authnzerver.actions.user module

This contains functions to drive user account related auth actions.

authnzerver.actions.user.create_new_user(payload: dict, min_pass_length: int = 12, max_unsafe_similarity: int = 33, override_authdb_path: str = None, raiseonfail: bool = False, config: types.SimpleNamespace = None) → dict[source]

Makes a new user.

Parameters:
  • payload (dict) –

    This is a dict with the following required keys:

    • full_name: str. Full name for the user
    • email: str. User’s email address
    • password: str. User’s password.

    Optional payload items include:

    • extra_info: dict. optional dict to add any extra info for this user, will be stored as JSON in the DB
    • verify_retry_wait: int, default: 6. This sets the amount of time in hours a user must wait before retrying a failed verification action, i.e., responding before expiry of and with the correct verification token.
    • system_id: str. If this is provided, must be a unique string that will serve as the system_id for the user. This ID is safe to share with client JS, etc., as opposed to the user_id primary key for the user. If not provided, a UUIDv4 will be generated and used for the system_id.
    • public_suffix_list: list of str. If this is provided as a payload item, it must be a list of domain name suffixes sources from the Mozilla Public Suffix list: https://publicsuffix.org/list/. This is used to check if the full name of the user may possibly be a spam link intended to be used when the authnzerver emails out verification tokens for new users. If the full name contains a suffix in this list, the user creation request will fail. If this item is not provided in the payload, this function will look up the current process’s namespace to see if it was loaded there and use it from there if so. If the public suffix list can’t be found in either item, new user creation will fail.

    In addition to these items received from an authnzerver client, the payload must also include the following keys (usually added in by a wrapping function):

    • reqid: int or str
    • pii_salt: str
  • override_authdb_path (str or None) – If given as a str, is the alternative path to the auth DB.
  • raiseonfail (bool) – If True, will raise an Exception if something goes wrong.
  • min_pass_length (int) – The minimum required character length of the password.
  • max_unsafe_similarity (int) – The maximum ratio required to fuzzy-match the input password against the server’s domain name, the user’s email, or their name.
  • config (SimpleNamespace object or None) – An object containing systemwide config variables as attributes. This is useful when the wrapping function needs to pass in some settings directly from environment variables.
Returns:

Returns a dict with the user’s user_id and user_email, and a boolean for send_verification.
Return type:

dict

Notes

If the email address already exists in the database, then either the user has forgotten that they have an account or someone else is being annoying. In this case, if is_active is True, we’ll tell the user that we’ve sent an email but won’t do anything. If is_active is False and emailverify_sent_datetime is at least payload[‘verify_retry_wait’] hours in the past, we’ll send a new email verification email and update the emailverify_sent_datetime. In this case, we’ll just tell the user that we’ve sent the email but won’t tell them if their account exists.

Only after the user verifies their email, is_active will be set to True and user_role will be set to ‘authenticated’.

authnzerver.actions.user.delete_user(payload: dict, raiseonfail: bool = False, override_authdb_path: str = None, config: types.SimpleNamespace = None) → dict[source]

Deletes a user.

This can only be called by the user themselves or the superuser.

FIXME: does this actually check if it’s called by the right user?

FIXME: add check_permissions to this to make more robust

This will also immediately invalidate all sessions corresponding to the target user.

Superuser accounts cannot be deleted.

Parameters:
  • payload (dict) –

    This is a dict with the following required keys:

    • email: str
    • user_id: int
    • password: str

    In addition to these items received from an authnzerver client, the payload must also include the following keys (usually added in by a wrapping function):

    • reqid: int or str
    • pii_salt: str
  • override_authdb_path (str or None) – If given as a str, is the alternative path to the auth DB.
  • raiseonfail (bool) – If True, will raise an Exception if something goes wrong.
  • config (SimpleNamespace object or None) – An object containing systemwide config variables as attributes. This is useful when the wrapping function needs to pass in some settings directly from environment variables.
Returns:

Returns a dict containing a success key indicating if the user was deleted.
Return type:

dict
authnzerver.actions.user.internal_delete_user(payload: dict, raiseonfail: bool = False, override_authdb_path: str = None, config: types.SimpleNamespace = None) → dict[source]

Deletes a user and does not check for permissions.

Suitable ONLY for internal server use by a frontend. Do NOT expose this function to an end user.

Parameters:
  • payload (dict) –

    This is a dict with the following required keys:

    • target_userid: int

    In addition to these items received from an authnzerver client, the payload must also include the following keys (usually added in by a wrapping function):

    • reqid: int or str
    • pii_salt: str
  • override_authdb_path (str or None) – If given as a str, is the alternative path to the auth DB.
  • raiseonfail (bool) – If True, will raise an Exception if something goes wrong.
  • config (SimpleNamespace object or None) – An object containing systemwide config variables as attributes. This is useful when the wrapping function needs to pass in some settings directly from environment variables.
Returns:

Returns a dict containing a success key indicating if the user was deleted.
Return type:

dict