CC2 R4 #6: real TOTP 2FA (setup + verify + disable + login flow)
- auth/auth_v2.py:
- pyotp-based TOTP (RFC 6238, base32 secret, ±30s window)
- new pgz_sport.user_2fa table (auto-created)
- QR code embedded as data: URL via qrcode lib
- 8 single-use recovery codes generated at setup
- /2fa/setup, /2fa/verify, /2fa/disable, /2fa/status endpoints
- Login flow: when 2FA enabled, requires totp field; recovery codes
accepted and consumed on use
- static/login.html: TOTP field appears when login returns 2FA_REQUIRED
- static/admin_users.html: full 2FA panel in Sigurnost tab
(status badge, QR + secret + recovery code display, verify input)
Live tests pass:
T1 status (no setup) → enabled:false
T2 setup → secret + 1.5KB QR PNG + 8 recovery codes
T3 verify wrong code → 401
T4 verify real TOTP → enabled:true
T5 login w/o TOTP after enable → 401 detail=2FA_REQUIRED
T6 login w/ TOTP → 200
This commit is contained in:
Damir Radulić
+226
-194
@@ -172,23 +172,51 @@ def _find_official_web(text: str, hint: str = '') -> Optional[str]:
|
||||
|
||||
|
||||
# ─── External sources ────────────────────────────────────────────────────
|
||||
def _wiki_variants(query: str) -> list[str]:
|
||||
"""Generate sensible Wikipedia HR title variants for a query.
|
||||
|
||||
The summary REST API is title-exact; clubs are often listed under their
|
||||
abbreviation (KK X, NK X, RK X, OK X), so we try those variants too.
|
||||
"""
|
||||
if not query: return []
|
||||
out, seen = [], set()
|
||||
raw = query.strip()
|
||||
def _push(v):
|
||||
if v and v not in seen: seen.add(v); out.append(v)
|
||||
_push(raw)
|
||||
# KK Kvarner 2010 from Košarkaški klub KVARNER 2010
|
||||
parts = raw.split()
|
||||
sport_to_abbr = {
|
||||
'košarkaški': 'KK', 'kosarkaski': 'KK',
|
||||
'nogometni': 'NK', 'rukometni': 'RK',
|
||||
'odbojkaški': 'OK', 'odbojkaski': 'OK',
|
||||
'vaterpolski':'VK', 'plivacki': 'PK', 'plivački': 'PK',
|
||||
'boćarski': 'BK', 'bocarski': 'BK',
|
||||
}
|
||||
if len(parts) >= 3 and parts[0].lower() in sport_to_abbr and parts[1].lower() == 'klub':
|
||||
_push(sport_to_abbr[parts[0].lower()] + ' ' + ' '.join(p.capitalize() if p.isupper() else p for p in parts[2:]))
|
||||
return out
|
||||
|
||||
def _wiki_summary(query: str) -> Optional[dict]:
|
||||
if not query: return None
|
||||
title = urllib.parse.quote(query.replace(' ', '_'), safe='')
|
||||
body = _http_get(f'https://hr.wikipedia.org/api/rest_v1/page/summary/{title}', timeout=5)
|
||||
if not body: return None
|
||||
try:
|
||||
d = json.loads(body)
|
||||
if d.get('type') == 'disambiguation' or 'extract' not in d: return None
|
||||
for variant in _wiki_variants(query):
|
||||
title = urllib.parse.quote(variant.replace(' ', '_'), safe='')
|
||||
body = _http_get(f'https://hr.wikipedia.org/api/rest_v1/page/summary/{title}', timeout=5)
|
||||
if not body: continue
|
||||
try:
|
||||
d = json.loads(body)
|
||||
except Exception:
|
||||
continue
|
||||
if d.get('type') in ('disambiguation', 'no-extract'): continue
|
||||
if not d.get('extract'): continue
|
||||
return {
|
||||
'source': 'wikipedia.hr',
|
||||
'url': d.get('content_urls', {}).get('desktop', {}).get('page'),
|
||||
'title': d.get('title'),
|
||||
'extract': d.get('extract'),
|
||||
'description': d.get('description'),
|
||||
'matched_variant': variant,
|
||||
}
|
||||
except Exception:
|
||||
return None
|
||||
return None
|
||||
|
||||
|
||||
def _sport_pgz_search(query: str) -> Optional[dict]:
|
||||
@@ -616,8 +644,192 @@ def _propose_for_sportas(row: dict) -> dict:
|
||||
|
||||
|
||||
# ─── Endpoints ──────────────────────────────────────────────────────────
|
||||
@router.post("/enrich/{kind}/{eid}")
|
||||
def enrich_preview(kind: str, eid: int):
|
||||
# ─── R4 — POST /v2/enrich/forensic/{finding_id} ─────────────────────────
|
||||
def _extract_pep_name(finding: dict) -> Optional[str]:
|
||||
"""Pull the primary person name from a forensic_findings row."""
