From 3f8d178d38686c1a5d71d94ebccdb61701469e95 Mon Sep 17 00:00:00 2001 From: stuppie Date: Mon, 31 Aug 2026 16:52:15 -0600 Subject: working on magic token and session token auth --- jb/views/auth.py | 77 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 77 insertions(+) create mode 100644 jb/views/auth.py (limited to 'jb/views/auth.py') diff --git a/jb/views/auth.py b/jb/views/auth.py new file mode 100644 index 0000000..0591294 --- /dev/null +++ b/jb/views/auth.py @@ -0,0 +1,77 @@ +"""Redis-backed magic-link authentication. + +The user service is deliberately not coupled to this module. Once that service +has resolved an email address to its stable user identifier, call +``create_magic_token`` and put the returned token in the emailed login URL. +""" + +from typing import Annotated + +from fastapi import APIRouter, Depends, Response, status +from fastapi.responses import HTMLResponse + +from jb.api.auth import ( + SESSION_COOKIE_NAME, + create_session, + get_authenticated_user, +) +from jb.api.magic_token import consume_magic_token +from jb.config import settings +from jb.models.auth import ( + MagicLinkExchangeRequest, + AuthenticatedUser, + email_to_product_user_id, +) +from jb.settings import BASE_HTML + +auth_router = APIRouter(prefix="/auth", tags=["Auth"]) + + +@auth_router.get("/magic-link/", response_class=HTMLResponse, include_in_schema=False) +def magic_link_landing_page() -> HTMLResponse: + """Serve the SPA without redeeming the token; email prefetches are harmless.""" + return HTMLResponse( + BASE_HTML, + headers={ + "Cache-Control": "no-store", + "Referrer-Policy": "no-referrer", + "X-Robots-Tag": "noindex, nofollow", + }, + ) + + +@auth_router.post("/magic-link/exchange", status_code=status.HTTP_204_NO_CONTENT) +def exchange_magic_link(body: MagicLinkExchangeRequest, response: Response) -> None: + """Exchange a magic link only after its landing page makes an explicit POST.""" + user_email = consume_magic_token(body.token) + product_user_id = email_to_product_user_id(user_email) + + # todo: hit thl to make sure this user exists + + session_token = create_session(product_user_id) + response.set_cookie( + key=SESSION_COOKIE_NAME, + value=session_token, + max_age=settings.session_token_ttl_seconds, + httponly=True, + secure=not settings.debug, + samesite="lax", + path="/", + ) + + +@auth_router.get("/session", response_model=AuthenticatedUser) +def get_session( + user: Annotated[AuthenticatedUser, Depends(get_authenticated_user)], +) -> AuthenticatedUser: + return user + + +@auth_router.delete("/session", status_code=status.HTTP_204_NO_CONTENT) +def delete_session( + response: Response, +) -> None: + # Logout is idempotent so clients can always discard their local token. + # JWT sessions are stateless, so logout discards the browser cookie. A token + # copied elsewhere remains valid until its short, configured expiration. + response.delete_cookie(key=SESSION_COOKIE_NAME, path="/") -- cgit v1.2.3 From c991d4f51254b1c81fa6e0e19b0ba94b8c5f61c4 Mon Sep 17 00:00:00 2001 From: stuppie Date: Tue, 1 Sep 2026 11:56:05 -0600 Subject: add GRApiManager. py-utils to generalresearch --- jb/api/auth.py | 13 ++--- jb/config.py | 2 +- jb/decorators.py | 13 +++-- jb/flow/assignment_tasks.py | 6 +-- jb/flow/monitoring.py | 2 +- jb/flow/tasks.py | 2 +- jb/managers/__init__.py | 2 +- jb/managers/amt.py | 2 +- jb/managers/gr_api.py | 112 ++++++++++++++++++++++++++++++++++++++++++++ jb/managers/thl.py | 12 ++--- jb/models/auth.py | 47 ++++++++++++++++--- jb/models/bonus.py | 2 +- jb/models/hit.py | 2 +- jb/settings.py | 7 ++- jb/views/auth.py | 36 ++++++++++---- requirements.txt | 9 +++- 16 files changed, 223 insertions(+), 46 deletions(-) create mode 100644 jb/managers/gr_api.py (limited to 'jb/views/auth.py') diff --git a/jb/api/auth.py b/jb/api/auth.py index 7d6c352..3481b30 100644 --- a/jb/api/auth.py +++ b/jb/api/auth.py @@ -8,13 +8,12 @@ from fastapi import Depends, HTTPException, Request, Response, status from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer from jb.config import settings -from jb.models.auth import AuthenticatedUser +from jb.decorators import gr_api_manager +from jb.models.auth import User bearer = HTTPBearer(auto_error=False) logger = logging.getLogger(__name__) -AUTH_CACHE_TTL_SECONDS = 60 - SESSION_COOKIE_NAME = "jb_session" JWT_ISSUER = "jamesbillings67" JWT_AUDIENCE = "jamesbillings67" @@ -23,7 +22,7 @@ JWT_AUDIENCE = "jamesbillings67" def get_authenticated_user( request: Request, credentials: Annotated[HTTPAuthorizationCredentials | None, Depends(bearer)], -) -> AuthenticatedUser: +) -> User: """FastAPI dependency for endpoints requiring a valid session.""" if settings.session_jwt_secret is None: raise HTTPException( @@ -66,11 +65,9 @@ def get_authenticated_user( ) product_user_id = claims.get("sub") - # todo: in here, hit THL by the user's bpuid (email hash), - # in order to 1) be sure user exists & 2) pull the display_name - user_email = ... # lookup in thl by product_user_id + user = gr_api_manager.get_user(product_user_id=product_user_id) - return AuthenticatedUser(email=user_email) + return user def create_session(product_user_id: str) -> str: diff --git a/jb/config.py b/jb/config.py index c7d07e5..a91494d 100644 --- a/jb/config.py +++ b/jb/config.py @@ -1,6 +1,6 @@ import logging -from generalresearchutils.config import is_debug +from generalresearch.config import is_debug from jb.settings import get_settings, get_test_settings diff --git a/jb/decorators.py b/jb/decorators.py index 5c1b1f5..cafd7a9 100644 --- a/jb/decorators.py +++ b/jb/decorators.py @@ -1,7 +1,7 @@ import boto3 from botocore.config import Config -from generalresearchutils.pg_helper import PostgresConfig -from generalresearchutils.redis_helper import RedisConfig +from generalresearch.pg_helper import PostgresConfig +from generalresearch.redis_helper import RedisConfig from influxdb import InfluxDBClient from mypy_boto3_mturk import MTurkClient from mypy_boto3_sns import SNSClient @@ -11,7 +11,8 @@ from jb.managers import Permission from jb.managers.amt import AMTManager from jb.managers.assignment import AssignmentManager from jb.managers.bonus import BonusManager -from jb.managers.hit import HitTypeManager, HitManager, HitQuestionManager +from jb.managers.gr_api import GRApiManager +from jb.managers.hit import HitManager, HitQuestionManager, HitTypeManager redis_config = RedisConfig( dsn=settings.redis, @@ -32,6 +33,12 @@ CLIENT_CONFIG = Config( read_timeout=2.5, ) +gr_api_manager = GRApiManager( + base_url=str(settings.gr_api_host), + token=settings.gr_api_token.get_secret_value(), + product_id=settings.product_id, +) + # We shouldn't use this directly. Use our AMTManager wrapper AMT_CLIENT: MTurkClient = boto3.client( service_name="mturk", diff --git a/jb/flow/assignment_tasks.py b/jb/flow/assignment_tasks.py index 18a844e..2db20f8 100644 --- a/jb/flow/assignment_tasks.py +++ b/jb/flow/assignment_tasks.py @@ -3,9 +3,9 @@ import math from datetime import timedelta from typing import Optional -from generalresearchutils.models.thl.definitions import PayoutStatus, StatusCode1 -from generalresearchutils.models.thl.wallet.cashout_method import CashoutRequestInfo -from generalresearchutils.currency import USDCent +from generalresearch.models.thl.definitions import PayoutStatus, StatusCode1 +from generalresearch.models.thl.wallet.cashout_method import CashoutRequestInfo +from generalresearch.currency import USDCent from jb.flow.monitoring import emit_error_event, emit_assignment_event, emit_bonus_event from jb.managers.amt import ( diff --git a/jb/flow/monitoring.py b/jb/flow/monitoring.py index 28f7271..334eab3 100644 --- a/jb/flow/monitoring.py +++ b/jb/flow/monitoring.py @@ -5,7 +5,7 @@ from mypy_boto3_mturk.literals import EventTypeType from jb.config import settings from jb.decorators import influx_client -from generalresearchutils.currency import USDCent +from generalresearch.currency import USDCent from jb.models.definitions import HitStatus, AssignmentStatus diff --git a/jb/flow/tasks.py b/jb/flow/tasks.py index 77825d3..6c5d6bb 100644 --- a/jb/flow/tasks.py +++ b/jb/flow/tasks.py @@ -2,7 +2,7 @@ import logging import time from typing import TypedDict, cast -from generalresearchutils.config import is_debug +from generalresearch.config import is_debug from jb.decorators import AMTM, HTM, HM, HQM, pg_config from jb.flow.maintenance import check_hit_status diff --git a/jb/managers/__init__.py b/jb/managers/__init__.py index e99569a..ec64f9f 100644 --- a/jb/managers/__init__.py +++ b/jb/managers/__init__.py @@ -1,7 +1,7 @@ from enum import IntEnum from typing import Collection -from generalresearchutils.pg_helper import PostgresConfig +from generalresearch.pg_helper import PostgresConfig class Permission(IntEnum): diff --git a/jb/managers/amt.py b/jb/managers/amt.py index 88ae07d..2cb0cbd 100644 --- a/jb/managers/amt.py +++ b/jb/managers/amt.py @@ -3,7 +3,7 @@ from datetime import timezone, datetime from typing import Tuple, Optional, List, Dict, Any import botocore.exceptions -from generalresearchutils.currency import USDCent +from generalresearch.currency import USDCent from mypy_boto3_mturk import MTurkClient from mypy_boto3_mturk.type_defs import ( AssignmentTypeDef, diff --git a/jb/managers/gr_api.py b/jb/managers/gr_api.py new file mode 100644 index 0000000..8ffeaf0 --- /dev/null +++ b/jb/managers/gr_api.py @@ -0,0 +1,112 @@ +"""Client for General Research's product-user API.""" + +from typing import Any + +import requests + +from jb.models.auth import User + + +class GRApiError(RuntimeError): + """The General Research API could not satisfy a request.""" + + +class GRApiManager: + def __init__( + self, + base_url: str, + token: str, + product_id: str, + timeout: float = 5.0, + session: requests.Session | None = None, + ) -> None: + if not token: + raise ValueError("General Research API token must not be empty") + + self.base_url = base_url.rstrip("/") + self.product_id = product_id + self.timeout = timeout + self.session = session or requests.Session() + self.session.headers.update( + { + "Authorization": token, + "Accept": "application/json", + "Content-Type": "application/json", + } + ) + + def _request(self, method: str, url: str, **kwargs: Any) -> requests.Response: + try: + response = self.session.request(method, url, timeout=self.timeout, **kwargs) + response.raise_for_status() + return response + except requests.RequestException as exc: + raise GRApiError( + f"General Research API request failed: {method} {url}" + ) from exc + + def _parse_user_response(self, res: dict) -> User: + return User.model_validate( + { + "product_user_id": res["product_user_id"], + "email": res["metadata"].get("email_address"), + "display_name": res["metadata"].get("display_name"), + } + ) + + def ensure_user_exists(self, user: User) -> User: + """Idempotently create the product user if it does not already exist.""" + url = f"{self.base_url}/{self.product_id}/user/{user.product_user_id}/" + res = self._request("PUT", url).json() + if res["metadata"].get("email_address") is None: + self.set_user_email(user) + return self.get_user(user.product_user_id) + user_thl = self._parse_user_response(res) + if user_thl.email != user.email: + raise ValueError( + f"user {user.product_user_id} already exists with email {user_thl.email}" + ) + return user_thl + + def get_user(self, product_user_id: str) -> User: + """Retrieve the user's email address and display name.""" + url = f"{self.base_url}/{self.product_id}/user/{product_user_id}/" + res = self._request("GET", url).json() + return self._parse_user_response(res) + + def get_user_by_email(self, email: str) -> User: + user = User.model_validate({"email": email}) + return self.get_user(user.product_user_id) + + def set_user_email(self, user: User) -> None: + """This should only be called once per user upon account creation. + A user cannot change their email address.""" + url = f"{self.base_url}/{self.product_id}/user/{user.product_user_id}/metadata/" + res = self._request( + "PATCH", + url, + json={"email_address": str(user.email)}, + ).json() + + def set_user_display_name(self, user: User) -> User: + """Can be called as many times as needed. Multiple + users can have the same display name.""" + if user.display_name is None: + return user + url = f"{self.base_url}/{self.product_id}/user/{user.product_user_id}/metadata/" + res = self._request( + "PATCH", + url, + json={"display_name": user.display_name}, + ).json() + return self.get_user(user.product_user_id) + + def transition_product_user_id(self, user: User, amt_worker_id: str) -> User: + """This should only be called once upon