Schutz gegen kursierende Partner-Codes (Rene: 'Bonus-Codes kursieren gerne das Internet')
1. QR-URL verrät den Code nicht mehr: /q/{token} → /?qr=TOKEN (vorher stand
der tippbare Code in der Adresszeile jedes Scanners). Registrierung löst
den Code server-seitig aus dem Token auf (auch ohne ref_code).
2. Notbremse: partner_codes.active — Admin kann Codes pausieren (Einlösung
gesperrt, Info-Endpoint 404, Historie/QR-Kontingente bleiben) und
reaktivieren. UI: ⏸/▶-Toggle + pausiert-Badge in der Codes-Tabelle.
3. max_uses im Anlege-Formular standardmäßig 50 statt unbegrenzt.
Tests: QR-only-Registrierung, Pause→keine Einlösung→Reaktivierung,
Redirect ohne Klartext-Code. Suite: 54 passed.
This commit is contained in:
parent
21bcc6b962
commit
2927ae2672
11 changed files with 136 additions and 39 deletions
2
VERSION
2
VERSION
|
|
@ -1 +1 @@
|
|||
1264
|
||||
1265
|
||||
|
|
@ -627,6 +627,8 @@ def _migrate(conn_factory):
|
|||
("users", "referred_qr", "TEXT"),
|
||||
# Partner-Code → Besitzer (für Self-Service: eigene QR-Kontingente + Stats einsehen)
|
||||
("partner_codes", "owner_user_id", "INTEGER"),
|
||||
# Notbremse für geleakte Codes: 0 = pausiert (Einlösung gesperrt, Historie bleibt)
|
||||
("partner_codes", "active", "INTEGER NOT NULL DEFAULT 1"),
|
||||
# Passwort-Zurücksetzen
|
||||
("users", "password_reset_token", "TEXT"),
|
||||
("users", "password_reset_expires", "TEXT"),
|
||||
|
|
|
|||
|
|
@ -2165,12 +2165,7 @@ async def partner_qr_scan(token: str):
|
|||
token = token.strip()
|
||||
with _db() as conn:
|
||||
row = conn.execute(
|
||||
"""SELECT q.token, pc.code
|
||||
FROM partner_qr_codes q
|
||||
JOIN partner_qr_batches b ON b.id = q.batch_id
|
||||
JOIN partner_codes pc ON pc.id = b.partner_code_id
|
||||
WHERE q.token = ?""",
|
||||
(token,)
|
||||
"SELECT token FROM partner_qr_codes WHERE token = ?", (token,)
|
||||
).fetchone()
|
||||
if not row:
|
||||
return _Redirect("/", status_code=302)
|
||||
|
|
@ -2182,8 +2177,10 @@ async def partner_qr_scan(token: str):
|
|||
WHERE token = ?""",
|
||||
(token,)
|
||||
)
|
||||
# ?ref= nutzt den bestehenden Partner-Code-Flow, ?qr= ergänzt die Einzelcode-Zuordnung
|
||||
return _Redirect(f"/?ref={row['code']}&qr={row['token']}", status_code=302)
|
||||
# Bewusst NUR der Token in der URL — der tippbare Partner-Code bleibt verborgen
|
||||
# (sonst könnte jeder Sticker-Scanner den Code ablesen und beliebig weitergeben).
|
||||
# Die Registrierung löst den Code server-seitig aus dem Token auf.
|
||||
return _Redirect(f"/?qr={row['token']}", status_code=302)
|
||||
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
|
|
|
|||
|
|
@ -205,11 +205,26 @@ async def register(data: RegisterRequest, response: Response, request: Request):
|
|||
).fetchone()
|
||||
new_user_id = user["id"]
|
||||
|
||||
if data.ref_code:
|
||||
code_upper = data.ref_code.strip().upper()
