350 lines
14 KiB
Python
350 lines
14 KiB
Python
import os
|
|
import logging
|
|
import uuid
|
|
import json
|
|
from datetime import datetime, timedelta, timezone
|
|
from typing import Optional
|
|
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
from sqlalchemy import select, and_
|
|
from sqlalchemy.orm import joinedload
|
|
from fastapi.encoders import jsonable_encoder
|
|
from fastapi import HTTPException, status
|
|
|
|
from app.models.identity import User, Person, UserRole, VerificationToken, Wallet
|
|
from app.models.gamification import UserStats
|
|
from app.models.organization import Organization, OrganizationMember, OrgType
|
|
from app.schemas.auth import UserLiteRegister, UserKYCComplete
|
|
from app.core.security import get_password_hash, verify_password, generate_secure_slug
|
|
from app.services.email_manager import email_manager
|
|
from app.core.config import settings
|
|
from app.services.config_service import config
|
|
from app.services.geo_service import GeoService
|
|
from app.services.security_service import security_service # Sentinel integráció
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
class AuthService:
|
|
@staticmethod
|
|
async def register_lite(db: AsyncSession, user_in: UserLiteRegister):
|
|
"""
|
|
Step 1: Lite Regisztráció (Manuális).
|
|
Létrehozza a Person és User rekordokat, de a fiók inaktív marad.
|
|
A folder_slug itt még NEM generálódik le!
|
|
"""
|
|
try:
|
|
# --- Dinamikus jelszóhossz ellenőrzés ---
|
|
# Lekérjük az admin beállítást, minimum 8 karakter a hard limit.
|
|
min_pass = await config.get_setting(db, "auth_min_password_length", default=8)
|
|
min_len = max(int(min_pass), 8)
|
|
|
|
if len(user_in.password) < min_len:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_400_BAD_REQUEST,
|
|
detail=f"A jelszónak legalább {min_len} karakter hosszúnak kell lennie."
|
|
)
|
|
|
|
new_person = Person(
|
|
first_name=user_in.first_name,
|
|
last_name=user_in.last_name,
|
|
is_active=False
|
|
)
|
|
db.add(new_person)
|
|
await db.flush()
|
|
|
|
new_user = User(
|
|
email=user_in.email,
|
|
hashed_password=get_password_hash(user_in.password),
|
|
person_id=new_person.id,
|
|
role=UserRole.user,
|
|
is_active=False,
|
|
is_deleted=False,
|
|
region_code=user_in.region_code,
|
|
preferred_language=user_in.lang,
|
|
timezone=user_in.timezone
|
|
# folder_slug marad NULL a Step 2-ig
|
|
)
|
|
db.add(new_user)
|
|
await db.flush()
|
|
|
|
# Verifikációs token generálása
|
|
reg_hours = await config.get_setting(db, "auth_registration_hours", region_code=user_in.region_code, default=48)
|
|
token_val = uuid.uuid4()
|
|
db.add(VerificationToken(
|
|
token=token_val,
|
|
user_id=new_user.id,
|
|
token_type="registration",
|
|
expires_at=datetime.now(timezone.utc) + timedelta(hours=int(reg_hours))
|
|
))
|
|
|
|
# Email kiküldése
|
|
verification_link = f"{settings.FRONTEND_BASE_URL}/verify?token={token_val}"
|
|
await email_manager.send_email(
|
|
recipient=user_in.email,
|
|
template_key="reg",
|
|
variables={"first_name": user_in.first_name, "link": verification_link},
|
|
lang=user_in.lang
|
|
)
|
|
|
|
# Audit log a regisztrációról
|
|
await security_service.log_event(
|
|
db,
|
|
user_id=new_user.id,
|
|
action="USER_REGISTER_LITE",
|
|
severity="info",
|
|
target_type="User",
|
|
target_id=str(new_user.id),
|
|
new_data={"email": user_in.email, "method": "manual"}
|
|
)
|
|
|
|
await db.commit()
|
|
await db.refresh(new_user)
|
|
return new_user
|
|
except HTTPException:
|
|
await db.rollback()
|
|
raise
|
|
except Exception as e:
|
|
await db.rollback()
|
|
logger.error(f"Registration Error: {str(e)}")
|
|
raise e
|
|
|
|
@staticmethod
|
|
async def complete_kyc(db: AsyncSession, user_id: int, kyc_in: UserKYCComplete):
|
|
"""
|
|
Step 2: Atomi Tranzakció.
|
|
Itt dől el minden: Adatok rögzítése, Shadow Identity ellenőrzés,
|
|
Flotta és Wallet létrehozás, majd a fiók aktiválása.
