Praxis CI
e39521d51d
- TASK-03-01 server/auth/passwords.py: argon2id via argon2-cffi
PasswordHasher (t=3, m=64MiB, p=4 — exceeds OWASP). hash/verify/
needs_rehash; verify returns False on mismatch (uniform 401 path).
- TASK-03-02 server/auth/cookies.py: get_session_middleware_kwargs()
→ Starlette SessionMiddleware (itsdangerous HMAC-SHA256, D-056).
Cookie praxis_op, httpOnly, SameSite=strict, max_age=28800 (8h).
PRAXIS_COOKIE_SECURE default true; false logs WARNING (R-AUTH-01).
G-031 reframe documented: k-anon defense-in-depth is the PRIMARY
mitigation (sniffed cookie → no PII); secure flag is SECONDARY.
- TASK-03-03 server/auth/rate_limit.py: slowapi Limiter (in-memory,
D-041), 5/minute per IP on login. reset_login_rate_limit() helper.
- TASK-03-04 server/auth/dependencies.py + models.py: current_operator
Depends — reads signed-cookie session, fetches operator from PgStore,
401 on missing/invalid/inactive (clears session), 503 if no Postgres.
Never trusts the client (D-057).
- TASK-03-05 server/auth/routes.py: APIRouter(prefix=/api/operator)
with POST /login (rate-limited, rehash-on-login), POST /logout
(auth-gated, clears session), GET /me (auth-gated, React guard).
- TASK-03-06 tests/test_auth.py: 18 unit tests (mocked PgStore) —
passwords, cookie config, rate limit, 401/503 cases, login/logout/me,
rehash-on-login.
- pyproject.toml: added itsdangerous>=2.1 (SessionMiddleware dep).
---ci---
project: praxis
phase: 1
milestone: v0.4
status: execute
persona: security-engineer
task: 03-01,03-02,03-03,03-04,03-05,03-06
requirements:
covered: [REQ-AUTH-01, REQ-NFR-AUTH-01]
grill:
- G-031 (R-AUTH-01 reframe: k-anon primary, secure flag secondary)
---/ci---
44 lines
1.4 KiB
Python
44 lines
1.4 KiB
Python
"""Argon2id password hashing (TASK-03-01, D-041, REQ-NFR-AUTH-01).
|
|
|
|
Uses argon2-cffi PasswordHasher with defaults that exceed OWASP minimums
|
|
(time_cost=3, memory_cost=64MiB, parallelism=4 — RESEARCH-v0.4 §2.1).
|
|
Single operator, low-frequency logins → hashing latency < 1s is
|
|
acceptable (R-AUTH-02).
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from argon2 import PasswordHasher
|
|
from argon2.exceptions import VerifyMismatchError
|
|
|
|
_ph = PasswordHasher()
|
|
|
|
|
|
def hash_password(plain: str) -> str:
|
|
"""Hash a plaintext password with argon2id. Returns the encoded hash string."""
|
|
return _ph.hash(plain)
|
|
|
|
|
|
def verify_password(stored_hash: str, plain: str) -> bool:
|
|
"""Verify a plaintext password against a stored argon2id hash.
|
|
|
|
Returns False on mismatch (no exception) so the login flow can apply a
|
|
uniform 401 + rate-limit-increment path on any auth failure.
|
|
"""
|
|
try:
|
|
_ph.verify(stored_hash, plain)
|
|
return True
|
|
except VerifyMismatchError:
|
|
return False
|
|
except Exception:
|
|
return False
|
|
|
|
|
|
def needs_rehash(stored_hash: str) -> bool:
|
|
"""True if the stored hash was produced with weaker params than the
|
|
current PasswordHasher defaults. The login flow rehashes + updates the
|
|
store when this returns True (param upgrades without forcing a reset)."""
|
|
return _ph.check_needs_rehash(stored_hash)
|
|
|
|
|
|
__all__ = ["hash_password", "verify_password", "needs_rehash"] |