|
||||
# Zuerst prüfen ob es ein Partner-Code ist
|
||||
# QR-only-Flow: Die Scan-URL trägt bewusst KEINEN Klartext-Code mehr —
|
||||
# der Partner-Code wird hier server-seitig aus dem QR-Token aufgelöst.
|
||||
ref_code_in = data.ref_code
|
||||
if not ref_code_in and data.qr_token:
|
||||
qr_row = conn.execute(
|
||||
"""SELECT pc.code FROM partner_qr_codes q
|
||||
JOIN partner_qr_batches b ON b.id = q.batch_id
|
||||
JOIN partner_codes pc ON pc.id = b.partner_code_id
|
||||
WHERE q.token=?""",
|
||||
(data.qr_token.strip(),)
|
||||
).fetchone()
|
||||
if qr_row:
|
||||
ref_code_in = qr_row["code"]
|
||||
|
||||
if ref_code_in:
|
||||
code_upper = ref_code_in.strip().upper()
|
||||
# Zuerst prüfen ob es ein Partner-Code ist (active=0 = Notbremse bei
|
||||
# geleakten Codes: wird wie nicht existent behandelt, Historie bleibt)
|
||||
partner = conn.execute(
|
||||
"SELECT id, grants_founder, max_uses FROM partner_codes WHERE code=?",
|
||||
"SELECT id, grants_founder, max_uses FROM partner_codes WHERE code=? AND active=1",
|
||||
(code_upper,)
|
||||
).fetchone()
|
||||
if partner:
|
||||
|
|
|
|||
|
|
@ -37,7 +37,7 @@ def list_partner_codes(user=Depends(require_admin)):
|
|||
with db() as conn:
|
||||
rows = conn.execute(
|
||||
"""SELECT pc.id, pc.code, pc.label, pc.grants_founder,
|
||||
pc.max_uses, pc.uses, pc.created_at, pc.owner_user_id,
|
||||
pc.max_uses, pc.uses, pc.created_at, pc.owner_user_id, pc.active,
|
||||
u.name AS created_by_name,
|
||||
o.name AS owner_name
|
||||
FROM partner_codes pc
|
||||
|
|
@ -48,6 +48,21 @@ def list_partner_codes(user=Depends(require_admin)):
|
|||
return [dict(r) for r in rows]
|
||||
|
||||
|
||||
@router.post("/admin/partner/codes/{code_id}/toggle")
|
||||
def toggle_partner_code(code_id: int, user=Depends(require_admin)):
|
||||
"""Notbremse: Code pausieren/reaktivieren (z. B. wenn er im Internet kursiert).
|
||||
Pausiert = Einlösung gesperrt, Stats und QR-Kontingente bleiben erhalten."""
|
||||
with db() as conn:
|
||||
row = conn.execute(
|
||||
"SELECT active FROM partner_codes WHERE id=?", (code_id,)
|
||||
).fetchone()
|
||||
if not row:
|
||||
raise HTTPException(404, "Partner-Code nicht gefunden.")
|
||||
new_state = 0 if row["active"] else 1
|
||||
conn.execute("UPDATE partner_codes SET active=? WHERE id=?", (new_state, code_id))
|
||||
return {"active": new_state}
|
||||
|
||||
|
||||
@router.post("/admin/partner/codes", status_code=201)
|
||||
def create_partner_code(data: PartnerCodeCreate, user=Depends(require_admin)):
|
||||
"""Neuen Partner-Code erstellen (admin only)."""
|
||||
|
|
@ -197,7 +212,7 @@ def partner_code_info(code: str):
|
|||
with db() as conn:
|
||||
row = conn.execute(
|
||||
"""SELECT code, label, grants_founder, max_uses, uses
|
||||
FROM partner_codes WHERE code=?""",
|
||||
FROM partner_codes WHERE code=? AND active=1""",
|
||||
(code.strip().upper(),)
|
||||
).fetchone()
|
||||
if not row:
|
||||
|
|
|
|||
|
|
@ -86,14 +86,14 @@
|
|||
<title>Ban Yaro</title>
|
||||
|
||||
<!-- Theme + theme-color Statusleiste vor CSS setzen -->
|
||||
<script src="/js/boot-early.js?v=1264"></script>
|
||||
<script src="/js/boot-early.js?v=1265"></script>
|
||||
|
||||
<!-- CSS: Reihenfolge ist wichtig — ?v= zwingt Browser zur Neuladung -->
|
||||
<link rel="stylesheet" href="/css/design-system.css?v=1264">
|
||||
<link rel="stylesheet" href="/css/layout.css?v=1264">
|
||||
<link rel="stylesheet" href="/css/components.css?v=1264">
|
||||
<link rel="stylesheet" href="/css/utilities.css?v=1264">
|
||||