|
|
"""
|
|
try:
|
|
stmt = select(User).options(joinedload(User.person)).where(User.id == user_id)
|
|
res = await db.execute(stmt)
|
|
user = res.scalar_one_or_none()
|
|
if not user: return None
|
|
|
|
# --- 1. BIZTONSÁG: User folder_slug generálása ---
|
|
# Ha Google-lel jött vagy még nincs slugja, most kap egyet.
|
|
if not user.folder_slug:
|
|
user.folder_slug = generate_secure_slug(length=12)
|
|
|
|
# Pénznem beállítása
|
|
if hasattr(kyc_in, 'preferred_currency') and kyc_in.preferred_currency:
|
|
user.preferred_currency = kyc_in.preferred_currency
|
|
|
|
# --- 2. Shadow Identity keresése (Már létezik-e ez a fizikai személy?) ---
|
|
identity_stmt = select(Person).where(and_(
|
|
Person.mothers_last_name == kyc_in.mothers_last_name,
|
|
Person.mothers_first_name == kyc_in.mothers_first_name,
|
|
Person.birth_place == kyc_in.birth_place,
|
|
Person.birth_date == kyc_in.birth_date
|
|
))
|
|
existing_person = (await db.execute(identity_stmt)).scalar_one_or_none()
|
|
|
|
if existing_person:
|
|
# Ha találtunk egyezést, összekötjük a User-t a meglévő Person-nel
|
|
user.person_id = existing_person.id
|
|
active_person = existing_person
|
|
logger.info(f"Shadow Identity linked: User {user_id} -> Person {existing_person.id}")
|
|
else:
|
|
# Ha nem, a saját (regisztrációkor létrehozott) Person-t töltjük fel
|
|
active_person = user.person
|
|
|
|
# --- 3. Cím rögzítése GeoService segítségével ---
|
|
addr_id = await GeoService.get_or_create_full_address(
|
|
db,
|
|
zip_code=kyc_in.address_zip,
|
|
city=kyc_in.address_city,
|
|
street_name=kyc_in.address_street_name,
|
|
street_type=kyc_in.address_street_type,
|
|
house_number=kyc_in.address_house_number,
|
|
parcel_id=kyc_in.address_hrsz
|
|
)
|
|
|
|
# --- 4. Személyes adatok frissítése ---
|
|
active_person.mothers_last_name = kyc_in.mothers_last_name
|
|
active_person.mothers_first_name = kyc_in.mothers_first_name
|
|
active_person.birth_place = kyc_in.birth_place
|
|
active_person.birth_date = kyc_in.birth_date
|
|
active_person.phone = kyc_in.phone_number
|
|
active_person.address_id = addr_id
|
|
|
|
# Dokumentumok és ICE kontakt mentése JSON-ként
|
|
active_person.identity_docs = jsonable_encoder(kyc_in.identity_docs)
|
|
active_person.ice_contact = jsonable_encoder(kyc_in.ice_contact)
|
|
|
|
# A Person most válik aktívvá
|
|
active_person.is_active = True
|
|
|
|
# --- 5. EGYÉNI FLOTTA LÉTREHOZÁSA (A KYC szerves része) ---
|
|
# Itt generáljuk a flotta mappáját is (folder_slug)
|
|
new_org = Organization(
|
|
full_name=f"{active_person.last_name} {active_person.first_name} Egyéni Flotta",
|
|
name=f"{active_person.last_name} Flotta",
|
|
folder_slug=generate_secure_slug(length=12), # FLOTTA SLUG
|
|
org_type=OrgType.individual,
|
|
owner_id=user.id,
|
|
is_transferable=False,
|
|
is_active=True,
|
|
status="verified",
|
|
language=user.preferred_language,
|
|
default_currency=user.preferred_currency or "HUF",
|
|
country_code=user.region_code
|
|
)
|
|
db.add(new_org)
|
|
await db.flush()
|
|
|
|
# Flotta tagság (Owner)
|
|
db.add(OrganizationMember(
|
|
organization_id=new_org.id,
|
|
user_id=user.id,
|
|
role="owner",
|
|
permissions={"can_add_asset": True, "can_view_costs": True, "is_admin": True}
|
|
))
|
|
|
|
# --- 6. PÉNZTÁRCA ÉS GAMIFICATION LÉTREHOZÁSA ---
|
|
db.add(Wallet(
|
|
user_id=user.id,
|
|
coin_balance=0,
|
|
credit_balance=0,
|
|
currency=user.preferred_currency or "HUF"
|
|
))
|
|
db.add(UserStats(user_id=user.id, total_xp=0, current_level=1))
|
|
|
|
# --- 7. AKTIVÁLÁS ÉS AUDIT ---
|
|
user.is_active = True
|
|
|
|
await security_service.log_event(
|
|
db,
|
|
user_id=user.id,
|
|
action="USER_KYC_COMPLETED",
|
|
severity="info",
|
|
target_type="User",
|
|
target_id=str(user.id),
|
|
new_data={
|
|
"status": "active",
|
|
"user_folder": user.folder_slug,
|
|
"organization_id": new_org.id,
|
|
"organization_folder": new_org.folder_slug,
|
|
"wallet_created": True
|
|
}
|
|
)
|
|
|
|
await db.commit()
|
|
await db.refresh(user)
|
|
return user
|
|
except Exception as e:
|
|
await db.rollback()
|
|
logger.error(f"KYC Atomi Tranzakció Hiba: {str(e)}")
|
|
raise e
|
|
|
|
@staticmethod
|
|
async def soft_delete_user(db: AsyncSession, user_id: int, reason: str, actor_id: int):
|
|
"""
|
|
Soft-Delete: Email felszabadítás és izoláció.
