§
    o¶»jµ%  ã                  ó>  — d Z ddlmZ ddlZddlZddlZddlZddlZddlZddl	m
Z
mZmZmZmZ ddlmZmZ ddlmZ  G d„ dej        ¦  «        Z ed	d	¬
¦  «         G d„ d¦  «        ¦   «         Z ed	d	¬
¦  «         G d„ d¦  «        ¦   «         Z G d„ d¦  «        ZdS )zÁ
Bank-Grade Security Engine for FreeExile.
Implements Hardware/Device Fingerprint Binding, High-Entropy Remember-Me Tokens,
Progressive Exponential Lockout Delays, and Immutable Audit Logging.
é    )ÚannotationsN)ÚAnyÚDictÚListÚOptionalÚTuple)Ú	dataclassÚfield)ÚDatabaseAccountRepositoryc                  ó.   — e Zd ZdZdZdZdZdZdZdZ	dZ
d	S )
ÚSecurityEventTypeÚLOGIN_SUCCESSÚ
LOGIN_FAILÚREGISTERÚ
OTP_VERIFYÚLOCKOUTÚREMEMBER_LOGINÚHIJACK_ATTEMPTÚLOGOUTN)Ú__name__Ú
__module__Ú__qualname__r   r   r   r   r   r   r   r   © ó    ú2C:\Projects\FreeExile\server\auth\bank_security.pyr   r      s6   € € € € € Ø#€MØ€JØ€HØ€JØ€GØ%€NØ%€NØ€F€F€Fr   r   T)ÚslotsÚfrozenc                  ó<   — e Zd ZU dZded<   ded<   ded<   ded<   dS )ÚDeviceFingerprintz2Hardware and browser/client telemetry fingerprint.ÚstrÚ	device_idÚdevice_nameÚhardware_hashÚ	client_ipN)r   r   r   Ú__doc__Ú__annotations__r   r   r   r   r      s@   € € € € € € à<Ð<Ø€N€N�NØÐÐÑØÐÐÑØ€N€N�N€N€Nr   r   c                  óD   — e Zd ZU dZded<   ded<   dZded<   dZded	<   dS )
ÚRememberTokenResultz4Result of remember-token issuance or authentication.ÚboolÚsuccessr    ÚmessageNúOptional[str]Ú	raw_tokenÚ
account_id)r   r   r   r%   r&   r-   r.   r   r   r   r(   r(   (   sL   € € € € € € à>Ð>Ø€M€M�MØ€L€L�LØ#€IÐ#Ð#Ð#Ñ#Ø $€JÐ$Ð$Ð$Ñ$Ð$Ð$r   r(   c                  ód   — e Zd ZdZd&d„Zd'd	„Z	 d(d)d„Zd*d+d„Z	 d,d-d„Zd.d „Z	d/d!„Z
d0d#„Zd1d$„Zd%S )2ÚBankGradeSecurityEnginezAEnterprise/Bank-Grade Authentication and Device Integrity Engine.Ú
repositoryr   ÚreturnÚNonec                ó   — || _         d S )N)r1   )Úselfr1   s     r   Ú__init__z BankGradeSecurityEngine.__init__4   s   € Ø$ˆŒˆˆr   r-   r    c                ót   — t          j        |                     d¦  «        ¦  «                             ¦   «         S )Nzutf-8)ÚhashlibÚsha256ÚencodeÚ	hexdigest)r5   r-   s     r   Ú_hash_tokenz#BankGradeSecurityEngine._hash_token7   s,   € ÝŒ~˜i×.Ò.¨wÑ7Ô7Ñ8Ô8×BÒBÑDÔDÐDr   Ú Ú
event_typer   r.   r,   Ú
ip_addressÚdevice_fingerprintÚstatusÚdetailsc                óB  — dt          j        ¦   «         j        dd…         › �}t          j        ¦   «         }| j                             ¦   «         5 }	|	                     d|||j        |||||f¦  «         |	                     ¦   «          ddd¦  «         n# 1 swxY w Y   |S )z)Record an immutable security audit event.Úaud_Né   zÎ
                INSERT INTO security_audit_logs (log_id, account_id, event_type, ip_address, device_fingerprint, status, details, timestamp)
                VALUES (?, ?, ?, ?, ?, ?, ?, ?)
