RugMunchMedia/rmi-backend
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
rmi-backend/app/_archive/legacy_2026_07/auth_extensions.py
cryptorugmunch 628c1d2a10
Some checks failed
CI / build (push) Failing after 3s
Details
refactor(rmi-backend,audit): mount Wave 3 + archive 136 dead-code files (P2.3) 
PHASE 2.3 (AUDIT-2026-Q3.md):

Task 1 — Wire-in Wave 3 (1 router mounted, 2 deferred):
  - app.routers.unified_scanner_router mounted at /api/v2/scanner/* (2 routes:
    POST /api/v2/scanner/token/scan, POST /api/v2/scanner/wallet/scan).
    Refactored prefix from /api/v2 -> /api/v2/scanner to avoid future conflicts
    with the v1 /api/v1/scanner/ stub.
  - app.routers.unified_wallet_scanner DEFERRED (no router APIRouter attribute;
    library module consumed by unified_scanner_router via get_wallet_scanner()).
  - app.routers.admin_extensions DEFERRED (DORMANT per audit; 25 routes at
    /api/v1/admin/* would shadow /api/v1/admin/alerts_webhook).

Task 2 — Archive 136 dead-code files to app/_archive/legacy_2026_07/:
  - 73 routers in app/routers/ (reach graph showed zero reach into mount.py).
  - 63 flat app/*.py (domain modules never imported by live code).
  - 1 file RESTORED post-archive: app/routers/x402_bridge_health.py (caught by
    tests/unit/test_bridge_health.py which directly imports it; reach graph
    considered tests/ only as transitive reach — to be patched in next cycle).

Forced-LIVE (NOT archived per user directive):
  - app/ai_pipeline_v3.py  (3 importers in audit window, importers themselves DEAD)
  - app/splade_bm25.py       (LIVE via app.rag_service)
  - app/wallet_manager_v2.py (LIVE via x402_enforcement, x402_tools, sweep_all, sweep_now)
  - app/crypto_embeddings.py (NOT in audit ARCHIVE list; heavy import graph)

Verification (forward-import closure from mount.py + main.py + factory.py + lifespan.py):
  - imports = 348 app.* modules
  - reached = 194 files reachable from roots
  - archive set = audit_dead (186) - reached - forced_live (4) - test_live (1) = 136
  - Net delta: 136 files moved, 44,932 LOC reduction, 293->295 active routes (+2 from Wave 3)

pyproject.toml updates:
  - setuptools.packages.find: added exclude for app._archive*
  - ruff.extend-exclude: added "app/_archive/"
  - mypy.exclude: added "app/_archive/"

Smoke test: pytest tests/ — 817 passed, 3 pre-existing failures unchanged
(0 new failures; 0 routes lost; all 4 forced-LIVE files still importable).

Restoration: git mv app/_archive/legacy_2026_07/<name>.py <original-path>
and add the import to app/mount.py ROUTER_MODULES.

Refs: AUDIT-2026-Q3.md /home/dev/pry/rmi-final-deadcode-2026-07-06.md
2026-07-06 20:52:31 +02:00

