RomanNum3ral
/
Cybersecurity-Projects
mirror of https://github.com/CarterPerez-dev/Cybersecurity-Projects.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add: bug bounty platform project

This commit is contained in:
CarterPerez-dev 2026-01-06 13:09:01 -05:00
parent 0794c43e9b
commit e4501c6697
197 changed files with 35392 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

109
PROJECTS/bug-bounty-platform/.env.example Normal file
View File

@ -0,0 +1,109 @@
# =============================================================================
# AngelaMos | 2026
# .env.example
# =============================================================================
# Copy this file to .env and update values for your environment
# =============================================================================
# =============================================================================
# HOST PORTS (change these to avoid conflicts between projects)
# =============================================================================
NGINX_HOST_PORT=8420
BACKEND_HOST_PORT=5420
FRONTEND_HOST_PORT=3420
POSTGRES_HOST_PORT=4420
REDIS_HOST_PORT=6420
# =============================================================================
# Application
# =============================================================================
APP_NAME=FullStack-Template
ENVIRONMENT=development
DEBUG=true
LOG_LEVEL=INFO
LOG_JSON_FORMAT=false
# =============================================================================
# Server (internal container settings)
# =============================================================================
HOST=0.0.0.0
PORT=8000
RELOAD=true
# =============================================================================
# PostgreSQL
# =============================================================================
POSTGRES_USER=postgres
POSTGRES_PASSWORD=postgres
POSTGRES_DB=app_db
POSTGRES_HOST=db
POSTGRES_CONTAINER_PORT=5432
DATABASE_URL=postgresql+asyncpg://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_CONTAINER_PORT}/${POSTGRES_DB}
DB_POOL_SIZE=20
DB_MAX_OVERFLOW=10
DB_POOL_TIMEOUT=30
DB_POOL_RECYCLE=1800
# =============================================================================
# Redis
# =============================================================================
REDIS_HOST=redis
REDIS_CONTAINER_PORT=6379
REDIS_PASSWORD=
REDIS_URL=redis://${REDIS_HOST}:${REDIS_CONTAINER_PORT}
# =============================================================================
# Security / JWT
# =============================================================================
SECRET_KEY=dev-only-change-this-in-production-minimum-32-characters-long
JWT_ALGORITHM=HS256
ACCESS_TOKEN_EXPIRE_MINUTES=15
REFRESH_TOKEN_EXPIRE_DAYS=7
# =============================================================================
# Admin Bootstrap (optional)
# =============================================================================
# If set, registering with this email auto-promotes to admin role.
# Leave empty or remove to disable auto-admin (all users register as USER).
ADMIN_EMAIL=
# =============================================================================
# CORS (must match HOST PORTS above!)
# =============================================================================
# Format: http://localhost:<NGINX_HOST_PORT>,http://localhost:<FRONTEND_HOST_PORT>
# Update these if you change the host ports above
CORS_ORIGINS=http://localhost,http://localhost:8420,http://localhost:3420
# =============================================================================
# Rate Limiting
# =============================================================================
RATE_LIMIT_DEFAULT=100/minute
RATE_LIMIT_AUTH=20/minute
# =============================================================================
# Frontend (Vite)
# =============================================================================
VITE_API_URL=/api
VITE_API_TARGET=http://localhost:8000
VITE_APP_TITLE=My App
# =============================================================================
# Cloudflare Tunnel (Production only - or use whatever deployment method you want)
# =============================================================================
# Option 1: Cloudflare Tunnel (zero config, no port forwarding needed)
# - Get token from Cloudflare Zero Trust dashboard
# - Access > Tunnels > Create a tunnel > Name it > Copy token below
# - Configure public hostname: yourdomain.com -> http://nginx:80
#
# Option 2: Traditional hosting (VM + domain + DNS)
# - Host on a VM, buy a domain, create A/CNAME record in Cloudflare DNS
# - Point to your VM's IP, expose nginx port, configure reverse proxy/SSL
#
# Option 3: Whatever works for you
# - Just make sure your nginx container is accessible and SSL is configured
CLOUDFLARE_TUNNEL_TOKEN=

39
PROJECTS/bug-bounty-platform/.gitignore vendored Normal file
View File

@ -0,0 +1,39 @@
# AngelaMos | 2025
# dev.compose.yml
venv
*.venv
*.env
*.cache
*.egg
__pycache__/
*.py[cod]
*$py.class
*.so
.Python
build/
develop-eggs/
dist/
downloads/
eggs/
.eggs/
lib64/
parts/
sdist/
var/
wheels/
*.egg-info/
.installed.cfg
*.egg
.pytest_cache/
.coverage
htmlcov/
.tox/
.mypy_cache/
.dmypy.json
dmypy.json
.DS_Store

36
PROJECTS/bug-bounty-platform/.pre-commit-config.yaml Normal file
View File

@ -0,0 +1,36 @@
# .pre-commit-config.yaml
repos:
- repo: https://github.com/astral-sh/ruff-pre-commit
rev: v0.14.8
hooks:
- id: ruff
args: ["backend/"]
always_run: true
- repo: local
hooks:
- id: mypy-check
name: MyPy Type Checking
entry: bash -c 'cd backend && mypy .'
language: system
types: [python]
pass_filenames: false
always_run: true
- id: pylint-check
name: PyLint Code Quality
entry: bash -c 'cd backend && pylint .'
language: system
types: [python]
pass_filenames: false
always_run: true
- repo: https://github.com/pre-commit/pre-commit-hooks
rev: v6.0.0
hooks:
- id: check-toml
- id: debug-statements
- id: end-of-file-fixer
- id: check-yaml
args: [--allow-multiple-documents]

21
PROJECTS/bug-bounty-platform/LICENSE Normal file
View File

@ -0,0 +1,21 @@
MIT License
©AngelaMos | 2026 | CarterPerez-dev
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