                )	ÚuuidÚuuid4ÚhexÚtimer1   Ú_get_connectionÚexecuteÚvalueÚcommit)
r5   r>   r.   r?   r@   rA   rB   Úlog_idÚnowÚconns
             r   Úlog_audit_eventz'BankGradeSecurityEngine.log_audit_event:   sâ   € ð 0�œ
™œÔ(¨¨"¨Ô-Ð/Ð/ˆÝŒi‰kŒkˆØŒ_×,Ò,Ñ.Ô.ð 	°$Ø�LŠLðð ˜ ZÔ%5°zÐCUÐW]Ð_fÐhkÐlñô ð ð �KŠK‰MŒMˆMð	ð 	ð 	ñ 	ô 	ð 	ð 	ð 	ð 	ð 	ð 	øøøð 	ð 	ð 	ð 	ð ˆs   Á8BÂBÂBé2   ÚlimitÚintúList[Dict[str, Any]]c                óÔ   — | j                              ¦   «         5 }|                     d||f¦  «        }d„ |                     ¦   «         D ¦   «         cd d d ¦  «         S # 1 swxY w Y   d S )NzVSELECT * FROM security_audit_logs WHERE account_id = ? ORDER BY timestamp DESC LIMIT ?c                ó,   — g | ]}t          |¦  «        ‘ŒS r   )Údict)Ú.0Úrs     r   ú
<listcomp>zFBankGradeSecurityEngine.get_audit_logs_for_account.<locals>.<listcomp>W   s   € Ð4Ð4Ð4 •D˜‘G”GÐ4Ð4Ð4r   )r1   rJ   rK   Úfetchall)r5   r.   rS   rP   Úcurs        r   Úget_audit_logs_for_accountz2BankGradeSecurityEngine.get_audit_logs_for_accountQ   s°   € ØŒ_×,Ò,Ñ.Ô.ð 	5°$Ø—,’,ØhØ˜UÐ#ñô ˆCð 5Ð4 S§\¢\¡^¤^Ð4Ñ4Ô4ð	5ð 	5ð 	5ð 	5ñ 	5ô 	5ð 	5ð 	5ð 	5ð 	5ð 	5ð 	5øøøð 	5ð 	5ð 	5ð 	5ð 	5ð 	5s   š6AÁA!Á$A!é   Údevicer   Ú
valid_daysr(   c                ó  — t          j        d¦  «        }|                      |¦  «        }t          j        ¦   «         }||dz  z   }| j                             ¦   «         5 }|                     d|||j        |j        |j	        |j
        ||f¦  «         |                     ¦   «          ddd¦  «         n# 1 swxY w Y   |                      t          j        ||j
        |j	        dd|j        › �¬¦  «         t          dd	||¬
¦  «        S )zSIssue a 256-bit cryptographically secure remember token tied to device fingerprint.é    i€Q a   
                INSERT OR REPLACE INTO remember_tokens (
                    token_hash, account_id, device_id, device_name, hardware_hash, client_ip, expires_at, is_revoked, created_at
                ) VALUES (?, ?, ?, ?, ?, ?, ?, 0, ?)
                NÚSUCCESSzRemember token issued for ©r>   r.   r?   r@   rA   rB   Tz"Remember token issued successfully©r*   r+   r-   r.   )ÚsecretsÚtoken_urlsafer<   rI   r1   rJ   rK   r!   r"   r#   r$   rM   rQ   r   r   r(   )	r5   r.   r`   ra   r-   Ú
token_hashrO   Ú
expires_atrP   s	            r   Úissue_remember_tokenz,BankGradeSecurityEngine.issue_remember_tokenY   sk  € õ Ô)¨"Ñ-Ô-ˆ	Ø×%Ò% iÑ0Ô0ˆ
ÝŒi‰kŒkˆØ˜J¨Ñ.Ñ/ˆ
àŒ_×,Ò,Ñ.Ô.ð 		°$Ø�LŠLðð
 ˜Z¨Ô)9¸6Ô;MÈvÔOcÐekÔeuð  xBð  DGð  Hñô ð ð �KŠK‰MŒMˆMð		ð 		ð 		ñ 		ô 		ð 		ð 		ð 		ð 		ð 		ð 		øøøð 		ð 		ð 		ð 		ð 	×ÒÝ(Ô1Ø!ØÔ'Ø%Ô3ØØE°Ô1CÐEÐEð 	ñ 	
ô 	
ð 	
õ #ØØ8ØØ!ð	
ñ 
ô 
ð 	
