|
| 1 | +"""Personal API token management. |
| 2 | +
|
| 3 | +Endpoints let the authenticated user list, create, and revoke their own |
| 4 | +tokens. Tokens inherit the owner's role and ACLs — there is no finer-grained |
| 5 | +scoping. Plaintext is shown **once** on creation and never stored; only the |
| 6 | +SHA-256 hash lives in the DB. A revoked token keeps its row so that the |
| 7 | +audit trail (and any `last_used` timestamp) survives. |
| 8 | +
|
| 9 | +Viewers can't create tokens because a viewer can't do anything with one |
| 10 | +either. Revoking and listing stay available to every authenticated user. |
| 11 | +""" |
| 12 | + |
| 13 | +import secrets |
| 14 | +from datetime import datetime, timedelta, timezone |
| 15 | +from typing import Optional |
| 16 | + |
| 17 | +from fastapi import APIRouter, Depends, HTTPException, Request |
| 18 | +from pydantic import BaseModel, Field |
| 19 | + |
| 20 | +from app.auth import ( |
| 21 | + API_TOKEN_DISPLAY_PREFIX_LEN, |
| 22 | + API_TOKEN_PREFIX, |
| 23 | + get_current_user, |
| 24 | + hash_api_token, |
| 25 | +) |
| 26 | +from app.database import get_db |
| 27 | +from app.routers.activity import log_activity |
| 28 | + |
| 29 | +router = APIRouter(prefix="/api/auth/tokens", tags=["tokens"]) |
| 30 | + |
| 31 | +# Default lifetime for a new token. Callers can override down to 1 or up to |
| 32 | +# 365 days, or pass 0 to mean "never expires". The cap stops a token from |
| 33 | +# silently outliving the user that created it. |
| 34 | +_DEFAULT_EXPIRES_DAYS = 30 |
| 35 | +_MAX_EXPIRES_DAYS = 365 |
| 36 | + |
| 37 | + |
| 38 | +class TokenCreate(BaseModel): |
| 39 | + name: str = Field(min_length=1, max_length=100) |
| 40 | + expires_in_days: Optional[int] = Field( |
| 41 | + default=_DEFAULT_EXPIRES_DAYS, |
| 42 | + ge=0, |
| 43 | + le=_MAX_EXPIRES_DAYS, |
| 44 | + description="0 = never expires", |
| 45 | + ) |
| 46 | + |
| 47 | + |
| 48 | +class TokenResponse(BaseModel): |
| 49 | + id: int |
| 50 | + name: str |
| 51 | + prefix: Optional[str] = None |
| 52 | + created_at: Optional[str] = None |
| 53 | + last_used: Optional[str] = None |
| 54 | + expires_at: Optional[str] = None |
| 55 | + revoked_at: Optional[str] = None |
| 56 | + |
| 57 | + |
| 58 | +class TokenCreateResponse(TokenResponse): |
| 59 | + token: str # plaintext — shown exactly once |
| 60 | + |
| 61 | + |
| 62 | +def _generate_plaintext() -> str: |
| 63 | + """Return a fresh `jwk_<random>` token string. |
| 64 | +
|
| 65 | + 32 bytes of randomness encoded urlsafe-b64 (no padding) comes out to |
| 66 | + ≈43 chars, which fits comfortably in a header alongside the 4-char |
| 67 | + prefix. |
| 68 | + """ |
| 69 | + body = secrets.token_urlsafe(32).rstrip("=") |
| 70 | + return f"{API_TOKEN_PREFIX}{body}" |
| 71 | + |
| 72 | + |
| 73 | +@router.get("", response_model=list[TokenResponse]) |
| 74 | +async def list_tokens(user=Depends(get_current_user)): |
| 75 | + """List the caller's own tokens (plaintext is not included).""" |
| 76 | + db = await get_db() |
| 77 | + rows = await db.execute_fetchall( |
| 78 | + """SELECT id, name, prefix, created_at, last_used, expires_at, revoked_at |
| 79 | + FROM api_tokens |
| 80 | + WHERE user_id = ? |
| 81 | + ORDER BY revoked_at IS NOT NULL, created_at DESC""", |
| 82 | + (user["id"],), |
| 83 | + ) |
| 84 | + return [dict(r) for r in rows] |
| 85 | + |
| 86 | + |
| 87 | +@router.post("", response_model=TokenCreateResponse, status_code=201) |
| 88 | +async def create_token( |
