e7bacc93da
CRITICAL fixes: - Auto-generated self-signed TLS certs (HTTPS/WSS by default) - Removed session_key from /srp/verify response (was sent in plaintext) - Replaced with HMAC-SHA256 ws_token for WebSocket authentication HIGH fixes: - WebSocket auth now validates ws_token via hmac.compare_digest() - /clear endpoint requires Bearer admin_token (printed at server start) - Password no longer required as CLI arg — supports env var + getpass prompt - Removed user_ip from Message model (no longer broadcast to clients) MEDIUM fixes: - Rate limiter on /srp/init and /srp/verify (10 req/min/IP) - MessageStore capped at 1000 messages (prevents RAM DoS) - access_log disabled (was leaking request metadata) LOW fixes: - Username sanitization against rich markup injection - Dead code removed from helpers.py All 79 tests passing. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
37 lines
1.0 KiB
Python
37 lines
1.0 KiB
Python
from dataclasses import dataclass, field
|
|
from uuid import uuid4
|
|
from datetime import datetime, timezone
|
|
from typing import Optional
|
|
|
|
|
|
@dataclass
|
|
class Message:
|
|
id: str = field(default_factory=lambda: str(uuid4()))
|
|
text: str = ""
|
|
timestamp: str = field(
|
|
default_factory=lambda: datetime.now(timezone.utc).isoformat()
|
|
)
|
|
username: str = ""
|
|
|
|
|
|
@dataclass
|
|
class UserSession:
|
|
user_id: str
|
|
ip: str
|
|
username: str = "unknown"
|
|
fernet_key: Optional[bytes] = None
|
|
created_at: str = field(
|
|
default_factory=lambda: datetime.now(timezone.utc).isoformat()
|
|
)
|
|
last_activity: str = field(
|
|
default_factory=lambda: datetime.now(timezone.utc).isoformat()
|
|
)
|
|
active: bool = True
|
|
|
|
def update_activity(self):
|
|
self.last_activity = datetime.now(timezone.utc).isoformat()
|
|
|
|
def is_stale(self, timeout_seconds: int = 3600) -> bool:
|
|
last = datetime.fromisoformat(self.last_activity)
|
|
return (datetime.now(timezone.utc) - last).total_seconds() > timeout_seconds
|