Python Full Stack Web Developer Course

Building a More Complex Module

Let's create a more realistic module for a web development project. This module will handle user authentication:

File location: /project/auth/user_auth.py

"""
User Authentication Module

This module provides functions for user authentication, including:
- Password hashing and verification
- User login and logout
- Session management
- Password reset functionality
"""

import hashlib
import os
import time
import re
from datetime import datetime, timedelta

# Constants
PASSWORD_MIN_LENGTH = 8
PASSWORD_EXPIRY_DAYS = 90
MAX_LOGIN_ATTEMPTS = 5
SESSION_TIMEOUT_MINUTES = 30

# In-memory storage (in a real application, this would be a database)
_users = {}
_sessions = {}
_failed_attempts = {}

def register_user(username, email, password):
    """
    Register a new user in the system.
    
    Args:
        username (str): The user's chosen username
        email (str): The user's email address
        password (str): The user's chosen password
        
    Returns:
        bool: True if registration successful, False otherwise
        
    Raises:
        ValueError: If username exists, email is invalid, or password is too weak
    """
    # Validate inputs
    if username in _users:
        raise ValueError(f"Username '{username}' already exists")
        
    if not _is_valid_email(email):
        raise ValueError("Invalid email format")
        
    password_check = _check_password_strength(password)
    if password_check != "OK":
        raise ValueError(f"Password too weak: {password_check}")
    
    # Hash the password with a salt
    salt = os.urandom(16).hex()
    hashed_pwd = _hash_password(password, salt)
    
    # Store the user
    _users[username] = {
        'email': email,
        'password_hash': hashed_pwd,
        'salt': salt,
        'created_at': datetime.now(),
        'last_login': None,
        'password_last_changed': datetime.now()
    }
    
    return True

def login(username, password):
    """
    Authenticate a user and create a session.
    
    Args:
        username (str): The user's username
        password (str): The user's password
        
    Returns:
        str: Session token if login successful, None otherwise
    """
    # Check if account is locked
    if _is_account_locked(username):
        return None
    
    # Check if user exists
    if username not in _users:
        _record_failed_attempt(username)
        return None
    
    # Check password
    user = _users[username]
    hashed_pwd = _hash_password(password, user['salt'])
    
    if hashed_pwd != user['password_hash']:
        _record_failed_attempt(username)
        return None
    
    # Reset failed attempts
    if username in _failed_attempts:
        del _failed_attempts[username]
    
    # Create session
    session_token = os.urandom(32).hex()
    _sessions[session_token] = {
        'username': username,
        'created_at': datetime.now(),
        'last_activity': datetime.now()
    }
    
    # Update user login time
    _users[username]['last_login'] = datetime.now()
    
    return session_token

def validate_session(session_token):
    """
    Validate a session token and update last activity time.
    
    Args:
        session_token (str): The session token to validate
        
    Returns:
        str: Username if session is valid, None otherwise
    """
    if session_token not in _sessions:
        return None
    
    session = _sessions[session_token]
    
    # Check if session has expired
    timeout = timedelta(minutes=SESSION_TIMEOUT_MINUTES)
    if datetime.now() - session['last_activity'] > timeout:
        # Session expired
        del _sessions[session_token]
        return None
    
    # Update last activity time
    session['last_activity'] = datetime.now()
    
    return session['username']

def logout(session_token):
    """
    Invalidate a session token.
    
    Args:
        session_token (str): The session token to invalidate
        
    Returns:
        bool: True if logout successful, False otherwise
    """
    if session_token in _sessions:
        del _sessions[session_token]
        return True
    return False

def change_password(username, old_password, new_password):
    """
    Change a user's password.
    
    Args:
        username (str): The user's username
        old_password (str): The user's current password
        new_password (str): The user's new password
        
    Returns:
        bool: True if password change successful, False otherwise
        
    Raises:
        ValueError: If new password is too weak
    """
    # Check if user exists
    if username not in _users:
        return False
    
    user = _users[username]
    
    # Verify old password
    hashed_old_pwd = _hash_password(old_password, user['salt'])
    if hashed_old_pwd != user['password_hash']:
        return False
    
    # Check new password strength
    password_check = _check_password_strength(new_password)
    if password_check != "OK":
        raise ValueError(f"New password too weak: {password_check}")
    
    # Hash new password with a new salt
    new_salt = os.urandom(16).hex()
    hashed_new_pwd = _hash_password(new_password, new_salt)
    
    # Update user information
    user['password_hash'] = hashed_new_pwd
    user['salt'] = new_salt
    user['password_last_changed'] = datetime.now()
    
    return True

# Private utility functions

def _is_valid_email(email):
    """Validate email format."""
    pattern = r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$'
    return bool(re.match(pattern, email))

def _hash_password(password, salt):
    """Hash a password with the given salt using SHA-256."""
    # In a real application, use a more secure hashing method like bcrypt
    return hashlib.sha256((password + salt).encode()).hexdigest()

def _check_password_strength(password):
    """Check if a password meets strength requirements."""
    if len(password) < PASSWORD_MIN_LENGTH:
        return f"Password must be at least {PASSWORD_MIN_LENGTH} characters"
    
    if not any(c.isupper() for c in password):
        return "Password must contain at least one uppercase letter"
    
    if not any(c.islower() for c in password):
        return "Password must contain at least one lowercase letter"
    
    if not any(c.isdigit() for c in password):
        return "Password must contain at least one digit"
    
    if not any(c in "!@#$%^&*()-_=+[]{}|;:,.<>?/" for c in password):
        return "Password must contain at least one special character"
    
    return "OK"

def _record_failed_attempt(username):
    """Record a failed login attempt."""
    current_time = datetime.now()
    
    if username not in _failed_attempts:
        _failed_attempts[username] = []
    