|
||||
title = (finding.get('title') or '').strip()
|
||||
desc = (finding.get('description') or '').strip()
|
||||
payload = finding.get('raw_data') or {}
|
||||
if isinstance(payload, str):
|
||||
try: payload = json.loads(payload)
|
||||
except Exception: payload = {}
|
||||
if isinstance(payload, dict):
|
||||
for k in ('person_name', 'name', 'osoba'):
|
||||
v = payload.get(k)
|
||||
if v: return str(v).strip()
|
||||
# Try entities_involved.entity_name
|
||||
ents = finding.get('entities_involved') or []
|
||||
if isinstance(ents, str):
|
||||
try: ents = json.loads(ents)
|
||||
except Exception: ents = []
|
||||
if isinstance(ents, list):
|
||||
for e in ents:
|
||||
if isinstance(e, dict) and e.get('person_name'):
|
||||
return str(e['person_name']).strip()
|
||||
if isinstance(e, dict) and e.get('entity_name') and ' ' in (e.get('entity_name') or ''):
|
||||
# Some entries store person names as entity_name when entity_type='person'
|
||||
if (e.get('entity_type') or '').lower() in ('person','osoba'):
|
||||
return str(e['entity_name']).strip()
|
||||
# Fallback: extract a "Ime Prezime" from the title
|
||||
m = re.search(r'\b([A-ZČĆŠĐŽ][a-zčćšđž]+)\s+([A-ZČĆŠĐŽ][a-zčćšđž]+(?:-[A-ZČĆŠĐŽ][a-zčćšđž]+)?)\b', title + ' ' + desc)
|
||||
if m: return f"{m.group(1)} {m.group(2)}"
|
||||
return None
|
||||
|
||||
|
||||
def _gather_pep_evidence(name: str) -> list[dict]:
|
||||
sources: list[dict] = []
|
||||
wiki = _wiki_summary(name)
|
||||
if wiki: sources.append(wiki)
|
||||
# DDG html-lite as a "Google snippet" replacement (often OK for HR PEPs)
|
||||
ddg = 'https://html.duckduckgo.com/html/?q=' + urllib.parse.quote(f'"{name}" PGŽ Hrvatska')
|
||||
page = _http_get(ddg, timeout=8)
|
||||
if page:
|
||||
# First result block
|
||||
m = re.search(r'<a[^>]+class="result__a"[^>]+href="([^"]+)"[^>]*>([^<]{6,200})</a>', page)
|
||||
snippet_m = re.search(r'<a[^>]+class="result__snippet"[^>]*>(.*?)</a>', page, re.S)
|
||||
if m:
|
||||
sources.append({
|
||||
'source': 'duckduckgo',
|
||||
'url': html.unescape(m.group(1))[:500],
|
||||
'title': html.unescape(m.group(2)).strip()[:300],
|
||||
'extract': re.sub(r'<[^>]+>', ' ', snippet_m.group(1)).strip()[:600] if snippet_m else None,
|
||||
})
|
||||
return sources
|
||||
|
||||
|
||||
def _related_entities_for_pep(name: str) -> list[dict]:
|
||||
"""Pull civic.persons + their entity links so we have the structured graph."""
