Feature/handees login security

build/cloudbuild.yaml

@@ -9,9 +9,9 @@ steps:
       - '--build-arg'
       - 'COCKROACH_DB_CERT_URL=${_COCKROACH_DB_CERT_URL}'
       - '-t'
-      - 'africa-south1-docker.pkg.dev/$PROJECT_ID/handees-dev/handees-backend:1.1'
+      - 'africa-south1-docker.pkg.dev/$PROJECT_ID/handees-dev/handees-backend:1.2'
       - '-f'
       - 'docker/Dockerfile'
       - '.'
 images:
-  - 'africa-south1-docker.pkg.dev/$PROJECT_ID/handees-dev/handees-backend:1.1'
+  - 'africa-south1-docker.pkg.dev/$PROJECT_ID/handees-dev/handees-backend:1.2'

core/api/auth/auth_helper.py

@@ -186,6 +186,7 @@ def wrapped(*args, **kwargs):
             token = request.headers['access-token']
             uid = verify_token(token)
             print(uid)
+            user = User.query.filter_by(user_id=uid).first()
             logger.debug("user with data: {} still has access".format(uid))
             user = User.query.filter_by(user_id=uid).first()
         except (Exception or Exception in excs or auth.ExpiredIdTokenError) as e:

core/api/bookings/events/artisan.py

@@ -137,7 +137,7 @@ def on_connect(auth):
 
 
 @socketio.on('disconnect', namespace='/artisan')
-def on_disconnect():
+def on_disconnect(reason=None):
     dropping_sid = request.sid
     print(f"==== Disconnecting: {dropping_sid} ====")
     if redis_4.exists(dropping_sid):
@@ -159,7 +159,7 @@ def on_disconnect():
 @parse_event_data
 @valid_auth_required
 def update_location(uid, data):
-    print("EXECUTING ... for {}".format(uid))
+    print("EXECUTING ... for {}".format(uid), flush=True)
     # add coords to redis
     redis_5.geoadd(
         name=data['job_category'],
@@ -293,7 +293,7 @@ def accept_offer(uid, data):
     room = data['booking_id']
     data['uid'] = uid
     lock_key = f"lock:booking:{room}"
-    with redis_.lock(lock_key, blocking_timeout=1):
+    with redis_.lock(lock_key, ttl=5000):
         if redis_.exists(room):
             # read and remove from queue
             bk_info = parse_str_data(redis_.get(room))
@@ -317,7 +317,6 @@ def accept_offer(uid, data):
                 only=(
                     'created_at',
                     'user_profile',
-                    'rating',
                     'job_category',
                     'jobs_completed',
                     'hourly_rate'
@@ -490,7 +489,7 @@ def handle_location_arrival(uid, data):
         )
 
     payload = {
-        'payload': messages.ARTISAN_ARRIVES,
+        'payload': {'message': messages.ARTISAN_ARRIVES},
         'recipient': redis_4.hget(
             'booking_id_to_uid',
             data['booking_id']

core/api/bookings/events/customer.py

@@ -85,7 +85,7 @@ def enter_chat_namespace(uid):
 
 
 @socketio.on('disconnect', namespace='/customer')
-def disconnect():
+def disconnect(reason=None):
     if redis_4.exists(request.sid):
         redis_4.delete(request.sid)
     sid_all = redis_4.hgetall("sid_to_user")

core/api/bookings/views.py

@@ -83,9 +83,6 @@ def create_booking(current_user):
             to_be_uploaded = [{**_base_img, **img} for img in images['files']]
             images_schema = BlobSchema(uid=current_user.id, many=True)
             images = images_schema.load(to_be_uploaded)
-            for img in images:
-                img.blob_id = uuid.uuid4().hex
-
             sess.add_all(images)
         sess.commit()
 

core/api/user/views.py

@@ -4,6 +4,7 @@
 from loguru import logger
 import sys
 
+
 from . import user
 from core import db
 from utils import decode_id
@@ -16,7 +17,8 @@
 from utils import (
     gen_response,
     error_response,
-    setLogger
+    setLogger,
+    paginate
 )
 from schemas.user_schemas import (
     AddNewUserSchema,
@@ -34,6 +36,7 @@
     login_required,
     permission_required
 )
+from devices import save_device_hash, check_device_hash
 
 logger.remove()
 setLogger()
@@ -57,6 +60,7 @@ def create_new_user():
     try:
         db.session.add(new_user)
         db.session.commit()
+        save_device_hash(new_user)
         return gen_response(
             201,
             data=schema.dump(new_user),
@@ -170,6 +174,8 @@ def add_app_token(current_user):
 @login_required
 def fetch_user(current_user):
     """ checks if uid exists """
+    user = User.query.filter_by(user_id=current_user.user_id).first()
+    check_device_hash(user)
     with db.session() as sess:
         schema = UserSchema(session=sess)
         return gen_response(
@@ -183,9 +189,15 @@ def fetch_user(current_user):
 @permission_required(Permission.service_request)
 def fetch_bookings_for_user(current_user):
     """ fetch all bookings made by a user """
-    bookings = current_user.bookings.order_by(
+    query = current_user.bookings.order_by(
         desc(Booking.created_at)
-    ).all()
+    )
+
+    pagination = paginate(
+        query=query,
+        page=request.args.get("page", 1, type=int),
+        per_page=request.args.get("per_page", 10, type=int),
+    )
 
     msg = 'fetched top recent bookings successfully'
     schema = BookingSchema(
@@ -205,8 +217,15 @@ def fetch_bookings_for_user(current_user):
 
     return gen_response(
         200,
-        data=schema.dump(bookings),
-        message=msg
+        data={
+                "bookings": schema.dump(pagination.items),
+                "page": pagination.page,
+                "per_page": pagination.per_page,
+                "total": pagination.total,
+                "pages": pagination.pages
+            },
+        message=msg,
+
     )
 
 

core/api/views.py

@@ -61,12 +61,12 @@ def request_download_urls(current_user):
             imgs = ImageFileSchema(action='download').load(data)
         except Exception as e:
             return error_response(status_code=400, message=str(e))
-            
+
         to_be_downloaded = []
         for img in imgs['images']:
             # Fetch the exact blob using the primary key
             blob = sess.get(Blob, img['blob_id'])
-            
+
             # Security check: ensure the current user actually owns this blob
             if not blob or blob.user_id != current_user.user_id:
                 return error_response(