<link rel="stylesheet" href="/css/lists.css?v=1264">
|
||||
<link rel="stylesheet" href="/css/design-system.css?v=1265">
|
||||
<link rel="stylesheet" href="/css/layout.css?v=1265">
|
||||
<link rel="stylesheet" href="/css/components.css?v=1265">
|
||||
<link rel="stylesheet" href="/css/utilities.css?v=1265">
|
||||
<link rel="stylesheet" href="/css/lists.css?v=1265">
|
||||
</head>
|
||||
<body>
|
||||
|
||||
|
|
@ -616,11 +616,11 @@
|
|||
<div id="modal-container"></div>
|
||||
|
||||
<!-- JS: Reihenfolge ist wichtig — erst Basis, dann Features -->
|
||||
<script src="/js/api.js?v=1264"></script>
|
||||
<script src="/js/ui.js?v=1264"></script>
|
||||
<script src="/js/app.js?v=1264"></script>
|
||||
<script src="/js/worlds.js?v=1264"></script>
|
||||
<script src="/js/offline-indicator.js?v=1264"></script>
|
||||
<script src="/js/api.js?v=1265"></script>
|
||||
<script src="/js/ui.js?v=1265"></script>
|
||||
<script src="/js/app.js?v=1265"></script>
|
||||
<script src="/js/worlds.js?v=1265"></script>
|
||||
<script src="/js/offline-indicator.js?v=1265"></script>
|
||||
|
||||
<!-- Feature-Seiten werden lazy geladen -->
|
||||
|
||||
|
|
@ -630,7 +630,7 @@
|
|||
|
||||
|
||||
<!-- Boot: Offline-Banner + SW-Registration (extrahiert für CSP) -->
|
||||
<script src="/js/boot.js?v=1264"></script>
|
||||
<script src="/js/boot.js?v=1265"></script>
|
||||
|
||||
|
||||
</body>
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@
|
|||
Router, State-Management, Navigation, Initialisierung.
|
||||
============================================================ */
|
||||
|
||||
const APP_VER = '1264'; // ← bei jedem Deploy mit Frontend-Änderungen erhöhen
|
||||
const APP_VER = '1265'; // ← bei jedem Deploy mit Frontend-Änderungen erhöhen
|
||||
const APP_VERSION = '1.6.0'; // ← semantische Version, wird bei make release gesetzt
|
||||
window.APP_VER = APP_VER; // global verfügbar für andere Module (z.B. offline-indicator)
|
||||
window.APP_VERSION = APP_VERSION;
|
||||
|
|
@ -1142,11 +1142,14 @@ const App = (() => {
|
|||
const urlParams = new URLSearchParams(window.location.search);
|
||||
const refCode = urlParams.get('ref');
|
||||
const qrToken = urlParams.get('qr');
|
||||
if (refCode) {
|
||||
if (refCode || qrToken) {
|
||||
try {
|
||||
localStorage.setItem('by_ref_code', refCode.toUpperCase());
|
||||
localStorage.setItem('by_ref_code_ts', String(Date.now()));
|
||||
// Partner-QR-Token (Sticker/Flyer) für Einzelcode-Rückverfolgung mitspeichern
|
||||
if (refCode) {
|
||||
localStorage.setItem('by_ref_code', refCode.toUpperCase());
|
||||
localStorage.setItem('by_ref_code_ts', String(Date.now()));
|
||||
}
|
||||
// Partner-QR-Token (Sticker/Flyer): kommt bewusst OHNE Klartext-Code —
|
||||
// die Registrierung löst den Partner-Code server-seitig aus dem Token auf
|
||||
if (qrToken) localStorage.setItem('by_qr_token', qrToken);
|
||||
} catch {}
|
||||
// URL bereinigen ohne Reload
|
||||
|
|
|
|||
|
|
@ -2326,8 +2326,8 @@ window.Page_admin = (() => {
|
|||
</div>
|
||||
<div style="display:grid;grid-template-columns:1fr 1fr;gap:var(--space-3);align-items:center">
|
||||
<div>
|
||||
<label class="form-label text-xs">Max. Einlösungen <span class="text-muted">(leer = unbegrenzt)</span></label>
|
||||
<input class="form-control" name="max_uses" type="number" min="1" placeholder="∞">
|
||||
<label class="form-label text-xs">Max. Einlösungen <span class="text-muted">(leer = unbegrenzt — Vorsicht, Codes kursieren gern im Netz)</span></label>
|
||||
<input class="form-control" name="max_uses" type="number" min="1" value="50" placeholder="∞">
