""" Orion Permit Portal — login and sign-up, restricted to an approved list of emails. How it works * Everything on the site (the dashboard and every /api route) requires a signed-in user. * Anyone can OPEN the sign-up page, but an account is only created if the email is on approved_emails.txt (one address per line; edit it any time — no restart needed). * Removing an address from that file also cuts off an existing account at its next request. * Passwords are stored hashed (never in plain text). Repeated wrong passwords lock the login for a while. Sessions last 14 days. Files (all live in ORION_AUTH_DIR, which defaults to this folder) approved_emails.txt — the allow-list you maintain users.db — accounts (hashed passwords) .secret_key — signs login cookies (auto-created) auth_events.log — sign-ups, sign-ins, failures, lockouts (no passwords) Settings (environment variables, all optional) ORION_AUTH_DIR where the files above live (put it OUTSIDE the folder you upload, so re-uploading the site can't overwrite accounts) ORION_COOKIE_SECURE "1" (default) = login cookie only travels over HTTPS; "0" for plain-http testing ORION_BEHIND_PROXY "1" (default) = trust the host's X-Forwarded-* headers; "0" if gunicorn is exposed directly """ import hmac import os import re import secrets import sqlite3 import time from datetime import datetime, timedelta from flask import (Blueprint, g, jsonify, make_response, redirect, render_template_string, request, session, url_for) from werkzeug.middleware.proxy_fix import ProxyFix from werkzeug.security import check_password_hash, generate_password_hash from auth_core import (AUTH_DIR, DB_PATH, APPROVED_PATH, SECRET_PATH, EVENT_LOG, MIN_PASSWORD, MAX_PASSWORD, normalize_email, approved_emails, connect, password_problem) SESSION_DAYS = 14 LOGIN_EMAIL_MAX = 5 # wrong passwords per email per 15 minutes LOGIN_IP_MAX = 20 # wrong passwords per IP per 15 minutes SIGNUP_IP_MAX = 10 # sign-up attempts per IP per hour OPEN_ENDPOINTS = {"auth.login", "auth.signup", "auth.logout"} UNSAFE_METHODS = {"POST", "PUT", "PATCH", "DELETE"} bp = Blueprint("auth", __name__) # Checked against when the email doesn't exist, so "no such user" takes as long as "wrong password" _DUMMY_HASH = generate_password_hash(secrets.token_hex(16)) # ── storage ────────────────────────────────────────────────────────────────── def db(): if "authdb" not in g: g.authdb = connect() return g.authdb def load_secret(): env = os.environ.get("ORION_SECRET_KEY") if env: return env os.makedirs(AUTH_DIR, exist_ok=True) if not os.path.exists(SECRET_PATH): fd = os.open(SECRET_PATH, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600) with os.fdopen(fd, "w") as f: f.write(secrets.token_hex(32)) with open(SECRET_PATH) as f: return f.read().strip() def log_event(kind, email="", ip=""): clean = lambda s: re.sub(r"[^\w@.+\-:]", "?", str(s))[:80] try: with open(EVENT_LOG, "a", encoding="utf-8") as f: f.write(f"{datetime.now():%Y-%m-%d %H:%M:%S} {kind:<16} {clean(email):<40} {clean(ip)}\n") except OSError: pass # ── approved list ──────────────────────────────────────────────────────────── # ── rate limiting ──────────────────────────────────────────────────────────── def attempts(key, window): return db().execute("SELECT COUNT(*) FROM attempts WHERE key=? AND ts>?", (key, time.time() - window)).fetchone()[0] def add_attempt(key): d = db() d.execute("INSERT INTO attempts(key, ts) VALUES(?,?)", (key, time.time())) if secrets.randbelow(50) == 0: d.execute("DELETE FROM attempts WHERE ts {{ title }} — Orion
OrionPermit Intelligence

{{ heading }}

{{ sub }}

{% if error %}{% endif %}
{% if signup %}
At least {{ minpw }} characters.
{% endif %}

