Spaces:
Running
Running
File size: 2,409 Bytes
340ee2f | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 | import hashlib
import secrets
import time
from dataclasses import dataclass, field
SESSION_TTL_SECONDS = 8 * 60 * 60
def _password_hash(password: str, salt: bytes) -> bytes:
return hashlib.scrypt(
password.encode("utf-8"),
salt=salt,
n=2**14,
r=8,
p=1,
dklen=32,
)
@dataclass
class RuntimeState:
"""Ephemeral setup/admin state. It intentionally resets with the container."""
configured: bool = False
bootstrap_code: str = ""
password_salt: bytes = b""
password_digest: bytes = b""
sessions: dict[str, float] = field(default_factory=dict)
def create_bootstrap_code(self) -> str:
self.bootstrap_code = secrets.token_urlsafe(12)
return self.bootstrap_code
def verify_bootstrap_code(self, provided: str) -> bool:
if not self.bootstrap_code:
return False
return secrets.compare_digest(provided.strip(), self.bootstrap_code)
def consume_bootstrap_code(self, provided: str) -> bool:
valid = self.verify_bootstrap_code(provided)
if valid:
self.bootstrap_code = ""
return valid
def set_password(self, password: str) -> None:
self.password_salt = secrets.token_bytes(16)
self.password_digest = _password_hash(password, self.password_salt)
self.sessions.clear()
def verify_password(self, password: str) -> bool:
if not self.password_salt or not self.password_digest:
return False
candidate = _password_hash(password, self.password_salt)
return secrets.compare_digest(candidate, self.password_digest)
def create_session(self) -> str:
self.prune_sessions()
token = secrets.token_urlsafe(32)
self.sessions[token] = time.time() + SESSION_TTL_SECONDS
return token
def valid_session(self, token: str | None) -> bool:
if not token:
return False
self.prune_sessions()
expiry = self.sessions.get(token)
return bool(expiry and expiry > time.time())
def revoke_session(self, token: str | None) -> None:
if token:
self.sessions.pop(token, None)
def prune_sessions(self) -> None:
now = time.time()
expired = [token for token, expiry in self.sessions.items() if expiry <= now]
for token in expired:
self.sessions.pop(token, None)
|