security.py

# security.py
# Handles password hashing, verification, and brute force slowdown.

import bcrypt
import time
from datetime import datetime, timedelta
import database

# ─────────────────────────────────────────────
#  PASSWORD HASHING
# ─────────────────────────────────────────────

def hash_password(plain_text_password):
    """
    Takes a plain password string and returns a bcrypt hash.

    'rounds=12' means bcrypt runs 2^12 = 4096 internal iterations.
    Higher = slower to crack, but also slightly slower for your app.
    12 is the industry standard sweet spot.

    bcrypt.hashpw() requires bytes, so we encode the string first.
    The salt is generated automatically and embedded in the result.
    """
    password_bytes = plain_text_password.encode("utf-8")
    salt = bcrypt.gensalt(rounds=12)
    hashed = bcrypt.hashpw(password_bytes, salt)
    # Store as a string in the database (decode from bytes)
    return hashed.decode("utf-8")


def verify_password(plain_text_password, stored_hash):
    """
    Checks if a plain password matches the stored bcrypt hash.
    Returns True if correct, False if wrong.

    bcrypt.checkpw() does the comparison safely —
    it re-hashes the input and compares internally.
    Never compare hashes with == yourself.
    """
    try:
        password_bytes = plain_text_password.encode("utf-8")
        hash_bytes = stored_hash.encode("utf-8")
        return bcrypt.checkpw(password_bytes, hash_bytes)
    except Exception:
        return False


# ─────────────────────────────────────────────
#  BRUTE FORCE PROTECTION
# ─────────────────────────────────────────────

# How many wrong attempts before we lock the account
MAX_ATTEMPTS = 3

# How long the lockout lasts (in minutes) — doubles each time
BASE_LOCKOUT_MINUTES = 1


def get_delay_seconds(failed_attempts):
    """
    Returns how many seconds to SLEEP before responding to a login attempt.
    This slows down automated attack scripts dramatically.

    Attempt 1 wrong: 0s delay
    Attempt 2 wrong: 2s delay
    Attempt 3 wrong: 4s delay
    Attempt 4 wrong: 8s delay
    Attempt 5+:      account locked
    """
    if failed_attempts <= 0:
        return 0
    delay = min(2 ** (failed_attempts - 1), 30)  # cap at 30 seconds
    return delay


# def is_account_locked(user):
#     """
#     Checks if the user's account is currently locked.
#     Returns (is_locked: bool, message: str, seconds_remaining: int)
#     """
#     if not user["is_locked"] and not user["lockout_until"]:
#         return False, "", 0

#     if user["lockout_until"]:
#         lockout_time = datetime.fromisoformat(user["lockout_until"])
#         now = datetime.now()

#         if now < lockout_time:
#             remaining = int((lockout_time - now).total_seconds())
#             minutes = remaining // 60
#             seconds = remaining % 60
#             msg = f"Account locked. Try again in {minutes}m {seconds}s."
#             return True, msg, remaining
#         else:
#             # Lockout has expired — automatically unlock
#             database.reset_failed_attempts(user["id"])
#             return False, "", 0

#     return True, "Account is permanently locked. Contact support.", 0

def is_account_locked(user):
    """
    Checks only for BRUTE FORCE lockout (failed_attempts based).
    Alert-based locks are handled separately in app.py before this is called.
    """
    # No lockout at all
    if not user["lockout_until"]:
        return False, "", 0

    # There is a timed lockout — check if it has expired
    lockout_time = datetime.fromisoformat(user["lockout_until"])
    now = datetime.now()

    if now < lockout_time:
        remaining = int((lockout_time - now).total_seconds())
        minutes   = remaining // 60
        seconds   = remaining % 60
        msg = f"Account locked. Try again in {minutes}m {seconds}s."
        return True, msg, remaining
    else:
        # Lockout expired — auto-unlock
        database.reset_failed_attempts(user["id"])
        return False, "", 0

def handle_failed_login(user):
    """
    Called every time a user enters the wrong password.
    - Increments the failure counter
    - Applies a time delay (slows down attackers)
    - Locks the account after MAX_ATTEMPTS failures

    Returns a message to show the user.
    """
    database.increment_failed_attempts(user["id"])
    new_attempts = user["failed_attempts"] + 1

    # Apply delay to slow down brute force scripts
    delay = get_delay_seconds(new_attempts)
    if delay > 0:
        time.sleep(delay)

    if new_attempts >= MAX_ATTEMPTS:
        # Calculate lockout duration — doubles each time they hit the limit
        lockout_minutes = BASE_LOCKOUT_MINUTES * (2 ** (new_attempts // MAX_ATTEMPTS - 1))
        lockout_minutes = min(lockout_minutes, 1440)  # cap at 24 hours
        lockout_until = datetime.now() + timedelta(minutes=lockout_minutes)
        database.set_lockout(user["id"], lockout_until.isoformat())
        return f"Too many failed attempts. Account locked for {lockout_minutes} minutes."

    remaining = MAX_ATTEMPTS - new_attempts
    return f"Wrong password. {remaining} attempt(s) remaining before lockout."


def validate_password_strength(password):
    """
    Checks if a password meets minimum security requirements.
    Returns (is_valid: bool, error_message: str)
    """
    if len(password) < 8:
        return False, "Password must be at least 8 characters."
    if not any(c.isupper() for c in password):
        return False, "Password must contain at least one uppercase letter."
    if not any(c.islower() for c in password):
        return False, "Password must contain at least one lowercase letter."
    if not any(c.isdigit() for c in password):
        return False, "Password must contain at least one number."
    return True, ""

# Add to the bottom of security.py

import secrets  # add this import at the TOP of security.py with other imports

def generate_reset_token():
    """
    Generates a cryptographically secure random token for password reset.

    secrets.token_urlsafe() uses the OS random number generator —
    far more secure than random.random(). The result is URL-safe base64,
    so it can go directly into a link without encoding issues.

    64 bytes gives us a token so long that brute-forcing it is
    computationally impossible (2^512 combinations).
    """
    return secrets.token_urlsafe(64)


def validate_reset_token(user, token):
    """
    Checks if a password reset token is valid and not expired.
    Returns (is_valid: bool, error_message: str)
    """
    if not user:
        return False, "Invalid or expired reset link."

    if not user["reset_token"] or user["reset_token"] != token:
        return False, "Invalid or expired reset link."

    if not user["reset_expires"]:
        return False, "Invalid or expired reset link."

    expires = datetime.fromisoformat(user["reset_expires"])
    if datetime.now() > expires:
        return False, "This reset link has expired. Please request a new one."

    return True, ""





import hashlib  # add this at the top of security.py with other imports

def hash_otp(otp_code):
    """
    Hashes a plain OTP using SHA-256 before storing in the database.
    We don't use bcrypt here because OTPs are already protected by:
      - 10-minute expiry
      - 3-attempt maximum
    SHA-256 is instant and sufficient for this use case.
    """
    return hashlib.sha256(otp_code.encode("utf-8")).hexdigest()


def verify_otp(entered_otp, stored_hash):
    """
    Hashes the entered OTP and compares it to the stored hash.
    Never compares plain OTP to the stored value directly.
    Returns True if they match.
    """
    return hashlib.sha256(entered_otp.encode("utf-8")).hexdigest() == stored_hash