    # Add current attempt
    _failed_attempts[username].append(current_time)
    
    # Remove attempts older than 1 hour
    one_hour_ago = current_time - timedelta(hours=1)
    _failed_attempts[username] = [
        attempt for attempt in _failed_attempts[username]
        if attempt > one_hour_ago
    ]

def _is_account_locked(username):
    """Check if an account is locked due to too many failed attempts."""
    if username not in _failed_attempts:
        return False
    
    # Count recent attempts
    recent_attempts = len(_failed_attempts[username])
    return recent_attempts >= MAX_LOGIN_ATTEMPTS

# For demonstration and testing
if __name__ == "__main__":
    # Register a user
    try:
        register_user("john_doe", "john@example.com", "Weak")
    except ValueError as e:
        print(f"Registration failed: {e}")
    
    # Register with a strong password
    register_user("john_doe", "john@example.com", "StrongP@ss123")
    print("User registered successfully")
    
    # Failed login
    session = login("john_doe", "wrong_password")
    print(f"Login with wrong password: {'Failed' if session is None else 'Succeeded'}")
    
    # Successful login
    session = login("john_doe", "StrongP@ss123")
    print(f"Login with correct password: {'Succeeded' if session else 'Failed'}")
    print(f"Session token: {session}")
    
    # Validate session
    username = validate_session(session)
    print(f"Session validation: {username}")
    
    # Change password
    success = change_password("john_doe", "StrongP@ss123", "NewerP@ss456")
    print(f"Password change: {'Succeeded' if success else 'Failed'}")
    
    # Logout
    success = logout(session)
    print(f"Logout: {'Succeeded' if success else 'Failed'}")

Now let's see how we might use this module in a web application:

File location: /project/app.py

from flask import Flask, request, jsonify, session
from auth.user_auth import register_user, login, validate_session, logout, change_password

app = Flask(__name__)
app.secret_key = 'your_secret_key'

@app.route('/api/register', methods=['POST'])
def api_register():
    data = request.json
    
    try:
        username = data.get('username')
        email = data.get('email')
        password = data.get('password')
        
        if not all([username, email, password]):
            return jsonify({'error': 'Missing required fields'}), 400
        
        success = register_user(username, email, password)
        return jsonify({'success': success}), 201
    
    except ValueError as e:
        return jsonify({'error': str(e)}), 400
    except Exception as e:
        return jsonify({'error': 'An unexpected error occurred'}), 500

@app.route('/api/login', methods=['POST'])
def api_login():
    data = request.json
    
    try:
        username = data.get('username')
        password = data.get('password')
        
        if not all([username, password]):
            return jsonify({'error': 'Missing required fields'}), 400
        
        session_token = login(username, password)
        
        if not session_token:
            return jsonify({'error': 'Invalid credentials'}), 401
        
        # Store in browser session
        session['auth_token'] = session_token
        
        return jsonify({'success': True, 'token': session_token})
    
    except Exception as e:
        return jsonify({'error': 'An unexpected error occurred'}), 500

@app.route('/api/logout', methods=['POST'])
def api_logout():
    try:
        session_token = session.get('auth_token')
        
        if not session_token:
            return jsonify({'error': 'Not logged in'}), 401
        
        success = logout(session_token)
        
        if success:
            # Clear browser session
            session.pop('auth_token', None)
            return jsonify({'success': True})
        
        return jsonify({'error': 'Invalid session'}), 401
    
    except Exception as e:
        return jsonify({'error': 'An unexpected error occurred'}), 500

@app.route('/api/change-password', methods=['POST'])
def api_change_password():
    data = request.json
    
    try:
        session_token = session.get('auth_token')
        
        if not session_token:
            return jsonify({'error': 'Not logged in'}), 401
        
        username = validate_session(session_token)
        
        if not username:
            return jsonify({'error': 'Invalid session'}), 401
        
        old_password = data.get('old_password')
        new_password = data.get('new_password')
        
        if not all([old_password, new_password]):
            return jsonify({'error': 'Missing required fields'}), 400
        
        success = change_password(username, old_password, new_password)
        
        if not success:
            return jsonify({'error': 'Incorrect current password'}), 400
        
        return jsonify({'success': True})
    
    except ValueError as e:
        return jsonify({'error': str(e)}), 400
    except Exception as e:
        return jsonify({'error': 'An unexpected error occurred'}), 500

@app.route('/api/protected', methods=['GET'])
def api_protected():
    try:
        session_token = session.get('auth_token')
        
        if not session_token:
            return jsonify({'error': 'Not logged in'}), 401
        
        username = validate_session(session_token)
        
        if not username:
            return jsonify({'error': 'Invalid session'}), 401
        
        return jsonify({
            'success': True,
            'message': f'Hello, {username}! This is protected content.'
        })
    
    except Exception as e:
        return jsonify({'error': 'An unexpected error occurred'}), 500

if __name__ == '__main__':
    app.run(debug=True)