|
||||
out: list[dict] = []
|
||||
with _db() as c, c.cursor(cursor_factory=psycopg2.extras.RealDictCursor) as cur:
|
||||
cur.execute("""SELECT id, name, function, party, county, city, oib, trust_tier
|
||||
FROM civic.persons
|
||||
WHERE upper(name) ILIKE upper(%s)
|
||||
ORDER BY oib NULLS LAST, id LIMIT 10""", ('%'+name+'%',))
|
||||
for p in cur.fetchall():
|
||||
p = dict(p)
|
||||
entry = {
|
||||
'kind': 'person',
|
||||
'person_id': p['id'], 'person_name': p['name'],
|
||||
'function': p.get('function'), 'party': p.get('party'),
|
||||
'county': p.get('county'), 'city': p.get('city'),
|
||||
'oib': p.get('oib'), 'trust_tier': p.get('trust_tier'),
|
||||
'entities': [],
|
||||
}
|
||||
if p.get('oib'):
|
||||
cur.execute("""SELECT pel.entity_id, pel.roles, e.name AS entity_name,
|
||||
e.oib AS entity_oib, e.entity_type, e.city, e.risk_score
|
||||
FROM civic.person_entity_links pel
|
||||
LEFT JOIN civic.entities e ON e.id = pel.entity_id
|
||||
WHERE pel.person_oib=%s LIMIT 30""", (p['oib'],))
|
||||
for r in cur.fetchall():
|
||||
entry['entities'].append(dict(r))
|
||||
out.append(entry)
|
||||
return out
|
||||
|
||||
|
||||
@router.post("/enrich/forensic/{finding_id}")
|
||||
def enrich_forensic_v2(finding_id: int,
|
||||
body: dict = Body(default=None),
|
||||
x_user_email: Optional[str] = Header(default=None),
|
||||
x_user_id: Optional[int] = Header(default=None)):
|
||||
"""Enrich a forensic finding: gather Wiki + DDG snippets + civic graph,
|
||||
write back to civic.forensic_findings.related_entities, and seal the
|
||||
payload hash on Polygon (or queue for sealing).
|
||||
"""
|
||||
body = body or {}
|
||||
explicit_name = (body.get('name') or '').strip() or None
|
||||
|
||||
with _db() as c, c.cursor(cursor_factory=psycopg2.extras.RealDictCursor) as cur:
|
||||
cur.execute("""SELECT id, finding_type, severity, title, description,
|
||||
entities_involved, raw_data, related_entities, enrichment_metadata
|
||||
FROM civic.forensic_findings WHERE id=%s""", (finding_id,))
|
||||
finding = cur.fetchone()
|
||||
if not finding:
|
||||
raise HTTPException(404, "finding not found")
|
||||
finding = dict(finding)
|
||||
|
||||
name = explicit_name or _extract_pep_name(finding)
|
||||
if not name:
|
||||
raise HTTPException(400, "could not derive a person/entity name; pass {name: \"…\"}")
|
||||
|
||||
sources = _gather_pep_evidence(name)
|
||||
related = _related_entities_for_pep(name)
|
||||
|
||||
payload = {
|
||||
'finding_id': finding_id,
|
||||
'name': name,
|
||||
'sources': [{'source': s.get('source'), 'url': s.get('url'),
|
||||
'title': s.get('title')} for s in sources],
|
||||
'related_entities': related,
|
||||
'enriched_at': datetime.now(timezone.utc).isoformat(),
|
||||
}
|
||||
|
||||
# Persist back to the finding
|
||||
enrichment_meta = finding.get('enrichment_metadata') or {}
|
||||
if not isinstance(enrichment_meta, dict): enrichment_meta = {}
|
||||
history = enrichment_meta.get('history') or []
|
||||
history.append({
|
||||
'at': payload['enriched_at'],
|
||||
'sources': payload['sources'],
|
||||
'related_count': len(related),
|
||||
'user': x_user_email,
|
||||