|
||||
</div>
|
||||
<div style="display:flex;align-items:center;gap:var(--space-2);padding-top:var(--space-5)">
|
||||
<input type="checkbox" id="adm-grants-founder" name="grants_founder" checked
|
||||
|
|
@ -2361,9 +2361,10 @@ window.Page_admin = (() => {
|
|||
</thead>
|
||||
<tbody>
|
||||
${codes.map(c => `
|
||||
<tr style="border-bottom:1px solid var(--c-border)" data-code-id="${c.id}">
|
||||
<tr style="border-bottom:1px solid var(--c-border);${c.active ? '' : 'opacity:.55'}" data-code-id="${c.id}">
|
||||
<td style="padding:var(--space-2) var(--space-3)">
|
||||
<code style="font-weight:700;color:var(--c-primary);letter-spacing:.08em">${c.code}</code>
|
||||
${c.active ? '' : `<div><span class="badge" style="background:#fee2e2;color:#dc2626;font-size:10px">⏸ pausiert</span></div>`}
|
||||
</td>
|
||||
<td style="padding:var(--space-2) var(--space-3);color:var(--c-text)">
|
||||
${c.label}
|
||||
|
|
@ -2379,7 +2380,12 @@ window.Page_admin = (() => {
|
|||
<td style="padding:var(--space-2) var(--space-3);text-align:center">
|
||||
${c.grants_founder ? '✓' : '—'}
|
||||
</td>
|
||||
<td style="padding:var(--space-2) var(--space-3)">
|
||||
<td style="padding:var(--space-2) var(--space-3);white-space:nowrap;text-align:right">
|
||||
<button class="btn btn-ghost btn-sm adm-toggle-code" data-id="${c.id}"
|
||||
title="${c.active ? 'Pausieren — Notbremse wenn der Code im Netz kursiert (Einlösung gesperrt, Historie bleibt)' : 'Wieder aktivieren'}"
|
||||
style="font-size:var(--text-xs)">
|
||||
${c.active ? '⏸ Pausieren' : '▶ Aktivieren'}
|
||||
</button>
|
||||
<button class="btn btn-ghost btn-sm adm-del-code" data-id="${c.id}"
|
||||
style="color:var(--c-danger,#dc2626);font-size:var(--text-xs)">
|
||||
${UI.icon('trash')} Löschen
|
||||
|
|
@ -2565,6 +2571,17 @@ window.Page_admin = (() => {
|
|||
</div>
|
||||
`;
|
||||
|
||||
// Code pausieren/aktivieren (Notbremse bei geleakten Codes)
|
||||
el.querySelectorAll('.adm-toggle-code').forEach(btn => {
|
||||
btn.addEventListener('click', async () => {
|
||||
try {
|
||||
const r = await API.post(`/admin/partner/codes/${btn.dataset.id}/toggle`, {});
|
||||
UI.toast.success(r.active ? 'Code wieder aktiv.' : 'Code pausiert — Einlösungen sind gesperrt.');
|
||||
await _renderPartner(el);
|
||||
} catch (err) { UI.toast.error(err.message); }
|
||||
});
|
||||
});
|
||||
|
||||
// Code-Besitzer zuordnen (Self-Service-QR-Zugriff für den Partner)
|
||||
el.querySelectorAll('.adm-code-owner').forEach(btn => {
|
||||
btn.addEventListener('click', async () => {
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@
|
|||
<meta charset="UTF-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
<meta name="color-scheme" content="light dark">
|
||||
<script src="/js/landing-init.js?v=1264"></script>
|
||||
<script src="/js/landing-init.js?v=1265"></script>
|
||||
<title>Ban Yaro — Die Hunde-App für Deutschland, Österreich & Schweiz</title>
|
||||
<meta name="description" content="Ban Yaro: Die kostenlose All-in-One Hunde-App für DACH. Tagebuch, Giftköder-Alarm, Training mit KI, Forum, Wurfbörse, Stammbaum, Inzucht-Check — DSGVO-konform, offline-fähig, direkt im Browser.">
|
||||
<meta name="keywords" content="Hunde App, Hunde Community, Wurfbörse, Züchter, Welpen kaufen, Stammbaum Hund, Inzuchtkoeffizient, Hundezucht, Impfpass Hund, Giftköder Alarm, Gassi Community, Hundetraining App, Hunde Forum, Hunde KI, Hundefilm Datenbank, Welpen Marktplatz">
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@
|
|||