532
PROJECTS/bug-bounty-platform/README.md Normal file
View File

@ -0,0 +1,532 @@
# Bug Bounty Platform
A production-ready, enterprise-grade bug bounty platform built with modern web technologies. This platform enables companies to run coordinated vulnerability disclosure programs, allowing security researchers to submit findings and receive rewards.
**Live Demo:** [bugbounty.carterperez-dev.com](https://bugbounty.carterperez-dev.com)
**API Documentation:** [bugbounty.carterperez-dev.com/api/docs](https://bugbounty.carterperez-dev.com/api/docs)
---
## Overview
This project demonstrates enterprise-level software architecture with:
- Async-first FastAPI backend with strict type safety
- Modern React frontend with TypeScript
- Production-ready security (JWT with refresh token rotation, Argon2id hashing)
- Advanced design patterns (Dependency Injection, Repository Pattern, Layered Architecture)
- Docker containerization with multi-stage builds
- Database migrations with Alembic
- Comprehensive testing and linting infrastructure
**Part of:** [Cybersecurity-Projects Repository](https://github.com/CarterPerez-dev/Cybersecurity-Projects) (60+ security-focused projects)
---
## Features
### Security Researcher Features
- User registration and authentication
- Browse public bug bounty programs
- Submit vulnerability reports with markdown support
- Track report status and receive updates
- Earn reputation and rewards
### Company Features
- Create and manage bug bounty programs
- Define program scope (assets, reward tiers, SLA)
- Triage incoming vulnerability reports
- Assess severity using CVSS scoring
- Award bounties to researchers
- Communicate via comments and attachments
### Platform Features
- Role-based access control (Researcher, Company, Admin)
- JWT authentication with refresh token rotation
- Token versioning for instant session invalidation
- Multi-device session management
- Rate limiting on all endpoints
- Comprehensive audit logging
- OpenAPI/Swagger documentation
---
## Tech Stack
### Backend
- **FastAPI** 0.123.0+ - Modern async Python web framework
- **Python** 3.12+ - Strict typing with mypy
- **PostgreSQL** 18 - Primary database with asyncpg driver
- **Redis** 7 - Caching and session storage
- **SQLAlchemy** 2.0+ - Async ORM
- **Alembic** - Database migrations
- **Pydantic** v2 - Data validation and settings
- **JWT** - Token-based authentication with rotation
- **Argon2id** - Password hashing via pwdlib
### Frontend
- **React** 19.2+ - UI library
- **TypeScript** 5.9 - Static typing
- **Vite** 7 - Build tool with Rolldown
- **React Router** 7.1 - File-based routing
- **TanStack Query** v5 - Server state management
- **Zustand** - Client state management
- **Axios** - HTTP client
- **SASS** - CSS preprocessing
### Infrastructure
- **Docker** + **Docker Compose** - Containerization
- **Nginx** - Reverse proxy and static file serving
- **Cloudflare Tunnel** - Zero-config deployment (optional)
- **Gunicorn** + **Uvicorn** - Production ASGI server
### Development Tools
- **Ruff** - Python linting and formatting
- **Biome** - JavaScript/TypeScript linting
- **MyPy** - Static type checking
- **Pytest** - Testing framework
- **Just** - Task runner (30+ commands)
- **Pre-commit hooks** - Automated quality checks
---
## Getting Started
You have two options:
### Option 1: Use the Live API (Easiest)
The platform is already deployed and running! You can:
- Use the web interface: [bugbounty.carterperez-dev.com](https://bugbounty.carterperez-dev.com)
- Access the API directly: [bugbounty.carterperez-dev.com/api/](https://bugbounty.carterperez-dev.com/api/)
- View API documentation: [bugbounty.carterperez-dev.com/api/docs](https://bugbounty.carterperez-dev.com/api/docs)
You can build your own client application using the deployed API endpoints. See the OpenAPI documentation for available endpoints and schemas.
### Option 2: Run It Yourself
If you want to run the entire platform locally or deploy your own instance:
#### Prerequisites
- [Docker](https://docs.docker.com/get-docker/) and [Docker Compose](https://docs.docker.com/compose/install/)
- [Just](https://github.com/casey/just) (task runner) - `cargo install just` or see [installation guide](https://github.com/casey/just#installation)
- Git
#### Quick Start
1. **Clone the repository:**
```bash
git clone https://github.com/CarterPerez-dev/Cybersecurity-Projects.git
cd Cybersecurity-Projects/PROJECTS/bug-bounty-platform
```
2. **Configure environment variables:**
```bash
cp .env.example .env
```
Edit `.env` and update these critical values:
- `SECRET_KEY` - Generate a secure random string (minimum 32 characters)
- `POSTGRES_PASSWORD` - Set a strong database password
- `ADMIN_EMAIL` - (Optional) First user with this email becomes admin
- `CORS_ORIGINS` - Update if using different ports
3. **Start the platform (development mode with hot reload):**
```bash
just dev-up
```
Or in production mode:
```bash
just up
```
4. **Access the platform:**
- **Frontend:** http://localhost:8420
- **API:** http://localhost:8420/api
- **API Docs:** http://localhost:8420/api/docs
- **Backend (direct):** http://localhost:5420
- **Frontend Dev Server:** http://localhost:3420 (dev mode only)
5. **Apply database migrations:**
```bash
just migrate head
```
6. **Create your first account:**
- Navigate to http://localhost:8420
- Click "Register"
- If you set `ADMIN_EMAIL` in `.env`, registering with that email grants admin privileges
#### Common Commands
The `justfile` provides 30+ commands for development:
```bash
just # List all available commands
# Development
just dev-up # Start in development mode (hot reload)
just dev-down # Stop development containers
just dev-logs backend # View backend logs
just dev-shell backend # Open shell in backend container
# Production
just up # Start in production mode
just down # Stop production containers
just build # Build all containers
just rebuild # Rebuild without cache
# Database
just migrate head # Apply all migrations
just migration "message" # Create new migration
just rollback # Rollback last migration
just db-current # Show current migration
# Linting & Type Checking
just lint # Run ruff + pylint
just ruff-fix # Auto-fix linting issues
just mypy # Type check with mypy
just biome-fix # Fix frontend linting issues
just typecheck # Run all type checks
# Testing
just test # Run all tests
just test-cov # Run tests with coverage report
# CI
just ci # Run full CI pipeline (lint + typecheck + test)
```
#### Project Structure
```
bug-bounty-platform/
├── backend/ # FastAPI backend (~7,000 lines)
│ ├── src/
│ │ ├── app/
│ │ │ ├── core/ # Base classes, database, security, constants and enums, etc.
│ │ │ ├── user/ # User domain
│ │ │ ├── auth/ # Authentication
│ │ │ ├── program/ # Bug bounty programs
│ │ │ ├── report/ # Vulnerability reports
│ │ │ └── admin/ # Admin functionality
│ │ └── config.py # configuration values
│ │ └── factory.py # essentially the 'main.py' file
│ │ └── __main__.py # Where the run command lives
│ ├── alembic/ # Database migrations
│ ├── tests/ # Unit and integration tests
│ └── pyproject.toml # Python dependencies
│
├── frontend/ # React + TypeScript frontend
│ ├── src/
│ │ ├── routes/ # Pages
│ │ ├── api/ # API client and hooks
│ │ ├── components/ # Reusable components
│ │ ├── styles/ # SCSS global values
│ │ └── core/ # App configuration, zustand stores (ui state management), api configuration
│ └── package.json
│
├── infra/ # Docker and Nginx configs
│ ├── nginx/
│ └── docker/
│
├── learn/ # Educational documentation (see below)
├── compose.yml # Production Docker Compose
├── dev.compose.yml # Development Docker Compose
├── justfile # Task runner commands
└── .env.example # Environment variables template
```
---
## Configuration
### Environment Variables
All configuration is done via `.env` file. Key variables:
| Variable | Description | Default |
|----------|-------------|---------|
| `NGINX_HOST_PORT` | External port for Nginx | 8420 |
| `BACKEND_HOST_PORT` | External port for backend API | 5420 |
| `FRONTEND_HOST_PORT` | External port for frontend dev server | 3420 |
| `POSTGRES_HOST_PORT` | External port for PostgreSQL | 4420 |
| `REDIS_HOST_PORT` | External port for Redis | 6420 |
| `SECRET_KEY` | JWT signing key (min 32 chars) | **MUST CHANGE** |
| `POSTGRES_PASSWORD` | Database password | **MUST CHANGE** |
| `ADMIN_EMAIL` | Auto-promote this email to admin | (empty) |
| `ENVIRONMENT` | dev/staging/production | development |
| `ACCESS_TOKEN_EXPIRE_MINUTES` | JWT access token lifetime | 15 |
| `REFRESH_TOKEN_EXPIRE_DAYS` | Refresh token lifetime | 7 |
See `.env.example` for all available options.
### Port Configuration
If the default ports conflict with other services, update these in `.env`:
```bash
NGINX_HOST_PORT=8420 # Change to any available port
BACKEND_HOST_PORT=5420 # Change to any available port
FRONTEND_HOST_PORT=3420 # Change to any available port
POSTGRES_HOST_PORT=4420 # Change to any available port
REDIS_HOST_PORT=6420 # Change to any available port
# IMPORTANT: Update CORS_ORIGINS to match NGINX_HOST_PORT
CORS_ORIGINS=http://localhost,http://localhost:8420,http://localhost:3420
```
---
## Deployment
### Option 1: Cloudflare Tunnel (Recommended for beginners)
No port forwarding or reverse proxy configuration needed!
1. Create a Cloudflare account and add your domain
2. Go to Zero Trust Dashboard > Access > Tunnels
3. Create a new tunnel, name it, and copy the token
4. Add the token to `.env`:
```bash
CLOUDFLARE_TUNNEL_TOKEN=your-token-here
```
5. Configure public hostname in Cloudflare:
- Public hostname: `yourdomain.com`
- Service: `http://nginx:80`
6. Start the platform:
```bash
just up
```
Your platform is now live at `https://yourdomain.com`!
### Option 2: Traditional Hosting (VPS)
1. Rent a VPS (DigitalOcean, AWS, Linode, etc.)
2. Install Docker and Docker Compose
3. Clone the repository and configure `.env`
4. Point your domain's A record to your VPS IP
5. Configure SSL (Let's Encrypt with Certbot)
6. Start the platform:
```bash
just up
```
### Option 3: Use the Existing Deployment
Just use the API at `bugbounty.carterperez-dev.com/api/` - no deployment needed!
---
## Learning Resources
This project includes comprehensive educational documentation in the `learn/` directory:
- **[ARCHITECTURE.md](learn/ARCHITECTURE.md)** - Deep dive into system architecture and design decisions
- **[PATTERNS.md](learn/PATTERNS.md)** - Explanation of design patterns used (DI, Repository, etc.)
- **[GETTING-STARTED.md](learn/GETTING-STARTED.md)** - Step-by-step tutorial for building similar applications
- **[DATABASE.md](learn/DATABASE.md)** - Database schema design and migration strategies
- **[SECURITY.md](learn/SECURITY.md)** - Security features and best practices explained
These documents are designed to help you understand not just *what* the code does, but *why* it's architected this way and *how* you can apply these patterns to your own projects.
---
## API Documentation
### Interactive Documentation
When running locally, access interactive API docs at:
- **Swagger UI:** http://localhost:8420/api/docs
- **ReDoc:** http://localhost:8420/api/redoc
For the live deployment:
- **Swagger UI:** [bugbounty.carterperez-dev.com/api/docs](https://bugbounty.carterperez-dev.com/api/docs)
### Key Endpoints
**Authentication:**
- `POST /api/v1/auth/register` - Create new account
- `POST /api/v1/auth/login` - Login (returns access + refresh tokens)
- `POST /api/v1/auth/refresh` - Refresh access token
- `POST /api/v1/auth/logout` - Logout (invalidates refresh token)
- `POST /api/v1/auth/logout-all` - Logout from all devices
**Users:**
- `GET /api/v1/users/me` - Get current user profile
- `PATCH /api/v1/users/me` - Update profile
- `GET /api/v1/users/{id}` - Get public user profile
**Programs:**
- `GET /api/v1/programs` - List all programs (paginated)
- `GET /api/v1/programs/{slug}` - Get program details
- `POST /api/v1/programs` - Create program (company only)
- `PATCH /api/v1/programs/{slug}` - Update program (owner only)
- `DELETE /api/v1/programs/{slug}` - Delete program (owner only)
**Reports:**
- `GET /api/v1/reports` - List your reports
- `GET /api/v1/reports/{id}` - Get report details
- `POST /api/v1/reports` - Submit vulnerability report
- `PATCH /api/v1/reports/{id}` - Update report (various endpoints for status changes)
**Admin:**
- `GET /api/v1/admin/stats` - Platform statistics
- `GET /api/v1/admin/users` - Manage users
- `GET /api/v1/admin/programs` - Manage programs
- `GET /api/v1/admin/reports` - Manage reports
All endpoints return JSON and use standard HTTP status codes.
---
## Development
### Running Tests
```bash
just test # Run all tests
just test-cov # Run with coverage report
```
### Type Checking
```bash
just mypy # Check backend types
just tsc # Check frontend types
just typecheck # Check all types
```
### Linting
```bash
just lint # Backend: ruff + pylint
just ruff-fix # Auto-fix backend linting issues
just biome-fix # Auto-fix frontend linting issues
just stylelint-fix # Auto-fix SCSS linting issues
```
### Database Migrations
```bash
just migration "Add user reputation field" # Create new migration
just migrate head # Apply all migrations
just rollback # Rollback last migration
just db-history # View migration history
```
### Docker Management
```bash
just dev-shell backend # Open shell in backend container
just dev-shell db # Open psql in database container
just dev-logs nginx # View nginx logs
just ps # List running containers
```
---
## Architecture Highlights
### Dependency Injection
FastAPI's dependency injection system is used extensively:
```python
from fastapi import Depends
from typing import Annotated
CurrentUser = Annotated[User, Depends(get_current_user)]
@router.get("/me")
async def get_me(user: CurrentUser) -> UserSchema:
return user
```
### Repository Pattern
All database operations go through repositories:
```python
class UserRepository(BaseRepository[User]):
async def find_by_email(self, email: str) -> User | None:
stmt = select(User).where(User.email == email)
result = await self.session.execute(stmt)
return result.scalar_one_or_none()
# Usage in service layer
async def authenticate_user(email: str, password: str) -> User:
user = await user_repo.find_by_email(email)
if not user or not verify_password(password, user.password_hash):
raise InvalidCredentialsError()
return user
```
### Type Safety
Strict type checking with mypy and TypeScript:
```python
from typing import Generic, TypeVar
ModelT = TypeVar("ModelT", bound=Base)
class BaseRepository(Generic[ModelT]):
def __init__(self, session: AsyncSession, model: type[ModelT]) -> None:
self.session = session
self.model = model
```
### Security
Multiple layers of security:
- JWT tokens with HS256 algorithm
- Token versioning (instant invalidation on password change)
- Refresh token rotation (prevents replay attacks)
- Argon2id password hashing
- Rate limiting (100 req/min default, 20 req/min for auth)
- CORS protection
- Input validation with Pydantic
See [learn/SECURITY.md](learn/SECURITY.md) for detailed explanations.
---
## Contributing
This is an educational project demonstrating production-level architecture. Feel free to:
- Fork the repository and build upon it
- Use it as a reference for your own projects
- Submit issues if you find bugs
- Share feedback and suggestions
---
## License
This project is part of the [Cybersecurity-Projects](https://github.com/CarterPerez-dev/Cybersecurity-Projects) repository.
© AngelaMos | 2026
---
## Links
- **Live Platform:** [bugbounty.carterperez-dev.com](https://bugbounty.carterperez-dev.com)
- **API Docs:** [bugbounty.carterperez-dev.com/api/docs](https://bugbounty.carterperez-dev.com/api/docs)
- **Parent Repository:** [Cybersecurity-Projects](https://github.com/CarterPerez-dev/Cybersecurity-Projects)
---
## Support
For questions, issues, or discussions:
1. Check the [learn/](learn/) directory for detailed documentation
2. Review the API documentation at `/api/docs`
3. Open an issue in the parent repository
4. Email: [contact information if applicable]
---
**Happy Hacking! 🔒**

