fix: critical fix to allow callsign to be none and password_salt to be a string field of max 32 charcters

Author: Qinkai Li

gs/backend/api/v1/aro/endpoints/auth/oauth.py

@@ -9,17 +9,15 @@
 After initial authentication, the user will need to additionally verify with their callsign.
 """
 
-from datetime import datetime, timedelta
-from hashlib import pbkdf2_hmac
+from datetime import datetime
 from os import urandom
-from typing import Optional
 from uuid import UUID, uuid4
 
 from authlib.integrations.starlette_client import OAuth, OAuthError
 from starlette.requests import Request
 from starlette.config import Config
 from fastapi.responses import RedirectResponse
-from fastapi import APIRouter, Depends, HTTPException, status
+from fastapi import APIRouter, HTTPException, status
 from pydantic import BaseModel, EmailStr
 from sqlmodel import select
 
@@ -204,7 +202,7 @@ async def google_callback(request: Request) -> TokenResponse:
     user = get_user_by_google_id(google_id=google_id)
     if not user:
         # Does the user email already exist?
-        existing_user = get_user_by_email(user)
+        existing_user = get_user_by_email(email)
         if existing_user:
             # Link Google Account to existing email
             with get_db_session() as session:
@@ -247,9 +245,8 @@ async def register(request: RegisterRequest) -> TokenResponse:
     existing_user = get_user_by_email(request.email)
     if existing_user:
         raise HTTPException(
-            
             status_code=status.HTTP_409_CONFLICT,
-            details="Email has already been taken.",
+            detail="Email has already been taken.",
         )
 
     # Create all user data
@@ -274,7 +271,7 @@ async def register(request: RegisterRequest) -> TokenResponse:
         login = AROUserLogin(
             email=user.email,
             password=hashed_password,
-            password_salt=salt,
+            password_salt=salt.hex(),
             hashing_algorithm_name=HASH_ALGORITHM,
             user_data_id=user.id,
             email_verification_token=verification_token,
@@ -286,7 +283,7 @@ async def register(request: RegisterRequest) -> TokenResponse:
         auth_token = create_auth_token(user.id, AROAuthToken.EMAIL_PASSWORD)
 
         return TokenResponse(
-            token=auth_token,
+            token=auth_token.token,
             user_id=user.id,
             expires_at=auth_token.expiry,
         )
@@ -312,7 +309,7 @@ async def login(request: LoginRequest) -> TokenResponse:
         if not verify_password(request.password, login_record.password_salt, login_record.password):
             raise HTTPException(
                 status_code=status.HTTP_401_UNAUTHORIZED,
-                details="Incorrect email or password.",
+                detail="Incorrect email or password.",
             )
 
         # Get the user data
@@ -327,7 +324,7 @@ async def login(request: LoginRequest) -> TokenResponse:
     auth_token = create_auth_token(user.id, AROAuthToken.EMAIL_PASSWORD)
 
     return TokenResponse(
-        token=auth_token,
+        token=auth_token.token,
         user_id=user.id,
         expires_at=auth_token.expiry,
     )
@@ -349,10 +346,10 @@ async def logout(token: str) -> dict:
             select(AROUserAuthToken).where(AROUserAuthToken.token == token)
         ).first()
 
-        if not auth_token():
+        if not auth_token:
             raise HTTPException(
                 status_code=status.HTTP_404_NOT_FOUND,
-                details="Couldn't find your login credentials. How did you even log in?",
+                detail="Couldn't find your login credentials. How did you even log in?",
             )
 
         session.delete(auth_token)
@@ -378,7 +375,7 @@ async def get_current_user(token: str) -> UserResponse:
         if not auth_token():
             raise HTTPException(
                 status_code=status.HTTP_404_NOT_FOUND,
-                details="Couldn't find your login credentials. How did you even log in?",
+                detail="Couldn't find your login credentials. How did you even log in?",
             )
 
         # Check for expiracy

gs/backend/api/v1/aro/endpoints/services.py

@@ -17,8 +17,6 @@
     AROUsers,
 )
 from gs.backend.data.database.engine import get_db_session
-from gs.backend.data.enums.aro_auth_token import AROAuthToken
-from gs.backend.data.tables.aro_user_tables import AROAuthToken
 
 TOKEN_EXPIRY_HOURS = 6.7
 HASH_ALGORITHM = "sha256"
@@ -29,8 +27,9 @@ def hash_password(password: str, salt: bytes) -> str:
     hashed = pbkdf2_hmac(HASH_ALGORITHM, password.encode(), salt, HASH_ITERATIONS)
     return hashed.hex()
 
-def verify_password(password: str, salt: bytes, hashed: str) -> bool:
+def verify_password(password: str, salt_hex: bytes, hashed: str) -> bool:
     # Verify a hashed password against its hash
+    salt = bytes.fromhex(salt_hex)
     return hash_password(password, salt) == hashed
 
 def create_auth_token(user_id: UUID, auth_type: AROUserAuthToken) -> AROUserAuthToken:
@@ -55,14 +54,14 @@ def create_auth_token(user_id: UUID, auth_type: AROUserAuthToken) -> AROUserAuth
 def get_user_by_email(email: str) -> AROUsers | None:
     # Find a user by their email address.
     with get_db_session() as session:
-        found_user = session.exec(select(AROUsers).where(AROUsers.email == email))
-        return found_user
+        found_user = session.exec(select(AROUsers).where(AROUsers.email == email)).first()
+    return found_user
 
 def get_user_by_google_id(google_id: str) -> AROUsers | None:
     # Find a user from their Google ID.
     with get_db_session() as session:
-        found_user = session.exec(select(AROUsers).where(AROUsers.google_id == google_id))
-        return found_user
+        found_user = session.exec(select(AROUsers).where(AROUsers.google_id == google_id)).first()
+    return found_user
 
 def create_oauth_user(google_id: str, email: str, first_name: str, last_name: str | None) -> AROUsers:
     # Create a new user from Google OAuth data.

gs/backend/data/tables/aro_user_tables.py

@@ -48,7 +48,7 @@ class AROUsers(BaseSQLModel, table=True):
 
     id: UUID = Field(default_factory=uuid4, primary_key=True, index=True)
 
-    call_sign: str = Field(
+    call_sign: str | None = Field(
         min_length=CALL_SIGN_MIN_LENGTH, 
         max_length=CALL_SIGN_MAX_LENGTH,
         default=None,
@@ -100,8 +100,8 @@ class AROUserLogin(BaseSQLModel, table=True):
 
     id: UUID = Field(default_factory=uuid4, primary_key=True, index=True)  # unique id for logins
     email: EmailStr = Field(min_length=EMAIL_MIN_LENGTH, max_length=DEFAULT_MAX_LENGTH, unique=True)
-    password: str = Field(max_length=20)
-    password_salt: bytes = urandom(16)
+    password: str = Field(max_length=128)
+    password_salt: str = Field(max_length=32)
     created_on: datetime = Field(default_factory=datetime.now)
     hashing_algorithm_name: str = Field(min_length=1, max_length=20)
     user_data_id: UUID = Column(DB_UUID, ForeignKey(AROUsers.id))  # type: ignore
@@ -110,7 +110,6 @@ class AROUserLogin(BaseSQLModel, table=True):
     __tablename__ = ARO_USER_LOGIN
     __table_args__ = {"schema": ARO_USER_SCHEMA_NAME}
 
-
 class AROUserAuthToken(BaseSQLModel, table=True):
     """
     Stores all information for User Auth Tokens