{{ alt|safe }}

""" def page(kind, error="", email="", status=200): if kind == "login": ctx = dict(title="Sign in", heading="Sign in", sub="Orion team access only.", button="Sign in", signup=False, alt='Need an account? Sign up' % url_for("auth.signup")) else: ctx = dict(title="Sign up", heading="Create your account", signup=True, button="Create account", sub="Only approved work emails can sign up.", alt='Already have an account? Sign in' % url_for("auth.login")) resp = make_response(render_template_string(PAGE, error=error, email=email, csrf=csrf_token(), minpw=MIN_PASSWORD, **ctx), status) resp.headers["Cache-Control"] = "no-store" return resp GENERIC_SIGNUP_ERROR = ("We couldn't create an account with those details. Use your approved work email, " "or ask whoever manages access to add you.") # ── routes ─────────────────────────────────────────────────────────────────── @bp.route("/login", methods=["GET", "POST"]) def login(): if current_user(): return redirect("/") if request.method == "GET": return page("login") if not csrf_ok(): return page("login", "Your page expired — please try again.", status=400) email, pw, ip = normalize_email(request.form.get("email")), request.form.get("password", ""), client_ip() ekey, ikey = f"login-email:{email}", f"login-ip:{ip}" if attempts(ekey, 900) >= LOGIN_EMAIL_MAX or attempts(ikey, 900) >= LOGIN_IP_MAX: log_event("LOGIN_LOCKED", email, ip) return page("login", "Too many attempts. Please wait 15 minutes and try again.", email, 429) row = db().execute("SELECT * FROM users WHERE email=?", (email,)).fetchone() if email else None password_ok = check_password_hash(row["pw_hash"] if row else _DUMMY_HASH, pw) and row is not None if password_ok and email in approved_emails(): clear_attempts(ekey) db().execute("UPDATE users SET last_login=? WHERE email=?", (datetime.now().isoformat(timespec="seconds"), email)); db().commit() start_session(email, row["session_epoch"]) log_event("LOGIN_OK", email, ip) return redirect("/") add_attempt(ekey); add_attempt(ikey) log_event("LOGIN_FAILED", email, ip) return page("login", "Incorrect email or password.", email, 401) @bp.route("/signup", methods=["GET", "POST"]) def signup(): if current_user(): return redirect("/") if request.method == "GET": return page("signup") if not csrf_ok(): return page("signup", "Your page expired — please try again.", status=400) email, pw, ip = normalize_email(request.form.get("email")), request.form.get("password", ""), client_ip() skey = f"signup-ip:{ip}" if attempts(skey, 3600) >= SIGNUP_IP_MAX: log_event("SIGNUP_LOCKED", email, ip) return page("signup", "Too many sign-up attempts. Please try again later.", email, 429) add_attempt(skey) if not email: return page("signup", "Please enter a valid email address.", status=400) problem = password_problem(pw, email) if not problem and pw != request.form.get("confirm", ""): problem = "The two passwords don't match." if problem: return page("signup", problem, email, 400) if email not in approved_emails(): log_event("SIGNUP_DENIED", email, ip) return page("signup", GENERIC_SIGNUP_ERROR, email, 400) if not create_user(email, pw): log_event("SIGNUP_EXISTS", email, ip) return page("signup", GENERIC_SIGNUP_ERROR + " If you already have an account, sign in instead.", email, 400) log_event("SIGNUP_OK", email, ip) start_session(email, 0) return redirect("/") @bp.route("/logout", methods=["POST"]) def logout(): email = session.get("email", "") session.clear() if email: log_event("LOGOUT", email, client_ip()) return redirect(url_for("auth.login"), 303) @bp.route("/api/me") def me(): return jsonify(email=g.user["email"]) # ── wiring ─────────────────────────────────────────────────────────────────── def init_auth(app): """Locks the whole site behind the login. Call once, right after creating the Flask app.""" app.secret_key = load_secret() app.config.update( SESSION_COOKIE_NAME="orion_session", SESSION_COOKIE_HTTPONLY=True, SESSION_COOKIE_SAMESITE="Lax", SESSION_COOKIE_SECURE=os.environ.get("ORION_COOKIE_SECURE", "1") != "0", PERMANENT_SESSION_LIFETIME=timedelta(days=SESSION_DAYS), MAX_CONTENT_LENGTH=2 * 1024 * 1024, ) if os.environ.get("ORION_BEHIND_PROXY", "1") != "0": app.wsgi_app = ProxyFix(app.wsgi_app, x_for=1, x_proto=1, x_host=1) app.register_blueprint(bp) connect().close() # create the tables on startup @app.before_request def _guard(): if request.method in UNSAFE_METHODS and not same_site(): return jsonify(error="cross-site request blocked"), 403 if request.endpoint in OPEN_ENDPOINTS: return None user = current_user() if user: g.user = user return None if request.path.startswith("/api/"): return jsonify(error="login required"), 401 return redirect(url_for("auth.login")) @app.after_request def _headers(resp): resp.headers.setdefault("X-Content-Type-Options", "nosniff") resp.headers.setdefault("X-Frame-Options", "DENY") if "no-store" not in (resp.headers.get("Cache-Control") or ""): resp.headers["Cache-Control"] = "private, no-cache" # never cached by shared proxies return resp @app.teardown_appcontext def _close(_exc): d = g.pop("authdb", None) if d is not None: d.close()