DinQuant/backend_api_python/app/services/security_service.py

"""
Security Service - Handles Turnstile verification, rate limiting, and brute-force protection.
"""

import json
import os
from datetime import datetime, timedelta
from typing import Any, Dict, Tuple

import requests

from app.utils.db import get_db_connection
from app.utils.logger import get_logger

logger = get_logger(__name__)

# Singleton instance
_security_service = None


def get_security_service():
    """Get singleton SecurityService instance"""
    global _security_service
    if _security_service is None:
        _security_service = SecurityService()
    return _security_service


class SecurityService:
    """Security service for authentication protection"""

    def __init__(self):
        self._load_config()

    def _load_config(self):
        """Load security configuration from environment variables"""
        # Turnstile config
        self.turnstile_site_key = os.getenv("TURNSTILE_SITE_KEY", "")
        self.turnstile_secret_key = os.getenv("TURNSTILE_SECRET_KEY", "")
        self.turnstile_enabled = bool(self.turnstile_site_key and self.turnstile_secret_key)

        # IP rate limit config
        self.ip_max_attempts = int(os.getenv("SECURITY_IP_MAX_ATTEMPTS", "10"))
        self.ip_window_minutes = int(os.getenv("SECURITY_IP_WINDOW_MINUTES", "5"))
        self.ip_block_minutes = int(os.getenv("SECURITY_IP_BLOCK_MINUTES", "15"))

        # Account rate limit config
        self.account_max_attempts = int(os.getenv("SECURITY_ACCOUNT_MAX_ATTEMPTS", "5"))
        self.account_window_minutes = int(os.getenv("SECURITY_ACCOUNT_WINDOW_MINUTES", "60"))
        self.account_block_minutes = int(os.getenv("SECURITY_ACCOUNT_BLOCK_MINUTES", "30"))

        # Verification code rate limit
        self.code_rate_limit_seconds = int(os.getenv("VERIFICATION_CODE_RATE_LIMIT", "60"))
        self.code_ip_hourly_limit = int(os.getenv("VERIFICATION_CODE_IP_HOURLY_LIMIT", "10"))

    def get_security_config(self) -> Dict[str, Any]:
        """Get public security config for frontend"""
        return {
            "turnstile_enabled": self.turnstile_enabled,
            "turnstile_site_key": self.turnstile_site_key,
            "registration_enabled": os.getenv("ENABLE_REGISTRATION", "true").lower() == "true",
            "oauth_google_enabled": bool(os.getenv("GOOGLE_CLIENT_ID", "")),
            "oauth_github_enabled": bool(os.getenv("GITHUB_CLIENT_ID", "")),
        }

    # =========================================================================
    # Turnstile Verification
    # =========================================================================

    def verify_turnstile(self, token: str, ip_address: str = None) -> Tuple[bool, str]:
        """
        Verify Cloudflare Turnstile token.

        Returns:
            (success, message)
        """
        if not self.turnstile_enabled:
            # If Turnstile is not configured, skip verification
            return True, "turnstile_disabled"

        if not token:
            return False, "Missing Turnstile token"

        try:
            response = requests.post(
                "https://challenges.cloudflare.com/turnstile/v0/siteverify",
                data={"secret": self.turnstile_secret_key, "response": token, "remoteip": ip_address},
                timeout=10,
            )
            result = response.json()

            if result.get("success"):
                return True, "verified"
            else:
                error_codes = result.get("error-codes", [])
                logger.warning(f"Turnstile verification failed: {error_codes}")
                return False, "Turnstile verification failed"

        except requests.RequestException as e:
            logger.error(f"Turnstile API error: {e}")
            # On API error, we might want to allow (fail-open) or deny (fail-closed)
            # For security, we'll deny
            return False, "Turnstile service unavailable"

    # =========================================================================
    # Rate Limiting & Brute-Force Protection
    # =========================================================================

    def record_login_attempt(
        self, identifier: str, identifier_type: str, success: bool, ip_address: str = None, user_agent: str = None
    ) -> bool:
        """
        Record a login attempt for rate limiting.

