| """登录: 标注人账号在环境变量 ANNOTATORS_JSON 里配置(密码只存 PBKDF2 哈希), 会话用 HMAC 签名 cookie。 |
| |
| ANNOTATORS_JSON 示例(scripts/hash_password.py 生成哈希): |
| { |
| "Rong": {"role": "admin", "pw": "pbkdf2_sha256$..."}, |
| "A": {"pw": "pbkdf2_sha256$...", "papers": ["MICCAI_3979_paper"]}, |
| "B": {"pw": "pbkdf2_sha256$..."} |
| } |
| papers 可选: 给了就只能看到这些论文。repo 可选: 给了就把此人标注写进那个仓库(默认写 DATA_REPO 的 annotations/<ID>/)。未配置 ANNOTATORS_JSON 且为 local 后端时 = 开放模式(同 0817 本地版, 任填 ID)。 |
| """ |
| import base64 |
| import hashlib |
| import hmac |
| import json |
| import secrets |
| import time |
| from typing import Optional |
|
|
| ITERATIONS = 200_000 |
| COOKIE = "repl_sess" |
| SESSION_TTL = 14 * 24 * 3600 |
|
|
|
|
| def hash_password(pw: str, salt: Optional[str] = None) -> str: |
| salt = salt or secrets.token_hex(16) |
| dk = hashlib.pbkdf2_hmac("sha256", pw.encode(), salt.encode(), ITERATIONS) |
| return f"pbkdf2_sha256${ITERATIONS}${salt}${dk.hex()}" |
|
|
|
|
| def verify_password(pw: str, stored: str) -> bool: |
| try: |
| algo, it, salt, digest = stored.split("$") |
| except ValueError: |
| return False |
| if algo != "pbkdf2_sha256": |
| return False |
| dk = hashlib.pbkdf2_hmac("sha256", pw.encode(), salt.encode(), int(it)) |
| return hmac.compare_digest(dk.hex(), digest) |
|
|
|
|
| def _b64(b: bytes) -> str: |
| return base64.urlsafe_b64encode(b).decode().rstrip("=") |
|
|
|
|
| def _unb64(s: str) -> bytes: |
| return base64.urlsafe_b64decode(s + "=" * (-len(s) % 4)) |
|
|
|
|
| def sign_session(secret: str, annotator: str) -> str: |
| body = _b64(json.dumps({"a": annotator, "exp": int(time.time()) + SESSION_TTL}).encode()) |
| mac = _b64(hmac.new(secret.encode(), body.encode(), hashlib.sha256).digest()) |
| return f"{body}.{mac}" |
|
|
|
|
| def read_session(secret: str, token: Optional[str]) -> Optional[str]: |
| if not token or "." not in token: |
| return None |
| body, mac = token.rsplit(".", 1) |
| want = _b64(hmac.new(secret.encode(), body.encode(), hashlib.sha256).digest()) |
| if not hmac.compare_digest(mac, want): |
| return None |
| try: |
| data = json.loads(_unb64(body)) |
| except (ValueError, json.JSONDecodeError): |
| return None |
| if data.get("exp", 0) < time.time(): |
| return None |
| return data.get("a") |
|
|