|
|
"""
|
|
stmt = select(User).where(User.id == user_id)
|
|
user = (await db.execute(stmt)).scalar_one_or_none()
|
|
|
|
if not user or user.is_deleted:
|
|
return False
|
|
|
|
old_email = user.email
|
|
# Email átnevezése az egyediség megőrzése érdekében (újraregisztrációhoz)
|
|
user.email = f"deleted_{user.id}_{datetime.now().strftime('%Y%m%d')}_{old_email}"
|
|
user.is_deleted = True
|
|
user.is_active = False
|
|
|
|
await security_service.log_event(
|
|
db,
|
|
user_id=actor_id,
|
|
action="USER_SOFT_DELETE",
|
|
severity="warning",
|
|
target_type="User",
|
|
target_id=str(user_id),
|
|
old_data={"email": old_email},
|
|
new_data={"is_deleted": True, "reason": reason}
|
|
)
|
|
|
|
await db.commit()
|
|
return True
|
|
|
|
@staticmethod
|
|
async def verify_email(db: AsyncSession, token_str: str):
|
|
try:
|
|
token_uuid = uuid.UUID(token_str)
|
|
stmt = select(VerificationToken).where(
|
|
and_(
|
|
VerificationToken.token == token_uuid,
|
|
VerificationToken.is_used == False,
|
|
VerificationToken.expires_at > datetime.now(timezone.utc)
|
|
)
|
|
)
|
|
res = await db.execute(stmt)
|
|
token = res.scalar_one_or_none()
|
|
if not token: return False
|
|
|
|
token.is_used = True
|
|
await db.commit()
|
|
return True
|
|
except:
|
|
return False
|
|
|
|
@staticmethod
|
|
async def authenticate(db: AsyncSession, email: str, password: str):
|
|
stmt = select(User).where(and_(User.email == email, User.is_deleted == False))
|
|
res = await db.execute(stmt)
|
|
user = res.scalar_one_or_none()
|
|
if user and verify_password(password, user.hashed_password):
|
|
return user
|
|
return None
|
|
|
|
@staticmethod
|
|
async def initiate_password_reset(db: AsyncSession, email: str):
|
|
stmt = select(User).where(and_(User.email == email, User.is_deleted == False))
|
|
user = (await db.execute(stmt)).scalar_one_or_none()
|
|
|
|
if user:
|
|
reset_hours = await config.get_setting(db, "auth_password_reset_hours", region_code=user.region_code, default=2)
|
|
token_val = uuid.uuid4()
|
|
db.add(VerificationToken(
|
|
token=token_val,
|
|
user_id=user.id,
|
|
token_type="password_reset",
|
|
expires_at=datetime.now(timezone.utc) + timedelta(hours=int(reset_hours))
|
|
))
|
|
|
|
reset_link = f"{settings.FRONTEND_BASE_URL}/reset-password?token={token_val}"
|
|
await email_manager.send_email(
|
|
recipient=email,
|
|
template_key="pwd_reset",
|
|
variables={"link": reset_link},
|
|
lang=user.preferred_language
|
|
)
|
|
await db.commit()
|
|
return "success"
|
|
return "not_found"
|
|
|
|
@staticmethod
|
|
async def reset_password(db: AsyncSession, email: str, token_str: str, new_password: str):
|
|
try:
|
|
token_uuid = uuid.UUID(token_str)
|
|
stmt = select(VerificationToken).join(User).where(
|
|
and_(
|
|
User.email == email,
|
|
VerificationToken.token == token_uuid,
|
|
VerificationToken.token_type == "password_reset",
|
|
VerificationToken.is_used == False,
|
|
VerificationToken.expires_at > datetime.now(timezone.utc)
|
|
)
|
|
)
|
|
token_rec = (await db.execute(stmt)).scalar_one_or_none()
|
|
if not token_rec: return False
|
|
|
|
user_stmt = select(User).where(User.id == token_rec.user_id)
|
|
user = (await db.execute(user_stmt)).scalar_one()
|
|
user.hashed_password = get_password_hash(new_password)
|
|
token_rec.is_used = True
|
|
|
|
await db.commit()
|
|
return True
|
|
except:
|
|
return False |