feat: add register/login/logout with revocable server-side sessions

Claude-Session: https://claude.ai/code/session_01M9MLit5Ko3X4s7rzC5Kv7X

backend/auth.py

@@ -5,10 +5,15 @@ import hashlib
 import hmac
 import logging
 import os
+import re
 import secrets
 from pathlib import Path
 
-from flask import Blueprint, Flask
+import psycopg2.errors
+from flask import Blueprint, Flask, current_app, g, jsonify, make_response, request
+
+from db import query, query_one
+from validation import ApiError, json_body, require_utf8
 
 log = logging.getLogger(__name__)
 bp = Blueprint("auth", __name__, url_prefix="/api/auth")
@@ -16,6 +21,10 @@ bp = Blueprint("auth", __name__, url_prefix="/api/auth")
 ITERATIONS = 600_000
 SALT_BYTES = 16
 MIN_PEPPER_CHARS = 32
+SESSION_COOKIE = "sid"
+USERNAME_PATTERN = re.compile(r"[A-Za-z0-9_.-]{3,64}")
+MIN_PASSWORD, MAX_PASSWORD = 12, 1024
+INVALID_LOGIN = "Invalid username or password"
 
 
 def init_app(app: Flask) -> None:
@@ -85,3 +94,120 @@ def load_pepper(pepper_file: Path) -> bytes:
             "the file to regenerate it (existing passwords will stop verifying)."
         )
     return pepper.encode()
+
+
+# --- Sessions ------------------------------------------------------------------
+
+def login_required(view):
+    @functools.wraps(view)
+    def wrapper(*args, **kwargs):
+        token = request.cookies.get(SESSION_COOKIE)
+        row = None
+        if token:
+            # One statement validates and slides the idle window. The created_at predicate enforces
+            # the 12-hour cap even while expires_at is still in the future (ADR-0002).
+            row = query_one(
+                """
+                UPDATE sessions
+                   SET expires_at = LEAST(now() + interval '30 minutes', created_at + interval '12 hours')
+                 WHERE token_hash = %s
+                   AND expires_at > now()
+                   AND created_at > now() - interval '12 hours'
+                RETURNING user_id
+                """,
+                (_token_hash(token),),
+            )
+        if row is None:
+            raise ApiError(401, "Not signed in or session expired; log in again")
+        g.user_id = row["user_id"]
+        return view(*args, **kwargs)
+
+    return wrapper
+
+
+def _token_hash(token: str) -> bytes:
+    return hashlib.sha256(token.encode("utf-8")).digest()
+
+
+def _pepper() -> bytes:
+    return current_app.extensions["password_pepper"]
+
+
+def _start_session(user: dict, status: int):
+    token = secrets.token_urlsafe(32)
+    query("DELETE FROM sessions WHERE user_id = %s AND expires_at <= now()", (user["id"],))
+    query(
+        "INSERT INTO sessions (token_hash, user_id, expires_at) VALUES (%s, %s, now() + interval '30 minutes')",
+        (_token_hash(token), user["id"]),
+    )
+    response = jsonify(id=user["id"], username=user["username"])
+    response.status_code = status
+    response.set_cookie(SESSION_COOKIE, token, httponly=True, secure=True, samesite="Lax", path="/api")
+    return response
+
+
+# --- Routes ----------------------------------------------------------------------
+
+def _password(body: dict) -> str:
+    password = body.get("password")
+    if not isinstance(password, str):
+        raise ApiError(400, "password is required and must be a string", "password")
+    if len(password) > MAX_PASSWORD:
+        raise ApiError(400, f"password must be at most {MAX_PASSWORD} characters", "password")
+    require_utf8(password, "password")
+    return password
+
+
+@bp.post("/register")
+def register():
+    body = json_body({"username", "password"})
+    username = body.get("username")
+    if not isinstance(username, str) or not USERNAME_PATTERN.fullmatch(username):
+        raise ApiError(400, "username must be 3-64 characters: letters, digits, '.', '_' or '-'", "username")
+    password = _password(body)
+    if len(password) < MIN_PASSWORD:
+        raise ApiError(400, f"password must be at least {MIN_PASSWORD} characters", "password")
+    try:
+        user = query_one(
+            "INSERT INTO users (username, password_hash) VALUES (%s, %s) RETURNING id, username",
+            (username, hash_password(password, _pepper())),
+        )
+    except psycopg2.errors.UniqueViolation:
+        raise ApiError(409, "Username already taken; choose another", "username") from None
+    return _start_session(user, 201)
+
+
+@bp.post("/login")
+def login():
+    body = json_body({"username", "password"})
+    password = _password(body)
+    username = body.get("username")
+    user = None
+    if isinstance(username, str) and USERNAME_PATTERN.fullmatch(username):
+        user = query_one(
+            "SELECT id, username, password_hash FROM users WHERE lower(username) = lower(%s)", (username,)
+        )
+    if user is None:
+        verify_password(password, _dummy_hash(), _pepper())
+        raise ApiError(401, INVALID_LOGIN)
+    if not verify_password(password, user["password_hash"], _pepper()):
+        raise ApiError(401, INVALID_LOGIN)
+    if needs_rehash(user["password_hash"]):
+        query("UPDATE users SET password_hash = %s WHERE id = %s", (hash_password(password, _pepper()), user["id"]))
+    return _start_session(user, 200)
+
+
+@bp.post("/logout")
+def logout():
+    token = request.cookies.get(SESSION_COOKIE)
+    if token:
+        query("DELETE FROM sessions WHERE token_hash = %s", (_token_hash(token),))
+    response = make_response("", 204)
+    response.delete_cookie(SESSION_COOKIE, path="/api", secure=True, httponly=True, samesite="Lax")
+    return response
+
+
+@bp.get("/me")
+@login_required
+def me():
+    return jsonify(query_one("SELECT id, username FROM users WHERE id = %s", (g.user_id,)))