127 lines
3.8 KiB
Python
127 lines
3.8 KiB
Python
"""Giriş / kayıt / çıkış — düz kullanıcılar ve admin'ler."""
|
||
from flask import (
|
||
Blueprint,
|
||
flash,
|
||
redirect,
|
||
render_template,
|
||
request,
|
||
session,
|
||
url_for,
|
||
)
|
||
from werkzeug.security import check_password_hash, generate_password_hash
|
||
|
||
import security
|
||
from db import get_db
|
||
|
||
auth_bp = Blueprint("auth", __name__)
|
||
|
||
MIN_PASSWORD = 8
|
||
|
||
|
||
@auth_bp.get("/giris")
|
||
def login_page():
|
||
return render_template("login.html")
|
||
|
||
|
||
def _try_admin(username, password):
|
||
cfg = security.load_server_config()
|
||
for adm in cfg["admins"]:
|
||
if username.lower() == adm["username"].lower():
|
||
if check_password_hash(adm["password_hash"], password):
|
||
return adm
|
||
return None
|
||
|
||
|
||
@auth_bp.post("/giris")
|
||
@security.rate_limited("auth", 10, 900)
|
||
def do_login():
|
||
username = security.clean_text(request.form.get("username"), 64)
|
||
password = request.form.get("password", "")
|
||
|
||
if not username or not password:
|
||
flash("Kullanıcı adı ve şifre gerekli.", "error")
|
||
return redirect(url_for("auth.login_page"))
|
||
|
||
adm = _try_admin(username, password)
|
||
if adm is not None:
|
||
session.clear()
|
||
session["role"] = "admin"
|
||
session["admin_name"] = adm["display_name"]
|
||
session.permanent = True
|
||
flash(f"Hoş geldiniz, {adm['display_name']}.", "success")
|
||
return redirect(url_for("projects.admin_panel"))
|
||
|
||
db = get_db()
|
||
user = db.execute(
|
||
"SELECT * FROM users WHERE username = ? COLLATE NOCASE", (username,)
|
||
).fetchone()
|
||
if user is None or not check_password_hash(user["password_hash"], password):
|
||
flash("Kullanıcı adı veya şifre hatalı.", "error")
|
||
return redirect(url_for("auth.login_page"))
|
||
|
||
session.clear()
|
||
session["user_id"] = user["id"]
|
||
session["name"] = user["display_name"]
|
||
session.permanent = True
|
||
flash(f"Tekrar hoş geldiniz, {user['display_name']}.", "success")
|
||
return redirect(url_for("index"))
|
||
|
||
|
||
@auth_bp.get("/kayit")
|
||
def kayit():
|
||
if session.get("user_id"):
|
||
return redirect(url_for("index"))
|
||
return render_template("register.html")
|
||
|
||
|
||
@auth_bp.post("/kayit")
|
||
@security.rate_limited("register", 8, 3600)
|
||
def do_register():
|
||
username = security.validate_username(request.form.get("username"))
|
||
name = security.clean_text(request.form.get("display_name"), 100)
|
||
password = request.form.get("password", "")
|
||
confirm = request.form.get("password_confirm", "")
|
||
|
||
if not username:
|
||
flash("Kullanıcı adı 3-32 karakter olmalı (harfler, rakamlar, . _ -).", "error")
|
||
return redirect(url_for("auth.kayit"))
|
||
if not name:
|
||
flash("Ad Soyad zorunlu.", "error")
|
||
return redirect(url_for("auth.kayit"))
|
||
if len(password) < MIN_PASSWORD:
|
||
flash("Şifre en az 8 karakter olmalı.", "error")
|
||
return redirect(url_for("auth.kayit"))
|
||
if password != confirm:
|
||
flash("Şifreler eşleşmiyor.", "error")
|
||
return redirect(url_for("auth.kayit"))
|
||
|
||
db = get_db()
|
||
exists = db.execute(
|
||
"SELECT 1 FROM users WHERE username = ? COLLATE NOCASE", (username,)
|
||
).fetchone()
|
||
if exists:
|
||
flash("Bu kullanıcı adı zaten kullanılıyor.", "error")
|
||
return redirect(url_for("auth.kayit"))
|
||
|
||
db.execute(
|
||
"INSERT INTO users (username, display_name, password_hash) VALUES (?, ?, ?)",
|
||
(username, name, generate_password_hash(password, method="pbkdf2:sha256")),
|
||
)
|
||
db.commit()
|
||
|
||
uid = db.execute(
|
||
"SELECT id FROM users WHERE username = ? COLLATE NOCASE", (username,)
|
||
).fetchone()["id"]
|
||
session.clear()
|
||
session["user_id"] = uid
|
||
session["name"] = name
|
||
session.permanent = True
|
||
flash("Hesabınız oluşturuldu.", "success")
|
||
return redirect(url_for("index"))
|
||
|
||
|
||
@auth_bp.post("/cikis")
|
||
def cikis():
|
||
session.clear()
|
||
flash("Çıkış yapıldı.", "info")
|
||
return redirect(url_for("index")) |