megaproxy
fe4e69b9ad
Phase 3 — Investments: - Multi-currency support: holdings track purchase currency, FX rates convert to base for totals - Capital gains report using UK Section 104 pool method, grouped by tax year - Capital Gains tab added to Reports page Phase 5 — Polish & Hardening: - Mobile-responsive layout: bottom nav, sidebar hidden on mobile, logo in TopBar, compact header buttons, hover-only actions now always visible on touch - Backup system: encrypted GPG backups via backup.sh, nightly scheduler job, admin API (list/trigger/download/restore), Settings UI with drag-to-restore confirmation - Docker entrypoint with gosu privilege drop to fix bind-mount ownership on fresh deployments - OWASP fixes: refresh token now bound to its session (new refresh_token_hash column + migration), CSRF secure flag tied to environment, IP-level rate limiting on login, TOTPEnableRequest Pydantic schema replaces raw dict - AES-256-GCM key rotation script (rotate_keys.py) with dry-run mode and atomic DB transaction - CLAUDE.md added for AI-assisted development context - README updated: correct reverse proxy port, accurate backup/restore commands, key rotation instructions Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
69 lines
1.5 KiB
Python
69 lines
1.5 KiB
Python
import uuid
|
|
from datetime import datetime
|
|
|
|
from pydantic import BaseModel, EmailStr, field_validator
|
|
|
|
|
|
class RegisterRequest(BaseModel):
|
|
email: EmailStr
|
|
password: str
|
|
display_name: str
|
|
|
|
@field_validator("password")
|
|
@classmethod
|
|
def password_strength(cls, v: str) -> str:
|
|
if len(v) < 12:
|
|
raise ValueError("Password must be at least 12 characters")
|
|
if not any(c.isupper() for c in v):
|
|
raise ValueError("Password must contain an uppercase letter")
|
|
if not any(c.isdigit() for c in v):
|
|
raise ValueError("Password must contain a digit")
|
|
return v
|
|
|
|
|
|
class LoginRequest(BaseModel):
|
|
email: EmailStr
|
|
password: str
|
|
|
|
|
|
class TOTPChallengeResponse(BaseModel):
|
|
totp_required: bool = True
|
|
challenge_token: str
|
|
|
|
|
|
class TOTPLoginRequest(BaseModel):
|
|
challenge_token: str
|
|
totp_code: str
|
|
|
|
|
|
class TokenResponse(BaseModel):
|
|
access_token: str
|
|
token_type: str = "bearer"
|
|
expires_in: int # seconds
|
|
|
|
|
|
class TOTPSetupResponse(BaseModel):
|
|
secret: str
|
|
qr_code_png_b64: str
|
|
backup_codes: list[str]
|
|
|
|
|
|
class TOTPVerifyRequest(BaseModel):
|
|
code: str
|
|
|
|
|
|
class TOTPEnableRequest(BaseModel):
|
|
secret: str
|
|
code: str
|
|
|
|
|
|
class SessionInfo(BaseModel):
|
|
id: uuid.UUID
|
|
ip_address: str | None
|
|
user_agent: str | None
|
|
last_active_at: datetime
|
|
expires_at: datetime
|
|
created_at: datetime
|
|
is_current: bool = False
|
|
|
|
model_config = {"from_attributes": True}
|