============================================================ */
|
||||
|
||||
// ← EINZIGE Stelle für die Version — STATIC_ASSETS und CACHE_VERSION leiten sich ab
|
||||
const VER = '1264';
|
||||
const VER = '1265';
|
||||
const CACHE_VERSION = `by-v${VER}`;
|
||||
const CACHE_STATIC = `${CACHE_VERSION}-static`;
|
||||
const CACHE_TILES = 'ban-yaro-tiles-v1'; // bleibt über SW-Updates erhalten
|
||||
|
|
|
|||
|
|
@ -50,7 +50,9 @@ def test_scan_redirects_and_counts(client, admin):
|
|||
|
||||
r = client.get(f"/q/{token}", follow_redirects=False)
|
||||
assert r.status_code == 302
|
||||
assert r.headers["location"] == f"/?ref={code['code']}&qr={token}"
|
||||
# Bewusst KEIN Klartext-Code in der URL — sonst liest jeder Scanner den Code ab
|
||||
assert r.headers["location"] == f"/?qr={token}"
|
||||
assert code["code"] not in r.headers["location"]
|
||||
client.get(f"/q/{token}", follow_redirects=False)
|
||||
|
||||
r = client.get("/api/admin/partner/qr-batches", headers=admin["headers"])
|
||||
|
|
@ -104,6 +106,52 @@ def test_registration_attributed_to_qr(client, admin):
|
|||
assert regs[0]["created_at"]
|
||||
|
||||
|
||||
def test_registration_with_qr_only(client, admin):
|
||||
"""Registrierung NUR mit qr_token (ohne ref_code) -> Code wird server-seitig aufgeloest."""
|
||||
code = _create_code(client, admin)
|
||||
batch = _create_batch(client, admin, code["id"], quantity=1)
|
||||
token = _batch_tokens(batch["id"])[0]
|
||||
|
||||
email = f"qro-{secrets.token_hex(4)}@example.com"
|
||||
r = client.post("/api/auth/register", json={
|
||||
"email": email, "password": "QrTest1234!", "name": f"qro{secrets.token_hex(3)}",
|
||||
"qr_token": token,
|
||||
})
|
||||
assert r.status_code == 200, r.text
|
||||
from database import db
|
||||
with db() as conn:
|
||||
row = conn.execute("SELECT referred_by, referred_qr FROM users WHERE email=?", (email,)).fetchone()
|
||||
assert row["referred_by"] == -code["id"]
|
||||
assert row["referred_qr"] == token
|
||||
|
||||
|
||||
def test_paused_code_not_redeemable(client, admin):
|
||||
"""Pausierter Code (Notbremse) -> keine Einloesung, Info-Endpoint 404; reaktivierbar."""
|
||||
code = _create_code(client, admin)
|
||||
r = client.post(f"/api/admin/partner/codes/{code['id']}/toggle", headers=admin["headers"])
|
||||
assert r.status_code == 200 and r.json()["active"] == 0
|
||||
|
||||
# Info-Endpoint: wie nicht existent
|
||||
assert client.get(f"/api/partner/codes/{code['code']}/info").status_code == 404
|
||||
|
||||
# Registrierung mit pausiertem Code -> keine Zuordnung
|
||||
email = f"qrp-{secrets.token_hex(4)}@example.com"
|
||||
r = client.post("/api/auth/register", json={
|
||||
"email": email, "password": "QrTest1234!", "name": f"qrp{secrets.token_hex(3)}",
|
||||
"ref_code": code["code"],
|
||||
})
|
||||
assert r.status_code == 200, r.text
|
||||
from database import db
|
||||
with db() as conn:
|
||||
row = conn.execute("SELECT referred_by FROM users WHERE email=?", (email,)).fetchone()
|
||||
assert row["referred_by"] is None
|
||||
|
||||
# Reaktivieren funktioniert
|
||||
r = client.post(f"/api/admin/partner/codes/{code['id']}/toggle", headers=admin["headers"])
|
||||
assert r.json()["active"] == 1
|
||||
assert client.get(f"/api/partner/codes/{code['code']}/info").status_code == 200
|
||||
|
||||
|
||||
def test_qr_token_must_match_code(client, admin):
|
||||
"""QR-Token eines FREMDEN Codes wird nicht zugeordnet (Manipulationsschutz)."""
|
||||
code_a = _create_code(client, admin)
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue