From efbb54c1e250e3d3d7ce99d4babc3091a00c902b Mon Sep 17 00:00:00 2001 From: Till Tomczak Date: Thu, 29 May 2025 19:24:14 +0200 Subject: [PATCH] "Improve database structure and templates for user login" --- backend/app/database/myp.db | Bin 106496 -> 106496 bytes backend/app/database/myp.db-wal | Bin 8272 -> 4152 bytes backend/app/debug_login.py | 200 ++++++++++++++++++++++- backend/app/templates/guest_request.html | 6 +- backend/app/templates/login.html | 24 ++- 5 files changed, 219 insertions(+), 11 deletions(-) diff --git a/backend/app/database/myp.db b/backend/app/database/myp.db index 472bd63537981f4b9ffba90e468cf02a5a516cc5..f69bc3a2323359ed86e214f94cc37eb82164a0aa 100644 GIT binary patch delta 141 zcmZoTz}9epZ3CMCiwOh2$!0+TEq=a6PewroYw<=_b#YEd$H_7Bnx;jr#Th|mmg(6+ zfxh1E9zjka`jHX-e*S@aS;ZDUl@&SZxo%lb-T|(9VWtJ)MQ+|cAxYtrcgb6+8CqJI kSn8QtnwprK7#SFu>Kd5p8d)j;h2b(57N$)K%M=(J0IRzt=l}o! delta 115 zcmZoTz}9epZ3CMCiys5O-)2Dt7k<7*eMUhBYw<=_b#YEdhRIIynx>_RPB{S?rOtU( z83v`51zsk3rd8qo<~arieom=Td4_3bsm=yb5dj{Bsg41j-Wg8%L7}OW7sy-j7?@j` TSm>FXSeltzHYqGqU~B*YFkK*H diff --git a/backend/app/database/myp.db-wal b/backend/app/database/myp.db-wal index 2d7f1f8286735b1d93870c8783dd9e4b4184b62c..4a7915b18345d826ea313e164cdfad2be09d26cf 100644 GIT binary patch delta 64 zcmccMutUMZyq>LzLHCga1A_nq5HP*Gq5l2eBk$UCe7FCwI!&twiU|X;6imF_*Kd!+ L#cf9xS_l9D-U}GK delta 286 zcmdm?aKXXCyq>LzLHCga1A_nq5HP;Hq5iGRDD(UozT1C7;-85F#e{)a3MT%kanqmu ziQ8=!S_mis#hH-hdgD?~TW_!Or@m32QINq}ypdI1oYRrP z5h%~VkeHI2ndgw3T9llcl3J{rl$uwimz4F^}>!uXF^Nn^{~^lvt8q1UAjc u*ucnC*T7WQ$Wp=3!pg+d%GgNH#N5){#M}r;#?s0VC}W^!Xl!X>YzP3ngjh2G diff --git a/backend/app/debug_login.py b/backend/app/debug_login.py index 0519ecba..875fd484 100644 --- a/backend/app/debug_login.py +++ b/backend/app/debug_login.py @@ -1 +1,199 @@ - \ No newline at end of file +#!/usr/bin/env python3.11 +""" +Debug-Script für Login-Probleme +Prüft Admin-Benutzer und Passwort-Hashing +""" + +import os +import sys +from datetime import datetime + +# Path für imports setzen +sys.path.append(os.path.dirname(os.path.abspath(__file__))) + +from models import get_db_session, User, create_initial_admin +import bcrypt + +def debug_admin_user(): + """Prüft den Admin-Benutzer in der Datenbank""" + print("=== DEBUG: Admin-Benutzer Analyse ===") + + try: + db_session = get_db_session() + + # Alle Benutzer anzeigen + users = db_session.query(User).all() + print(f"\n📊 Gefundene Benutzer: {len(users)}") + + for user in users: + print(f"\n👤 Benutzer ID: {user.id}") + print(f" Email: {user.email}") + print(f" Username: {user.username}") + print(f" Name: {user.name}") + print(f" Role: {user.role}") + print(f" Is Admin: {user.is_admin}") + print(f" Active: {user.active}") + print(f" Password Hash: {user.password_hash[:20]}...") + print(f" Created: {user.created_at}") + + # Admin-Benutzer spezifisch prüfen + admin_email = "admin@mercedes-benz.com" + admin_username = "admin" + + print(f"\n🔍 Suche nach Admin-Benutzer:") + print(f" Email: {admin_email}") + print(f" Username: {admin_username}") + + # Suche nach E-Mail + admin_by_email = db_session.query(User).filter(User.email == admin_email).first() + if admin_by_email: + print(f"✅ Admin gefunden per E-Mail: {admin_by_email.email}") + else: + print(f"❌ Kein Admin mit E-Mail {admin_email} gefunden") + + # Suche nach Username + admin_by_username = db_session.query(User).filter(User.username == admin_username).first() + if admin_by_username: + print(f"✅ Admin gefunden per Username: {admin_by_username.username}") + else: + print(f"❌ Kein Admin mit Username {admin_username} gefunden") + + db_session.close() + + return admin_by_email or admin_by_username + + except Exception as e: + print(f"❌ Fehler beim Datenbankzugriff: {str(e)}") + return None + +def test_password_verification(user, test_password="744563017196A"): + """Testet die Passwort-Verifikation""" + print(f"\n=== DEBUG: Passwort-Test ===") + print(f"Test-Passwort: {test_password}") + + if not user: + print("❌ Kein Benutzer für Passwort-Test vorhanden") + return False + + try: + # Manueller bcrypt-Test + password_bytes = test_password.encode('utf-8') + hash_bytes = user.password_hash.encode('utf-8') + + print(f"Password Bytes: {password_bytes}") + print(f"Hash (first 50 