transition from an + AMT account to a General Research account.""" + url = f"{self.base_url}/{self.product_id}/user/{amt_worker_id}/" + res = self._request( + "PATCH", url, json={"product_user_id": user.product_user_id} + ) + self.set_user_email(user) + return self.get_user(user.product_user_id) diff --git a/jb/managers/thl.py b/jb/managers/thl.py index 6e8effc..f0534db 100644 --- a/jb/managers/thl.py +++ b/jb/managers/thl.py @@ -1,16 +1,16 @@ -from generalresearchutils.models.thl.payout import UserPayoutEvent -from generalresearchutils.models.thl.task_status import TaskStatusResponse -from generalresearchutils.models.thl.wallet.cashout_method import ( +from generalresearch.models.thl.payout import UserPayoutEvent +from generalresearch.models.thl.task_status import TaskStatusResponse +from generalresearch.models.thl.wallet.cashout_method import ( CashoutRequestResponse, CashoutRequestInfo, ) -from generalresearchutils.models.thl.user_profile import UserProfile -from generalresearchutils.currency import USDCent +from generalresearch.models.thl.user_profile import UserProfile +from generalresearch.currency import USDCent from jb.config import settings -from generalresearchutils.models.thl.definitions import PayoutStatus +from generalresearch.models.thl.definitions import PayoutStatus from typing import Optional diff --git a/jb/models/auth.py b/jb/models/auth.py index 5f31bd3..8b48088 100644 --- a/jb/models/auth.py +++ b/jb/models/auth.py @@ -1,5 +1,6 @@ import hashlib import hmac +from typing import Any from pydantic import ( BaseModel, @@ -8,6 +9,8 @@ from pydantic import ( Field, TypeAdapter, computed_field, + field_validator, + model_validator, ) from jb.config import settings @@ -30,29 +33,59 @@ def email_to_product_user_id(email: str) -> str: return hmac.new( key=salt_bytes, msg=normalized_email.encode("utf-8"), - digestmod=hashlib.sha256, + digestmod=hashlib.sha1, ).hexdigest() -class AuthenticatedUser(BaseModel): +class User(BaseModel): """A user that has been authenticated and exists in THL""" email: EmailStr = Field() + display_name: str | None = Field(default=None, max_length=255) + + @field_validator("email", mode="before") + @classmethod + def normalize_email(cls, value: Any) -> Any: + if not isinstance(value, str): + return value + if not value.isascii(): + raise ValueError("email must contain ASCII characters only") + return value.lower() + + @model_validator(mode="before") + @classmethod + def validate_product_user_id(cls, data: Any) -> Any: + if not isinstance(data, dict) or "product_user_id" not in data: + return data + + provided_id = data["product_user_id"] + email = data.get("email") + if email is None: + return data + + expected_id = email_to_product_user_id(str(email)) + if not isinstance(provided_id, str) or not hmac.compare_digest( + provided_id, expected_id + ): + raise ValueError(f"product_user_id {provided_id} does not match email {email}") + + # The computed field is authoritative; do not retain the input value. + validated_data = dict(data) + validated_data.pop("product_user_id") + return validated_data + @computed_field + @property def product_user_id(self) -> str: return email_to_product_user_id(self.email) -class AccountCreate(BaseModel): - email: EmailStr = Field() - - class AccountLogin(BaseModel): + # There is no practical difference between an Account "login" and "create" email: EmailStr = Field() - class MagicLinkExchangeRequest(BaseModel): model_config = ConfigDict(extra="forbid") diff --git a/jb/models/bonus.py b/jb/models/bonus.py index a536dd1..5f81add 100644 --- a/jb/models/bonus.py +++ b/jb/models/bonus.py @@ -3,7 +3,7 @@ from typing import Optional, Dict, Any from pydantic import BaseModel, Field, ConfigDict, PositiveInt from typing_extensions import Self -from generalresearchutils.currency import USDCent +from generalresearch.currency import USDCent from jb.models.custom_types import AMTBoto3ID, AwareDatetimeISO, UUIDStr diff --git a/jb/models/hit.py b/jb/models/hit.py index fba2ecf..45478fc 100644 --- a/jb/models/hit.py +++ b/jb/models/hit.py @@ -13,7 +13,7 @@ from pydantic import ( ) from typing_extensions import Self -from generalresearchutils.currency import USDCent +from generalresearch.currency import USDCent from jb.models.custom_types import AMTBoto3ID, HttpsUrlStr, AwareDatetimeISO from jb.models.definitions import HitStatus, HitReviewStatus diff --git a/jb/settings.py b/jb/settings.py index cc1e870..78b4b02 100644 --- a/jb/settings.py +++ b/jb/settings.py @@ -3,7 +3,7 @@ from functools import lru_cache from pathlib import Path from typing import Optional -from generalresearchutils.models.custom_types import InfluxDsn +from generalresearch.models.custom_types import InfluxDsn from pydantic import Field, PostgresDsn, HttpUrl, RedisDsn, SecretStr from pydantic_settings import BaseSettings, SettingsConfigDict @@ -60,6 +60,11 @@ class Settings(AmtJbBaseSettings): magic_token_salt: SecretStr = Field(min_length=32) + gr_api_host: HttpUrl = Field( + default=HttpUrl("https://generalresearch.com/api/v2/") + ) + gr_api_token: SecretStr = Field(min_length=1) + class TestSettings(Settings): model_config = SettingsConfigDict( diff --git a/jb/views/auth.py b/jb/views/auth.py index 0591294..06dbdde 100644 --- a/jb/views/auth.py +++ b/jb/views/auth.py @@ -6,8 +6,9 @@ has resolved an email address to its stable user identifier, call """ from typing import Annotated +from urllib.parse import urlencode -from fastapi import APIRouter, Depends, Response, status +from fastapi import APIRouter, Depends, HTTPException, Response, status from fastapi.responses import HTMLResponse from jb.api.auth import ( @@ -15,11 +16,13 @@ from jb.api.auth import ( create_session, get_authenticated_user, ) -from jb.api.magic_token import consume_magic_token +from jb.api.magic_token import consume_magic_token, create_magic_token from jb.config import settings +from jb.decorators import gr_api_manager from jb.models.auth import ( MagicLinkExchangeRequest, - AuthenticatedUser, + AccountLogin, + User, email_to_product_user_id, ) from jb.settings import BASE_HTML @@ -27,6 +30,20 @@ from jb.settings import BASE_HTML auth_router = APIRouter(prefix="/auth", tags=["Auth"]) +@auth_router.post("/magic-link/request") +def request_mock_magic_link(body: AccountLogin) -> dict[str, str]: + """Create a magic link without sending email in development.""" + if not settings.debug: + raise HTTPException(status_code=status.HTTP_404_NOT_FOUND) + + # todo: send email here + + user = User(email=body.email) + token = create_magic_token(str(user.email)) + query = urlencode({"token": token}) + return {"magic_link": f"/auth/magic-link/?{query}"} + + @auth_router.get("/magic-link/", response_class=HTMLResponse, include_in_schema=False) def magic_link_landing_page() -> HTMLResponse: """Serve the SPA without redeeming the token; email prefetches are harmless.""" @@ -44,11 +61,12 @@ def magic_link_landing_page() -> HTMLResponse: def exchange_magic_link(body: MagicLinkExchangeRequest, response: Response) -> None: """Exchange a magic link only after its landing page makes an explicit POST.""" user_email = consume_magic_token(body.token) - product_user_id = email_to_product_user_id(user_email) - # todo: hit thl to make sure this user exists + user = User.model_validate({'email': user_email}) + # hit thl to make sure this user exists + user = gr_api_manager.ensure_user_exists(user) - session_token = create_session(product_user_id) + session_token = create_session(user.product_user_id) response.set_cookie( key=SESSION_COOKIE_NAME, value=session_token, @@ -60,10 +78,10 @@ def exchange_magic_link(body: MagicLinkExchangeRequest, response: Response) -> N ) -@auth_router.get("/session", response_model=AuthenticatedUser) +@auth_router.get("/session", response_model=User) def get_session( - user: Annotated[AuthenticatedUser, Depends(get_authenticated_user)], -) -> AuthenticatedUser: + user: Annotated[User, Depends(get_authenticated_user)], +) -> User: return user diff --git a/requirements.txt b/requirements.txt index c23b668..315a711 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,4 +1,4 @@ -git+ssh://code.g-r-l.com:6611/py-utils@v3.3.4 +git+ssh://code.g-r-l.com:6611/generalresearch@v3.4.5 aiohappyeyeballs==2.6.1 aiohttp==3.13.0 aiosignal==1.4.0 @@ -24,6 +24,7 @@ dnspython==2.8.0 email-validator==2.3.0 Faker==37.11.0 fastapi==0.119.0 +filelock==3.32.5 frozenlist==1.8.0 fsspec==2025.9.0 geoip2==5.1.0 @@ -51,22 +52,24 @@ pandas==2.3.3 pandera==0.26.1 partd==1.4.2 pathspec==0.12.1 +phonenumbers==9.0.38 platformdirs==4.5.0 pluggy==1.6.0 propcache==0.4.1 protobuf==6.32.1 psutil==7.1.1 psycopg==3.2.10 +pyarrow==25.0.1 pycountry==24.6.1 pydantic==2.12.0 pydantic-extra-types==2.10.6 pydantic-settings==2.11.0 pydantic_core==2.41.1 Pygments==2.19.2 +PyJWT==2.13.0 pylibmc==1.6.3 pymemcache==4.0.0 PyMySQL==1.1.2 -PyJWT==2.13.0 pytest==8.4.2 python-dateutil==2.9.0.post0 python-dotenv==1.1.1 @@ -75,6 +78,7 @@ pytz==2025.2 PyYAML==6.0.3 redis==6.4.0 requests==2.32.5 +requests-file==3.0.1 requests-mock==1.12.1 s3transfer==0.14.0 scipy==1.16.2 @@ -86,6 +90,7 @@ sniffio==1.3.1 sortedcontainers==2.4.0 starlette==0.48.0 tblib==3.2.0 +tldextract==5.3.2 toolz==1.1.0 tornado==6.5.2 typeguard==4.4.4 -- cgit v1.2.3 From f5a1882de073ea6859c226395daefeb566e9e802 Mon Sep 17 00:00:00 2001 From: stuppie Date: Tue, 1 Sep 2026 12:17:32 -0600 Subject: add a test_magic_link with a super cool fake_gr_api_manager using fastapi dependency_overrides --- jb-ui/src/pages/MagicLink.tsx | 2 +- jb/api/auth.py | 7 +++-- jb/dependencies.py | 8 ++++++ jb/views/auth.py | 16 +++++++---- tests/http/test_auth.py | 66 +++++++++++++++++++++++++++++++++++++++++++ 5 files changed, 89 insertions(+), 10 deletions(-) create mode 100644 jb/dependencies.py create mode 100644 tests/http/test_auth.py (limited to 'jb/views/auth.py') diff --git a/jb-ui/src/pages/MagicLink.tsx b/jb-ui/src/pages/MagicLink.tsx index cf7f87b..4042624 100644 --- a/jb-ui/src/pages/MagicLink.tsx +++ b/jb-ui/src/pages/MagicLink.tsx @@ -25,7 +25,7 @@ const MagicLink = function () { method: "POST", credentials: "include", headers: {"Content-Type": "application/json"}, - body: JSON.stringify({token}), + body: JSON.stringify({"token": token}), }).then((response) => { if (!response.ok) throw new Error("Magic-link exchange failed"); window.location.replace("/"); diff --git a/jb/api/auth.py b/jb/api/auth.py index 3481b30..a92515d 100644 --- a/jb/api/auth.py +++ b/jb/api/auth.py @@ -8,7 +8,8 @@ from fastapi import Depends, HTTPException, Request, Response, status from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer from jb.config import settings -from jb.decorators import gr_api_manager +from jb.dependencies import get_gr_api_manager +from jb.managers.gr_api import GRApiManager from jb.models.auth import User bearer = HTTPBearer(auto_error=False) @@ -22,6 +23,7 @@ JWT_AUDIENCE = "jamesbillings67" def get_authenticated_user( request: Request, credentials: Annotated[HTTPAuthorizationCredentials | None, Depends(bearer)], + gr_api: Annotated[GRApiManager, Depends(get_gr_api_manager)], ) -> User: """FastAPI dependency for endpoints requiring a valid session.""" if settings.session_jwt_secret is None: @@ -65,7 +67,7 @@ def get_authenticated_user( ) product_user_id = claims.get("sub") - user = gr_api_manager.get_user(product_user_id=product_user_id) + user = gr_api.get_user(product_user_id=product_user_id) return user @@ -86,4 +88,3 @@ def create_session(product_user_id: str) -> str: algorithm="HS256", ) - diff --git a/jb/dependencies.py b/jb/dependencies.py new file mode 100644 index 0000000..b9577bc --- /dev/null +++ b/jb/dependencies.py @@ -0,0 +1,8 @@ +"""FastAPI dependency providers shared by application routes.""" + +from jb.decorators import gr_api_manager +from jb.managers.gr_api import GRApiManager + + +def get_gr_api_manager() -> GRApiManager: + return gr_api_manager diff --git a/jb/views/auth.py b/jb/views/auth.py index 06dbdde..33c9452 100644 --- a/jb/views/auth.py +++ b/jb/views/auth.py @@ -18,12 +18,12 @@ from jb.api.auth import ( ) from jb.api.magic_token import consume_magic_token, create_magic_token from jb.config import settings -from jb.decorators import gr_api_manager +from jb.dependencies import get_gr_api_manager +from jb.managers.gr_api import GRApiManager from jb.models.auth import ( - MagicLinkExchangeRequest, AccountLogin, + MagicLinkExchangeRequest, User, - email_to_product_user_id, ) from jb.settings import BASE_HTML @@ -58,13 +58,17 @@ def magic_link_landing_page() -> HTMLResponse: @auth_router.post("/magic-link/exchange", status_code=status.HTTP_204_NO_CONTENT) -def exchange_magic_link(body: MagicLinkExchangeRequest, response: Response) -> None: +def exchange_magic_link( + body: MagicLinkExchangeRequest, + response: Response, + gr_api: Annotated[GRApiManager, Depends(get_gr_api_manager)], +) -> None: """Exchange a magic link only after its landing page makes an explicit POST.""" user_email = consume_magic_token(body.token) - user = User.model_validate({'email': user_email}) + user = User.model_validate({"email": user_email}) # hit thl to make sure this user exists - user = gr_api_manager.ensure_user_exists(user) + user = gr_api.ensure_user_exists(user) session_token = create_session(user.product_user_id) response.set_cookie( diff --git a/tests/http/test_auth.py b/tests/http/test_auth.py new file mode 100644 index 0000000..8a625bf --- /dev/null +++ b/tests/http/test_auth.py @@ -0,0 +1,66 @@ +import secrets +from urllib.parse import parse_qs, urlparse + +import pytest +from httpx import AsyncClient + +from jb.api.auth import SESSION_COOKIE_NAME +from jb.dependencies import get_gr_api_manager +from jb.main import app +from jb.models.auth import User + + +class FakeGRApiManager: + def __init__(self): + self.users: dict[str, User] = {} + + def ensure_user_exists(self, user: User) -> User: + self.users.setdefault(user.product_user_id, user) + return self.users[user.product_user_id] + + def get_user(self, product_user_id: str) -> User: + return self.users[product_user_id] + + +@pytest.fixture +def email() -> str: + email = secrets.token_urlsafe(16) + "@gmail.com" + return email.lower() + + +@pytest.fixture +def fake_gr_api_manager(): + manager = FakeGRApiManager() + app.dependency_overrides[get_gr_api_manager] = lambda: manager + yield manager + app.dependency_overrides.pop(get_gr_api_manager, None) + + +class TestAuth: + @pytest.mark.anyio + async def test_magic_link( + self, + httpxclient: AsyncClient, + fake_gr_api_manager: FakeGRApiManager, + email: str, + ): + client = httpxclient + + res = await client.post( + "/auth/magic-link/request", json={"email": email} + ) + d = res.json() + assert res.status_code == 200 + assert d["magic_link"] + + token = parse_qs(urlparse(d["magic_link"]).query)["token"][0] + + url = "/auth/magic-link/exchange" + body = {"token": token} + res = await client.post(url, json=body) + assert res.status_code == 204 + assert client.cookies.get(SESSION_COOKIE_NAME) + + res = await client.get("/auth/session") + assert res.status_code == 200 + assert res.json()["email"] == email -- cgit v1.2.3 From 81261e52931d055df5830e29b9bf5ef81ba9134e Mon Sep 17 00:00:00 2001 From: stuppie Date: Tue, 1 Sep 2026 14:17:10 -0600 Subject: add a magic token flow specifically for amt account link. gr api manager add more logging and error handling --- jb/api/magic_token.py | 34 ++++++++++++++++++++++++-- jb/managers/gr_api.py | 59 ++++++++++++++++++++++++++++++++++++++++++---- jb/models/auth.py | 11 ++++++++- jb/views/auth.py | 58 ++++++++++++++++++++++++++++++++++++++------- tests/conftest.py | 4 ++-- tests/fixtures/flow.py | 10 ++++---- tests/fixtures/managers.py | 2 +- tests/fixtures/models.py | 4 ++-- tests/flow/test_tasks.py | 2 +- tests/http/test_auth.py | 58 +++++++++++++++++++++++++++++++++++++++++++++ 10 files changed, 215 insertions(+), 27 deletions(-) (limited to 'jb/views/auth.py') diff --git a/jb/api/magic_token.py b/jb/api/magic_token.py index 136e1b4..e0a1cca 100644 --- a/jb/api/magic_token.py +++ b/jb/api/magic_token.py @@ -4,15 +4,17 @@ import secrets from fastapi import HTTPException, status from jb.decorators import REDIS +from jb.models.auth import AmtAccountLink, User MAGIC_TOKEN_PREFIX = "auth:magic:" +AMT_ACCOUNT_LINK_TOKEN_PREFIX = "auth:amt-account-link:" MAGIC_TOKEN_TTL: int = 5 * 60 # 5 minutes, in seconds -def redis_token_key(token: str) -> str: +def redis_token_key(token: str, prefix: str = MAGIC_TOKEN_PREFIX) -> str: # Redis never contains a usable credential, even if its keys are exposed. digest = hashlib.sha256(token.encode("utf-8")).hexdigest() - return f"{MAGIC_TOKEN_PREFIX}{digest}" + return f"{prefix}{digest}" def create_magic_token(user_email: str) -> str: @@ -39,3 +41,31 @@ def consume_magic_token(token: str) -> str: detail="Invalid or expired magic token", ) return user_email + + +def create_amt_account_link_token(user: User, amt_worker_id: str) -> str: + """Bind an email and AMT worker ID to an opaque, short-lived token.""" + data = AmtAccountLink( + email=user.email, + amt_worker_id=amt_worker_id, + ) + token = secrets.token_urlsafe(32) + REDIS.set( + redis_token_key(token, AMT_ACCOUNT_LINK_TOKEN_PREFIX), + data.model_dump_json(), + ex=MAGIC_TOKEN_TTL, + ) + return token + + +def consume_amt_account_link_token(token: str) -> AmtAccountLink: + """Atomically consume and validate an AMT account-link token.""" + raw_data = REDIS.getdel( + redis_token_key(token, AMT_ACCOUNT_LINK_TOKEN_PREFIX) + ) + if raw_data is None: + raise HTTPException( + status_code=status.HTTP_401_UNAUTHORIZED, + detail="Invalid or expired account-link token", + ) + return AmtAccountLink.model_validate_json(raw_data) diff --git a/jb/managers/gr_api.py b/jb/managers/gr_api.py index 8ffeaf0..a31f7da 100644 --- a/jb/managers/gr_api.py +++ b/jb/managers/gr_api.py @@ -1,16 +1,23 @@ """Client for General Research's product-user API.""" +import logging from typing import Any import requests from jb.models.auth import User +logger = logging.getLogger(__name__) + class GRApiError(RuntimeError): """The General Research API could not satisfy a request.""" +class GRApiNotFoundError(GRApiError): + """The requested General Research API resource does not exist.""" + + class GRApiManager: def __init__( self, @@ -40,6 +47,14 @@ class GRApiManager: response = self.session.request(method, url, timeout=self.timeout, **kwargs) response.raise_for_status() return response + except requests.HTTPError as exc: + if exc.response is not None and exc.response.status_code == 404: + raise GRApiNotFoundError( + f"General Research API resource not found: {method} {url}" + ) from exc + raise GRApiError( + f"General Research API request failed: {method} {url}" + ) from exc except requests.RequestException as exc: raise GRApiError( f"General Research API request failed: {method} {url}" @@ -101,12 +116,46 @@ class GRApiManager: ).json() return self.get_user(user.product_user_id) - def transition_product_user_id(self, user: User, amt_worker_id: str) -> User: + def transition_user_from_amt(self, user: User, amt_worker_id: str) -> User: """This should only be called once upon transition from an AMT account to a General Research account.""" url = f"{self.base_url}/{self.product_id}/user/{amt_worker_id}/" - res = self._request( - "PATCH", url, json={"product_user_id": user.product_user_id} - ) + try: + self._request( + "PATCH", url, json={"product_user_id": user.product_user_id} + ) + except GRApiNotFoundError as exc: + raise ValueError(f"User {amt_worker_id} does not exist") from exc + except GRApiError as exc: + http_error = exc.__cause__ + response = ( + http_error.response + if isinstance(http_error, requests.HTTPError) + else None + ) + if response is not None and response.status_code == 400: + try: + detail = response.json().get("detail") + except (ValueError, AttributeError): + detail = None + if detail == "Unable to update User": + raise ValueError( + "unable to update user, probably another user already " + "exists with this email" + ) from exc + raise self.set_user_email(user) - return self.get_user(user.product_user_id) + transitioned_user = self.get_user(user.product_user_id) + logger.warning( + "Transitioned product user from AMT worker %s to %s with email %s", + amt_worker_id, + transitioned_user.product_user_id, + transitioned_user.email, + extra={ + "event": "transition_user_from_amt", + "amt_worker_id": amt_worker_id, + "product_user_id": transitioned_user.product_user_id, + "email": str(transitioned_user.email), + }, + ) + return transitioned_user diff --git a/jb/models/auth.py b/jb/models/auth.py index 8b48088..d0e8386 100644 --- a/jb/models/auth.py +++ b/jb/models/auth.py @@ -68,7 +68,9 @@ class User(BaseModel): if not isinstance(provided_id, str) or not hmac.compare_digest( provided_id, expected_id ): - raise ValueError(f"product_user_id {provided_id} does not match email {email}") + raise ValueError( + f"product_user_id {provided_id} does not match email {email}" + ) # The computed field is authoritative; do not retain the input value. validated_data = dict(data) @@ -92,6 +94,13 @@ class MagicLinkExchangeRequest(BaseModel): token: str = Field(min_length=1) +class AmtAccountLink(BaseModel): + model_config = ConfigDict(extra="forbid") + + email: EmailStr + amt_worker_id: str = Field(min_length=3, max_length=50) + + class SessionResponse(BaseModel): session_token: str token_type: str = "bearer" diff --git a/jb/views/auth.py b/jb/views/auth.py index 33c9452..dc63ca3 100644 --- a/jb/views/auth.py +++ b/jb/views/auth.py @@ -1,10 +1,3 @@ -"""Redis-backed magic-link authentication. - -The user service is deliberately not coupled to this module. Once that service -has resolved an email address to its stable user identifier, call -``create_magic_token`` and put the returned token in the emailed login URL. -""" - from typing import Annotated from urllib.parse import urlencode @@ -16,12 +9,18 @@ from jb.api.auth import ( create_session, get_authenticated_user, ) -from jb.api.magic_token import consume_magic_token, create_magic_token +from jb.api.magic_token import ( + consume_amt_account_link_token, + consume_magic_token, + create_amt_account_link_token, + create_magic_token, +) from jb.config import settings from jb.dependencies import get_gr_api_manager from jb.managers.gr_api import GRApiManager from jb.models.auth import ( AccountLogin, + AmtAccountLink, MagicLinkExchangeRequest, User, ) @@ -44,6 +43,20 @@ def request_mock_magic_link(body: AccountLogin) -> dict[str, str]: return {"magic_link": f"/auth/magic-link/?{query}"} +@auth_router.post("/link-amt/request") +def link_amt_account(body: AmtAccountLink) -> dict[str, str]: + """Create a mock AMT account-link email in development.""" + if not settings.debug: + raise HTTPException(status_code=status.HTTP_404_NOT_FOUND) + + # TODO: Derive amt_worker_id from a server-validated AMT assignment and + # send this link by email instead of returning it. + user = User(email=body.email) + token = create_amt_account_link_token(user, body.amt_worker_id) + query = urlencode({"token": token}) + return {"magic_link": f"/auth/link-amt/?{query}"} + + @auth_router.get("/magic-link/", response_class=HTMLResponse, include_in_schema=False) def magic_link_landing_page() -> HTMLResponse: """Serve the SPA without redeeming the token; email prefetches are harmless.""" @@ -57,6 +70,12 @@ def magic_link_landing_page() -> HTMLResponse: ) +@auth_router.get("/link-amt/", response_class=HTMLResponse, include_in_schema=False) +def link_amt_account_landing_page() -> HTMLResponse: + """Serve the account-link SPA without consuming the one-time token.""" + return magic_link_landing_page() + + @auth_router.post("/magic-link/exchange", status_code=status.HTTP_204_NO_CONTENT) def exchange_magic_link( body: MagicLinkExchangeRequest, @@ -82,6 +101,29 @@ def exchange_magic_link( ) +@auth_router.post("/link-amt/exchange", status_code=status.HTTP_204_NO_CONTENT) +def exchange_amt_account_link( + body: MagicLinkExchangeRequest, + response: Response, + gr_api: Annotated[GRApiManager, Depends(get_gr_api_manager)], +) -> None: + """Validate the email link, then transition the bound AMT account.""" + token_data = consume_amt_account_link_token(body.token) + user = User(email=token_data.email) + user = gr_api.transition_user_from_amt(user, token_data.amt_worker_id) + + session_token = create_session(user.product_user_id) + response.set_cookie( + key=SESSION_COOKIE_NAME, + value=session_token, + max_age=settings.session_token_ttl_seconds, + httponly=True, + secure=not settings.debug, + samesite="lax", + path="/", + ) + + @auth_router.get("/session", response_model=User) def get_session( user: Annotated[User, Depends(get_authenticated_user)], diff --git a/tests/conftest.py b/tests/conftest.py index 25eb457..c056821 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -3,7 +3,7 @@ from typing import TYPE_CHECKING from uuid import uuid4 from dotenv import load_dotenv import pytest -from generalresearchutils.pg_helper import PostgresConfig +from generalresearch.pg_helper import PostgresConfig from tests import generate_amt_id from _pytest.config import Config from jb.decorators import CLIENT_CONFIG @@ -99,7 +99,7 @@ def settings(env_file_path: str) -> "Settings": @pytest.fixture(scope="session") def redis(settings: "Settings"): - from generalresearchutils.redis_helper import RedisConfig + from generalresearch.redis_helper import RedisConfig redis_config = RedisConfig( dsn=settings.redis, diff --git a/tests/fixtures/flow.py b/tests/fixtures/flow.py index dd2f83e..08ec49e 100644 --- a/tests/fixtures/flow.py +++ b/tests/fixtures/flow.py @@ -4,9 +4,9 @@ from uuid import uuid4 import pytest import requests -from generalresearchutils.models.thl.payout import UserPayoutEvent -from generalresearchutils.models.thl.wallet import PayoutType -from generalresearchutils.models.thl.wallet.cashout_method import ( +from generalresearch.models.thl.payout import UserPayoutEvent +from generalresearch.models.thl.wallet import PayoutType +from generalresearch.models.thl.wallet.cashout_method import ( CashoutRequestResponse, CashoutRequestInfo, ) @@ -20,8 +20,8 @@ from jb.managers.amt import ( APPROVAL_MESSAGE, BONUS_MESSAGE, ) -from generalresearchutils.currency import USDCent -from generalresearchutils.models.thl.definitions import PayoutStatus +from generalresearch.currency import USDCent +from generalresearch.models.thl.definitions import PayoutStatus @pytest.fixture diff --git a/tests/fixtures/managers.py b/tests/fixtures/managers.py index a3187d7..d10b542 100644 --- a/tests/fixtures/managers.py +++ b/tests/fixtures/managers.py @@ -1,7 +1,7 @@ from typing import TYPE_CHECKING import pytest from jb.managers import Permission -from generalresearchutils.pg_helper import PostgresConfig +from generalresearch.pg_helper import PostgresConfig from mypy_boto3_mturk import MTurkClient if TYPE_CHECKING: diff --git a/tests/fixtures/models.py b/tests/fixtures/models.py index 671c7b3..b818caa 100644 --- a/tests/fixtures/models.py +++ b/tests/fixtures/models.py @@ -3,13 +3,13 @@ from datetime import timezone, datetime import pytest from jb.models.event import MTurkEvent -from generalresearchutils.pg_helper import PostgresConfig +from generalresearch.pg_helper import PostgresConfig from datetime import datetime, timezone, timedelta from typing import Optional, TYPE_CHECKING, Callable, Generator from jb.managers.amt import AMTManager from jb.models.assignment import AssignmentStub, Assignment -from generalresearchutils.currency import USDCent +from generalresearch.currency import USDCent from jb.models.definitions import HitStatus, HitReviewStatus, AssignmentStatus from jb.models.hit import HitType, HitQuestion, Hit from tests import generate_amt_id diff --git a/tests/flow/test_tasks.py b/tests/flow/test_tasks.py index 3a71504..f939d20 100644 --- a/tests/flow/test_tasks.py +++ b/tests/flow/test_tasks.py @@ -16,7 +16,7 @@ from jb.managers.amt import ( from mypy_boto3_mturk.type_defs import ( GetAssignmentResponseTypeDef, ) -from generalresearchutils.currency import USDCent +from generalresearch.currency import USDCent from jb.managers.assignment import AssignmentManager from jb.managers.bonus import BonusManager from jb.managers.hit import HitManager diff --git a/tests/http/test_auth.py b/tests/http/test_auth.py index 8a625bf..02ac88a 100644 --- a/tests/http/test_auth.py +++ b/tests/http/test_auth.py @@ -13,6 +13,8 @@ from jb.models.auth import User class FakeGRApiManager: def __init__(self): self.users: dict[str, User] = {} + self.amt_worker_ids: set[str] = set() + self.transition_calls: list[tuple[User, str]] = [] def ensure_user_exists(self, user: User) -> User: self.users.setdefault(user.product_user_id, user) @@ -21,6 +23,18 @@ class FakeGRApiManager: def get_user(self, product_user_id: str) -> User: return self.users[product_user_id] + def add_amt_user(self, amt_worker_id: str) -> None: + self.amt_worker_ids.add(amt_worker_id) + + def transition_user_from_amt(self, user: User, amt_worker_id: str) -> User: + self.transition_calls.append((user, amt_worker_id)) + if amt_worker_id not in self.amt_worker_ids: + raise ValueError(f"User {amt_worker_id} does not exist") + + self.amt_worker_ids.remove(amt_worker_id) + self.users[user.product_user_id] = user + return user + @pytest.fixture def email() -> str: @@ -64,3 +78,47 @@ class TestAuth: res = await client.get("/auth/session") assert res.status_code == 200 assert res.json()["email"] == email + + @pytest.mark.anyio + async def test_amt_account_link( + self, + httpxclient: AsyncClient, + fake_gr_api_manager: FakeGRApiManager, + email: str, + amt_worker_id: str, + ): + client = httpxclient + fake_gr_api_manager.add_amt_user(amt_worker_id) + + res = await client.post( + "/auth/link-amt/request", + json={"email": email, "amt_worker_id": amt_worker_id}, + ) + d = res.json() + assert res.status_code == 200 + assert d["magic_link"] + assert fake_gr_api_manager.transition_calls == [] + + token = parse_qs(urlparse(d["magic_link"]).query)["token"][0] + + url = "/auth/link-amt/exchange" + body = {"token": token} + res = await client.post(url, json=body) + assert res.status_code == 204 + assert client.cookies.get(SESSION_COOKIE_NAME) + assert len(fake_gr_api_manager.transition_calls) == 1 + transitioned_user, transitioned_amt_worker_id = ( + fake_gr_api_manager.transition_calls[0] + ) + assert transitioned_user.email == email + assert transitioned_amt_worker_id == amt_worker_id + assert amt_worker_id not in fake_gr_api_manager.amt_worker_ids + + res = await client.get("/auth/session") + assert res.status_code == 200 + assert res.json()["email"] == email + + # Make sure we can't do it again + res = await client.post(url, json=body) + assert res.status_code == 401 + assert len(fake_gr_api_manager.transition_calls) == 1 -- cgit v1.2.3 From f3e37a1c73bd0d68966f24995011b5c93305273d Mon Sep 17 00:00:00 2001 From: stuppie Date: Tue, 8 Sep 2026 16:02:08 -0600 Subject: email integration --- jb/api/magic_token.py | 4 +- jb/flow/events.py | 9 +-- jb/managers/email_manager.py | 57 +++++++++++++++++++ jb/settings.py | 4 ++ jb/views/auth.py | 130 ++++++++++++++++++++++++++++++------------- tests/fixtures/flow.py | 2 +- 6 files changed, 155 insertions(+), 51 deletions(-) create mode 100644 jb/managers/email_manager.py (limited to 'jb/views/auth.py') diff --git a/jb/api/magic_token.py b/jb/api/magic_token.py index e0a1cca..562ba81 100644 --- a/jb/api/magic_token.py +++ b/jb/api/magic_token.py @@ -43,10 +43,10 @@ def consume_magic_token(token: str) -> str: return user_email -def create_amt_account_link_token(user: User, amt_worker_id: str) -> str: +def create_amt_account_link_token(email: str, amt_worker_id: str) -> str: """Bind an email and AMT worker ID to an opaque, short-lived token.""" data = AmtAccountLink( - email=user.email, + email=email, amt_worker_id=amt_worker_id, ) token = secrets.token_urlsafe(32) diff --git a/jb/flow/events.py b/jb/flow/events.py index 04c4bb6..0eb91fd 100644 --- a/jb/flow/events.py +++ b/jb/flow/events.py @@ -2,7 +2,7 @@ import logging import time from concurrent import futures from concurrent.futures import Executor, ThreadPoolExecutor -from typing import TypedDict, cast +from typing import cast import redis @@ -19,13 +19,6 @@ from jb.models.event import MTurkEvent StreamMessages = list[tuple[str, list[tuple[bytes, dict[bytes, bytes]]]]] -class PendingEntry(TypedDict): - message_id: bytes - consumer: bytes - time_since_delivered: int - times_delivered: int - - def process_mturk_events_task(): executor = ThreadPoolExecutor(max_workers=5) create_consumer_group() diff --git a/jb/managers/email_manager.py b/jb/managers/email_manager.py new file mode 100644 index 0000000..dcbe167 --- /dev/null +++ b/jb/managers/email_manager.py @@ -0,0 +1,57 @@ +import requests + +from jb.config import settings + +MAUTIC_BASE_URL = "https://mail.jamesbillings67.com" +EMAIL_TEMPLATE_ID = 1 +auth_headers = {"Authorization": f"Basic {settings.mautic_api_key.get_secret_value()}"} + + +def get_or_create_contact(email: str, amt_worker_id: str | None = None): + # amt_worker_id = "A2Z2FRA128FNW" + body = {"email": email} + if amt_worker_id: + body["amt_worker_id"] = amt_worker_id + res = requests.post( + url=f"{MAUTIC_BASE_URL}/api/contacts/new", + json=body, + headers=auth_headers, + ).json() + contact_id = res["contact"]["id"] + return contact_id + + +def send_login_email_from_url(mautic_url, magic_link) -> None: + email_tokens = { + "magic_link": magic_link, + } + body = {"tokens": email_tokens} + response = requests.post(url=mautic_url, json=body, headers=auth_headers) + try: + response.raise_for_status() + except requests.exceptions.HTTPError: + print(f"Failed to send email. Status code: {response.status_code}") + print(response.text) + raise + d = response.json() + assert d.get("success"), f"Failed to send email: {d.get('failed')}" + print("Email sent successfully") + + +def send_login_email(email: str, magic_token: str): + contact_id = get_or_create_contact(email=email) + mautic_url = ( + f"{MAUTIC_BASE_URL}/api/emails/{EMAIL_TEMPLATE_ID}/contact/{contact_id}/send" + ) + magic_link = f"{settings.base_url}auth/magic-link/?token={magic_token}" + return send_login_email_from_url(mautic_url, magic_link) + + +def send_amt_link_email(email: str, magic_token: str): + # don't actually associate the email with the worker ID until they click the link + contact_id = get_or_create_contact(email=email) + mautic_url = ( + f"{MAUTIC_BASE_URL}/api/emails/{EMAIL_TEMPLATE_ID}/contact/{contact_id}/send" + ) + magic_link = f"{settings.base_url}auth/link-amt/?token={magic_token}" + return send_login_email_from_url(mautic_url, magic_link) diff --git a/jb/settings.py b/jb/settings.py index 7fe2a5a..86c8a36 100644 --- a/jb/settings.py +++ b/jb/settings.py @@ -41,6 +41,7 @@ class Settings(AmtJbBaseSettings): ) debug: bool = False app_name: str = "AMT JB API" + base_url: HttpUrl = Field(default=HttpUrl("https://jamesbillings67.com/")) fsb_host: HttpUrl = Field(default=HttpUrl("https://fsb.generalresearch.com/")) # Needed for admin function on fsb w/o authentication @@ -62,6 +63,8 @@ class Settings(AmtJbBaseSettings): ) gr_api_token: SecretStr = Field(min_length=1) + mautic_api_key: SecretStr = Field(min_length=32) + class TestSettings(Settings): model_config = SettingsConfigDict( @@ -73,6 +76,7 @@ class TestSettings(Settings): ) debug: bool = True app_name: str = "AMT JB API Test" + base_url: HttpUrl = Field(default=HttpUrl("http://127.0.0.1:8081/")) @lru_cache diff --git a/jb/views/auth.py b/jb/views/auth.py index dc63ca3..6f8a3e2 100644 --- a/jb/views/auth.py +++ b/jb/views/auth.py @@ -1,8 +1,9 @@ +import logging from typing import Annotated from urllib.parse import urlencode from fastapi import APIRouter, Depends, HTTPException, Response, status -from fastapi.responses import HTMLResponse +from fastapi.responses import HTMLResponse, RedirectResponse from jb.api.auth import ( SESSION_COOKIE_NAME, @@ -17,6 +18,11 @@ from jb.api.magic_token import ( ) from jb.config import settings from jb.dependencies import get_gr_api_manager +from jb.managers.email_manager import ( + get_or_create_contact, + send_amt_link_email, + send_login_email, +) from jb.managers.gr_api import GRApiManager from jb.models.auth import ( AccountLogin, @@ -30,36 +36,34 @@ auth_router = APIRouter(prefix="/auth", tags=["Auth"]) @auth_router.post("/magic-link/request") -def request_mock_magic_link(body: AccountLogin) -> dict[str, str]: - """Create a magic link without sending email in development.""" - if not settings.debug: - raise HTTPException(status_code=status.HTTP_404_NOT_FOUND) - - # todo: send email here - - user = User(email=body.email) - token = create_magic_token(str(user.email)) - query = urlencode({"token": token}) - return {"magic_link": f"/auth/magic-link/?{query}"} +def request_magic_link(body: AccountLogin) -> dict[str, str]: + """Create a magic link.""" + email = str(body.email) + token = create_magic_token(user_email=email) + if settings.debug: + query = urlencode({"token": token}) + return {"magic_link": f"{settings.base_url}auth/magic-link/?{query}"} -@auth_router.post("/link-amt/request") -def link_amt_account(body: AmtAccountLink) -> dict[str, str]: - """Create a mock AMT account-link email in development.""" - if not settings.debug: - raise HTTPException(status_code=status.HTTP_404_NOT_FOUND) - - # TODO: Derive amt_worker_id from a server-validated AMT assignment and - # send this link by email instead of returning it. - user = User(email=body.email) - token = create_amt_account_link_token(user, body.amt_worker_id) - query = urlencode({"token": token}) - return {"magic_link": f"/auth/link-amt/?{query}"} + send_login_email(email=email, magic_token=token) + return {"detail": "Link sent. Check your inbox and follow the link to log in."