Spaces:
Sleeping
Sleeping
File size: 2,502 Bytes
9d21edd | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 | import hashlib
import os
import secrets
import sqlite3
from pathlib import Path
from typing import Tuple
PROJECT_ROOT = Path(__file__).resolve().parents[1]
DATA_DIR = PROJECT_ROOT / "data"
DB_PATH = DATA_DIR / "users.db"
def _ensure_db() -> None:
DATA_DIR.mkdir(parents=True, exist_ok=True)
conn = sqlite3.connect(DB_PATH)
try:
conn.execute(
"""
CREATE TABLE IF NOT EXISTS users (
id INTEGER PRIMARY KEY AUTOINCREMENT,
username TEXT UNIQUE NOT NULL,
password_hash TEXT NOT NULL,
salt TEXT NOT NULL,
created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
)
"""
)
conn.commit()
finally:
conn.close()
def _hash_password(password: str, salt_hex: str) -> str:
salt = bytes.fromhex(salt_hex)
digest = hashlib.pbkdf2_hmac("sha256", password.encode("utf-8"), salt, 120_000)
return digest.hex()
def _normalize_username(username: str) -> str:
return username.strip().lower()
def create_user(username: str, password: str) -> Tuple[bool, str]:
_ensure_db()
normalized = _normalize_username(username)
if len(normalized) < 3:
return False, "Username must be at least 3 characters."
if len(password) < 8:
return False, "Password must be at least 8 characters."
salt_hex = secrets.token_hex(16)
password_hash = _hash_password(password, salt_hex)
conn = sqlite3.connect(DB_PATH)
try:
conn.execute(
"INSERT INTO users (username, password_hash, salt) VALUES (?, ?, ?)",
(normalized, password_hash, salt_hex),
)
conn.commit()
return True, "Account created successfully."
except sqlite3.IntegrityError:
return False, "Username already exists."
finally:
conn.close()
def authenticate_user(username: str, password: str) -> Tuple[bool, str]:
_ensure_db()
normalized = _normalize_username(username)
conn = sqlite3.connect(DB_PATH)
try:
row = conn.execute(
"SELECT password_hash, salt FROM users WHERE username = ?",
(normalized,),
).fetchone()
finally:
conn.close()
if not row:
return False, "User not found."
stored_hash, salt_hex = row
candidate_hash = _hash_password(password, salt_hex)
if candidate_hash != stored_hash:
return False, "Incorrect password."
return True, "Login successful."
|