Ergänzung Datenschutzerklärung und Impressum, Fristenformular in Einstellungen

backend/app/routers/auth.py

@@ -28,6 +28,7 @@ from app.schemas import (
     RegisterIn,
     UserOut,
 )
+from app.runtime_settings import get_duration
 from app.users import apply_if_complete
 from app.security import (
     check_rate_limit,
@@ -96,7 +97,8 @@ def register(
         )
 
     if not check_rate_limit(
-        db, f"register:{client_ip(request)}", limit=5, window_minutes=60
+        db, bucket_key(db, "register", client_ip(request)),
+        limit=5, window_minutes=60,
     ):
         db.commit()
         raise HTTPException(status.HTTP_429_TOO_MANY_REQUESTS, "Zu viele Versuche.")
@@ -113,12 +115,14 @@ def register(
         )
         db.add(user)
         db.flush()
-        raw = _issue_token(db, user, "verify", hours=24)
+        raw = _issue_token(db, user, "verify", hours=get_duration(db, "verify_hours"))
         background.add_task(send_verification, email, raw)
     elif existing.verified_at is None:
         # Unbestaetigtes Konto: neuen Link schicken, statt zu verraten,
         # dass die Adresse schon vergeben ist.
-        raw = _issue_token(db, existing, "verify", hours=24)
+        raw = _issue_token(
+            db, existing, "verify", hours=get_duration(db, "verify_hours")
+        )
         background.add_task(send_verification, email, raw)
     # Bestaetigtes Konto: nichts tun, aber gleiche Antwort geben.
 
@@ -148,8 +152,13 @@ def verify(token: str, db: DbSession):
 def login(payload: LoginIn, request: Request, response: Response, db: DbSession):
     email = normalize_email(payload.email)
 
-    ip_ok = check_rate_limit(db, f"login-ip:{client_ip(request)}", limit=20, window_minutes=15)
-    acct_ok = check_rate_limit(db, f"login-acct:{email}", limit=8, window_minutes=15)
+    ip_ok = check_rate_limit(
+        db, bucket_key(db, "login-ip", client_ip(request)),
+        limit=20, window_minutes=15,
+    )
+    acct_ok = check_rate_limit(
+        db, bucket_key(db, "login-acct", email), limit=8, window_minutes=15
+    )
     if not (ip_ok and acct_ok):
         db.commit()
         raise HTTPException(
@@ -266,7 +275,8 @@ def reset_request(
     background: BackgroundTasks,
 ):
     if not check_rate_limit(
-        db, f"reset:{client_ip(request)}", limit=5, window_minutes=60
+        db, bucket_key(db, "reset", client_ip(request)),
+        limit=5, window_minutes=60,
     ):
         db.commit()
         raise HTTPException(status.HTTP_429_TOO_MANY_REQUESTS, "Zu viele Versuche.")
@@ -274,7 +284,7 @@ def reset_request(
     email = normalize_email(payload.email)
     user = db.scalar(select(User).where(User.email == email))
     if user is not None and user.is_active and user.verified_at is not None:
-        raw = _issue_token(db, user, "reset", hours=1)
+        raw = _issue_token(db, user, "reset", hours=get_duration(db, "reset_hours"))
         background.add_task(send_password_reset, email, raw)
 
     db.commit()