\{{tWHQ=Սc 6NbdO}aX]:λs.E(Ʈsj4~.=3+ȭ()(ZoʱaxЌd r8xF?U=;un.ylj,VMrD}WaG2L)VO TZ2=Ɖ 1L[h}KEZ> E\|G;/vF-SiHtLe[.9D\(p )'V02۳3:7yqm$W}'[6(9SDs{pj铨WiflHo򝀻I ɑUY?>*P~o2`LzʒA)k"2U6.i)a7 pAEnw6^|P5\1,qX >=Ԧ-S5@ U/3Qw-zDžrinT%Ǝ wqu&:aCȥϲyҞPpޱCz_9F*mi@1C|,by. WXE|I2X䉣OcIQ?X R,!n\/D}ui8[8KUx[JO|pFzR4]'lA{bcxw94VA*mi@1C|w\9xBq|dA&#mC_xU&& l \o}Í/a,fhΛkq,>LS'_,>ś6,HȈ@ʲ1h f^8d@Ǎa6Ck ZC凡3P11X_-^;Flim#k~K 9G>oUm̓"~y"kdu 0ݛo:=T -ox#1AO}L0ߤX%e1!? ۭہU"<[NIJ"cbZݻc9Zqe7 YHfϟ]K{붬$|KV+gnhقkȅyh!+MI5f`CbШKݦ Cʽ(h}5 ELWe-{ [camռIܠy&!汯 ߇7l[`AVz~DNhDn)pdևX+4O='d;3?5VDO{SiR1Cr -7t'Ia7J`rCCɦ;*weEX<1Wؽ+*HꛑrEC":\D -ଶ 8 4Hm9<gh6H2bM|Mmr 7&G =)(!= ǚ/8[iUPeƠǓEbw(u,Q& WFr'6.7mw!ʹD{ٮRٸ%vq!4gOw|1"Ɠ(g4ř [ `(S]\b쌀̖j8̥*(Tq(dWf\t  Q"$7^[Aw?xǯc4*(G)_nw{9x< "*CV򞌪5IW{<.2N­_<]|ЋaF2+R4/O Uu {w_ TBWI;.vI-?Eb36I #XC6.œ@2z}DB p9>M3Bd`' 9-c^'ubl-G881i. .Hrr{|b44)eOukrv㲗nvB(>JlFPcDۯGYcA'1|9 :Ɣ̦rE ț(3F7$OzX#GגWFтnsɀ:~\Q@C3M_!Qij};~[brWNZRHxUR_A[dword = None if old: member = dict(old) if member['is_super']: raise HTTPException(400, 'Platform administrators already have explicit access to all businesses.') if not member['active']: raise HTTPException(400, 'This account is disabled. Ask the platform administrator to enable it.') else: password = secrets.token_urlsafe(18) member = create_user(conn, name, email, password, must_change=True) if conn.execute('SELECT 1 FROM memberships WHERE business_id=? AND user_id=?', (bid, member['id'])).fetchone(): raise HTTPException(409, 'This person is already a member of this business.') insert(conn, 'memberships', dict(business_id=bid, user_id=member['id'], role=role)) audit(conn, user, bid, 'Added team member', 'users', member['id'], role) return dict(user=safe_user(member), temporary_password=password) def login(request: Request, response: Response, email: str, password: str): email = email.strip().lower() ip = request.client.host if request.client else 'unknown' ts = time.time() keys = [('ip:' + digest(ip), 30), ('email:' + digest(email), 10)] blocked = False with db(write=True) as conn: conn.execute('DELETE FROM login_limits WHERE resets_at= maximum: blocked = True if not blocked: for key, _ in keys: conn.execute('''INSERT INTO login_limits(key,attempts,resets_at) VALUES(?,1,?) ON CONFLICT(key) DO UPDATE SET attempts=attempts+1''', (key, ts + 900)) row = conn.execute('SELECT * FROM users WHERE email=? COLLATE NOCASE', (email,)).fetchone() if blocked: raise HTTPException(429, 'Too many sign-in attempts. Wait 15 minutes and try again.') valid = verify(row['password_hash'] if row else DUMMY, password) if not row or not valid or not row['active']: raise HTTPException(401, 'Email or password is incorrect.') user = dict(row) token, csrf = secrets.token_urlsafe(32), secrets.token_urlsafe(32) with db(write=True) as conn: conn.execute('DELETE FROM login_limits WHERE key=?', ('email:' + digest(email),)) if HASHER.check_needs_rehash(user['password_hash']): conn.execute('UPDATE users SET password_hash=? WHERE id=?', (hash_password(password), user['id'])) # Rotate any previous session attached to this browser. previous = request.cookies.get(COOKIE) if previous: conn.execute('DELETE FROM sessions WHERE token_hash=?', (digest(previous),)) insert(conn, 'sessions', dict(token_hash=digest(token), user_id=user['id'], csrf=csrf, expires_at=ts+ABSOLUTE, last_seen=ts)) audit(conn, user, None, 'Signed in', 'users', user['id']) response.set_cookie(COOKIE, token, httponly=True, secure=SECURE, samesite='lax', max_age=ABSOLUTE, path='/') return dict(user=safe_user(user), csrf=csrf)