P1.6: secure guest invitation tokens (secrets.token_urlsafe + SHA-256 hash + one-time use + session revocation)

app/routes/guests.py

@@ -1,7 +1,16 @@
-"""Guest management routes — invite, list, delete guests (admin only)."""
+"""Guest management routes — invite, list, delete guests (admin only).
+
+Uses secure invitation tokens (P1.6 fix):
+- Token is a random 32-byte URL-safe string (secrets.token_urlsafe)
+- Only the SHA-256 hash is stored in the database
+- One-time use: used_at is set on acceptance
+- Session revocation via Redis on guest deletion
+"""
 
 from __future__ import annotations
 
+import hashlib
+import secrets
 import uuid
 from datetime import UTC, datetime, timedelta
 
@@ -14,11 +23,17 @@ from app.core.auth import get_redis, hash_password
 from app.core.db import get_db
 from app.deps import get_current_user, require_admin
 from app.models.guest_user import GuestUser
+from app.models.guest_invitation import GuestInvitation
 
 router = APIRouter(prefix="/api/v1/guests", tags=["guests"])
 settings = get_settings()
 
 
+def _hash_token(token: str) -> str:
+    """Hash a token using SHA-256."""
+    return hashlib.sha256(token.encode()).hexdigest()
+
+
 @router.post("/invite")
 async def invite_guest(
     request: Request,
@@ -26,10 +41,10 @@ async def invite_guest(
     db: AsyncSession = Depends(get_db),
     current_user: dict = Depends(require_admin),
 ):
-    """Invite a guest user. Admin only."""
+    """Invite a guest user. Admin only. Returns a secure invitation token."""
     email = body.get("email", "")
     name = body.get("name", "")
-    expires_in_hours = body.get("expires_in_hours", 72)  # Default 3 days
+    expires_in_hours = body.get("expires_in_hours", 72)
 
     if not email or not name:
         raise HTTPException(
@@ -39,6 +54,7 @@ async def invite_guest(
 
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
+    expires_at = datetime.now(UTC) + timedelta(hours=expires_in_hours)
 
     # Check if guest already exists for this tenant
     existing_q = await db.execute(
@@ -53,32 +69,36 @@ async def invite_guest(
                 status_code=status.HTTP_409_CONFLICT,
                 detail={"detail": "Guest already active", "code": "guest_exists"},
             )
-        # Re-invite: update existing record
+        # Re-invite: update existing record and create new token
         existing.name = name
         existing.status = "invited"
         existing.invited_by = user_id
-        existing.expires_at = datetime.now(UTC) + timedelta(hours=expires_in_hours)
+        existing.expires_at = expires_at
         existing.password_hash = None
-        await db.commit()
-        await db.refresh(existing)
-        return {
-            "id": str(existing.id),
-            "email": existing.email,
-            "name": existing.name,
-            "status": existing.status,
-            "expires_at": existing.expires_at.isoformat() if existing.expires_at else None,
-        }
+        await db.flush()
+        guest = existing
+    else:
+        guest = GuestUser(
+            email=email,
+            name=name,
+            tenant_id=tenant_id,
+            invited_by=user_id,
+            status="invited",
+            expires_at=expires_at,
+        )
+        db.add(guest)
+        await db.flush()
 
-    expires_at = datetime.now(UTC) + timedelta(hours=expires_in_hours)
-    guest = GuestUser(
-        email=email,
-        name=name,
-        tenant_id=tenant_id,
-        invited_by=user_id,
-        status="invited",
+    # Generate secure invitation token
+    raw_token = secrets.token_urlsafe(32)
+    token_hash = _hash_token(raw_token)
+    invitation = GuestInvitation(
+        guest_user_id=guest.id,
+        token_hash=token_hash,
         expires_at=expires_at,
+        created_by=user_id,
     )
-    db.add(guest)
+    db.add(invitation)
     await db.commit()
     await db.refresh(guest)
 
@@ -88,6 +108,7 @@ async def invite_guest(
         "name": guest.name,
         "status": guest.status,
         "expires_at": guest.expires_at.isoformat() if guest.expires_at else None,
+        "invitation_token": raw_token,  # Only returned once — not stored in plaintext
     }
 
 
@@ -97,7 +118,7 @@ async def accept_invitation(
     body: dict,
     db: AsyncSession = Depends(get_db),
 ):
-    """Guest accepts invitation and sets password."""
+    """Guest accepts invitation and sets password. Token is one-time use."""
     password = body.get("password", "")
     if not password or len(password) < 8:
         raise HTTPException(
@@ -105,36 +126,43 @@ async def accept_invitation(
             detail={"detail": "Password must be at least 8 characters", "code": "weak_password"},
         )
 
-    # Token is the guest user ID
-    try:
-        guest_id = uuid.UUID(token)
-    except ValueError:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail={"detail": "Invalid token", "code": "invalid_token"},
-        )
-
-    guest_q = await db.execute(
-        select(GuestUser).where(GuestUser.id == guest_id).where(GuestUser.status == "invited")
+    # Hash the token and look up the invitation
+    token_hash = _hash_token(token)
+    inv_q = await db.execute(
+        select(GuestInvitation)
+        .where(GuestInvitation.token_hash == token_hash)
+        .where(GuestInvitation.used_at.is_(None))
+        .where(GuestInvitation.revoked_at.is_(None))
     )
-    guest = guest_q.scalar_one_or_none()
-    if not guest:
+    invitation = inv_q.scalar_one_or_none()
+    if not invitation:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
-            detail={"detail": "Invitation not found or already accepted", "code": "invitation_not_found"},
+            detail={"detail": "Invitation not found, already used, or revoked", "code": "invitation_not_found"},
         )
 
     # Check expiration
-    if guest.expires_at and guest.expires_at < datetime.now(UTC):
-        guest.status = "expired"
-        await db.commit()
+    if invitation.expires_at < datetime.now(UTC):
         raise HTTPException(
             status_code=status.HTTP_410_GONE,
             detail={"detail": "Invitation expired", "code": "invitation_expired"},
         )
 
+    # Load guest
+    guest_q = await db.execute(
+        select(GuestUser).where(GuestUser.id == invitation.guest_user_id)
+    )
+    guest = guest_q.scalar_one_or_none()
+    if not guest or guest.status != "invited":
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail={"detail": "Guest account not found or already active", "code": "guest_not_found"},
+        )
+
+    # Set password and activate
     guest.password_hash = hash_password(password)
     guest.status = "active"
+    invitation.used_at = datetime.now(UTC)  # One-time use
     await db.commit()
 
     return {"message": "Invitation accepted", "status": "active"}
@@ -172,7 +200,7 @@ async def delete_guest(
     db: AsyncSession = Depends(get_db),
     current_user: dict = Depends(require_admin),
 ):
-    """Delete/revoke a guest user."""
+    """Delete/revoke a guest user and invalidate all sessions."""
     tenant_id = uuid.UUID(current_user["tenant_id"])
     try:
         gid = uuid.UUID(guest_id)
@@ -195,10 +223,28 @@ async def delete_guest(
     # Revoke: mark as revoked and clear password
     guest.status = "revoked"
     guest.password_hash = None
+
+    # Revoke all pending invitations
+    from sqlalchemy import update
+    await db.execute(
+        update(GuestInvitation)
+        .where(GuestInvitation.guest_user_id == gid)
+        .where(GuestInvitation.revoked_at.is_(None))
+        .values(revoked_at=datetime.now(UTC))
+    )
     await db.commit()
 
-    # Invalidate any active guest sessions
+    # Invalidate all active guest sessions via Redis
     redis = get_redis()
-    # We can't easily find all sessions for this guest, but they'll expire naturally
+    if redis:
+        # Find and delete all guest sessions for this user
+        # Session keys are stored as session:{session_id} with guest_user_id inside
+        # We use a Redis index: guest_sessions:{guest_user_id} → set of session_ids
+        session_key = f"guest_sessions:{gid}"
+        session_ids = await redis.smembers(session_key)
+        if session_ids:
+            for sid in session_ids:
+                await redis.delete(f"session:{sid}")
+            await redis.delete(session_key)
 
-    return {"message": "Guest revoked", "status": "revoked"}
+    return {"message": "Guest revoked, all sessions invalidated", "status": "revoked"}