595 lines
20 KiB
Python
Raw Permalink Blame History

"""
RMI Auth Extensions - Password Reset, Profile Management, Multi-Chain Wallets
=============================================================================
Adds to existing /root/backend/app/auth.py:
- Password reset via email token
- Password change (authenticated)
- Profile update (display name, email, avatar)
- Multi-chain wallet linking/unlinking
- Wallet signature verification for EVM, Solana, Tron, BTC, Monero
"""
import hashlib
import json
import logging
import os
import secrets
from datetime import datetime, timedelta
from fastapi import APIRouter, HTTPException, Request
from pydantic import BaseModel, EmailStr, Field
logger = logging.getLogger(__name__)
router = APIRouter(tags=["auth-ext"])
# ── Config ──
JWT_SECRET = os.getenv("JWT_SECRET", "rmi-jwt-secret-change-me")
JWT_ALGORITHM = "HS256"
RESET_TOKEN_EXPIRY_HOURS = 24
# ── Redis helper ──
# (These will be imported or we patch auth.py directly)
# ── Models ──
class ForgotPasswordRequest(BaseModel):
email: EmailStr
class ResetPasswordRequest(BaseModel):
token: str
new_password: str = Field(..., min_length=8)
class ChangePasswordRequest(BaseModel):
current_password: str
new_password: str = Field(..., min_length=8)
class UpdateProfileRequest(BaseModel):
display_name: str | None = None
avatar_url: str | None = None
class LinkWalletRequest(BaseModel):
address: str
chain: str
signature: str
message: str
class UnlinkWalletRequest(BaseModel):
address: str
chain: str
class WalletInfo(BaseModel):
address: str
chain: str
added_at: str
is_primary: bool = False
class ProfileResponse(BaseModel):
id: str
email: str
display_name: str
avatar_url: str | None = None
tier: str
role: str
wallets: list[WalletInfo]
created_at: str
xp: int = 0
level: int = 1
badges: list[str] = []
# ── Password Reset ──
@router.post("/forgot-password")
async def forgot_password(req: ForgotPasswordRequest):
"""Request password reset - sends email with reset token."""
from app.auth import _get_user_by_email
user = _get_user_by_email(req.email)
if not user:
# Return success even if email not found (prevents enumeration)
return {
"status": "ok",
"message": "If this email is registered, a reset link has been sent.",
}
# Generate reset token
reset_token = secrets.token_urlsafe(32)
token_hash = hashlib.sha256(reset_token.encode()).hexdigest()
# Store token in Redis with expiry
r = get_redis() # noqa: F821 -- pre-existing bug, see fix(f821) tracking issue
r.setex(f"rmi:password_reset:{token_hash}", timedelta(hours=RESET_TOKEN_EXPIRY_HOURS), user["id"])
# TODO: Send actual email via your email router
# For now, log it (replace with email service)
reset_url = f"https://rugmunch.io/reset-password?token={reset_token}"
logger.info(f"[PASSWORD RESET] Email={req.email} URL={reset_url}")
# If you have email_router.py:
try:
from app.email_router import send_email
await send_email(
to=req.email,
subject="RugMunch Intelligence - Password Reset",
body=f"Click to reset your password: {reset_url}\n\nThis link expires in 24 hours.\n\nIf you didn't request this, ignore this email.",
html=f"""
<html><body style="font-family:sans-serif;max-width:500px;margin:40px auto;">
<h2>Password Reset</h2>
<p>Click below to reset your RugMunch Intelligence password:</p>
<a href="{reset_url}" style="display:inline-block;padding:12px 24px;background:#6366f1;color:#fff;text-decoration:none;border-radius:6px;">Reset Password</a>
<p style="color:#666;font-size:12px;margin-top:20px;">Expires in 24 hours. Didn't request this? Ignore this email.</p>
</body></html>
""",
)
except Exception as e:
logger.warning(f"Email send failed: {e}")
return {"status": "ok", "message": "If this email is registered, a reset link has been sent."}
@router.post("/reset-password")
async def reset_password(req: ResetPasswordRequest):
"""Reset password using token from email."""
from app.auth import _get_user, _save_user, hash_password
token_hash = hashlib.sha256(req.token.encode()).hexdigest()
r = get_redis() # noqa: F821 -- pre-existing bug, see fix(f821) tracking issue
user_id = r.get(f"rmi:password_reset:{token_hash}")
if not user_id:
raise HTTPException(status_code=400, detail="Invalid or expired reset token")
user = _get_user(user_id)
if not user:
raise HTTPException(status_code=400, detail="Invalid or expired reset token")
# Update password
user["password_hash"] = hash_password(req.new_password)
user["updated_at"] = datetime.utcnow().isoformat()
_save_user(user)
# Delete used token
r.delete(f"rmi:password_reset:{token_hash}")
# Invalidate all existing sessions for this user
# (Optional: force re-login)
return {"status": "ok", "message": "Password updated successfully. Please log in again."}
# ── Change Password (Authenticated) ──
@router.post("/change-password")
async def change_password(req: ChangePasswordRequest, request: Request):
"""Change password while logged in."""
from app.auth import _save_user, get_current_user, hash_password, verify_password
user = await get_current_user(request)
if not user:
raise HTTPException(status_code=401, detail="Authentication required")
# Verify current password
if not user.get("password_hash"):
raise HTTPException(status_code=400, detail="No password set for this account")
if not verify_password(req.current_password, user["password_hash"]):
raise HTTPException(status_code=401, detail="Current password is incorrect")
# Update password
user["password_hash"] = hash_password(req.new_password)
user["updated_at"] = datetime.utcnow().isoformat()
_save_user(user)
return {"status": "ok", "message": "Password changed successfully"}
# ── Profile Management ──
@router.get("/profile", response_model=ProfileResponse)
async def get_profile(request: Request):
"""Get full user profile including linked wallets."""
from app.auth import get_current_user
user = await get_current_user(request)
if not user:
raise HTTPException(status_code=401, detail="Authentication required")
# Get linked wallets
r = get_redis() # noqa: F821 -- pre-existing bug, see fix(f821) tracking issue
wallets_raw = r.hget("rmi:user_wallets", user["id"])
wallets = json.loads(wallets_raw) if wallets_raw else []
return {
"id": user["id"],
"email": user["email"],
"display_name": user.get("display_name", user["email"]),
"avatar_url": user.get("avatar_url"),
"tier": user.get("tier", "FREE"),
"role": user.get("role", "USER"),
"wallets": wallets,
"created_at": user.get("created_at"),
"xp": user.get("xp", 0),
"level": user.get("level", 1),
"badges": user.get("badges", []),
}
@router.patch("/profile")
async def update_profile(req: UpdateProfileRequest, request: Request):
"""Update user profile (display name, avatar)."""
from app.auth import _save_user, get_current_user
user = await get_current_user(request)
if not user:
raise HTTPException(status_code=401, detail="Authentication required")
if req.display_name is not None:
user["display_name"] = req.display_name[:50] # Max 50 chars
if req.avatar_url is not None:
user["avatar_url"] = req.avatar_url[:500] # Max 500 chars
user["updated_at"] = datetime.utcnow().isoformat()
_save_user(user)
return {"status": "ok", "message": "Profile updated"}
# ── Multi-Chain Wallet Management ──
CHAIN_CONFIG = {
"ethereum": {"name": "Ethereum", "type": "evm", "chain_id": 1},
"base": {"name": "Base", "type": "evm", "chain_id": 8453},
"arbitrum": {"name": "Arbitrum", "type": "evm", "chain_id": 42161},
"optimism": {"name": "Optimism", "type": "evm", "chain_id": 10},
"polygon": {"name": "Polygon", "type": "evm", "chain_id": 137},
"bsc": {"name": "BSC", "type": "evm", "chain_id": 56},
"avalanche": {"name": "Avalanche", "type": "evm", "chain_id": 43114},
"fantom": {"name": "Fantom", "type": "evm", "chain_id": 250},
"solana": {"name": "Solana", "type": "solana"},
"tron": {"name": "Tron", "type": "tron"},
"bitcoin": {"name": "Bitcoin", "type": "btc"},
"monero": {"name": "Monero", "type": "xmr"},
"litecoin": {"name": "Litecoin", "type": "ltc"},
"dogecoin": {"name": "Dogecoin", "type": "doge"},
"ripple": {"name": "XRP", "type": "xrp"},
}
def verify_evm_signature(message: str, signature: str, address: str) -> bool:
"""Verify EVM (Ethereum, Base, BSC, etc.) signature."""
try:
from eth_account import Account
from eth_account.messages import encode_defunct
message_encoded = encode_defunct(text=message)
recovered = Account.recover_message(message_encoded, signature=signature)
return recovered.lower() == address.lower()
except Exception as e:
logger.warning(f"EVM signature verification failed: {e}")
return False
def verify_solana_signature(message: str, signature: str, address: str) -> bool:
"""Verify Solana signature."""
try:
import base58
import nacl.signing
pubkey = base58.b58decode(address)
sig = base58.b58decode(signature)
verify_key = nacl.signing.VerifyKey(pubkey)
verify_key.verify(message.encode(), sig)
return True
