Function trigger_vulnerability_scan_for_threat_intel

webapp_modern.py:8016–8076

Trigger vulnerability scanning to generate data for threat intelligence enrichment

()

@app.route('/api/auth/setup', methods=['POST'])
def auth_setup():
    """Initial authentication setup - creates user, encrypts DB, generates recovery codes."""
    if auth_mgr.is_configured():
        return jsonify({'success': False, 'error': 'Authentication is already configured'}), 400

    data = request.get_json()
    if not data:
        return jsonify({'success': False, 'error': 'No data provided'}), 400

    username = data.get('username', '').strip()
    password = data.get('password', '')
    confirm = data.get('confirm_password', '')

    if password != confirm:
        return jsonify({'success': False, 'error': 'Passwords do not match'}), 400

    result = auth_mgr.setup(username, password)
    if result['success']:
        # Auto-login after setup
        session['authenticated'] = True
        session['username'] = username
        session['login_time'] = time.time()
        session.permanent = True
        return jsonify(result)
    else:
        return jsonify(result), 400


# Simple in-memory rate limit for login / recovery. Per source-IP sliding window:
#   _AUTH_LOCKOUT_THRESHOLD failed attempts within _AUTH_LOCKOUT_WINDOW seconds
#   → next attempts rejected for _AUTH_LOCKOUT_WINDOW seconds.
# Memory only: resets on process restart. Sufficient on a single-Pi deployment.
_AUTH_LOCKOUT_THRESHOLD = 5
_AUTH_LOCKOUT_WINDOW = 60
_auth_attempts = {}  # ip -> list[timestamp] of failed attempts
_auth_attempts_lock = threading.Lock()


def _auth_client_ip():
    # Trust X-Forwarded-For only if explicitly configured; otherwise use remote_addr.
    return request.headers.get('X-Real-IP') or request.remote_addr or 'unknown'


def _auth_rate_limited(ip):
    now = time.time()
    with _auth_attempts_lock:
        attempts = [t for t in _auth_attempts.get(ip, []) if now - t < _AUTH_LOCKOUT_WINDOW]
        _auth_attempts[ip] = attempts
        if len(attempts) >= _AUTH_LOCKOUT_THRESHOLD:
            retry_after = int(_AUTH_LOCKOUT_WINDOW - (now - attempts[0])) + 1
            return True, max(retry_after, 1)
    return False, 0


def _auth_record_failure(ip):
    with _auth_attempts_lock:
        _auth_attempts.setdefault(ip, []).append(time.time())