s   ÁAB1Â1B5Â8B5Úcurrent_devicec                ó8  — |                       |¦  «        }t          j        ¦   «         }| j                             ¦   «         5 }|                     d||f¦  «        }|                     ¦   «         }ddd¦  «         n# 1 swxY w Y   |st          dd¬¦  «        S |d         }|d         }	|d         }
t          j        |	|j	        ¦  «        }t          j        |
|j
        ¦  «        }|r|sq|                      |¦  «         |                      t          j        ||j        |j	        d	d
|	dd…         › d|j	        dd…         › d�¬¦  «         t          dd¬¦  «        S |                      t          j        ||j        |j	        dd¬¦  «         t          dd||¬¦  «        S )zSAuthenticate remember token with strict device fingerprint and hardware hash check.zXSELECT * FROM remember_tokens WHERE token_hash = ? AND is_revoked = 0 AND expires_at > ?NFz$Invalid or expired remember-me token)r*   r+   r.   r#   r!   ÚREVOKEDz#Fingerprint mismatch! Expected HW: é   z
..., Got: z...re   zEDevice fingerprint mismatch. Re-authentication required for security.rd   z)1-Click login via valid remember-me tokenTz%Remember-me authentication successfulrf   )r<   rI   r1   rJ   rK   Úfetchoner(   rg   Úcompare_digestr#   r!   Úrevoke_remember_tokenrQ   r   r   r$   r   )r5   r-   rl   ri   rO   rP   r]   Úrowr.   Ústored_hw_hashÚstored_device_idÚis_hw_matchÚis_dev_matchs                r   Úauthenticate_remember_tokenz3BankGradeSecurityEngine.authenticate_remember_token€   s9  € ð ×%Ò% iÑ0Ô0ˆ
ÝŒi‰kŒkˆàŒ_×,Ò,Ñ.Ô.ð 	!°$Ø—,’,ØjØ˜SÐ!ñô ˆCð —,’,‘.”.ˆCð	!ð 	!ð 	!ñ 	!ô 	!ð 	!ð 	!ð 	!ð 	!ð 	!ð 	!øøøð 	!ð 	!ð 	!ð 	!ð ð 	fÝ&¨uÐ>dÐeÑeÔeÐeà˜Ô&ˆ
Ø˜_Ô-ˆØ˜{Ô+Ðõ Ô,¨^¸^Ô=YÑZÔZˆÝÔ-Ð.>ÀÔ@XÑYÔYˆàð 	 ð 	ð ×&Ò& yÑ1Ô1Ð1Ø× Ò Ý,Ô;Ø%Ø)Ô3Ø#1Ô#?Ø ð B¸nÈRÈaÈRÔ>Pð  Bð  BÐ\jÔ\xÐy{Ðz{Ðy{Ô\|ð  Bð  Bð  Bð !ñ ô ð õ 'ØØ_ðñ ô ð ð
 	×ÒÝ(Ô7Ø!Ø%Ô/Ø-Ô;ØØ?ð 	ñ 	
ô 	
ð 	
õ #ØØ;ØØ!ð	
ñ 
ô 
ð 	
s   Á-A;Á;A?ÂA?c                óê   — |                       |¦  «        }| j                             ¦   «         5 }|                     d|f¦  «         |                     ¦   «          d d d ¦  «         d S # 1 swxY w Y   d S )Nz>UPDATE remember_tokens SET is_revoked = 1 WHERE token_hash = ?)r<   r1   rJ   rK   rM   )r5   r-   ri   rP   s       r   rr   z-BankGradeSecurityEngine.revoke_remember_token¼   s°   € Ø×%Ò% iÑ0Ô0ˆ
ØŒ_×,Ò,Ñ.Ô.ð 	°$Ø�LŠLÐYÐ\fÐ[hÑiÔiÐiØ�KŠK‰MŒMˆMð	ð 	ð 	ñ 	ô 	ð 	ð 	ð 	ð 	ð 	ð 	ð 	øøøð 	ð 	ð 	ð 	ð 	ð 	s   ¯,A(Á(A,Á/A,úTuple[float, bool]c           
     ó6  — | j                              |¦  «        }|sdS |xj        dz  c_        t          j        ¦   «         }d}d}|j        dk    rd}np|j        dk    rd}nb|j        dk    rd}nT|j        d	k    rd
