés — user.person már eager-loaded, így nem okoz MissingGreenlet hibát verification_link = f"{settings.FRONTEND_BASE_URL}/verify?token={token_val}" person = user.person first_name = person.first_name if person else user.email logger.info(f"Email küldés indítása (resend verification) ide: {email}...") result = await email_manager.send_email( recipient=email, template_key="reg", variables={"first_name": first_name, "link": verification_link}, lang=user.preferred_language ) logger.info(f"Email küldés eredménye (resend verification): {result}") await db.commit() logger.info(f"Resend verification email sent to {email}") return "success" @staticmethod async def soft_delete_user(db: AsyncSession, user_id: int, reason: str, actor_id: int): """ Felhasználó törlése (Soft-Delete) auditálással, Person-preserving logikával. Üzleti szabályok: 1. User: is_active=False, is_deleted=True, deleted_at=utcnow 2. Email átírás: deleted_{id}_{timestamp}_{original_email} 3. Person rekordot NEM bántja (megőrizzük a jövőbeli újraaktiváláshoz) 4. Wallet és Gamification adatok megőrzése (inaktív user miatt freeze) 5. Refresh token-ek érvénytelenítése (JWT-alapú, így a deleted_at middleware ellenőrzi) """ stmt = select(User).where(User.id == user_id) user = (await db.execute(stmt)).scalar_one_or_none() if not user or user.is_deleted: return False # 1. Anonymize email with timestamp old_email = user.email timestamp = datetime.now(timezone.utc).strftime('%Y%m%d_%H%M%S') user.email = f"deleted_{user.id}_{timestamp}_{old_email}" # 2. Set soft-delete flags user.is_deleted = True user.is_active = False user.deleted_at = datetime.now(timezone.utc) # 3. CRITICAL: Do NOT touch Person record # Person.is_active stays as-is, Person data stays intact # This allows future re-activation with the same identity # 4. Security audit log with deleted_at info await security_service.log_event( db, user_id=actor_id, action="USER_SOFT_DELETE", severity=LogSeverity.warning, target_type="User", target_id=str(user_id), new_data={ "reason": reason, "deleted_at": str(user.deleted_at), "person_preserved": True } ) await db.commit() return True