} @auth_router.get("/magic-link/", response_class=HTMLResponse, include_in_schema=False) -def magic_link_landing_page() -> HTMLResponse: +def magic_link_landing_page( + gr_api: Annotated[GRApiManager, Depends(get_gr_api_manager)], + token: str | None = None, +) -> Response: """Serve the SPA without redeeming the token; email prefetches are harmless.""" + if settings.debug: + if token is None: + raise HTTPException( + status_code=status.HTTP_400_BAD_REQUEST, + detail="token is required", + ) + response = RedirectResponse(url="/", status_code=status.HTTP_303_SEE_OTHER) + _exchange_magic_link(token, response, gr_api) + return response return HTMLResponse( BASE_HTML, headers={ @@ -70,12 +74,6 @@ def magic_link_landing_page() -> HTMLResponse: ) -@auth_router.get("/link-amt/", response_class=HTMLResponse, include_in_schema=False) -def link_amt_account_landing_page() -> HTMLResponse: - """Serve the account-link SPA without consuming the one-time token.""" - return magic_link_landing_page() - - @auth_router.post("/magic-link/exchange", status_code=status.HTTP_204_NO_CONTENT) def exchange_magic_link( body: MagicLinkExchangeRequest, @@ -83,16 +81,15 @@ def exchange_magic_link( gr_api: Annotated[GRApiManager, Depends(get_gr_api_manager)], ) -> None: """Exchange a magic link only after its landing page makes an explicit POST.""" - user_email = consume_magic_token(body.token) + _exchange_magic_link(body.token, response, gr_api) - user = User.model_validate({"email": user_email}) - # hit thl to make sure this user exists - user = gr_api.ensure_user_exists(user) - session_token = create_session(user.product_user_id) +def _exchange_magic_link(token: str, response: Response, gr_api: GRApiManager) -> None: + user_email = consume_magic_token(token) + user = gr_api.ensure_user_exists(User.model_validate({"email": user_email})) response.set_cookie( key=SESSION_COOKIE_NAME, - value=session_token, + value=create_session(user.product_user_id), max_age=settings.session_token_ttl_seconds, httponly=True, secure=not settings.debug, @@ -101,6 +98,45 @@ def exchange_magic_link( ) +@auth_router.post("/link-amt/request") +def link_amt_account(body: AmtAccountLink) -> dict[str, str]: + """Link an AMT account and login.""" + email = str(body.email) + amt_worker_id = body.amt_worker_id + token = create_amt_account_link_token(email=email, amt_worker_id=amt_worker_id) + + if settings.debug: + query = urlencode({"token": token}) + return {"magic_link": f"{settings.base_url}auth/link-amt/?{query}"} + + send_amt_link_email(email=email, magic_token=token) + return {"detail": "Link sent. Check your inbox and follow the link to log in."} + + +@auth_router.get("/link-amt/", response_class=HTMLResponse, include_in_schema=False) +def link_amt_account_landing_page( + gr_api: Annotated[GRApiManager, Depends(get_gr_api_manager)], + token: str | None = None, +) -> HTMLResponse: + """Serve the account-link SPA without consuming the one-time token.""" + if settings.debug: + if token is None: + raise HTTPException( + status_code=status.HTTP_400_BAD_REQUEST, + detail="token is required", + ) + response = RedirectResponse(url="/", status_code=status.HTTP_303_SEE_OTHER) + _exchange_amt_account_link(token, response, gr_api) + return HTMLResponse( + BASE_HTML, + headers={ + "Cache-Control": "no-store", + "Referrer-Policy": "no-referrer", + "X-Robots-Tag": "noindex, nofollow", + }, + ) + + @auth_router.post("/link-amt/exchange", status_code=status.HTTP_204_NO_CONTENT) def exchange_amt_account_link( body: MagicLinkExchangeRequest, @@ -108,9 +144,23 @@ def exchange_amt_account_link( gr_api: Annotated[GRApiManager, Depends(get_gr_api_manager)], ) -> None: """Validate the email link, then transition the bound AMT account.""" - token_data = consume_amt_account_link_token(body.token) - user = User(email=token_data.email) - user = gr_api.transition_user_from_amt(user, token_data.amt_worker_id) + try: + _exchange_amt_account_link(body.token, response, gr_api) + except ValueError as e: + logging.error(f"Failed to exchange AMT account link: {e}") + raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e)) + + +def _exchange_amt_account_link(token: str, response: Response, gr_api: GRApiManager): + token_data = consume_amt_account_link_token(token) + email = token_data.email + amt_worker_id = token_data.amt_worker_id + + user = User(email=email) + user = gr_api.transition_user_from_amt(user=user, amt_worker_id=amt_worker_id) + + # In Mautic, associate the email with the worker ID (AFTER the user has transitioned) + get_or_create_contact(email=email, amt_worker_id=amt_worker_id) session_token = create_session(user.product_user_id) response.set_cookie( diff --git a/tests/fixtures/flow.py b/tests/fixtures/flow.py index 08ec49e..3fcca81 100644 --- a/tests/fixtures/flow.py +++ b/tests/fixtures/flow.py @@ -5,7 +5,7 @@ from uuid import uuid4 import pytest import requests from generalresearch.models.thl.payout import UserPayoutEvent -from generalresearch.models.thl.wallet import PayoutType +from generalresearch.models.thl.wallet.definitions import PayoutType from generalresearch.models.thl.wallet.cashout_method import ( CashoutRequestResponse, CashoutRequestInfo, -- cgit v1.2.3 From 4dca7296742b607e74f16e2f6484c51163a41ace Mon Sep 17 00:00:00 2001 From: Max Nanis Date: Thu, 10 Sep 2026 01:00:39 -0700 Subject: using model_validator on GRLSettings. Allows null default values, then to asser them on load. Required so pydantic_settings can be loaded in tests without params --- jb/api/auth.py | 3 +- jb/api/magic_token.py | 2 +- jb/config.py | 13 +---- jb/decorators.py | 11 ++++ jb/flow/assignment_tasks.py | 17 +++--- jb/flow/events.py | 9 ++-- jb/flow/tasks.py | 17 +++--- jb/main.py | 5 +- jb/managers/amt.py | 16 +++--- jb/managers/email_manager.py | 7 +++ jb/managers/gr_api.py | 12 ++--- jb/managers/hit.py | 2 +- jb/models/assignment.py | 5 +- jb/models/auth.py | 1 + jb/models/hit.py | 110 +++++++++++++++++++------------------ jb/settings.py | 86 ++++++++++++++++++----------- jb/views/auth.py | 4 +- tests/conftest.py | 125 +++++++++++++++++++++++++++++++++++-------- tests/http/test_auth.py | 4 +- 19 files changed, 275 insertions(+), 174 deletions(-) (limited to 'jb/views/auth.py') diff --git a/jb/api/auth.py b/jb/api/auth.py index 411b8f1..1542e70 100644 --- a/jb/api/auth.py +++ b/jb/api/auth.py @@ -1,4 +1,3 @@ -import logging from datetime import datetime, timedelta, timezone from typing import Annotated from uuid import uuid4 @@ -13,7 +12,6 @@ from jb.managers.gr_api import GRApiManager from jb.models.auth import User bearer = HTTPBearer(auto_error=False) -logger = logging.getLogger(__name__) SESSION_COOKIE_NAME = "jb_session" JWT_ISSUER = "jamesbillings67" @@ -74,6 +72,7 @@ def get_authenticated_user( def create_session(product_user_id: str) -> str: now = datetime.now(timezone.utc) + assert settings.session_jwt_secret return jwt.encode( { "sub": product_user_id, diff --git a/jb/api/magic_token.py b/jb/api/magic_token.py index b7f7575..5f78996 100644 --- a/jb/api/magic_token.py +++ b/jb/api/magic_token.py @@ -40,7 +40,7 @@ def consume_magic_token(token: str) -> str: status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid or expired magic token", ) - return user_email + return str(user_email) def create_amt_account_link_token(email: str, amt_worker_id: str) -> str: diff --git a/jb/config.py b/jb/config.py index 359f108..7993f53 100644 --- a/jb/config.py +++ b/jb/config.py @@ -1,17 +1,8 @@ import logging -from generalresearch.config import is_debug +from jb.settings import get_settings -from jb.settings import get_settings, get_test_settings - -if is_debug(): - print("running using TEST settings") - settings = get_test_settings() - assert settings.debug is True -else: - print("running using PROD settings") - settings = get_settings() - assert settings.debug is False +settings = get_settings() if settings.debug: LOG_LEVEL = logging.DEBUG diff --git a/jb/decorators.py b/jb/decorators.py index cafd7a9..1a7a145 100644 --- a/jb/decorators.py +++ b/jb/decorators.py @@ -1,3 +1,5 @@ +import logging + import boto3 from botocore.config import Config from generalresearch.pg_helper import PostgresConfig @@ -22,6 +24,15 @@ redis_config = RedisConfig( ) REDIS = redis_config.create_redis_client() +# --- Logging --- + +logging.basicConfig( + level=logging.INFO, + format="%(asctime)s - %(levelname)s:%(name)s:%(message)s", + datefmt="%Y-%m-%d %H:%M:%S", +) +LOG = logging.getLogger("amtjb") + CLIENT_CONFIG = Config( # connect_timeout (float or int) – The time in seconds till a timeout # exception is thrown when attempting to make a connection. The default diff --git a/jb/flow/assignment_tasks.py b/jb/flow/assignment_tasks.py index bdebb3d..b3c820a 100644 --- a/jb/flow/assignment_tasks.py +++ b/jb/flow/assignment_tasks.py @@ -1,5 +1,4 @@ -import logging - +from jb.decorators import LOG from jb.flow.monitoring import emit_assignment_event, emit_error_event from jb.managers.amt import ( REJECT_MESSAGE_UNKNOWN_ASSIGNMENT, @@ -27,7 +26,7 @@ def process_assignment_submitted( # # Step 1: Attempt to get the Assignment out of the API # - logging.info(f"{event=}") + LOG.info(f"{event=}") # This is the assignment model from AMT. In the DB, we should only have # the AssignmentStub @@ -42,7 +41,7 @@ def process_assignment_submitted( # It is not found in amt, either it is invalid, not yet submitted, or # already been approved/rejected, so we just do nothing ... # todo: maybe we confirm its state matches what we have in the db - logging.warning(f"No assignment found on AMT: {event.amt_assignment_id}") + LOG.warning(f"No assignment found on AMT: {event.amt_assignment_id}") emit_error_event( event_type="assignment_not_found_in_amt", amt_hit_type_id=event.amt_hit_type_id, @@ -70,9 +69,7 @@ def review_hit(amtm: AMTManager, hm: HitManager, assignment: Assignment) -> None hit, _ = amtm.get_hit_if_exists(amt_hit_id=assignment.amt_hit_id) if hit is None: - logging.warning( - f"Hit not found when trying to review hit: {assignment.amt_hit_id}" - ) + LOG.warning(f"Hit not found when trying to review hit: {assignment.amt_hit_id}") return # Update the db @@ -101,7 +98,7 @@ def reject_assignment( event_type="failed_to_reject_assignment", amt_hit_type_id=amt_hit_type_id, ) - logging.exception(f"Failed to reject assignment: {amt_assignment_id}") + LOG.exception(f"Failed to reject assignment: {amt_assignment_id}") # We just rejected this assignment, get it from amazon again assignment = amtm.get_assignment(amt_assignment_id=amt_assignment_id) @@ -112,7 +109,7 @@ def reject_assignment( # need to create as assignment first ... stub = am.get_stub_if_exists(amt_assignment_id=assignment.amt_assignment_id) if stub is None: - logging.warning( + LOG.warning( f"Rejected assignment doesn't exist in DB. Creating ... : {amt_assignment_id}" ) # Even if the assignment doesn't exist, the hit must ... @@ -123,5 +120,5 @@ def reject_assignment( emit_assignment_event( status=AssignmentStatus.Rejected, amt_hit_type_id=amt_hit_type_id, reason=msg ) - logging.warning(f"Rejected assignment: {amt_assignment_id}") + LOG.warning(f"Rejected assignment: {amt_assignment_id}") return assignment diff --git a/jb/flow/events.py b/jb/flow/events.py index 0eb91fd..f224c01 100644 --- a/jb/flow/events.py +++ b/jb/flow/events.py @@ -1,4 +1,3 @@ -import logging import time from concurrent import futures from concurrent.futures import Executor, ThreadPoolExecutor @@ -11,7 +10,7 @@ from jb.config import ( CONSUMER_NAME, JB_EVENTS_STREAM, ) -from jb.decorators import REDIS +from jb.decorators import LOG, REDIS from jb.flow.assignment_tasks import process_assignment_submitted from jb.flow.monitoring import emit_error_event from jb.models.event import MTurkEvent @@ -26,7 +25,7 @@ def process_mturk_events_task(): try: process_mturk_events(executor=executor) except Exception as e: - logging.exception(e) + LOG.exception(e) finally: time.sleep(1) @@ -71,7 +70,7 @@ def process_mturk_events_chunk(executor: Executor) -> int | None: executor.submit(process_assignment_submitted_event, event, str(msg_id)) ) else: - logging.info(f"Discarding {event}") + LOG.info(f"Discarding {event}") REDIS.xdel(JB_EVENTS_STREAM, msg_id) futures.wait(fs, timeout=60) @@ -84,7 +83,7 @@ def process_assignment_submitted_event(event: MTurkEvent, msg_id: str): try: process_assignment_submitted(amtm=AMTM, am=AM, hm=HM, bm=BM, event=event) except Exception as e: - logging.exception(f"{event.amt_assignment_id=}, {e=}") + LOG.exception(f"{event.amt_assignment_id=}, {e=}") emit_error_event( event_type="failed_process_assignment_submitted", amt_hit_type_id=event.amt_hit_type_id, diff --git a/jb/flow/tasks.py b/jb/flow/tasks.py index 24e96d4..c555021 100644 --- a/jb/flow/tasks.py +++ b/jb/flow/tasks.py @@ -1,19 +1,14 @@ -import logging import