Nirodan
80ec5eca7b
- Move SECRET_KEY out of docker-compose into .env (env_file), add .env.example - Add flask-limiter with 10 req/min on login route; introduce util/limiter.py - Replace direct mysql.connector.connect() calls with MySQLConnectionPool via util/db_pool.py - Fix deprecated datetime.utcnow() -> datetime.now(timezone.utc) in auth/login.py - Remove dead /api/scripts 410 route from admin.py - Add MD5 security warning in Md5Tool.jsx - Add ErrorBoundary component and wrap App.jsx - Expand README with setup guide, screenshot and project structure Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
51 lines
1.6 KiB
Python
51 lines
1.6 KiB
Python
from flask import request, jsonify
|
|
from werkzeug.security import check_password_hash
|
|
from datetime import datetime, timedelta, timezone
|
|
import jwt
|
|
|
|
from util.logger import logger
|
|
from util.db_pool import get_connection
|
|
from util.limiter import limiter
|
|
from auth.token import SECRET_KEY
|
|
|
|
|
|
@limiter.limit("10 per minute")
|
|
def login_route():
|
|
data = request.get_json()
|
|
username = data.get('username')
|
|
password = data.get('password')
|
|
|
|
if not SECRET_KEY:
|
|
logger.error("Login blocked: SECRET_KEY is not configured.")
|
|
return jsonify({"message": "Server misconfigured"}), 500
|
|
|
|
try:
|
|
conn = get_connection()
|
|
cursor = conn.cursor(dictionary=True)
|
|
cursor.execute("SELECT * FROM users WHERE username = %s", (username,))
|
|
user = cursor.fetchone()
|
|
cursor.close()
|
|
conn.close()
|
|
|
|
if user and check_password_hash(user['password'], password):
|
|
logger.info(f"Login successful: {username}")
|
|
|
|
payload = {
|
|
"username": user['username'],
|
|
"role": user['role'],
|
|
"exp": datetime.now(timezone.utc) + timedelta(minutes=60)
|
|
}
|
|
token = jwt.encode(payload, SECRET_KEY, algorithm="HS256")
|
|
|
|
return jsonify({
|
|
"token": token,
|
|
"role": user['role']
|
|
})
|
|
|
|
logger.warning(f"⛔ Login failed: {username}")
|
|
return jsonify({"message": "Login failed"}), 401
|
|
|
|
except Exception as e:
|
|
logger.error(f"[Login Error] {e}")
|
|
return jsonify({"message": "Server error"}), 500
|