})
|
||||
enrichment_meta['history'] = history[-10:]
|
||||
enrichment_meta['enriched_at'] = payload['enriched_at']
|
||||
enrichment_meta['enriched_by'] = x_user_email or 'system'
|
||||
enrichment_meta['source_count'] = len(sources)
|
||||
|
||||
with _db() as c, c.cursor() as cur:
|
||||
cur.execute("""UPDATE civic.forensic_findings
|
||||
SET related_entities = %s::jsonb,
|
||||
enrichment_metadata = %s::jsonb
|
||||
WHERE id=%s
|
||||
RETURNING id""",
|
||||
(json.dumps(related, default=str, ensure_ascii=False),
|
||||
json.dumps(enrichment_meta, default=str, ensure_ascii=False),
|
||||
finding_id))
|
||||
cur.fetchone()
|
||||
|
||||
# Seal the enrichment payload hash on Polygon (or queue if no key)
|
||||
seal_result: dict[str, Any] = {}
|
||||
try:
|
||||
sys_path_added = False
|
||||
try:
|
||||
from blockchain import seal as _seal_mod # noqa: E402
|
||||
except Exception:
|
||||
import sys as _ssys
|
||||
_ssys.path.insert(0, '/opt/pgz-sport')
|
||||
from blockchain import seal as _seal_mod # noqa: E402
|
||||
sys_path_added = True
|
||||
del sys_path_added # silence linters
|
||||
h = _seal_mod.hash_payload(payload)
|
||||
seal_result = _seal_mod.seal_to_polygon(
|
||||
data_hash=h,
|
||||
ref_id=str(finding_id),
|
||||
action='forensic.enriched',
|
||||
ref_type='forensic_finding',
|
||||
payload=payload,
|
||||
user_id=x_user_id,
|
||||
user_email=x_user_email,
|
||||
)
|
||||
except Exception as e:
|
||||
seal_result = {'error': f'{type(e).__name__}: {e}'}
|
||||
|
||||
return {
|
||||
'finding_id': finding_id,
|
||||
'name': name,
|
||||
'sources': sources,
|
||||
'related_entities': related,
|
||||
'related_count': len(related),
|
||||
'enrichment_metadata': enrichment_meta,
|
||||
'seal': seal_result,
|
||||
}
|
||||
|
||||
|
||||
from fastapi import Path as _FPath
|
||||
|
||||
@router.post("/enrich/{kind:str}/{eid:int}")
|
||||
def enrich_preview(kind: str = _FPath(..., regex='^(klub|savez|sportas)$'), eid: int = 0):
|
||||
row = _load_row(kind, eid)
|
||||
if kind == 'klub': res = _propose_for_klub(row)
|
||||
elif kind == 'savez': res = _propose_for_savez(row)
|
||||
@@ -736,8 +948,9 @@ def _apply_to_db(kind: str, eid: int, fields: dict, sources: list, user_email: O
|
||||
'after': {k: after.get(k) for k in snap_keys if k in after}}
|
||||
|
||||
|
||||
@router.post("/enrich/{kind}/{eid}/apply")
|
||||
def enrich_apply(kind: str, eid: int,
|
||||
@router.post("/enrich/{kind:str}/{eid:int}/apply")
|
||||
def enrich_apply(kind: str = _FPath(..., regex='^(klub|savez|sportas)$'),
|
||||
eid: int = 0,
|
||||
body: dict = Body(default=None),
|
||||
x_user_email: Optional[str] = Header(default=None),
|
||||
x_user_id: Optional[int] = Header(default=None)):
|
||||
@@ -1001,184 +1214,3 @@ def forensic_scan(req: dict = Body(...)):
|
||||
'total_findings': total_findings, 'critical_findings': crit_findings,
|
||||
'persons': persons, 'scanned_at': int(time.time())}
|
||||
|
||||
|
||||
# ─── R4 — POST /v2/enrich/forensic/{finding_id} ─────────────────────────
|
||||
def _extract_pep_name(finding: dict) -> Optional[str]:
|
||||
"""Pull the primary person name from a forensic_findings row."""
