karldns.de/karldns/store/accounts.py

from __future__ import annotations

from datetime import UTC, datetime

from ..security import hash_lookup_token, hash_secret, new_bearer_secret, verify_secret
from .base import StoreConnectionMixin
from .types import AccountRow, account_row


class AccountsMixin(StoreConnectionMixin):
    def create_account(self, hostname: str, username: str | None = None, *, accepted: bool = True) -> AccountRow:
        now = datetime.now(UTC).isoformat()
        update_slug = new_bearer_secret()
        management_slug = new_bearer_secret()
        management_hash = hash_lookup_token(management_slug)
        accepted_at = now if accepted else None
        with self.connect() as conn:
            conn.execute(
                """
                INSERT INTO accounts(hostname, update_slug, management_hash, created_at, accepted_at, disabled)
                VALUES (?, ?, ?, ?, ?, 0)
                """,
                (hostname, update_slug, management_hash, now, accepted_at),
            )
        return {
            "hostname": hostname,
            "update_slug": update_slug,
            "management_slug": management_slug,
            "accepted_at": accepted_at,
        }

    def list_accounts(self, limit: int = 100, offset: int = 0) -> list[AccountRow]:
        with self.connect() as conn:
            rows = conn.execute(
                """
            SELECT accounts.hostname, accounts.update_slug,
                   accounts.created_at, accounts.accepted_at, accounts.disabled, records.ipv4, records.ipv6, records.updated_at
            FROM accounts
            LEFT JOIN records ON records.hostname = accounts.hostname
            ORDER BY accounts.hostname
            LIMIT ? OFFSET ?
            """,
                (limit, offset),
            ).fetchall()
        return [account_row(row) for row in rows]

    def count_accounts(self) -> int:
        with self.connect() as conn:
            row = conn.execute("SELECT COUNT(*) FROM accounts").fetchone()
        return int(row[0])

    def get_account_by_hostname(self, hostname: str) -> AccountRow | None:
        with self.connect() as conn:
            account = conn.execute(
                """
                SELECT accounts.hostname, accounts.update_slug, accounts.dashboard_password_hash,
                       accounts.created_at, accounts.accepted_at, accounts.disabled, records.ipv4, records.ipv6, records.updated_at
                FROM accounts
                LEFT JOIN records ON records.hostname = accounts.hostname
                WHERE accounts.hostname = ?
                """,
                (hostname,),
            ).fetchone()
        return account_row(account) if account else None

    def get_account_by_slug(self, update_slug: str) -> AccountRow | None:
        with self.connect() as conn:
            account = conn.execute(
                """
                SELECT hostname, update_slug, accepted_at, disabled FROM accounts
                WHERE update_slug = ?
                """,
                (update_slug,),
            ).fetchone()
        return account_row(account) if account else None

    def get_account_by_management_slug(self, management_slug: str) -> AccountRow | None:
        with self.connect() as conn:
            account = conn.execute(
                """
                SELECT accounts.hostname, accounts.update_slug, accounts.dashboard_password_hash,
                       accounts.created_at, accounts.accepted_at, accounts.disabled, records.ipv4, records.ipv6, records.updated_at
                FROM accounts
                LEFT JOIN records ON records.hostname = accounts.hostname
                WHERE accounts.management_hash = ?
                """,
                (hash_lookup_token(management_slug),),
            ).fetchone()
        return account_row(account) if account else None

    def activate_account(self, hostname: str) -> AccountRow | None:
        now = datetime.now(UTC).isoformat()
        with self.connect() as conn:
            conn.execute(
                "UPDATE accounts SET accepted_at = COALESCE(accepted_at, ?) WHERE hostname = ?",
                (now, hostname),
            )
        return self.get_account_by_hostname(hostname)

    def delete_account(self, hostname: str) -> None:
        with self.connect() as conn:
            conn.execute("DELETE FROM accounts WHERE hostname = ?", (hostname,))
            conn.execute("DELETE FROM records WHERE hostname = ?", (hostname,))

    def rotate_update_slug(self, hostname: str) -> AccountRow | None:
        update_slug = new_bearer_secret()
        with self.connect() as conn:
            conn.execute("UPDATE accounts SET update_slug = ? WHERE hostname = ?", (update_slug, hostname))
        return self.get_account_by_hostname(hostname)

    def rotate_management_slug(self, hostname: str) -> AccountRow | None:
        management_slug = new_bearer_secret()
        management_hash = hash_lookup_token(management_slug)
        with self.connect() as conn:
            conn.execute("UPDATE accounts SET management_hash = ? WHERE hostname = ?", (management_hash, hostname))
        account = self.get_account_by_hostname(hostname)
        if account:
            account["management_slug"] = management_slug
        return account

    def set_dashboard_password(self, hostname: str, password: str) -> AccountRow | None:
        password_hash = hash_secret(password)
        with self.connect() as conn:
            conn.execute(
                "UPDATE accounts SET dashboard_password_hash = ? WHERE hostname = ?",
                (password_hash, hostname),
            )
        return self.get_account_by_hostname(hostname)

    def clear_dashboard_password(self, hostname: str) -> AccountRow | None:
        with self.connect() as conn:
            conn.execute("UPDATE accounts SET dashboard_password_hash = NULL WHERE hostname = ?", (hostname,))
        return self.get_account_by_hostname(hostname)

    def verify_dashboard_password(self, hostname: str, password: str | None) -> bool:
        if not password:
            return False
        with self.connect() as conn:
            account = conn.execute(
                """
                SELECT dashboard_password_hash, disabled FROM accounts
                WHERE hostname = ?
                """,
                (hostname,),
            ).fetchone()
        if not account or account["disabled"] or not account["dashboard_password_hash"]:
            return False
        return verify_secret(password, account["dashboard_password_hash"])