}nFd}d}|dz   |_        |                      t          j        ||j        |j	        dd|j        › d�¬¦  «         | j          
                    |¦  «         |s7|                      t          j        ||j        |j	        dd|j        › �¬¦  «         ||fS )zMRecord login failure, compute progressive exponential delay, or lock account.)ç        Fé   Fr|   é   g      ð?é   g       @é   g      @Tg      Œ@ÚLOCKEDz$Account locked for 15 minutes after z failed attemptsre   ÚFAILzFailed attempt #)r1   Ú	get_by_idÚfailed_login_attemptsrI   Úlockout_untilrQ   r   r   r$   r#   Úupdate_accountr   )r5   r.   r`   ÚaccountrO   Ú	is_lockedÚdelays          r   Úrecord_login_failurez,BankGradeSecurityEngine.record_login_failureÂ   sq  € ð ”/×+Ò+¨JÑ7Ô7ˆØð 	Ø�:àÐ%Ô%¨Ñ*Ð%Ô%ÝŒi‰kŒkˆØˆ	ØˆàÔ(¨AÒ-Ð-ØˆEˆEØÔ*¨aÒ/Ð/ØˆEˆEØÔ*¨aÒ/Ð/ØˆEˆEØÔ*¨aÒ/Ð/ØˆEˆEð ˆIØˆEØ$'¨%¡KˆGÔ!Ø× Ò Ý,Ô4Ø%Ø!Ô+Ø#)Ô#7ØØn¸wÔ?\ÐnÐnÐnð !ñ ô ð ð 	Œ×&Ò& wÑ/Ô/Ð/àð 	Ø× Ò Ý,Ô7Ø%Ø!Ô+Ø#)Ô#7ØØJ¨7Ô+HÐJÐJð !ñ ô ð ð �iÐÐr   c           	     ó0  — | j                              |¦  «        }|ryd|_        d|_        t	          j        ¦   «         |_        | j                              |¦  «         |                      t          j	        ||j
        |j        dd|j        › �¬¦  «         dS dS )z2Reset failed attempt counters on successful login.r   Nrd   z#User authenticated successfully on re   )r1   rƒ   r„   r…   rI   Úlast_login_atr†   rQ   r   r   r$   r#   r"   )r5   r.   r`   r‡   s       r   Úrecord_login_successz,BankGradeSecurityEngine.record_login_successõ   s¬   € ð ”/×+Ò+¨JÑ7Ô7ˆØð 	Ø,-ˆGÔ)Ø$(ˆGÔ!Ý$(¤I¡K¤KˆGÔ!ØŒO×*Ò*¨7Ñ3Ô3Ð3à× Ò Ý,Ô:Ø%Ø!Ô+Ø#)Ô#7Ø ØR¸fÔ>PÐRÐRð !ñ ô ð ð ð ð	ð 	r   N)r1   r   r2   r3   )r-   r    r2   r    )r=   )r>   r   r.   r,   r?   r    r@   r,   rA   r    rB   r    r2   r    )rR   )r.   r    rS   rT   r2   rU   )r_   )r.   r    r`   r   ra   rT   r2   r(   )r-   r    rl   r   r2   r(   )r-   r    r2   r3   )r.   r    r`   r   r2   rz   )r.   r    r`   r   r2   r3   )r   r   r   r%   r6   r<   rQ   r^   rk   rx   rr   rŠ   r�   r   r   r   r0   r0   1   sî   € € € € € ØKÐKð%ð %ð %ð %ðEð Eð Eð Eð ðð ð ð ð ð.5ð 5ð 5ð 5ð 5ð ð	%
ð %
ð %
ð %
ð %
ðN:
ð :
ð :
ð :
ðxð ð ð ð1 ð 1 ð 1 ð 1 ðfð ð ð ð ð r   r0   )r%   Ú
__future__r   Úenumr8   Úhmacrg   rI   rF   Útypingr   r   r   r   r   Údataclassesr	   r
   Úserver.auth.databaser   ÚEnumr   r   r(   r0   r   r   r   ú<module>r•      s�  ððð ð #Ð "Ð "Ð "Ð "Ð "Ø €€€Ø €€€Ø €€€Ø €€€Ø €€€Ø €€€Ø 3Ð 3Ð 3Ð 3Ð 3Ð 3Ð 3Ð 3Ð 3Ð 3Ð 3Ð 3Ð 3Ð 3Ø (Ð (Ð (Ð (Ð (Ð (Ð (Ð (à :Ð :Ð :Ð :Ð :Ð :ðð ð ð ð ˜œ	ñ ô ð ð €�˜dÐ#Ñ#Ô#ðð ð ð ð ñ ô ñ $Ô#ðð €�˜dÐ#Ñ#Ô#ð%ð %ð %ð %ð %ñ %ô %ñ $Ô#ð%ðXð Xð Xð Xð Xñ Xô Xð Xð Xð Xr   