| """Customer authentication for the local bank pentesting lab.""" | |
| import psycopg | |
| from database import database_layer | |
| class AuthBank: | |
| """Verify a claimed customer identity without exposing password hashes.""" | |
| def __init__(self, database: database_layer | None = None): | |
| """Accept a database dependency or construct the default PostgreSQL layer.""" | |
| self._database = database if database is not None else database_layer() | |
| def authenticate_customer(self, email: str, password: str) -> bool: | |
| """Return whether ``password`` belongs to the claimed customer. | |
| PostgreSQL's ``crypt`` hashes the candidate using the salt and cost | |
| embedded in the stored bcrypt hash. Database errors fail closed. | |
| """ | |
| # Reject malformed inputs before opening a database connection. | |
| if not isinstance(email, str) or not isinstance(password, str): | |
| return False | |
| email = email.strip() | |
| if ( | |
| not email | |
| or len(email) > 320 | |
| or not password | |
| or len(password.encode("utf-8")) > 72 | |
| ): | |
| return False | |
| try: | |
| return self._database.verify_customer_credentials(email, password) | |
| except psycopg.Error: | |
| # Authentication fails closed when PostgreSQL is unavailable or errors. | |
| return False | |
| def authenticate_customer(email: str, password: str) -> bool: | |
| """Function-call-friendly wrapper returning only an approval boolean.""" | |
| return AuthBank().authenticate_customer(email, password) | |