except Exception as e:
logger.warning(f"Solana signature verification failed: {e}")
return False
def verify_tron_signature(message: str, signature: str, address: str) -> bool:
"""Verify Tron signature (uses same curve as Ethereum)."""
try:
# Tron addresses start with T, need to convert to ETH format for verification
from eth_account import Account
from eth_account.messages import encode_defunct
# Basic Tron address validation
if not address.startswith("T") or len(address) != 34:
return False
# For Tron, we use the same ECDSA as Ethereum but address format differs
# In production, use tronpy or proper conversion
message_encoded = encode_defunct(text=message)
Account.recover_message(message_encoded, signature=signature)
# Convert recovered ETH address to Tron base58 (simplified)
# Full implementation needs tronpy
return True # Stub - replace with full Tron verification
except Exception as e:
logger.warning(f"Tron signature verification failed: {e}")
return False
def verify_btc_signature(message: str, signature: str, address: str) -> bool:
"""Verify Bitcoin signature."""
try:
# Use bitcoinlib or ecdsa for full verification
# This is a simplified stub
return len(signature) >= 20 and len(address) >= 26
except Exception as e:
logger.warning(f"BTC signature verification failed: {e}")
return False
def verify_monero_signature(message: str, signature: str, address: str) -> bool:
"""Verify Monero signature."""
try:
# Monero uses ed25519 + ring signatures
# Full verification requires monero-python or similar
return len(address) >= 95 and address.startswith("4")
except Exception as e:
logger.warning(f"Monero signature verification failed: {e}")
return False
def verify_wallet_signature_chain(message: str, signature: str, address: str, chain: str) -> bool:
"""Route signature verification to the correct chain handler."""
chain_lower = chain.lower()
config = CHAIN_CONFIG.get(chain_lower)
if not config:
logger.warning(f"Unknown chain for signature verification: {chain}")
return False
chain_type = config["type"]
if chain_type == "evm":
return verify_evm_signature(message, signature, address)
elif chain_type == "solana":
return verify_solana_signature(message, signature, address)
elif chain_type == "tron":
return verify_tron_signature(message, signature, address)
elif chain_type == "btc":
return verify_btc_signature(message, signature, address)
elif chain_type == "xmr":
return verify_monero_signature(message, signature, address)
else:
# Generic fallback
return len(signature) >= 60 and len(address) >= 20
@router.get("/wallet/chains")
async def list_supported_chains():
"""List all supported wallet chains for connection."""
return {
"chains": [
{
"id": k,
"name": v["name"],
"type": v["type"],
"chain_id": v.get("chain_id"),
}
for k, v in CHAIN_CONFIG.items()
]
}
@router.post("/wallet/link")
async def link_wallet(req: LinkWalletRequest, request: Request):
"""Link a new wallet to the user's account."""
from app.auth import _save_user, get_current_user
user = await get_current_user(request)
if not user:
raise HTTPException(status_code=401, detail="Authentication required")
# Validate chain
if req.chain.lower() not in CHAIN_CONFIG:
raise HTTPException(status_code=400, detail=f"Unsupported chain: {req.chain}")
# Verify signature
if not verify_wallet_signature_chain(req.message, req.signature, req.address, req.chain):
raise HTTPException(status_code=401, detail="Invalid wallet signature")
# Get existing wallets
r = get_redis() # noqa: F821 -- pre-existing bug, see fix(f821) tracking issue
wallets_key = "rmi:user_wallets"
wallets_raw = r.hget(wallets_key, user["id"])
wallets = json.loads(wallets_raw) if wallets_raw else []
# Check if already linked
for w in wallets:
if w["address"].lower() == req.address.lower() and w["chain"].lower() == req.chain.lower():
raise HTTPException(status_code=400, detail="Wallet already linked")
# Add wallet
is_primary = len(wallets) == 0
new_wallet = {
"address": req.address,
"chain": req.chain.lower(),
"added_at": datetime.utcnow().isoformat(),
"is_primary": is_primary,
}
wallets.append(new_wallet)
r.hset(wallets_key, user["id"], json.dumps(wallets))
# Update user's primary wallet if first
if is_primary:
user["wallet_address"] = req.address
user["wallet_chain"] = req.chain.lower()
_save_user(user)
return {"status": "ok", "wallet": new_wallet}
@router.post("/wallet/unlink")
async def unlink_wallet(req: UnlinkWalletRequest, request: Request):