time from typing import TypedDict, cast from generalresearch.config import is_debug -from jb.decorators import AMTM, HM, HQM, HTM, pg_config +from jb.decorators import AMTM, HM, HQM, HTM, LOG, pg_config from jb.flow.maintenance import check_hit_status from jb.flow.monitoring import emit_hit_event, write_hit_gauge from jb.models.definitions import HitStatus from jb.models.hit import Hit, HitQuestion, HitType -logging.basicConfig() -logger = logging.getLogger() -logger.setLevel(logging.INFO) - class HitRow(TypedDict): amt_hit_id: str @@ -34,7 +29,7 @@ def check_stale_hits(): params={"status": HitStatus.Assignable.value}, ) for hit in cast(list[HitRow], res): - logging.info(f"check_stale_hits: {hit["amt_hit_id"]}") + LOG.info(f"check_stale_hits: {hit["amt_hit_id"]}") check_hit_status( amtm=AMTM, amt_hit_id=hit["amt_hit_id"], @@ -56,7 +51,7 @@ def check_expired_hits(): params={"status": HitStatus.Assignable.value}, ) for hit in cast(list[HitRow], res): - logging.info(f"check_expired_hits: {hit["amt_hit_id"]}") + LOG.info(f"check_expired_hits: {hit["amt_hit_id"]}") check_hit_status( amtm=AMTM, amt_hit_id=hit["amt_hit_id"], @@ -87,7 +82,7 @@ def refill_hits() -> None: assert hit_type.amt_hit_type_id active_count = HM.get_active_count(hit_type_id=hit_type.id) - logging.info( + LOG.info( f"HitType: {hit_type.amt_hit_type_id}, {hit_type.min_active=}, active_count={active_count}" ) write_hit_gauge( @@ -97,7 +92,7 @@ def refill_hits() -> None: ) if active_count < hit_type.min_active: cnt_todo = hit_type.min_active - active_count - logging.info(f"Refilling {cnt_todo} hits") + LOG.info(f"Refilling {cnt_todo} hits") for _ in range(cnt_todo): create_hit_from_hittype(hit_type) @@ -109,6 +104,6 @@ def refill_hits_task(): check_stale_hits() refill_hits() except Exception as e: - logging.exception(e) + LOG.exception(e) finally: time.sleep(5 * 60) diff --git a/jb/main.py b/jb/main.py index 9f4f000..cbbda98 100644 --- a/jb/main.py +++ b/jb/main.py @@ -3,13 +3,12 @@ from typing import Any from fastapi import FastAPI from fastapi.responses import HTMLResponse -from starlette.middleware.cors import CORSMiddleware -from starlette.middleware.trustedhost import TrustedHostMiddleware - from jb.config import settings from jb.settings import BASE_HTML from jb.views.auth import auth_router from jb.views.common import common_router +from starlette.middleware.cors import CORSMiddleware +from starlette.middleware.trustedhost import TrustedHostMiddleware app = FastAPI( servers=[ diff --git a/jb/managers/amt.py b/jb/managers/amt.py index e2c7e90..2411080 100644 --- a/jb/managers/amt.py +++ b/jb/managers/amt.py @@ -1,4 +1,3 @@ -import logging from datetime import datetime, timezone from typing import Any @@ -15,6 +14,7 @@ from mypy_boto3_mturk.type_defs import ( from pydantic import ValidationError from jb.config import TOPIC_ARN +from jb.decorators import LOG from jb.models import AMTAccount from jb.models.assignment import Assignment from jb.models.bonus import Bonus @@ -78,7 +78,7 @@ class AMTManager: return HitStatus.Disposed else: - logging.warning(msg) + LOG.warning(msg) return HitStatus.Unassignable return res.status @@ -137,7 +137,7 @@ class AMTManager: # Baddies have been known to submit assignments with purposely # malformed "answer" (xml) section, which will raise # a pydantic validation error. Try to parse again with no Answer. - logging.exception(e) + LOG.exception(e) ass_res["Answer"] = None # If it wasn't the Answer that caused the ValidationError, it'll raise again assignment = Assignment.from_amt_get_assignment(ass_res) @@ -152,7 +152,7 @@ class AMTManager: try: return self.get_assignment(amt_assignment_id=amt_assignment_id) except botocore.exceptions.ClientError as e: - logging.warning(e) + LOG.warning(e) error_code = e.response["Error"]["Code"] error_msg = e.response["Error"]["Message"] if error_code == "RequestError" and expected_err_msg in error_msg: @@ -170,7 +170,7 @@ class AMTManager: ) except botocore.exceptions.ClientError as e: - logging.warning(e) + LOG.warning(e) return None def approve_assignment_if_possible( @@ -189,7 +189,7 @@ class AMTManager: ) except botocore.exceptions.ClientError as e: - logging.warning(e) + LOG.warning(e) return None def update_hit_review_status(self, amt_hit_id: str, revert: bool = False) -> None: @@ -198,7 +198,7 @@ class AMTManager: self.amt_client.update_hit_review_status(HITId=amt_hit_id, Revert=revert) except botocore.exceptions.ClientError as e: - logging.warning(f"{amt_hit_id=}, {e}") + LOG.warning(f"{amt_hit_id=}, {e}") error_msg = e.response["Error"]["Message"] if "does not exist" in error_msg: @@ -225,7 +225,7 @@ class AMTManager: ) except botocore.exceptions.ClientError as e: - logging.warning(f"{amt_worker_id=} {amt_assignment_id=}, {e}") + LOG.warning(f"{amt_worker_id=} {amt_assignment_id=}, {e}") return None def get_bonus(self, amt_assignment_id: str, payout_event_id: str) -> Bonus | None: diff --git a/jb/managers/email_manager.py b/jb/managers/email_manager.py index e740e20..78acc9d 100644 --- a/jb/managers/email_manager.py +++ b/jb/managers/email_manager.py @@ -1,9 +1,12 @@ import requests +from generalresearch.config import is_debug from jb.config import settings MAUTIC_BASE_URL = "https://mail.jamesbillings67.com" EMAIL_TEMPLATE_ID = 1 + +assert settings.mautic_api_key auth_headers = {"Authorization": f"Basic {settings.mautic_api_key.get_secret_value()}"} @@ -22,6 +25,10 @@ def get_or_create_contact(email: str, amt_worker_id: str | None = None): def send_login_email_from_url(mautic_url: str, magic_link: str) -> None: + if is_debug(): + print("MAGIC_LINK: ", magic_link) + return + email_tokens = { "magic_link": magic_link, } diff --git a/jb/managers/gr_api.py b/jb/managers/gr_api.py index 494ceea..70c6a60 100644 --- a/jb/managers/gr_api.py +++ b/jb/managers/gr_api.py @@ -1,14 +1,12 @@ """Client for General Research's product-user API.""" -import logging from typing import Any import requests +from jb.decorators import LOG from jb.models.auth import User -logger = logging.getLogger(__name__) - class GRApiError(RuntimeError): """The General Research API could not satisfy a request.""" @@ -60,7 +58,7 @@ class GRApiManager: f"General Research API request failed: {method} {url}" ) from exc - def _parse_user_response(self, res: dict) -> User: + def _parse_user_response(self, res: dict[str, Any]) -> User: return User.model_validate( { "product_user_id": res["product_user_id"], @@ -98,7 +96,7 @@ class GRApiManager: """This should only be called once per user upon account creation. A user cannot change their email address.""" url = f"{self.base_url}/{self.product_id}/user/{user.product_user_id}/metadata/" - res = self._request( + _ = self._request( "PATCH", url, json={"email_address": str(user.email)}, @@ -110,7 +108,7 @@ class GRApiManager: if user.display_name is None: return user url = f"{self.base_url}/{self.product_id}/user/{user.product_user_id}/metadata/" - res = self._request( + _ = self._request( "PATCH", url, json={"display_name": user.display_name}, @@ -145,7 +143,7 @@ class GRApiManager: raise self.set_user_email(user) transitioned_user = self.get_user(user.product_user_id) - logger.warning( + LOG.warning( "Transitioned product user from AMT worker %s to %s with email %s", amt_worker_id, transitioned_user.product_user_id, diff --git a/jb/managers/hit.py b/jb/managers/hit.py index a178d4d..2c6067b 100644 --- a/jb/managers/hit.py +++ b/jb/managers/hit.py @@ -306,7 +306,7 @@ class HitManager(PostgresManager): def get_active_count(self, hit_type_id: int) -> int: return self.pg_config.execute_sql_query( - """ + query=""" SELECT COUNT(1) as active_count FROM mtwerk_hit WHERE status = %(status)s diff --git a/jb/models/assignment.py b/jb/models/assignment.py index 775cd63..1f7033d 100644 --- a/jb/models/assignment.py +++ b/jb/models/assignment.py @@ -1,4 +1,3 @@ -import logging from datetime import datetime, timezone from typing import Any, TypedDict from xml.etree import ElementTree @@ -15,6 +14,7 @@ from pydantic import ( ) from typing_extensions import Self +from jb.decorators import LOG from jb.models.custom_types import AMTBoto3ID, AwareDatetimeISO, UUIDStr from jb.models.definitions import AssignmentStatus @@ -140,7 +140,8 @@ class Assignment(AssignmentStub): values["tsid"] = TypeAdapter(UUIDStr).validate_python(tsid) except ValidationError as e: # Don't break the model validation if a baddie messes with the tsid in the answer. - logging.warning(e) + LOG.warning(e) + values["tsid"] = None return values diff --git a/jb/models/auth.py b/jb/models/auth.py index fef5070..886a607 100644 --- a/jb/models/auth.py +++ b/jb/models/auth.py @@ -22,6 +22,7 @@ def email_to_product_user_id(email: str) -> str: The same normalized email and secret salt always produce the same ID. Keep the salt private and stable; changing it changes every generated ID. """ + assert settings.magic_token_salt salt_bytes = settings.magic_token_salt.get_secret_value().encode("utf-8") if len(salt_bytes) < 32: raise ValueError("salt must be at least 32 bytes") diff --git a/jb/models/hit.py b/jb/models/hit.py index f6c854f..a091c83 100644 --- a/jb/models/hit.py +++ b/jb/models/hit.py @@ -88,15 +88,19 @@ class HitType(HitTypeCommon): # --- GRL Specific --- min_active: NonNegativeInt = Field(default=0, le=100_000) - def to_api_request_body(self): - return dict( - AutoApprovalDelayInSeconds=round(self.auto_approval_delay.total_seconds()), - AssignmentDurationInSeconds=round(self.assignment_duration.total_seconds()), - Reward=str(self.reward.to_usd()), - Title=self.title, - Keywords=self.keywords, - Description=self.description, - ) + def to_api_request_body(self) -> dict[str, Any]: + return { + "AutoApprovalDelayInSeconds": round( + self.auto_approval_delay.total_seconds() + ), + "AssignmentDurationInSeconds": round( + self.assignment_duration.total_seconds() + ), + "Reward": str(self.reward.to_usd()), + "Title": self.title, + "Keywords": self.keywords, + "Description": self.description, + } def to_postgres(self): d = self.model_dump(mode="json") @@ -109,7 +113,7 @@ class HitType(HitTypeCommon): return cls.model_validate(data) def generate_hit_amt_request(self, question: HitQuestion) -> dict[str, Any]: - d = dict() + d = {} d["HITTypeId"] = self.amt_hit_type_id d["MaxAssignments"] = 1 d["LifetimeInSeconds"] = round(timedelta(days=14).total_seconds()) @@ -175,27 +179,27 @@ class Hit(HitTypeCommon): assert hit_type.amt_hit_type_id is not None h = cls.model_validate( - dict( - amt_hit_id=data["HITId"], - amt_hit_type_id=data["HITTypeId"], - amt_group_id=data["HITGroupId"], - status=HitStatus[data["HITStatus"]], - review_status=HitReviewStatus[data["HITReviewStatus"]], - creation_time=data["CreationTime"].astimezone(tz=timezone.utc), - expiration=data["Expiration"].astimezone(tz=timezone.utc), - hit_question_xml=data["Question"], - qualification_requirements=data["QualificationRequirements"], - max_assignments=data["MaxAssignments"], - assignment_pending_count=data["NumberOfAssignmentsPending"], - assignment_available_count=data["NumberOfAssignmentsAvailable"], - assignment_completed_count=data["NumberOfAssignmentsCompleted"], - description=data["Description"], - keywords=data["Keywords"], - reward=USDCent(round(float(data["Reward"]) * 100)), - title=data["Title"], - question_id=question.id, - hit_type_id=hit_type.id, - ) + { + "amt_hit_id": data["HITId"], + "amt_hit_type_id": data["HITTypeId"], + "amt_group_id": data["HITGroupId"], + "status": HitStatus[data["HITStatus"]], + "review_status": HitReviewStatus[data["HITReviewStatus"]], + "creation_time": data["CreationTime"].astimezone(tz=timezone.utc), + "expiration": data["Expiration"].astimezone(tz=timezone.utc), + "hit_question_xml": data["Question"], + "qualification_requirements": data["QualificationRequirements"], + "max_assignments": data["MaxAssignments"], + "assignment_pending_count": data["NumberOfAssignmentsPending"], + "assignment_available_count": data["NumberOfAssignmentsAvailable"], + "assignment_completed_count": data["NumberOfAssignmentsCompleted"], + "description": data["Description"], + "keywords": data["Keywords"], + "reward": USDCent(round(float(data["Reward"]) * 100)), + "title": data["Title"], + "question_id": question.id, + "hit_type_id": hit_type.id, + } ) return h @@ -203,27 +207,27 @@ class Hit(HitTypeCommon): @classmethod def from_amt_get_hit(cls, data: HITTypeDef) -> Self: h = cls.model_validate( - dict( - amt_hit_id=data["HITId"], - amt_hit_type_id=data["HITTypeId"], - amt_group_id=data["HITGroupId"], - status=HitStatus[data["HITStatus"]], - review_status=HitReviewStatus[data["HITReviewStatus"]], - creation_time=data["CreationTime"].astimezone(tz=timezone.utc), - expiration=data["Expiration"].astimezone(tz=timezone.utc), - hit_question_xml=data["Question"], - qualification_requirements=data["QualificationRequirements"], - max_assignments=data["MaxAssignments"], - assignment_pending_count=data["NumberOfAssignmentsPending"], - assignment_available_count=data["NumberOfAssignmentsAvailable"], - assignment_completed_count=data["NumberOfAssignmentsCompleted"], - description=data["Description"], - keywords=data["Keywords"], - reward=USDCent(round(float(data["Reward"]) * 100)), - title=data["Title"], - question_id=None, - hit_type_id=None, - ) + { + "amt_hit_id": data["HITId"], + "amt_hit_type_id": data["HITTypeId"], + "amt_group_id": data["HITGroupId"], + "status": HitStatus[data["HITStatus"]], + "review_status": HitReviewStatus[data["HITReviewStatus"]], + "creation_time": data["CreationTime"].astimezone(tz=timezone.utc), + "expiration": data["Expiration"].astimezone(tz=timezone.utc), + "hit_question_xml": data["Question"], + "qualification_requirements": data["QualificationRequirements"], + "max_assignments": data["MaxAssignments"], + "assignment_pending_count": data["NumberOfAssignmentsPending"], + "assignment_available_count": data["NumberOfAssignmentsAvailable"], + "assignment_completed_count": data["NumberOfAssignmentsCompleted"], + "description": data["Description"], + "keywords": data["Keywords"], + "reward": USDCent(round(float(data["Reward"]) * 100)), + "title": data["Title"], + "question_id": None, + "hit_type_id": None, + } ) return h @@ -246,7 +250,7 @@ class Hit(HitTypeCommon): } res = {} - lookup_table = dict(ExternalURL="url", FrameHeight="height") + lookup_table = {"ExternalURL": "url", "FrameHeight": "height"} for a in root.findall("mt:*", ns): key = lookup_table[a.tag.split("}")[1]] val = a.text diff --git a/jb/settings.py b/jb/settings.py index 7747afc..f0851a5 100644 --- a/jb/settings.py +++ b/jb/settings.py @@ -1,14 +1,15 @@ -import os from functools import lru_cache +from os.path import abspath +from os.path import dirname as pdirname +from os.path import join as pjoin from pathlib import Path from generalresearch.models.custom_types import InfluxDsn -from pydantic import Field, HttpUrl, PostgresDsn, RedisDsn, SecretStr -from pydantic_settings import BaseSettings, SettingsConfigDict - from jb.models.custom_types import UUIDStr +from pydantic import Field, HttpUrl, PostgresDsn, RedisDsn, SecretStr, model_validator +from pydantic_settings import BaseSettings, SettingsConfigDict -BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__))) +BASE_DIR = pdirname(pdirname(abspath(__file__))) BASE_HTML_PATH = Path(BASE_DIR) / "templates" / "base.html" BASE_HTML = BASE_HTML_PATH.read_text() @@ -20,24 +21,28 @@ class AmtJbBaseSettings(BaseSettings): redis: RedisDsn | None = Field(default=None) redis_timeout: float = Field(default=0.10) - amt_jb_db: PostgresDsn = Field() + amt_jb_db: PostgresDsn | None = Field(default=None) amt_endpoint: HttpUrl | None = Field(default=None) amt_access_id: str | None = Field(default=None) amt_secret_key: str | None = Field(default=None) - aws_owner_id: str = Field() - aws_subscription_arn: str = Field() + aws_owner_id: str | None = Field(default=None) + aws_subscription_arn: str | None = Field(default=None) class Settings(AmtJbBaseSettings): model_config = SettingsConfigDict( - env_prefix="", + env_file=( + pjoin(BASE_DIR, x) + for x in [".env.test", ".env.testing", ".env.staging", ".env.prod"] + ), + env_file_encoding="utf-8", case_sensitive=False, - env_file=os.path.join(BASE_DIR, ".env"), extra="allow", cli_parse_args=False, ) + debug: bool = False app_name: str = "AMT JB API" base_url: HttpUrl = Field(default=HttpUrl("https://jamesbillings67.com/")) @@ -46,41 +51,58 @@ class Settings(AmtJbBaseSettings): # Needed for admin function on fsb w/o authentication fsb_host_private_route: str | None = Field(default=None) - product_id: UUIDStr = Field() + product_id: UUIDStr | None = Field(default=None) influx_db: InfluxDsn | None = Field(default=None) - sns_path: str = Field() + sns_path: str | None = Field(default=None) session_token_ttl_seconds: int = Field(default=30 * 24 * 60 * 60, gt=0) - session_jwt_secret: SecretStr = Field(min_length=32) + session_jwt_secret: SecretStr | None = Field(default=None, min_length=32) - magic_token_salt: SecretStr = Field(min_length=32) + magic_token_salt: SecretStr | None = Field(default=None, min_length=32) gr_api_host: HttpUrl = Field(default=HttpUrl("https://generalresearch.com/api/v2/")) - gr_api_token: SecretStr = Field(min_length=1) + gr_api_token: SecretStr | None = Field(default=None, min_length=1) - mautic_api_key: SecretStr = Field(min_length=32) + mautic_api_key: SecretStr | None = Field(default=None, min_length=32) + @model_validator(mode="after") + def validate_host_and_key(self) -> "Settings": -class TestSettings(Settings): - model_config = SettingsConfigDict( - env_prefix="", - case_sensitive=False, - env_file=os.path.join(BASE_DIR, ".env.test"), - extra="allow", - cli_parse_args=False, - ) - debug: bool = True - app_name: str = "AMT JB API Test" - base_url: HttpUrl = Field(default=HttpUrl("http://127.0.0.1:8081/")) + if not self.amt_jb_db: + raise ValueError("amt_jb_db is required") + if not self.aws_owner_id: + raise ValueError("aws_owner_id is required") -@lru_cache -def get_settings(): - return Settings() + if not self.aws_subscription_arn: + raise ValueError("aws_subscription_arn is required") + + if not self.product_id: + raise ValueError("product_id is required") + + if not self.sns_path: + raise ValueError("sns_path is required") + + if not self.session_jwt_secret: + raise ValueError("session_jwt_secret is required") + + if not self.magic_token_salt: + raise ValueError("magic_token_salt is required") + + if self.session_jwt_secret == self.magic_token_salt: + raise ValueError("JWT Secret must be different than Magic Token Salt") + + if not self.gr_api_token: + raise ValueError("gr_api_token is required") + + if not self.mautic_api_key: + raise ValueError("mautic_api_key is required") + + return self @lru_cache -def get_test_settings(): - return TestSettings() +def get_settings(): + return Settings() diff --git a/jb/views/auth.py b/jb/views/auth.py index 6f8a3e2..44fef10 100644 --- a/jb/views/auth.py +++ b/jb/views/auth.py @@ -1,4 +1,3 @@ -import logging from typing import Annotated from urllib.parse import urlencode @@ -17,6 +16,7 @@ from jb.api.magic_token import ( create_magic_token, ) from jb.config import settings +from jb.decorators import LOG from jb.dependencies import get_gr_api_manager from jb.managers.email_manager import ( get_or_create_contact, @@ -147,7 +147,7 @@ def exchange_amt_account_link( try: _exchange_amt_account_link(body.token, response, gr_api) except ValueError as e: - logging.error(f"Failed to exchange AMT account link: {e}") + LOG.error(f"Failed to exchange AMT account link: {e}") raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e)) diff --git a/tests/conftest.py b/tests/conftest.py index 2a3a580..002aced 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -1,12 +1,18 @@ +from __future__ import annotations + import os +import subprocess +import sys +from collections.abc import Callable +from pathlib import Path from typing import TYPE_CHECKING from uuid import uuid4 import pytest -from _pytest.config import Config -from dotenv import load_dotenv -from generalresearch.pg_helper import PostgresConfig +from generalresearch.models.custom_types import PostgresDict +from generalresearch.pg_helper import PostgresConfig, PostgresDsn from mypy_boto3_mturk import MTurkClient +from pytest import TempPathFactory from jb.decorators import CLIENT_CONFIG from tests import generate_amt_id @@ -77,26 +83,108 @@ def pe_id() -> str: @pytest.fixture(scope="session") -def env_file_path(pytestconfig: Config) -> str: - root_path = pytestconfig.rootpath - env_path = os.path.join(root_path, ".env.test") +def settings() -> "Settings": + from jb.settings import Settings as JBSettings + + return JBSettings() - if os.path.exists(env_path): - load_dotenv(dotenv_path=env_path, override=True) - return env_path +# --- Database Connectors --- @pytest.fixture(scope="session") -def settings(env_file_path: str) -> "Settings": - from jb.settings import Settings as JBSettings +def django_db_factory( + postgres_instance: PostgresDsn, + gr_repo: Callable[..., Path], + django_settings_file: Callable[..., tuple[str, Path]], + postgres_instance_dict: PostgresDict, + tmp_path_factory: TempPathFactory, +) -> Callable[..., PostgresDsn | None]: + + _ran = {} + + def _inner( + django_project: str = "generalresearch.thl_django", + ) -> PostgresDsn | None: + + if _ran.get(django_project, False): + print(f"Already ran django_db_factory:{django_project}") + return postgres_instance + _ran[django_project] = True + + _cwd = None + _manage_path = "generalresearch.thl_django.app.manage" + _settings_module, _settings_dir = django_settings_file( + extra_installed_apps=[ + "generalresearch.thl_django", + ], + ) + + pythonpath = str(_settings_dir) + if existing_pythonpath := os.environ.get("PYTHONPATH"): + pythonpath += os.pathsep + existing_pythonpath + + env = { + **os.environ, + "DJANGO_SETTINGS_MODULE": _settings_module, + "PYTHONPATH": pythonpath, + } + + # we check right after. if we check now, we won't print if bad + res1 = subprocess.run( # noqa: PLW1510 + [ + sys.executable, + "-m", + _manage_path, + "makemigrations", + f"--settings={_settings_module}", + ], + cwd=str(_cwd) if _cwd is not None else None, + env=env, + capture_output=True, + text=True, + ) + + if res1.returncode != 0: + print("STDOUT:", res1.stdout) + print("STDERR:", res1.stderr) + res1.check_returncode() + + res2 = subprocess.run( # noqa: PLW1510 + [ + sys.executable, + "-m", + _manage_path, + "migrate", + f"--settings={_settings_module}", + ], + env=env, + cwd=str(_cwd) if _cwd is not None else None, + capture_output=True, + text=True, + ) + + if res2.returncode != 0: + print("STDOUT:", res2.stdout) + print("STDERR:", res2.stderr) + res2.check_returncode() + + # 3. Return the Dsn so the factory gives a way to connect + return postgres_instance + + return _inner - s = JBSettings(_env_file=env_file_path) - return s +@pytest.fixture(scope="session") +def pg_config(settings: "Settings") -> PostgresConfig: + return PostgresConfig( + dsn=settings.amt_jb_db, + connect_timeout=1, + statement_timeout=1, + ) -# --- Database Connectors --- +# --- Redis --- @pytest.fixture(scope="session") @@ -112,15 +200,6 @@ def redis(settings: "Settings"): return redis_config.create_redis_client() -@pytest.fixture(scope="session") -def pg_config(settings: "Settings") -> PostgresConfig: - return PostgresConfig( - dsn=settings.amt_jb_db, - connect_timeout=1, - statement_timeout=1, - ) - - # --- Connectors --- @pytest.fixture(scope="session") def amt_client(settings: "Settings") -> MTurkClient: diff --git a/tests/http/test_auth.py b/tests/http/test_auth.py index ebda742..1fa1335 100644 --- a/tests/http/test_auth.py +++ b/tests/http/test_auth.py @@ -1,4 +1,3 @@ -import secrets from urllib.parse import parse_qs, urlparse import pytest @@ -38,8 +37,7 @@ class FakeGRApiManager: @pytest.fixture def email() -> str: - email = secrets.token_urlsafe(16) + "@gmail.com" - return email.lower() + return "unittest@generalresearch.com" @pytest.fixture -- cgit v1.2.3 From edff9381275d90d7be5f078430554ae592a27f5d Mon Sep 17 00:00:00 2001 From: Max Nanis Date: Fri, 11 Sep 2026 11:27:58 -0700 Subject: Current jb flask testing state. --- jb/api/magic_token.py | 2 +- jb/main.py | 1 + jb/managers/email_manager.py | 16 ++++++++-------- jb/settings.py | 2 +- jb/views/auth.py | 30 ++++++++++++++++++++---------- 5 files changed, 31 insertions(+), 20 deletions(-) (limited to 'jb/views/auth.py') diff --git a/jb/api/magic_token.py b/jb/api/magic_token.py index 910dc12..b60d5e9 100644 --- a/jb/api/magic_token.py +++ b/jb/api/magic_token.py @@ -9,7 +9,7 @@ from jb.models.auth import AmtAccountLink MAGIC_TOKEN_PREFIX = "auth:magic:" AMT_ACCOUNT_LINK_TOKEN_PREFIX = "auth:amt-account-link:" -MAGIC_TOKEN_TTL: int = 5 * 60 # 5 minutes, in seconds +MAGIC_TOKEN_TTL: int = 10 * 60 # 10 minutes, in seconds def redis_token_key(token: str, prefix: str = MAGIC_TOKEN_PREFIX) -> str: diff --git a/jb/main.py b/jb/main.py index 9f4f000..e30bb38 100644 --- a/jb/main.py +++ b/jb/main.py @@ -22,6 +22,7 @@ app = FastAPI( version="1.0.0", ) + app.add_middleware( CORSMiddleware, allow_origins=["*"], diff --git a/jb/managers/email_manager.py b/jb/managers/email_manager.py index 78acc9d..7298c60 100644 --- a/jb/managers/email_manager.py +++ b/jb/managers/email_manager.py @@ -10,8 +10,7 @@ assert settings.mautic_api_key auth_headers = {"Authorization": f"Basic {settings.mautic_api_key.get_secret_value()}"} -def get_or_create_contact(email: str, amt_worker_id: str | None = None): - # amt_worker_id = "A2Z2FRA128FNW" +def get_or_create_contact(email: str, amt_worker_id: str | None = None) -> int: body = {"email": email} if amt_worker_id: body["amt_worker_id"] = amt_worker_id @@ -20,8 +19,7 @@ def get_or_create_contact(email: str, amt_worker_id: str | None = None): json=body, headers=auth_headers, ).json() - contact_id = res["contact"]["id"] - return contact_id + return int(res["contact"]["id"]) def send_login_email_from_url(mautic_url: str, magic_link: str) -> None: @@ -34,6 +32,7 @@ def send_login_email_from_url(mautic_url: str, magic_link: str) -> None: } body = {"tokens": email_tokens} response = requests.post(url=mautic_url, json=body, headers=auth_headers) + try: response.raise_for_status() except requests.exceptions.HTTPError: @@ -41,20 +40,21 @@ def send_login_email_from_url(mautic_url: str, magic_link: str) -> None: print(response.text) raise d = response.json() + assert d.get("success"), f"Failed to send email: {d.get('failed')}" print("Email sent successfully") -def send_login_email(email: str, magic_token: str): +def send_login_email(email: str, magic_token: str) -> None: contact_id = get_or_create_contact(email=email) mautic_url = ( f"{MAUTIC_BASE_URL}/api/emails/{EMAIL_TEMPLATE_ID}/contact/{contact_id}/send" ) magic_link = f"{settings.base_url}auth/magic-link/?token={magic_token}" - return send_login_email_from_url(mautic_url, magic_link) + send_login_email_from_url(mautic_url, magic_link) -def send_amt_link_email(email: str, magic_token: str): +def send_amt_link_email(email: str, magic_token: str) -> None: # Don't actually associate the email with the worker ID # until they click the link contact_id = get_or_create_contact(email=email) @@ -62,4 +62,4 @@ def send_amt_link_email(email: str, magic_token: str): f"{MAUTIC_BASE_URL}/api/emails/{EMAIL_TEMPLATE_ID}/contact/{contact_id}/send" ) magic_link = f"{settings.base_url}auth/link-amt/?token={magic_token}" - return send_login_email_from_url(mautic_url, magic_link) + send_login_email_from_url(mautic_url, magic_link) diff --git a/jb/settings.py b/jb/settings.py index a425b31..1c02075 100644 --- a/jb/settings.py +++ b/jb/settings.py @@ -52,7 +52,7 @@ class Settings(GRLBaseSettings): sns_path: str | None = Field(default=None) - session_token_ttl_seconds: int = Field(default=30 * 24 * 60 * 60, gt=0) + session_token_ttl_seconds: int = Field(default=30 * 24 * 60 * 60, gt=0) # 30 days session_jwt_secret: SecretStr | None = Field(default=None, min_length=32) magic_token_salt: SecretStr | None = Field(default=None, min_length=32) diff --git a/jb/views/auth.py b/jb/views/auth.py index 44fef10..bf39b51 100644 --- a/jb/views/auth.py +++ b/jb/views/auth.py @@ -2,7 +2,7 @@ from typing import Annotated from urllib.parse import urlencode from fastapi import APIRouter, Depends, HTTPException, Response, status -from fastapi.responses import HTMLResponse, RedirectResponse +from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse from jb.api.auth import ( SESSION_COOKIE_NAME, @@ -103,6 +103,12 @@ def link_amt_account(body: AmtAccountLink) -> dict[str, str]: """Link an AMT account and login.""" email = str(body.email) amt_worker_id = body.amt_worker_id + + # TODO! Prevent a user that's already transitioned their account, from being + # TODO! able to continuously create this special link token. + # TODO! Max Notes: this seems to be handled within the gr-api, and that + # TODO! can raise, the following line would / should fail if needed. + token = create_amt_account_link_token(email=email, amt_worker_id=amt_worker_id) if settings.debug: @@ -110,7 +116,7 @@ def link_amt_account(body: AmtAccountLink) -> dict[str, str]: return {"magic_link": f"{settings.base_url}auth/link-amt/?{query}"} send_amt_link_email(email=email, magic_token=token) - return {"detail": "Link sent. Check your inbox and follow the link to log in."} + return {} @auth_router.get("/link-amt/", response_class=HTMLResponse, include_in_schema=False) @@ -119,14 +125,18 @@ def link_amt_account_landing_page( token: str | None = None, ) -> HTMLResponse: """Serve the account-link SPA without consuming the one-time token.""" - if settings.debug: - if token is None: - raise HTTPException( - status_code=status.HTTP_400_BAD_REQUEST, - detail="token is required", - ) - response = RedirectResponse(url="/", status_code=status.HTTP_303_SEE_OTHER) - _exchange_amt_account_link(token, response, gr_api) + + # TODO! Try catch any of this, and if it fails, show the user a + # TODO! failed HTML page. As of now, it shows them a failed JSON response. + + if token is None: + raise HTTPException( + status_code=status.HTTP_400_BAD_REQUEST, + detail="token is required", + ) + _response = RedirectResponse(url="/", status_code=status.HTTP_303_SEE_OTHER) + _exchange_amt_account_link(token=token, response=_response, gr_api=gr_api) + return HTMLResponse( BASE_HTML, headers={ -- cgit v1.2.3 From 11d63b171501b9c29398133b795c3bcc1ae85a1b Mon Sep 17 00:00:00 2001 From: Max Nanis Date: Fri, 11 Sep 2026 18:16:06 -0700 Subject: using RTK with session login. start of magic token request --- jb-ui/.vscode/settings.json | 2 +- jb-ui/src/AuthContext.tsx | 28 ++++++++++++ jb-ui/src/JBApp.tsx | 4 +- jb-ui/src/models/authAPI.ts | 23 ++++++++++ jb-ui/src/pages/Work.tsx | 103 ++++++++++++++++++++++++++++++++++++++++---- jb-ui/src/store.ts | 5 +++ jb/views/auth.py | 20 +++++---- 7 files changed, 164 insertions(+), 21 deletions(-) create mode 100644 jb-ui/src/AuthContext.tsx create mode 100644 jb-ui/src/models/authAPI.ts (limited to 'jb/views/auth.py') diff --git a/jb-ui/.vscode/settings.json b/jb-ui/.vscode/settings.json index 4257030..9b8250c 100644 --- a/jb-ui/.vscode/settings.json +++ b/jb-ui/.vscode/settings.json @@ -10,6 +10,6 @@ "editor.formatOnSave": true }, "editor.codeActionsOnSave": { - "source.fixAll.eslint": true + "source.fixAll.eslint": "explicit" } } \ No newline at end of file diff --git a/jb-ui/src/AuthContext.tsx b/jb-ui/src/AuthContext.tsx new file mode 100644 index 0000000..85bcdb0 --- /dev/null +++ b/jb-ui/src/AuthContext.tsx @@ -0,0 +1,28 @@ +// AuthContext.jsx +import { createContext, useContext, useEffect, useState } from "react"; + +const AuthContext = createContext(null); + +export function AuthProvider({ children }) { + const [user, setUser] = useState(null); + const [loading, setLoading] = useState(true); + + useEffect(() => { + fetch("/api/me", { credentials: "include" }) + .then((res) => (res.ok ? res.json() : null)) + .then(setUser) + .finally(() => setLoading(false)); + }, []); + + return ( + + {children} + + ); +} + +export function useAuth() { + return useContext(AuthContext); +} diff --git a/jb-ui/src/JBApp.tsx b/jb-ui/src/JBApp.tsx index 7c99315..fd0eeba 100644 --- a/jb-ui/src/JBApp.tsx +++ b/jb-ui/src/JBApp.tsx @@ -225,10 +225,10 @@ function JBApp() { return ( - } /> }> }> - } /> + } /> + } /> {/* } /> */} } /> diff --git a/jb-ui/src/models/authAPI.ts b/jb-ui/src/models/authAPI.ts new file mode 100644 index 0000000..1ac7886 --- /dev/null +++ b/jb-ui/src/models/authAPI.ts @@ -0,0 +1,23 @@ +import { createApi, fetchBaseQuery } from "@reduxjs/toolkit/query/react"; + +export const authApi = createApi({ + reducerPath: "authApi", + baseQuery: fetchBaseQuery({ + baseUrl: "/auth", + credentials: "include", // sends the httpOnly cookie + }), + tagTypes: ["User"], + endpoints: (builder) => ({ + getMe: builder.query({ + query: () => "/session", + providesTags: ["User"], + }), + // logout: builder.mutation({ + // query: () => ({ url: "/de-session", method: "POST" }), + // invalidatesTags: ["User"], + // }), + }), +}); + +// export const { useGetMeQuery, useLogoutMutation } = authApi; +export const { useGetMeQuery } = authApi; diff --git a/jb-ui/src/pages/Work.tsx b/jb-ui/src/pages/Work.tsx index 32dcc96..e33328e 100644 --- a/jb-ui/src/pages/Work.tsx +++ b/jb-ui/src/pages/Work.tsx @@ -1,3 +1,4 @@ +import { useGetMeQuery } from "@/models/authAPI"; import { BucketTask, OfferwallApi, @@ -828,17 +829,101 @@ const SurveyEnter = () => { ); }; +type RequestState = "idle" | "working" | "sent" | "failed"; + +const Login = () => { + const [email, setEmail] = useState(""); + const [state, setState] = useState("idle"); + const bpuid = useAppSelector((state) => state.app.bpuid); + + // const dispatch = useAppDispatch(); + const submit = async (event: FormEvent) => { + event.preventDefault(); + setState("working"); + + try { + const response = await fetch("/auth/magic-link/request", { + method: "POST", + credentials: "include", + headers: { "Content-Type": "application/json" }, + body: JSON.stringify({ + email: email, + }), + }); + + if (!response.ok) throw new Error("Account-link request failed"); + + const body = (await response.json()) as { magic_link?: string }; + console.log(body.magic_link ?? null); + } catch { + setState("failed"); + } + }; + + return ( +
+

+ Please Login +

+ +
+ setEmail(event.target.value)} + placeholder="hello@jamesbillings67.com" + /> + +
+ + {state === "sent" && ( +

+ Check your email to login. +

+ )} + + {state === "failed" &&

Unable to send the link. Please try again.

} +
+ ); +}; + const Work = () => { const entered = useAppSelector((state) => state.app.currentBucketEntered); - const assignment_id = useAppSelector((state) => state.app.assignment_id); - - if (!assignment_id) { - return ( -

- No Assignment ID found. Please access this page through the Amazon - Mechanical Turk platform. -

- ); + // const assignment_id = useAppSelector((state) => state.app.assignment_id); + // if (!assignment_id) { + // return ( + //

+ // No Assignment ID found. Please access this page through the Amazon + // Mechanical Turk platform. + //

+ // ); + // } + + const { data: user, isLoading, isError } = useGetMeQuery(); + // const location = useLocation(); + + if (isLoading) return
Loading...
; + + if (isError || !user) { + return ; } return <>{entered ? : }; diff --git a/jb-ui/src/store.ts b/jb-ui/src/store.ts index 07cac9e..baf13b7 100644 --- a/jb-ui/src/store.ts +++ b/jb-ui/src/store.ts @@ -1,6 +1,8 @@ import appReducers from "@/models/appSlice"; import grlStatsReducers from "@/models/grlStatsSlice"; import grlEventsReducers from "@/models/grlEventsSlice"; +import { authApi } from "@/models/authAPI"; + import profilingQuestionsReducers from "@/models/profilingQuestionsSlice"; import type { Action, ThunkAction } from "@reduxjs/toolkit"; import { configureStore } from "@reduxjs/toolkit"; @@ -8,10 +10,13 @@ import { configureStore } from "@reduxjs/toolkit"; export const store = configureStore({ reducer: { app: appReducers, + // auth: authReducers, + [authApi.reducerPath]: authApi.reducer, stats: grlStatsReducers, events: grlEventsReducers, profilingQuestions: profilingQuestionsReducers, }, + middleware: (getDefault) => getDefault().concat(authApi.middleware), }); // Infer the type of `store` diff --git a/jb/views/auth.py b/jb/views/auth.py index bf39b51..ce9c1e0 100644 --- a/jb/views/auth.py +++ b/jb/views/auth.py @@ -2,7 +2,7 @@ from typing import Annotated from urllib.parse import urlencode from fastapi import APIRouter, Depends, HTTPException, Response, status -from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse +from fastapi.responses import HTMLResponse, RedirectResponse from jb.api.auth import ( SESSION_COOKIE_NAME, @@ -119,7 +119,7 @@ def link_amt_account(body: AmtAccountLink) -> dict[str, str]: return {} -@auth_router.get("/link-amt/", response_class=HTMLResponse, include_in_schema=False) +@auth_router.get("/debug/", response_class=HTMLResponse, include_in_schema=False) def link_amt_account_landing_page( gr_api: Annotated[GRApiManager, Depends(get_gr_api_manager)], token: str | None = None, @@ -129,13 +129,15 @@ def link_amt_account_landing_page( # TODO! Try catch any of this, and if it fails, show the user a # TODO! failed HTML page. As of now, it shows them a failed JSON response. - if token is None: - raise HTTPException( - status_code=status.HTTP_400_BAD_REQUEST, - detail="token is required", - ) - _response = RedirectResponse(url="/", status_code=status.HTTP_303_SEE_OTHER) - _exchange_amt_account_link(token=token, response=_response, gr_api=gr_api) + if settings.debug: + if token is None: + raise HTTPException( + status_code=status.HTTP_400_BAD_REQUEST, + detail="token is required", + ) + + _response = RedirectResponse(url="/", status_code=status.HTTP_303_SEE_OTHER) + _exchange_amt_account_link(token=token, response=_response, gr_api=gr_api) return HTMLResponse( BASE_HTML, -- cgit v1.2.3