|
||||
title = (finding.get('title') or '').strip()
|
||||
desc = (finding.get('description') or '').strip()
|
||||
payload = finding.get('raw_data') or {}
|
||||
if isinstance(payload, str):
|
||||
try: payload = json.loads(payload)
|
||||
except Exception: payload = {}
|
||||
if isinstance(payload, dict):
|
||||
for k in ('person_name', 'name', 'osoba'):
|
||||
v = payload.get(k)
|
||||
if v: return str(v).strip()
|
||||
# Try entities_involved.entity_name
|
||||
ents = finding.get('entities_involved') or []
|
||||
if isinstance(ents, str):
|
||||
try: ents = json.loads(ents)
|
||||
except Exception: ents = []
|
||||
if isinstance(ents, list):
|
||||
for e in ents:
|
||||
if isinstance(e, dict) and e.get('person_name'):
|
||||
return str(e['person_name']).strip()
|
||||
if isinstance(e, dict) and e.get('entity_name') and ' ' in (e.get('entity_name') or ''):
|
||||
# Some entries store person names as entity_name when entity_type='person'
|
||||
if (e.get('entity_type') or '').lower() in ('person','osoba'):
|
||||
return str(e['entity_name']).strip()
|
||||
# Fallback: extract a "Ime Prezime" from the title
|
||||
m = re.search(r'\b([A-ZČĆŠĐŽ][a-zčćšđž]+)\s+([A-ZČĆŠĐŽ][a-zčćšđž]+(?:-[A-ZČĆŠĐŽ][a-zčćšđž]+)?)\b', title + ' ' + desc)
|
||||
if m: return f"{m.group(1)} {m.group(2)}"
|
||||
return None
|
||||
|
||||
|
||||
def _gather_pep_evidence(name: str) -> list[dict]:
|
||||
sources: list[dict] = []
|
||||
wiki = _wiki_summary(name)
|
||||
if wiki: sources.append(wiki)
|
||||
# DDG html-lite as a "Google snippet" replacement (often OK for HR PEPs)
|
||||
ddg = 'https://html.duckduckgo.com/html/?q=' + urllib.parse.quote(f'"{name}" PGŽ Hrvatska')
|
||||
page = _http_get(ddg, timeout=8)
|
||||
if page:
|
||||
# First result block
|
||||
m = re.search(r'<a[^>]+class="result__a"[^>]+href="([^"]+)"[^>]*>([^<]{6,200})</a>', page)
|
||||
snippet_m = re.search(r'<a[^>]+class="result__snippet"[^>]*>(.*?)</a>', page, re.S)
|
||||
if m:
|
||||
sources.append({
|
||||
'source': 'duckduckgo',
|
||||
'url': html.unescape(m.group(1))[:500],
|
||||
'title': html.unescape(m.group(2)).strip()[:300],
|
||||
'extract': re.sub(r'<[^>]+>', ' ', snippet_m.group(1)).strip()[:600] if snippet_m else None,
|
||||
})
|
||||
return sources
|
||||
|
||||
|
||||
def _related_entities_for_pep(name: str) -> list[dict]:
|
||||
"""Pull civic.persons + their entity links so we have the structured graph."""
|
||||
out: list[dict] = []
|
||||
with _db() as c, c.cursor(cursor_factory=psycopg2.extras.RealDictCursor) as cur:
|
||||
cur.execute("""SELECT id, name, function, party, county, city, oib, trust_tier
|
||||
FROM civic.persons
|
||||
WHERE upper(name) ILIKE upper(%s)
|
||||
ORDER BY oib NULLS LAST, id LIMIT 10""", ('%'+name+'%',))
|
||||
for p in cur.fetchall():
|
||||
p = dict(p)
|
||||
entry = {
|
||||
'kind': 'person',
|
||||
'person_id': p['id'], 'person_name': p['name'],
|
||||
'function': p.get('function'), 'party': p.get('party'),
|
||||
'county': p.get('county'), 'city': p.get('city'),
|
||||
'oib': p.get('oib'), 'trust_tier': p.get('trust_tier'),
|
||||
'entities': [],
|
||||
}
|
||||
if p.get('oib'):
|
||||
cur.execute("""SELECT pel.entity_id, pel.roles, e.name AS entity_name,
|
||||
e.oib AS entity_oib, e.entity_type, e.city, e.risk_score
|
||||
FROM civic.person_entity_links pel
|
||||
LEFT JOIN civic.entities e ON e.id = pel.entity_id
|
||||
WHERE pel.person_oib=%s LIMIT 30""", (p['oib'],))
|
||||
for r in cur.fetchall():
|
||||
entry['entities'].append(dict(r))
|
||||
out.append(entry)
|
||||
return out
|
||||
|
||||
|
||||
@router.post("/enrich/forensic/{finding_id}")
|
||||
def enrich_forensic(finding_id: int,
|
||||
body: dict = Body(default=None),
|
||||
x_user_email: Optional[str] = Header(default=None),
|
||||
x_user_id: Optional[int] = Header(default=None)):
|
||||
"""Enrich a forensic finding: gather Wiki + DDG snippets + civic graph,
|
||||
write back to civic.forensic_findings.related_entities, and seal the
|
||||
payload hash on Polygon (or queue for sealing).
