Skip to content
This repository was archived by the owner on Jan 1, 2026. It is now read-only.

Comments

Secure registration and add login with and without OTP#7

Merged
Vianpyro merged 51 commits intomainfrom
feature/secure_registration_add_login
Jun 22, 2025
Merged

Secure registration and add login with and without OTP#7
Vianpyro merged 51 commits intomainfrom
feature/secure_registration_add_login

Conversation

@Vianpyro
Copy link
Member

@Vianpyro Vianpyro commented Jun 12, 2025

Description

This pull request introduces significant improvements to the user authentication and registration system. The registration flow now enforces email verification before user creation and supports 2FA (OTP). Various code enhancements were made for clarity, consistency, and maintainability.

Changes Made

  • Refactored user registration to use PostgreSQL stored procedure and sanitize username input.
  • Replaced UserCreate schema with UserRegister for clarity and alignment with the new flow.
  • Moved sanitize_username to string_utils and removed username.py.
  • Added HTTPException handling for existing users during registration.
  • Added descriptive docstring to the user registration endpoint.
  • Renamed language_id to language_iso_code in the User model for clarity.
  • Renamed language_iso_code to language_id in model and schema for consistency.
  • Implemented email confirmation flow and login endpoint.
  • Enhanced login endpoint with improved response structure.
  • Implemented OTP-based 2FA login and registration enhancements for OTP secret generation.
  • Moved in-memory store declaration to a more appropriate location for clarity.
  • Updated SQLAlchemy engine initialization for better performance (echo=False, pool_pre_ping=True).
  • Changed registration flow to require email confirmation before creating the user account.

How to Test

  1. Register a new user using the registration endpoint.
  2. Check your email for a confirmation link and confirm the account.
  3. Attempt to log in using the confirmed account credentials.
  4. If 2FA is enabled, provide the OTP when prompted.
  5. Verify that the login flow completes successfully and that invalid or unconfirmed users are appropriately blocked.

Checklist

  • My code follows the project's coding style.
  • I have performed a self-review of my code.
  • I have added necessary tests (if applicable).
  • I have documented my changes (if necessary).

Additional Context

These updates are foundational for enforcing stronger security in the authentication process, including email verification and 2FA. The code has been refactored to improve modularity and clarity, especially in schema and utility functions.

@Vianpyro Vianpyro self-assigned this Jun 12, 2025
@Vianpyro Vianpyro added type: feature Requests for new functionality or features. complexity: complex Tasks with unclear paths that need exploration or experimentation. priority: high Important tasks that require immediate attention. special: breaking change Tasks that will introduce a breaking change and require careful implementation. status: needs review Ready for code or design review. type: configuration Changes or updates to configuration files or settings. type: refactor Improvements to existing code without changing functionality. type: secrets management Issues related to securing or managing secrets, tokens, and environment variables. type: security Issues or improvements related to app security. labels Jun 12, 2025
Vianpyro and others added 28 commits June 12, 2025 18:44
…w fixtures and tests for email and phone encryption, hashing, and verification token generation.
…directly and remove utility functions for versioned requests.
…oints; add utility functions for token creation and hashing.
… add payload generation fixtures for login and OTP tests
…and remove unnecessary fields from login payloads in schemas and tests.
@Vianpyro Vianpyro merged commit d9c3b7e into main Jun 22, 2025
13 of 15 checks passed
@Vianpyro Vianpyro deleted the feature/secure_registration_add_login branch June 22, 2025 11:51
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

complexity: complex Tasks with unclear paths that need exploration or experimentation. priority: high Important tasks that require immediate attention. special: breaking change Tasks that will introduce a breaking change and require careful implementation. status: needs review Ready for code or design review. type: configuration Changes or updates to configuration files or settings. type: feature Requests for new functionality or features. type: refactor Improvements to existing code without changing functionality. type: secrets management Issues related to securing or managing secrets, tokens, and environment variables. type: security Issues or improvements related to app security.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant