fix(auth): add username validation and account check in login

Ensure case-sensitive username comparison and verify user has at least one account.
This commit is contained in:
Karl 2025-08-18 14:03:46 +01:00
parent ad42907ad9
commit e2559fab30

11
app.py
View File

@ -189,10 +189,21 @@ def login() -> Union[Response, str]:
response.raise_for_status()
response_data = response.json()
if response_data.get("auth") == "Success":
# Ensure case-sensitive username comparison
if response_data.get("username") != username:
return render_template("index.html", error="Invalid username or password. Please try again.")
session["logged_in"] = True
session["username"] = response_data.get("username", username)
session["user_id"] = response_data.get("user_id")
session["auth_credentials"] = encoded_credentials
# Check if the user has at least one account
base_url = app.config["BACKEND_URL"]
all_accounts = get_user_accounts(base_url, session["auth_credentials"])
if not all_accounts:
return render_template("index.html", error="No accounts associated with this user.")
next_url = request.args.get("next")
if next_url:
return redirect(next_url)