| 89 | + body: TokenCreate, |
| 90 | + request: Request, |
| 91 | + user=Depends(get_current_user), |
| 92 | +): |
| 93 | + # Refuse if the caller authenticated using an API token themselves. |
| 94 | + # Otherwise a stolen token could be used to mint a replacement that |
| 95 | + # outlives the victim revoking the original. |
| 96 | + auth_header = request.headers.get("Authorization", "") |
| 97 | + if auth_header.startswith(f"Bearer {API_TOKEN_PREFIX}"): |
| 98 | + raise HTTPException( |
| 99 | + status_code=403, |
| 100 | + detail="API tokens cannot create other API tokens; sign in as the user", |
| 101 | + ) |
| 102 | + |
| 103 | + if user.get("role") == "viewer": |
| 104 | + raise HTTPException( |
| 105 | + status_code=403, detail="Viewers cannot create API tokens" |
| 106 | + ) |
| 107 | + |
| 108 | + plaintext = _generate_plaintext() |
| 109 | + prefix = plaintext[:API_TOKEN_DISPLAY_PREFIX_LEN] |
| 110 | + expires_at: Optional[str] = None |
| 111 | + if body.expires_in_days and body.expires_in_days > 0: |
| 112 | + exp = datetime.now(timezone.utc) + timedelta(days=body.expires_in_days) |
| 113 | + # Store in the same textual shape SQLite uses for CURRENT_TIMESTAMP so |
| 114 | + # the resolver can parse both rows written here and any legacy rows |
| 115 | + # written by CURRENT_TIMESTAMP defaults without branching. |
| 116 | + expires_at = exp.strftime("%Y-%m-%d %H:%M:%S") |
| 117 | + |
| 118 | + db = await get_db() |
| 119 | + cursor = await db.execute( |
| 120 | + """INSERT INTO api_tokens (user_id, name, token_hash, prefix, expires_at) |
| 121 | + VALUES (?, ?, ?, ?, ?)""", |
| 122 | + (user["id"], body.name, hash_api_token(plaintext), prefix, expires_at), |
| 123 | + ) |
| 124 | + token_id = cursor.lastrowid |
| 125 | + await log_activity( |
| 126 | + db, user["id"], "created", "api_token", token_id, |
| 127 | + {"name": body.name, "expires_at": expires_at}, |
| 128 | + ) |
| 129 | + await db.commit() |
| 130 | + |
| 131 | + rows = await db.execute_fetchall( |
| 132 | + """SELECT id, name, prefix, created_at, last_used, expires_at, revoked_at |
| 133 | + FROM api_tokens WHERE id = ?""", |
| 134 | + (token_id,), |
| 135 | + ) |
| 136 | + result = dict(rows[0]) |
| 137 | + result["token"] = plaintext |
| 138 | + return result |
| 139 | + |
| 140 | + |
| 141 | +@router.delete("/{token_id}", status_code=204) |
| 142 | +async def revoke_token(token_id: int, user=Depends(get_current_user)): |
| 143 | + """Revoke one of the caller's tokens. Already-revoked is a no-op. |
| 144 | +
|
| 145 | + The row stays in place so the audit log entry still has a target. |
| 146 | + """ |
| 147 | + db = await get_db() |
| 148 | + rows = await db.execute_fetchall( |
| 149 | + "SELECT id, user_id, name, revoked_at FROM api_tokens WHERE id = ?", |
| 150 | + (token_id,), |
| 151 | + ) |
| 152 | + if not rows or rows[0]["user_id"] != user["id"]: |
| 153 | + # Treat cross-user probes as "not found" so an attacker can't |
| 154 | + # enumerate someone else's token ids. |
| 155 | + raise HTTPException(status_code=404, detail="Token not found") |
| 156 | + if rows[0]["revoked_at"] is not None: |
| 157 | + return |
| 158 | + |
| 159 | + await db.execute( |
| 160 | + "UPDATE api_tokens SET revoked_at = CURRENT_TIMESTAMP WHERE id = ?", |
| 161 | + (token_id,), |
| 162 | + ) |
| 163 | + await log_activity( |
| 164 | + db, user["id"], "revoked", "api_token", token_id, |
| 165 | + {"name": rows[0]["name"]}, |
| 166 | + ) |
| 167 | + await db.commit() |
0 commit comments