        Args:
            identifier: IP address or username
            identifier_type: 'ip' or 'account'
            success: Whether the attempt was successful
            ip_address: Client IP address
            user_agent: Client user agent string
        """
        try:
            with get_db_connection() as db:
                cur = db.cursor()
                cur.execute(
                    """
                    INSERT INTO qd_login_attempts
                    (identifier, identifier_type, success, ip_address, user_agent)
                    VALUES (?, ?, ?, ?, ?)
                    """,
                    (identifier, identifier_type, success, ip_address, user_agent),
                )
                db.commit()
                cur.close()
            return True
        except Exception as e:
            logger.error(f"Failed to record login attempt: {e}")
            return False

    def is_blocked(self, identifier: str, identifier_type: str) -> Tuple[bool, int]:
        """
        Check if an identifier (IP or account) is blocked due to too many failed attempts.

        Returns:
            (is_blocked, remaining_seconds)
        """
        try:
            if identifier_type == "ip":
                max_attempts = self.ip_max_attempts
                window_minutes = self.ip_window_minutes
                block_minutes = self.ip_block_minutes
            else:  # account
                max_attempts = self.account_max_attempts
                window_minutes = self.account_window_minutes
                block_minutes = self.account_block_minutes

            with get_db_connection() as db:
                cur = db.cursor()

                # Count failed attempts in the time window
                window_start = datetime.now() - timedelta(minutes=window_minutes)
                cur.execute(
                    """
                    SELECT COUNT(*) as count, MAX(attempt_time) as last_attempt
                    FROM qd_login_attempts
                    WHERE identifier = ? AND identifier_type = ?
                    AND success = FALSE AND attempt_time > ?
                    """,
                    (identifier, identifier_type, window_start),
                )
                row = cur.fetchone()
                cur.close()

                if not row:
                    return False, 0

                failed_count = row["count"] or 0
                last_attempt = row["last_attempt"]

                if failed_count >= max_attempts:
                    # Check if still in block period
                    if last_attempt:
                        block_until = last_attempt + timedelta(minutes=block_minutes)
                        if datetime.now() < block_until:
                            remaining = int((block_until - datetime.now()).total_seconds())
                            return True, remaining

                return False, 0

        except Exception as e:
            logger.error(f"Failed to check block status: {e}")
            return False, 0

    def check_login_allowed(self, username: str, ip_address: str) -> Tuple[bool, str]:
        """
        Check if login is allowed for the given username and IP.

        Returns:
            (allowed, message)
        """
        # Check IP block
        ip_blocked, ip_remaining = self.is_blocked(ip_address, "ip")
        if ip_blocked:
            minutes = ip_remaining // 60
            return False, f"Too many failed attempts from this IP. Try again in {minutes + 1} minutes."

        # Check account block
        account_blocked, account_remaining = self.is_blocked(username, "account")
        if account_blocked:
            minutes = account_remaining // 60
            return (
                False,
                f"Account temporarily locked due to too many failed attempts. Try again in {minutes + 1} minutes.",
            )

        return True, "allowed"

    def clear_login_attempts(self, identifier: str, identifier_type: str) -> bool:
        """
        Clear login attempts for an identifier (called after successful login).
        """
        try:
            with get_db_connection() as db:
                cur = db.cursor()
                cur.execute(
                    """
                    DELETE FROM qd_login_attempts
                    WHERE identifier = ? AND identifier_type = ?
                    """,
                    (identifier, identifier_type),
                )
                db.commit()
                cur.close()
            return True
        except Exception as e:
            logger.error(f"Failed to clear login attempts: {e}")
            return False

    # =========================================================================
    # Security Audit Logging
    # =========================================================================

    def log_security_event(
        self, action: str, user_id: int = None, ip_address: str = None, user_agent: str = None, details: dict = None
    ) -> bool:
        """
        Log a security-related event.