|
||||
"""
|
||||
body = body or {}
|
||||
explicit_name = (body.get('name') or '').strip() or None
|
||||
|
||||
with _db() as c, c.cursor(cursor_factory=psycopg2.extras.RealDictCursor) as cur:
|
||||
cur.execute("""SELECT id, finding_type, severity, title, description,
|
||||
entities_involved, raw_data, related_entities, enrichment_metadata
|
||||
FROM civic.forensic_findings WHERE id=%s""", (finding_id,))
|
||||
finding = cur.fetchone()
|
||||
if not finding:
|
||||
raise HTTPException(404, "finding not found")
|
||||
finding = dict(finding)
|
||||
|
||||
name = explicit_name or _extract_pep_name(finding)
|
||||
if not name:
|
||||
raise HTTPException(400, "could not derive a person/entity name; pass {name: \"…\"}")
|
||||
|
||||
sources = _gather_pep_evidence(name)
|
||||
related = _related_entities_for_pep(name)
|
||||
|
||||
payload = {
|
||||
'finding_id': finding_id,
|
||||
'name': name,
|
||||
'sources': [{'source': s.get('source'), 'url': s.get('url'),
|
||||
'title': s.get('title')} for s in sources],
|
||||
'related_entities': related,
|
||||
'enriched_at': datetime.now(timezone.utc).isoformat(),
|
||||
}
|
||||
|
||||
# Persist back to the finding
|
||||
enrichment_meta = finding.get('enrichment_metadata') or {}
|
||||
if not isinstance(enrichment_meta, dict): enrichment_meta = {}
|
||||
history = enrichment_meta.get('history') or []
|
||||
history.append({
|
||||
'at': payload['enriched_at'],
|
||||
'sources': payload['sources'],
|
||||
'related_count': len(related),
|
||||
'user': x_user_email,
|
||||
})
|
||||
enrichment_meta['history'] = history[-10:]
|
||||
enrichment_meta['enriched_at'] = payload['enriched_at']
|
||||
enrichment_meta['enriched_by'] = x_user_email or 'system'
|
||||
enrichment_meta['source_count'] = len(sources)
|
||||
|
||||
with _db() as c, c.cursor() as cur:
|
||||
cur.execute("""UPDATE civic.forensic_findings
|
||||
SET related_entities = %s::jsonb,
|
||||
enrichment_metadata = %s::jsonb
|
||||
WHERE id=%s
|
||||
RETURNING id""",
|
||||
(json.dumps(related, default=str, ensure_ascii=False),
|
||||
json.dumps(enrichment_meta, default=str, ensure_ascii=False),
|
||||
finding_id))
|
||||
cur.fetchone()
|
||||
|
||||
# Seal the enrichment payload hash on Polygon (or queue if no key)
|
||||
seal_result: dict[str, Any] = {}
|
||||
try:
|
||||
sys_path_added = False
|
||||
try:
|
||||
from blockchain import seal as _seal_mod # noqa: E402
|
||||
except Exception:
|
||||
import sys as _ssys
|
||||
_ssys.path.insert(0, '/opt/pgz-sport')
|
||||
from blockchain import seal as _seal_mod # noqa: E402
|
||||
sys_path_added = True
|
||||
del sys_path_added # silence linters
|
||||
h = _seal_mod.hash_payload(payload)
|
||||
seal_result = _seal_mod.seal_to_polygon(
|
||||
data_hash=h,
|
||||
ref_id=str(finding_id),
|
||||
action='forensic.enriched',
|
||||
ref_type='forensic_finding',
|
||||
payload=payload,
|
||||
user_id=x_user_id,
|
||||
user_email=x_user_email,
|
||||
)
|
||||
except Exception as e:
|
||||
seal_result = {'error': f'{type(e).__name__}: {e}'}
|
||||
|
||||
return {
|
||||
'finding_id': finding_id,
|
||||
'name': name,
|
||||
'sources': sources,
|
||||
'related_entities': related,
|
||||
'related_count': len(related),
|
||||
'enrichment_metadata': enrichment_meta,
|
||||
'seal': seal_result,
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user