chars): {user.password_hash[:50]}") + + # Test mit bcrypt + is_valid_bcrypt = bcrypt.checkpw(password_bytes, hash_bytes) + print(f"✅ bcrypt.checkpw() Ergebnis: {is_valid_bcrypt}") + + # Test mit User-Methode + is_valid_user_method = user.check_password(test_password) + print(f"✅ user.check_password() Ergebnis: {is_valid_user_method}") + + return is_valid_bcrypt and is_valid_user_method + + except Exception as e: + print(f"❌ Fehler beim Passwort-Test: {str(e)}") + return False + +def recreate_admin(): + """Erstellt den Admin-Benutzer neu""" + print(f"\n=== DEBUG: Admin-Benutzer neu erstellen ===") + + try: + success = create_initial_admin( + email="admin@mercedes-benz.com", + password="744563017196A", + name="System Administrator", + username="admin" + ) + + if success: + print("✅ Admin-Benutzer erfolgreich erstellt/aktualisiert") + else: + print("❌ Fehler beim Erstellen des Admin-Benutzers") + + return success + + except Exception as e: + print(f"❌ Fehler beim Erstellen des Admins: {str(e)}") + return False + +def test_login_credentials(): + """Testet verschiedene Login-Kombinationen""" + print(f"\n=== DEBUG: Login-Kombinationen testen ===") + + test_combinations = [ + ("admin@mercedes-benz.com", "744563017196A"), + ("admin", "744563017196A"), + ] + + db_session = get_db_session() + + for email_or_username, password in test_combinations: + print(f"\n🔍 Teste: {email_or_username} / {password}") + + # Simuliere Login-Logic aus app.py + user = db_session.query(User).filter( + (User.username == email_or_username) | (User.email == email_or_username) + ).first() + + if user: + print(f"✅ Benutzer gefunden: {user.email} ({user.username})") + + if user.check_password(password): + print(f"✅ Passwort korrekt!") + print(f"✅ Login wäre erfolgreich für: {user.email}") + else: + print(f"❌ Passwort falsch!") + else: + print(f"❌ Kein Benutzer mit {email_or_username} gefunden") + + db_session.close() + +def check_rate_limiting(): + """Prüft Rate Limiting Status""" + print(f"\n=== DEBUG: Rate Limiting Status ===") + + # Simuliere localStorage-Werte (die wären normalerweise im Browser) + # In einer echten Anwendung würden diese aus der Datenbank oder einem Cache kommen + print("ℹ️ Rate Limiting wird client-seitig im localStorage verwaltet") + print("ℹ️ Überprüfen Sie Ihren Browser-localStorage:") + print(" - loginAttempts: sollte < 5 sein") + print(" - lastAttemptTime: Zeit des letzten Versuchs") + print("\n💡 Tipp: Öffnen Sie Entwicklertools > Application > Local Storage") + print(" und löschen Sie 'loginAttempts' und 'lastAttemptTime' Einträge") + +if __name__ == "__main__": + print("🚀 MYP Login Debug-Tool gestartet") + print("=" * 50) + + # 1. Admin-Benutzer prüfen + admin_user = debug_admin_user() + + # 2. Passwort-Verifikation testen + if admin_user: + test_password_verification(admin_user) + + # 3. Admin neu erstellen falls Probleme + if not admin_user: + print("\n⚠️ Kein Admin gefunden - erstelle neuen Admin...") + recreate_admin() + admin_user = debug_admin_user() + if admin_user: + test_password_verification(admin_user) + + # 4. Login-Kombinationen testen + test_login_credentials() + + # 5. Rate Limiting prüfen + check_rate_limiting() + + print("\n" + "=" * 50) + print("🎯 Debug abgeschlossen!") + print("\n💡 Lösungsvorschläge:") + print("1. Verwenden Sie admin@mercedes-benz.com + 744563017196A") + print("2. Oder verwenden Sie admin + 744563017196A") + print("3. Löschen Sie Rate-Limiting im Browser localStorage") + print("4. Prüfen Sie die Browser-Konsole auf JavaScript-Fehler") \ No newline at end of file diff --git a/backend/app/templates/guest_request.html b/backend/app/templates/guest_request.html index 8554b325..be1ecdb0 100644 --- a/backend/app/templates/guest_request.html +++ b/backend/app/templates/guest_request.html @@ -445,12 +445,12 @@
{% if form %} - {{ form.printer_id(class="mercedes-form-input block w-full px-4 py-3", required="required") }} + {{ form.printer_id(class="mercedes-form-input block w-full px-4 py-3") }} {% else %} - diff --git a/backend/app/templates/login.html b/backend/app/templates/login.html index 6f10c0eb..28b1e0a6 100644 --- a/backend/app/templates/login.html +++ b/backend/app/templates/login.html @@ -454,13 +454,13 @@ {% block scripts %}