        Args:
            action: Event type (login, logout, register, reset_password, etc.)
            user_id: User ID if applicable
            ip_address: Client IP
            user_agent: Client user agent
            details: Additional details as dict
        """
        try:
            details_json = json.dumps(details) if details else None

            with get_db_connection() as db:
                cur = db.cursor()
                cur.execute(
                    """
                    INSERT INTO qd_security_logs
                    (user_id, action, ip_address, user_agent, details)
                    VALUES (?, ?, ?, ?, ?)
                    """,
                    (user_id, action, ip_address, user_agent, details_json),
                )
                db.commit()
                cur.close()
            return True
        except Exception as e:
            logger.error(f"Failed to log security event: {e}")
            return False

    # =========================================================================
    # Verification Code Rate Limiting
    # =========================================================================

    def can_send_verification_code(self, email: str, ip_address: str) -> Tuple[bool, str]:
        """
        Check if we can send a verification code to this email from this IP.

        Returns:
            (allowed, message)
        """
        try:
            with get_db_connection() as db:
                cur = db.cursor()

                # Check email rate limit (one code per minute per email)
                rate_limit_time = datetime.now() - timedelta(seconds=self.code_rate_limit_seconds)
                cur.execute(
                    """
                    SELECT COUNT(*) as count FROM qd_verification_codes
                    WHERE email = ? AND created_at > ?
                    """,
                    (email, rate_limit_time),
                )
                row = cur.fetchone()
                if row and row["count"] > 0:
                    return False, f"Please wait {self.code_rate_limit_seconds} seconds before requesting another code"

                # Check IP hourly limit
                hour_ago = datetime.now() - timedelta(hours=1)
                cur.execute(
                    """
                    SELECT COUNT(*) as count FROM qd_verification_codes
                    WHERE ip_address = ? AND created_at > ?
                    """,
                    (ip_address, hour_ago),
                )
                row = cur.fetchone()
                if row and row["count"] >= self.code_ip_hourly_limit:
                    return False, "Too many verification code requests from this IP. Try again later."

                cur.close()
                return True, "allowed"

        except Exception as e:
            logger.error(f"Failed to check verification code rate limit: {e}")
            return True, "allowed"  # Fail open on DB errors

    # =========================================================================
    # Password Strength Validation
    # =========================================================================

    def validate_password_strength(self, password: str) -> Tuple[bool, str]:
        """
        Validate password meets minimum security requirements.

        Requirements:
        - At least 8 characters
        - Contains at least one uppercase letter
        - Contains at least one lowercase letter
        - Contains at least one digit

        Returns:
            (valid, message)
        """
        if len(password) < 8:
            return False, "Password must be at least 8 characters long"

        if not any(c.isupper() for c in password):
            return False, "Password must contain at least one uppercase letter"

        if not any(c.islower() for c in password):
            return False, "Password must contain at least one lowercase letter"

        if not any(c.isdigit() for c in password):
            return False, "Password must contain at least one digit"

        return True, "valid"

    # =========================================================================
    # Cleanup
    # =========================================================================

    def cleanup_old_records(self, days: int = 7) -> int:
        """
        Clean up old login attempts and expired verification codes.

        Returns:
            Number of records deleted
        """
        deleted = 0
        cutoff = datetime.now() - timedelta(days=days)

        try:
            with get_db_connection() as db:
                cur = db.cursor()

                # Clean old login attempts
                cur.execute("DELETE FROM qd_login_attempts WHERE attempt_time < ?", (cutoff,))
                deleted += cur.rowcount or 0

                # Clean expired verification codes
                cur.execute("DELETE FROM qd_verification_codes WHERE expires_at < ?", (cutoff,))
                deleted += cur.rowcount or 0

                db.commit()
                cur.close()

            logger.info(f"Security cleanup: deleted {deleted} old records")
            return deleted

        except Exception as e:
            logger.error(f"Security cleanup failed: {e}")
            return 0