"""Unlink a wallet from the user's account."""
from app.auth import _save_user, get_current_user
user = await get_current_user(request)
if not user:
raise HTTPException(status_code=401, detail="Authentication required")
r = get_redis() # noqa: F821 -- pre-existing bug, see fix(f821) tracking issue
wallets_key = "rmi:user_wallets"
wallets_raw = r.hget(wallets_key, user["id"])
wallets = json.loads(wallets_raw) if wallets_raw else []
# Find and remove
new_wallets = [
w
for w in wallets
if not (w["address"].lower() == req.address.lower() and w["chain"].lower() == req.chain.lower())
]
if len(new_wallets) == len(wallets):
raise HTTPException(status_code=404, detail="Wallet not found")
# Update primary if needed
if new_wallets and not any(w.get("is_primary") for w in new_wallets):
new_wallets[0]["is_primary"] = True
user["wallet_address"] = new_wallets[0]["address"]
user["wallet_chain"] = new_wallets[0]["chain"]
elif not new_wallets:
user["wallet_address"] = None
user["wallet_chain"] = None
r.hset(wallets_key, user["id"], json.dumps(new_wallets))
_save_user(user)
return {"status": "ok", "message": "Wallet unlinked"}
@router.get("/wallet/list")
async def list_wallets(request: Request):
"""List all wallets linked to the current user."""
from app.auth import get_current_user
user = await get_current_user(request)
if not user:
raise HTTPException(status_code=401, detail="Authentication required")
r = get_redis() # noqa: F821 -- pre-existing bug, see fix(f821) tracking issue
wallets_raw = r.hget("rmi:user_wallets", user["id"])
wallets = json.loads(wallets_raw) if wallets_raw else []
return {"wallets": wallets}
# ── Privacy Settings ──
class PrivacySettings(BaseModel):
show_email: bool = False
show_wallets: bool = False
show_xp_level: bool = True
show_badges: bool = True
allow_direct_messages: bool = True
profile_visibility: str = "public" # public, unlisted, private
@router.get("/privacy-settings")
async def get_privacy_settings(request: Request):
"""Get user privacy settings."""
from app.auth import get_current_user
user = await get_current_user(request)
if not user:
raise HTTPException(status_code=401, detail="Authentication required")
settings = user.get(
"privacy_settings",
{
"show_email": False,
"show_wallets": False,
"show_xp_level": True,
"show_badges": True,
"allow_direct_messages": True,
"profile_visibility": "public",
},
)
return {"settings": settings}
@router.patch("/privacy-settings")
async def update_privacy_settings(req: PrivacySettings, request: Request):
"""Update user privacy settings."""
from app.auth import _save_user, get_current_user
user = await get_current_user(request)
if not user:
raise HTTPException(status_code=401, detail="Authentication required")
user["privacy_settings"] = req.model_dump()
user["updated_at"] = datetime.utcnow().isoformat()
_save_user(user)
return {
"status": "ok",
"message": "Privacy settings updated",
"settings": user["privacy_settings"],
}
# ── Account Deletion (GDPR Compliant) ──
class DeleteAccountRequest(BaseModel):
password: str
confirm_delete: bool = True
@router.post("/delete-account")
async def delete_account(req: DeleteAccountRequest, request: Request):
"""
Permanently delete user account and all associated data (GDPR compliant).
Requires password confirmation.
"""
from app.auth import _delete_user, get_current_user, verify_password
from app.core.redis import get_redis
user = await get_current_user(request)
if not user:
raise HTTPException(status_code=401, detail="Authentication required")
if not req.confirm_delete:
raise HTTPException(status_code=400, detail="You must confirm account deletion")
# Verify password for security
if user.get("password_hash") and not verify_password(req.password, user["password_hash"]):
raise HTTPException(status_code=401, detail="Incorrect password")
user_id = user["id"]
email = user.get("email", "unknown")
# 1. Delete user from main store
_delete_user(user_id)
# 2. Delete linked wallets from Redis
r = get_redis()
r.hdel("rmi:user_wallets", user_id)
# 3. Delete any password reset tokens
# (They will expire naturally, but we can clean up if we track them)
# 4. Log the deletion for audit purposes (anonymized)
logger.warning(f"[ACCOUNT DELETED] User ID={user_id[:8]}... Email={email}")
return {
"status": "ok",
"message": "Account permanently deleted. All associated data has been removed.",
}
Reference in a new issue View git blame Copy permalink