85
PROJECTS/bug-bounty-platform/backend/.dockerignore Normal file
View File

@ -0,0 +1,85 @@
# ===============================
# © AngelaMos | 2025
# .dockerignore
# ===============================
# Virtual environments
.venv/
venv/
ENV/
# Python cache
__pycache__/
*.py[cod]
*$py.class
*.pyo
# Type checker / linter caches
.mypy_cache/
.ruff_cache/
.pytest_cache/
.ty_cache/
# Coverage
.coverage
.coverage.*
htmlcov/
coverage.xml
*.cover
# Build artifacts
dist/
build/
*.egg-info/
*.egg
# IDE
.idea/
.vscode/
*.swp
*.swo
*~
# Environment files (keep .env.example)
.env
.env.local
.env.*.local
# Git
.git/
.gitignore
.gitattributes
# Docker (don't need these in the image)
Dockerfile*
docker-compose*
.dockerignore
# Tests (not needed in prod image)
tests/
conftest.py
pytest.ini
.coveragerc
# Documentation
docs/
*.md
*.rst
LICENSE
# Logs
*.log
logs/
# Local databases
*.db
*.sqlite
*.sqlite3
# Alembic versions not needed in image (migrations run separately)
# alembic/versions/
# Misc
.DS_Store
Thumbs.db
*.bak

46
PROJECTS/bug-bounty-platform/backend/.style.yapf Executable file
View File

@ -0,0 +1,46 @@
[style]
based_on_style = pep8
column_limit = 75
indent_width = 4
continuation_indent_width = 4
indent_closing_brackets = false
dedent_closing_brackets = true
indent_blank_lines = false
spaces_before_comment = 2
spaces_around_power_operator = false
spaces_around_default_or_named_assign = true
space_between_ending_comma_and_closing_bracket = false
space_inside_brackets = false
spaces_around_subscript_colon = true
blank_line_before_nested_class_or_def = false
blank_line_before_class_docstring = false
blank_lines_around_top_level_definition = 2
blank_lines_between_top_level_imports_and_variables = 2
blank_line_before_module_docstring = false
split_before_logical_operator = true
split_before_first_argument = true
split_before_named_assigns = true
split_complex_comprehension = true
split_before_expression_after_opening_paren = false
split_before_closing_bracket = true
split_all_comma_separated_values = true
split_all_top_level_comma_separated_values = false
coalesce_brackets = false
each_dict_entry_on_separate_line = true
allow_multiline_lambdas = false
allow_multiline_dictionary_keys = false
split_penalty_import_names = 0
join_multiple_lines = false
align_closing_bracket_with_visual_indent = true
arithmetic_precedence_indication = false
split_penalty_for_added_line_split = 275
use_tabs = false
split_before_dot = false
split_arguments_when_comma_terminated = true
i18n_function_call = ['_', 'N_', 'gettext', 'ngettext']
i18n_comment = ['# Translators:', '# i18n:']
split_penalty_comprehension = 80
split_penalty_after_opening_bracket = 280
split_penalty_before_if_expr = 0
split_penalty_bitwise_operator = 290
split_penalty_logical_operator = 0

43
PROJECTS/bug-bounty-platform/backend/alembic.ini Normal file
View File

@ -0,0 +1,43 @@
[alembic]
script_location = alembic
prepend_sys_path = .
version_path_separator = os
file_template = %%(year)d%%(month).2d%%(day).2d_%%(hour).2d%%(minute).2d%%(second).2d_%%(slug)s
sqlalchemy.url = driver://user:pass@localhost/dbname
[post_write_hooks]
[loggers]
keys = root,sqlalchemy,alembic
[handlers]
keys = console
[formatters]
keys = generic
[logger_root]
level = WARN
handlers = console
qualname =
[logger_sqlalchemy]
level = WARN
handlers =
qualname = sqlalchemy.engine
[logger_alembic]
level = INFO
handlers =
qualname = alembic
[handler_console]
class = StreamHandler
args = (sys.stderr,)
level = NOTSET
formatter = generic
[formatter_generic]
format = %(levelname)-5.5s [%(name)s] %(message)s
datefmt = %H:%M:%S

124
PROJECTS/bug-bounty-platform/backend/alembic/env.py Normal file
View File

@ -0,0 +1,124 @@
"""
ⒸAngelaMos | 2025
env.py
"""
import asyncio
from logging.config import fileConfig
from alembic import context
from sqlalchemy import pool
from sqlalchemy.engine import Connection
from sqlalchemy.ext.asyncio import async_engine_from_config
from config import settings
from core.Base import Base
from core.enums import SafeEnum
from user.User import User
from auth.RefreshToken import RefreshToken
from program.Program import Program
from program.Asset import Asset
from program.RewardTier import RewardTier
from report.Report import Report
from report.Comment import Comment
from report.Attachment import Attachment
config = context.config
def render_item(type_, obj, autogen_context):
"""
Custom renderer for alembic autogenerate.
Converts SafeEnum to standard sa.Enum and ensures DateTime uses timezone.
"""
import sqlalchemy as sa
if isinstance(obj, SafeEnum):
enum_class = obj.enum_class
values = [e.value for e in enum_class]
return f"sa.Enum({', '.join(repr(v) for v in values)}, name='{obj.name}')"
if isinstance(obj, sa.DateTime):
return "sa.DateTime(timezone=True)"
return False
if config.config_file_name is not None:
fileConfig(config.config_file_name)
target_metadata = Base.metadata
def get_url() -> str:
"""
Get database URL from settings
"""
return str(settings.DATABASE_URL)
def run_migrations_offline() -> None:
"""
Run migrations in 'offline' mode
"""
url = get_url()
context.configure(
url = url,
target_metadata = target_metadata,
literal_binds = True,
dialect_opts = {"paramstyle": "named"},
compare_type = True,
compare_server_default = True,
render_item = render_item,
)
with context.begin_transaction():
context.run_migrations()
def do_run_migrations(connection: Connection) -> None:
"""
Run migrations with connection
"""
context.configure(
connection = connection,
target_metadata = target_metadata,
compare_type = True,
compare_server_default = True,
render_item = render_item,
)
with context.begin_transaction():
context.run_migrations()
async def run_async_migrations() -> None:
"""
Run migrations in async mode
"""
configuration = config.get_section(config.config_ini_section, {})
configuration["sqlalchemy.url"] = get_url()
connectable = async_engine_from_config(
configuration,
prefix = "sqlalchemy.",
poolclass = pool.NullPool,
)
async with connectable.connect() as connection:
await connection.run_sync(do_run_migrations)
await connectable.dispose()
def run_migrations_online() -> None:
"""
Run migrations in 'online' mode
"""
asyncio.run(run_async_migrations())
if context.is_offline_mode():
run_migrations_offline()
else:
run_migrations_online()

24
PROJECTS/bug-bounty-platform/backend/alembic/script.py.mako Normal file
View File

@ -0,0 +1,24 @@
"""${message}
Revision ID: ${up_revision}
Revises: ${down_revision | comma,n}
Create Date: ${create_date}
"""
from typing import Sequence, Union
from alembic import op
import sqlalchemy as sa
${imports if imports else ""}
revision: str = ${repr(up_revision)}
down_revision: Union[str, None] = ${repr(down_revision)}
branch_labels: Union[str, Sequence[str], None] = ${repr(branch_labels)}
depends_on: Union[str, Sequence[str], None] = ${repr(depends_on)}
def upgrade() -> None:
${upgrades if upgrades else "pass"}
def downgrade() -> None:
${downgrades if downgrades else "pass"}

67
PROJECTS/bug-bounty-platform/backend/alembic/versions/20251224_033104_initial.py Normal file
View File

@ -0,0 +1,67 @@
"""initial
Revision ID: 801b86be184b
Revises:
Create Date: 2025-12-24 03:31:04.712921
"""
from typing import Sequence, Union
from alembic import op
import sqlalchemy as sa
revision: str = '801b86be184b'
down_revision: Union[str, None] = None
branch_labels: Union[str, Sequence[str], None] = None
depends_on: Union[str, Sequence[str], None] = None
def upgrade() -> None:
# ### commands auto generated by Alembic - please adjust! ###
op.create_table('users',
sa.Column('email', sa.String(length=320), nullable=False),
sa.Column('hashed_password', sa.String(length=1024), nullable=False),
sa.Column('full_name', sa.String(length=255), nullable=True),
sa.Column('is_active', sa.Boolean(), nullable=False),
sa.Column('is_verified', sa.Boolean(), nullable=False),
sa.Column('role', sa.Enum('unknown', 'user', 'admin', name='userrole'), nullable=False),
sa.Column('token_version', sa.Integer(), nullable=False),
sa.Column('id', sa.Uuid(), nullable=False),
sa.Column('created_at', sa.DateTime(timezone=True), server_default=sa.text('now()'), nullable=False),
sa.Column('updated_at', sa.DateTime(timezone=True), nullable=True),
sa.PrimaryKeyConstraint('id', name=op.f('pk_users'))
)
op.create_index(op.f('ix_users_email'), 'users', ['email'], unique=True)
op.create_table('refresh_tokens',
sa.Column('token_hash', sa.String(length=64), nullable=False),
sa.Column('user_id', sa.Uuid(), nullable=False),
sa.Column('family_id', sa.Uuid(), nullable=False),
sa.Column('device_id', sa.String(length=255), nullable=True),
sa.Column('device_name', sa.String(length=100), nullable=True),
sa.Column('ip_address', sa.String(length=45), nullable=True),
sa.Column('expires_at', sa.DateTime(timezone=True), nullable=False),
sa.Column('is_revoked', sa.Boolean(), nullable=False),
sa.Column('revoked_at', sa.DateTime(timezone=True), nullable=True),
sa.Column('id', sa.Uuid(), nullable=False),
sa.Column('created_at', sa.DateTime(timezone=True), server_default=sa.text('now()'), nullable=False),
sa.Column('updated_at', sa.DateTime(timezone=True), nullable=True),
sa.ForeignKeyConstraint(['user_id'], ['users.id'], name=op.f('fk_refresh_tokens_user_id_users'), ondelete='CASCADE'),
sa.PrimaryKeyConstraint('id', name=op.f('pk_refresh_tokens'))
)
op.create_index(op.f('ix_refresh_tokens_expires_at'), 'refresh_tokens', ['expires_at'], unique=False)
op.create_index(op.f('ix_refresh_tokens_family_id'), 'refresh_tokens', ['family_id'], unique=False)
op.create_index(op.f('ix_refresh_tokens_token_hash'), 'refresh_tokens', ['token_hash'], unique=True)
op.create_index(op.f('ix_refresh_tokens_user_id'), 'refresh_tokens', ['user_id'], unique=False)
# ### end Alembic commands ###
def downgrade() -> None:
# ### commands auto generated by Alembic - please adjust! ###
op.drop_index(op.f('ix_refresh_tokens_user_id'), table_name='refresh_tokens')
op.drop_index(op.f('ix_refresh_tokens_token_hash'), table_name='refresh_tokens')
op.drop_index(op.f('ix_refresh_tokens_family_id'), table_name='refresh_tokens')
op.drop_index(op.f('ix_refresh_tokens_expires_at'), table_name='refresh_tokens')
op.drop_table('refresh_tokens')
op.drop_index(op.f('ix_users_email'), table_name='users')
op.drop_table('users')
# ### end Alembic commands ###

152
PROJECTS/bug-bounty-platform/backend/alembic/versions/20260106_010122_add_bug_bounty_models.py Normal file
View File

@ -0,0 +1,152 @@
"""add bug bounty models
Revision ID: de05481ca143
Revises: 801b86be184b
Create Date: 2026-01-06 01:01:22.847036
"""
from typing import Sequence, Union
from alembic import op
import sqlalchemy as sa
revision: str = 'de05481ca143'
down_revision: Union[str, None] = '801b86be184b'
branch_labels: Union[str, Sequence[str], None] = None
depends_on: Union[str, Sequence[str], None] = None
def upgrade() -> None:
# ### commands auto generated by Alembic - please adjust! ###
op.create_table('programs',
sa.Column('company_id', sa.Uuid(), nullable=False),
sa.Column('name', sa.String(length=255), nullable=False),
sa.Column('slug', sa.String(length=100), nullable=False),
sa.Column('description', sa.Text(), nullable=True),
sa.Column('rules', sa.Text(), nullable=True),
sa.Column('response_sla_hours', sa.Integer(), nullable=False),
sa.Column('status', sa.Enum('draft', 'active', 'paused', 'closed', name='programstatus'), nullable=False),
sa.Column('visibility', sa.Enum('public', 'private', 'invite_only', name='programvisibility'), nullable=False),
sa.Column('id', sa.Uuid(), nullable=False),
sa.Column('created_at', sa.DateTime(timezone=True), server_default=sa.text('now()'), nullable=False),
sa.Column('updated_at', sa.DateTime(timezone=True), nullable=True),
sa.ForeignKeyConstraint(['company_id'], ['users.id'], name=op.f('fk_programs_company_id_users'), ondelete='CASCADE'),
sa.PrimaryKeyConstraint('id', name=op.f('pk_programs'))
)
op.create_index(op.f('ix_programs_company_id'), 'programs', ['company_id'], unique=False)
op.create_index(op.f('ix_programs_slug'), 'programs', ['slug'], unique=True)
op.create_index(op.f('ix_programs_status'), 'programs', ['status'], unique=False)
op.create_table('assets',
sa.Column('program_id', sa.Uuid(), nullable=False),
sa.Column('asset_type', sa.Enum('domain', 'api', 'mobile_app', 'source_code', 'hardware', 'other', name='assettype'), nullable=False),
sa.Column('identifier', sa.String(length=500), nullable=False),
sa.Column('in_scope', sa.Boolean(), nullable=False),
sa.Column('description', sa.Text(), nullable=True),
sa.Column('id', sa.Uuid(), nullable=False),
sa.Column('created_at', sa.DateTime(timezone=True), server_default=sa.text('now()'), nullable=False),
sa.Column('updated_at', sa.DateTime(timezone=True), nullable=True),
sa.ForeignKeyConstraint(['program_id'], ['programs.id'], name=op.f('fk_assets_program_id_programs'), ondelete='CASCADE'),
sa.PrimaryKeyConstraint('id', name=op.f('pk_assets'))
)
op.create_index(op.f('ix_assets_program_id'), 'assets', ['program_id'], unique=False)
op.create_table('reports',
sa.Column('program_id', sa.Uuid(), nullable=False),
sa.Column('researcher_id', sa.Uuid(), nullable=False),
sa.Column('title', sa.String(length=500), nullable=False),
sa.Column('description', sa.Text(), nullable=False),
sa.Column('steps_to_reproduce', sa.Text(), nullable=True),
sa.Column('impact', sa.Text(), nullable=True),
sa.Column('severity_submitted', sa.Enum('critical', 'high', 'medium', 'low', 'informational', name='severity'), nullable=False),
sa.Column('severity_final', sa.Enum('critical', 'high', 'medium', 'low', 'informational', name='severity'), nullable=True),
sa.Column('status', sa.Enum('new', 'triaging', 'needs_more_info', 'accepted', 'duplicate', 'informative', 'not_applicable', 'resolved', 'disclosed', name='reportstatus'), nullable=False),
sa.Column('cvss_score', sa.Numeric(precision=3, scale=1), nullable=True),
sa.Column('cwe_id', sa.String(length=20), nullable=True),
sa.Column('bounty_amount', sa.Integer(), nullable=True),
sa.Column('duplicate_of_id', sa.Uuid(), nullable=True),
sa.Column('triaged_at', sa.DateTime(timezone=True), nullable=True),
sa.Column('resolved_at', sa.DateTime(timezone=True), nullable=True),
sa.Column('disclosed_at', sa.DateTime(timezone=True), nullable=True),
sa.Column('id', sa.Uuid(), nullable=False),
sa.Column('created_at', sa.DateTime(timezone=True), server_default=sa.text('now()'), nullable=False),
sa.Column('updated_at', sa.DateTime(timezone=True), nullable=True),
sa.ForeignKeyConstraint(['duplicate_of_id'], ['reports.id'], name=op.f('fk_reports_duplicate_of_id_reports'), ondelete='SET NULL'),
sa.ForeignKeyConstraint(['program_id'], ['programs.id'], name=op.f('fk_reports_program_id_programs'), ondelete='CASCADE'),
sa.ForeignKeyConstraint(['researcher_id'], ['users.id'], name=op.f('fk_reports_researcher_id_users'), ondelete='CASCADE'),
sa.PrimaryKeyConstraint('id', name=op.f('pk_reports'))
)
op.create_index(op.f('ix_reports_program_id'), 'reports', ['program_id'], unique=False)
op.create_index(op.f('ix_reports_researcher_id'), 'reports', ['researcher_id'], unique=False)
op.create_index(op.f('ix_reports_status'), 'reports', ['status'], unique=False)
op.create_table('reward_tiers',
sa.Column('program_id', sa.Uuid(), nullable=False),
sa.Column('severity', sa.Enum('critical', 'high', 'medium', 'low', 'informational', name='severity'), nullable=False),
sa.Column('min_bounty', sa.Integer(), nullable=False),
sa.Column('max_bounty', sa.Integer(), nullable=False),
sa.Column('currency', sa.String(length=3), nullable=False),
sa.Column('id', sa.Uuid(), nullable=False),
sa.Column('created_at', sa.DateTime(timezone=True), server_default=sa.text('now()'), nullable=False),
sa.Column('updated_at', sa.DateTime(timezone=True), nullable=True),
sa.ForeignKeyConstraint(['program_id'], ['programs.id'], name=op.f('fk_reward_tiers_program_id_programs'), ondelete='CASCADE'),
sa.PrimaryKeyConstraint('id', name=op.f('pk_reward_tiers'))
)
op.create_index(op.f('ix_reward_tiers_program_id'), 'reward_tiers', ['program_id'], unique=False)
op.create_table('comments',
sa.Column('report_id', sa.Uuid(), nullable=False),
sa.Column('author_id', sa.Uuid(), nullable=False),
sa.Column('content', sa.Text(), nullable=False),
sa.Column('is_internal', sa.Boolean(), nullable=False),
sa.Column('id', sa.Uuid(), nullable=False),
sa.Column('created_at', sa.DateTime(timezone=True), server_default=sa.text('now()'), nullable=False),
sa.Column('updated_at', sa.DateTime(timezone=True), nullable=True),
sa.ForeignKeyConstraint(['author_id'], ['users.id'], name=op.f('fk_comments_author_id_users'), ondelete='CASCADE'),
sa.ForeignKeyConstraint(['report_id'], ['reports.id'], name=op.f('fk_comments_report_id_reports'), ondelete='CASCADE'),
sa.PrimaryKeyConstraint('id', name=op.f('pk_comments'))
)
op.create_index(op.f('ix_comments_author_id'), 'comments', ['author_id'], unique=False)
op.create_index(op.f('ix_comments_report_id'), 'comments', ['report_id'], unique=False)
op.create_table('attachments',
sa.Column('report_id', sa.Uuid(), nullable=False),
sa.Column('comment_id', sa.Uuid(), nullable=True),
sa.Column('filename', sa.String(length=255), nullable=False),
sa.Column('storage_path', sa.String(length=500), nullable=False),
sa.Column('mime_type', sa.String(length=100), nullable=False),
sa.Column('size_bytes', sa.BigInteger(), nullable=False),
sa.Column('id', sa.Uuid(), nullable=False),
sa.Column('created_at', sa.DateTime(timezone=True), server_default=sa.text('now()'), nullable=False),
sa.Column('updated_at', sa.DateTime(timezone=True), nullable=True),
sa.ForeignKeyConstraint(['comment_id'], ['comments.id'], name=op.f('fk_attachments_comment_id_comments'), ondelete='SET NULL'),
sa.ForeignKeyConstraint(['report_id'], ['reports.id'], name=op.f('fk_attachments_report_id_reports'), ondelete='CASCADE'),
sa.PrimaryKeyConstraint('id', name=op.f('pk_attachments'))
)
op.create_index(op.f('ix_attachments_report_id'), 'attachments', ['report_id'], unique=False)
op.add_column('users', sa.Column('company_name', sa.String(length=255), nullable=True))
op.add_column('users', sa.Column('bio', sa.Text(), nullable=True))
op.add_column('users', sa.Column('website', sa.String(length=500), nullable=True))
op.add_column('users', sa.Column('reputation_score', sa.Integer(), nullable=False))
# ### end Alembic commands ###
def downgrade() -> None:
# ### commands auto generated by Alembic - please adjust! ###
op.drop_column('users', 'reputation_score')
op.drop_column('users', 'website')
op.drop_column('users', 'bio')
op.drop_column('users', 'company_name')
op.drop_index(op.f('ix_attachments_report_id'), table_name='attachments')
op.drop_table('attachments')
op.drop_index(op.f('ix_comments_report_id'), table_name='comments')
op.drop_index(op.f('ix_comments_author_id'), table_name='comments')
op.drop_table('comments')
op.drop_index(op.f('ix_reward_tiers_program_id'), table_name='reward_tiers')
op.drop_table('reward_tiers')
op.drop_index(op.f('ix_reports_status'), table_name='reports')
op.drop_index(op.f('ix_reports_researcher_id'), table_name='reports')
op.drop_index(op.f('ix_reports_program_id'), table_name='reports')
op.drop_table('reports')
op.drop_index(op.f('ix_assets_program_id'), table_name='assets')
op.drop_table('assets')
op.drop_index(op.f('ix_programs_status'), table_name='programs')
op.drop_index(op.f('ix_programs_slug'), table_name='programs')
op.drop_index(op.f('ix_programs_company_id'), table_name='programs')
op.drop_table('programs')
# ### end Alembic commands ###

42
PROJECTS/bug-bounty-platform/backend/app/__main__.py Normal file
View File

@ -0,0 +1,42 @@
"""
ⒸAngelaMos | 2026
__main__.py
"""
import uvicorn
from config import settings
from factory import create_app
app = create_app()
if __name__ == "__main__":
uvicorn.run(
"app.__main__:app",
host = settings.HOST,
port = settings.PORT,
reload = settings.RELOAD,
)
"""
⠀⠀⠀⠀⠀⠴⣦⣤⡀⢄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⣨⣥⣄⣀⠀⡁⠀⠀⡀⡠⠀⠀⠀⠂⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⢠⣾⣿⣷⣮⣷⡦⠥⠈⡶⠮⣤⣀⡠⠀⡀⣐⣀⡈⠁⠀⠐⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⣾⣿⣿⣿⣿⠟⠀⠠⠊⠉⠀⠀⢀⠉⠙⠚⠧⣦⣀⡀⢀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⣿⣿⣿⣿⡏⠀⠀⠀⠀⠀⠠⠀⠁⠀⢤⠀⠀⠀⠨⡉⠛⠶⠤⣄⣄⢀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⢀⣿⣿⣿⣿⡀⠀⠀⢰⠀⠍⡾⠆⠀⠀⣠⡦⠄⡀⠄⠀⠠⠀⠀⠀⠈⠙⠓⠦⢤⣀⡀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠸⣿⣿⣿⣿⣿⣶⣦⢠⡈⠀⠀⠀⠀⠀⠋⠛⠉⡂⠈⠙⠀⣰⠀⠀⠀⠀⠀⠀⠀⠀⠉⠛⠺⠦⣄⣀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠻⢿⣿⣿⣿⣿⣿⣾⣿⣿⣦⢤⡀⢀⣂⣨⠀⢅⢱⡔⠒⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠉⠙⠲⠴⣠⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠈⠙⠻⠿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣶⣎⠘⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠑⠠⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⢀⣤⣶⣾⣽⡿⢿⣿⣿⣿⣿⣿⣿⣿⣿⠳⢄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⣿⣿⠏⢠⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠁⠀⠹⣦⣴⠖⠲⠆⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠘⢿⠀⢻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠏⠀⠀⠈⠀⠀⠀⠒⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢩⠢⣙⠿⣿⣿⣿⣿⣿⣿⡿⠃⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠸⣆⠈⠛⢶⣌⡉⣻⣿⡿⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢻⣷⣄⣤⣙⣿⣿⣿⣷⣄⣀⣀⣀⣀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢠⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠿⠟⠛⠟⠠⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣴⣿⡿⣿⣿⣿⣿⣿⣿⡿⠋⠉⠀⠀⠀⠀⠀⠀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠁⠙⠁⠘⢮⣛⡽⠛⠿⡿⠥⠀
"""

9
PROJECTS/bug-bounty-platform/backend/app/admin/__init__.py Normal file
View File

@ -0,0 +1,9 @@
"""
ⒸAngelaMos | 2026
admin module
"""
from .routes import router
__all__ = ["router"]

25
PROJECTS/bug-bounty-platform/backend/app/admin/dependencies.py Normal file
View File

@ -0,0 +1,25 @@
"""
ⒸAngelaMos | 2026
dependencies.py
"""
from typing import Annotated
from fastapi import Depends
from sqlalchemy.ext.asyncio import AsyncSession
from core.database import get_db_session
from .service import AdminService
async def get_admin_service(
session: Annotated[AsyncSession,
Depends(get_db_session)],
) -> AdminService:
"""
Dependency for AdminService
"""
return AdminService(session)
AdminServiceDep = Annotated[AdminService, Depends(get_admin_service)]

0
PROJECTS/bug-bounty-platform/backend/app/admin/py.typed Normal file
View File

314
PROJECTS/bug-bounty-platform/backend/app/admin/repository.py Normal file
View File

@ -0,0 +1,314 @@
"""
ⒸAngelaMos | 2026
repository.py
"""
from typing import Any
from collections.abc import Sequence
from datetime import UTC, datetime, timedelta
from uuid import UUID
from sqlalchemy import func, select
from sqlalchemy.ext.asyncio import AsyncSession
from config import ProgramStatus, ReportStatus, UserRole
from program.Program import Program
from report.Report import Report
from user.User import User
class AdminRepository:
"""
Repository for admin-specific database operations
"""
@classmethod
async def get_all_programs(
cls,
session: AsyncSession,
skip: int = 0,
limit: int = 20,
status_filter: ProgramStatus | None = None,
) -> Sequence[tuple[Program,
User,
int]]:
"""
Get all programs with company info and report count
"""
report_count_subq = (
select(
Report.program_id,
func.count(Report.id).label("report_count")
).group_by(Report.program_id).subquery()
)
query = (
select(
Program,
User,
func.coalesce(report_count_subq.c.report_count,
0).label("report_count")
).join(User,
Program.company_id == User.id).outerjoin(
report_count_subq,
Program.id == report_count_subq.c.program_id
)
)
if status_filter:
query = query.where(Program.status == status_filter)
result = await session.execute(
query.order_by(Program.created_at.desc()
).offset(skip).limit(limit)
)
return [tuple(row) for row in result.all()]
@classmethod
async def count_all_programs(
cls,
session: AsyncSession,
status_filter: ProgramStatus | None = None,
) -> int:
"""
Count all programs
"""
query = select(func.count()).select_from(Program)
if status_filter:
query = query.where(Program.status == status_filter)
result = await session.execute(query)
return result.scalar_one()
@classmethod
async def get_program_by_id(
cls,
session: AsyncSession,
program_id: UUID,
) -> Program | None:
"""
Get program by ID for admin operations
"""
return await session.get(Program, program_id)
@classmethod
async def get_all_reports(
cls,
session: AsyncSession,
skip: int = 0,
limit: int = 20,
status_filter: ReportStatus | None = None,
severity_filter: str | None = None,
) -> Sequence[tuple[Report,
Program,
User]]:
"""
Get all reports with program and researcher info
"""
query = (
select(Report,
Program,
User).join(Program,
Report.program_id == Program.id).join(
User,
Report.researcher_id == User.id
)
)
if status_filter:
query = query.where(Report.status == status_filter)
if severity_filter:
query = query.where(
Report.severity_submitted == severity_filter
)
result = await session.execute(
query.order_by(Report.created_at.desc()
).offset(skip).limit(limit)
)
return [tuple(row) for row in result.all()]
@classmethod
async def count_all_reports(
cls,
session: AsyncSession,
status_filter: ReportStatus | None = None,
severity_filter: str | None = None,
) -> int:
"""
Count all reports
"""
query = select(func.count()).select_from(Report)
if status_filter:
query = query.where(Report.status == status_filter)
if severity_filter:
query = query.where(
Report.severity_submitted == severity_filter
)
result = await session.execute(query)
return result.scalar_one()
@classmethod
async def get_report_by_id(
cls,
session: AsyncSession,
report_id: UUID,
) -> Report | None:
"""
Get report by ID for admin operations
"""
return await session.get(Report, report_id)
@classmethod
async def get_all_users_with_stats(
cls,
session: AsyncSession,
skip: int = 0,
limit: int = 20,
role_filter: UserRole | None = None,
) -> Sequence[tuple[User,
int,
int]]:
"""
Get all users with program and report counts
"""
program_count_subq = (
select(
Program.company_id,
func.count(Program.id).label("program_count")
).group_by(Program.company_id).subquery()
)
report_count_subq = (
select(
Report.researcher_id,
func.count(Report.id).label("report_count")
).group_by(Report.researcher_id).subquery()
)
query = (
select(
User,
func.coalesce(program_count_subq.c.program_count,
0).label("program_count"),
func.coalesce(report_count_subq.c.report_count,
0).label("report_count")
).outerjoin(
program_count_subq,
User.id == program_count_subq.c.company_id
).outerjoin(
report_count_subq,
User.id == report_count_subq.c.researcher_id
)
)
if role_filter:
query = query.where(User.role == role_filter)
result = await session.execute(
query.order_by(User.created_at.desc()
).offset(skip).limit(limit)
)
return [tuple(row) for row in result.all()]
@classmethod
async def count_all_users(
cls,
session: AsyncSession,
role_filter: UserRole | None = None,
) -> int:
"""
Count all users
"""
query = select(func.count()).select_from(User)
if role_filter:
query = query.where(User.role == role_filter)
result = await session.execute(query)
return result.scalar_one()
@classmethod
async def get_platform_stats(
cls,
session: AsyncSession,
) -> dict[str,
Any]:
"""
Get platform-wide statistics
"""
now = datetime.now(UTC)
month_ago = now - timedelta(days = 30)
total_users = await session.execute(
select(func.count()).select_from(User)
)
users_by_role = await session.execute(
select(User.role,
func.count()).group_by(User.role)
)
role_counts = {
str(role): count
for role, count in users_by_role.all()
}
total_programs = await session.execute(
select(func.count()).select_from(Program)
)
active_programs = await session.execute(
select(func.count()).select_from(Program).where(
Program.status == ProgramStatus.ACTIVE
)
)
total_reports = await session.execute(
select(func.count()).select_from(Report)
)
reports_by_status = await session.execute(
select(Report.status,
func.count()).group_by(Report.status)
)
status_counts = {
str(status): count
for status, count in reports_by_status.all()
}
total_bounties = await session.execute(
select(func.coalesce(func.sum(Report.bounty_amount),
0)).where(
Report.bounty_amount.isnot(None)
)
)
reports_this_month = await session.execute(
select(func.count()).select_from(Report).where(
Report.created_at >= month_ago
)
)
new_users_this_month = await session.execute(
select(func.count()
).select_from(User).where(User.created_at >= month_ago)
)
return {
"total_users": total_users.scalar_one(),
"total_researchers": role_counts.get("user",
0),
"total_companies": role_counts.get("company",
0),
"total_programs": total_programs.scalar_one(),
"active_programs": active_programs.scalar_one(),
"total_reports": total_reports.scalar_one(),
"reports_by_status": status_counts,
"total_bounties_paid": total_bounties.scalar_one(),
"reports_this_month": reports_this_month.scalar_one(),
"new_users_this_month": new_users_this_month.scalar_one(),
}

309
PROJECTS/bug-bounty-platform/backend/app/admin/routes.py Normal file
View File

@ -0,0 +1,309 @@
"""
ⒸAngelaMos | 2026
routes.py
"""
from uuid import UUID
from typing import Annotated
from fastapi import (
APIRouter,
Depends,
Query,
status,
)
from config import (
settings,
ProgramStatus,
ReportStatus,
UserRole,
)
from core.dependencies import RequireRole
from core.responses import (
AUTH_401,
CONFLICT_409,
FORBIDDEN_403,
NOT_FOUND_404,
)
from user.schemas import (
AdminUserCreate,
UserResponse,
UserUpdateAdmin,
)
from user.User import User
from user.dependencies import UserServiceDep
from .dependencies import AdminServiceDep
from .schemas import (
AdminProgramListResponse,
AdminProgramResponse,
AdminProgramUpdate,
AdminReportListResponse,
AdminReportResponse,
AdminReportUpdate,
AdminUserListResponse,
PlatformStatsResponse,
)
router = APIRouter(prefix = "/admin", tags = ["admin"])
AdminOnly = Annotated[User, Depends(RequireRole(UserRole.ADMIN))]
@router.get(
"/stats",
response_model = PlatformStatsResponse,
responses = {
**AUTH_401,
**FORBIDDEN_403
},
)
async def get_platform_stats(
admin_service: AdminServiceDep,
_: AdminOnly,
) -> PlatformStatsResponse:
"""
Get platform-wide statistics (admin only)
"""
return await admin_service.get_platform_stats()
@router.get(
"/programs",
response_model = AdminProgramListResponse,
responses = {
**AUTH_401,
**FORBIDDEN_403
},
)
async def list_programs(
admin_service: AdminServiceDep,
_: AdminOnly,
page: int = Query(default = 1,
ge = 1),
size: int = Query(
default = settings.PAGINATION_DEFAULT_SIZE,
ge = 1,
le = settings.PAGINATION_MAX_SIZE
),
status_filter: ProgramStatus
| None = Query(default = None,
alias = "status"),
) -> AdminProgramListResponse:
"""
List all programs (admin only)
"""
return await admin_service.list_programs(page, size, status_filter)
@router.patch(
"/programs/{program_id}",
response_model = AdminProgramResponse,
responses = {
**AUTH_401,
**FORBIDDEN_403,
**NOT_FOUND_404
},
)
async def update_program(
admin_service: AdminServiceDep,
_: AdminOnly,
program_id: UUID,
data: AdminProgramUpdate,
) -> AdminProgramResponse:
"""
Update a program (admin only)
"""
return await admin_service.update_program(program_id, data)
@router.delete(
"/programs/{program_id}",
status_code = status.HTTP_204_NO_CONTENT,
responses = {
**AUTH_401,
**FORBIDDEN_403,
**NOT_FOUND_404
},
)
async def delete_program(
admin_service: AdminServiceDep,
_: AdminOnly,
program_id: UUID,
) -> None:
"""
Delete a program (admin only, hard delete)
"""
await admin_service.delete_program(program_id)
@router.get(
"/reports",
response_model = AdminReportListResponse,
responses = {
**AUTH_401,
**FORBIDDEN_403
},
)
async def list_reports(
admin_service: AdminServiceDep,
_: AdminOnly,
page: int = Query(default = 1,
ge = 1),
size: int = Query(
default = settings.PAGINATION_DEFAULT_SIZE,
ge = 1,
le = settings.PAGINATION_MAX_SIZE
),
status_filter: ReportStatus
| None = Query(default = None,
alias = "status"),
severity_filter: str
| None = Query(default = None,
alias = "severity"),
) -> AdminReportListResponse:
"""
List all reports (admin only)
"""
return await admin_service.list_reports(
page,
size,
status_filter,
severity_filter
)
@router.patch(
"/reports/{report_id}",
response_model = AdminReportResponse,
responses = {
**AUTH_401,
**FORBIDDEN_403,
**NOT_FOUND_404
},
)
async def update_report(
admin_service: AdminServiceDep,
_: AdminOnly,
report_id: UUID,
data: AdminReportUpdate,
) -> AdminReportResponse:
"""
Update a report (admin only, override)
"""
return await admin_service.update_report(report_id, data)
@router.get(
"/users",
response_model = AdminUserListResponse,
responses = {
**AUTH_401,
**FORBIDDEN_403
},
)
async def list_users(
admin_service: AdminServiceDep,
_: AdminOnly,
page: int = Query(default = 1,
ge = 1),
size: int = Query(
default = settings.PAGINATION_DEFAULT_SIZE,
ge = 1,
le = settings.PAGINATION_MAX_SIZE
),
role_filter: UserRole | None = Query(default = None,
alias = "role"),
) -> AdminUserListResponse:
"""
List all users with stats (admin only)
"""
return await admin_service.list_users_with_stats(
page,
size,
role_filter
)
@router.post(
"/users",
response_model = UserResponse,
status_code = status.HTTP_201_CREATED,
responses = {
**AUTH_401,
**FORBIDDEN_403,
**CONFLICT_409
},
)
async def create_user(
user_service: UserServiceDep,
_: AdminOnly,
user_data: AdminUserCreate,
) -> UserResponse:
"""
Create a new user (admin only, bypasses registration)
"""
return await user_service.admin_create_user(user_data)
@router.get(
"/users/{user_id}",
response_model = UserResponse,
responses = {
**AUTH_401,
**FORBIDDEN_403,
**NOT_FOUND_404
},
)
async def get_user(
user_service: UserServiceDep,
_: AdminOnly,
user_id: UUID,
) -> UserResponse:
"""
Get user by ID (admin only)
"""
return await user_service.get_user_by_id(user_id)
@router.patch(
"/users/{user_id}",
response_model = UserResponse,
responses = {
**AUTH_401,
**FORBIDDEN_403,
**NOT_FOUND_404,
**CONFLICT_409
},
)
async def update_user(
user_service: UserServiceDep,
_: AdminOnly,
user_id: UUID,
user_data: UserUpdateAdmin,
) -> UserResponse:
"""
Update user (admin only)
"""
return await user_service.admin_update_user(user_id, user_data)
@router.delete(
"/users/{user_id}",
status_code = status.HTTP_204_NO_CONTENT,
responses = {
**AUTH_401,
**FORBIDDEN_403,
**NOT_FOUND_404
},
)
async def delete_user(
user_service: UserServiceDep,
_: AdminOnly,
user_id: UUID,
) -> None:
"""
Delete user (admin only, hard delete)
"""
await user_service.admin_delete_user(user_id)

136
PROJECTS/bug-bounty-platform/backend/app/admin/schemas.py Normal file
View File

@ -0,0 +1,136 @@
"""
ⒸAngelaMos | 2026
schemas.py
"""
from datetime import datetime
from decimal import Decimal
from uuid import UUID
from pydantic import Field
from config import (
ProgramStatus,
ProgramVisibility,
ReportStatus,
Severity,
UserRole,
)
from core.base_schema import BaseSchema, BaseResponseSchema
class AdminProgramUpdate(BaseSchema):
"""
Schema for admin updating a program
"""
name: str | None = None
status: ProgramStatus | None = None
visibility: ProgramVisibility | None = None
is_featured: bool | None = None
class AdminProgramResponse(BaseResponseSchema):
"""
Schema for admin program view with company info
"""
company_id: UUID
company_email: str
company_name: str | None
name: str
slug: str
description: str | None
status: ProgramStatus
visibility: ProgramVisibility
response_sla_hours: int
report_count: int
class AdminProgramListResponse(BaseSchema):
"""
Schema for paginated admin program list
"""
items: list[AdminProgramResponse]
total: int
page: int
size: int
class AdminReportUpdate(BaseSchema):
"""
Schema for admin overriding a report
"""
status: ReportStatus | None = None
severity_final: Severity | None = None
cvss_score: Decimal | None = Field(default = None, ge = 0, le = 10)
bounty_amount: int | None = Field(default = None, ge = 0)
admin_notes: str | None = None
class AdminReportResponse(BaseResponseSchema):
"""
Schema for admin report view with program/researcher info
"""
program_id: UUID
program_name: str
program_slug: str
researcher_id: UUID
researcher_email: str
researcher_name: str | None
title: str
severity_submitted: Severity
severity_final: Severity | None
status: ReportStatus
bounty_amount: int | None
triaged_at: datetime | None
resolved_at: datetime | None
class AdminReportListResponse(BaseSchema):
"""
Schema for paginated admin report list
"""
items: list[AdminReportResponse]
total: int
page: int
size: int
class PlatformStatsResponse(BaseSchema):
"""
Schema for platform-wide statistics
"""
total_users: int
total_researchers: int
total_companies: int
total_programs: int
active_programs: int
total_reports: int
reports_by_status: dict[str, int]
total_bounties_paid: int
reports_this_month: int
new_users_this_month: int
class AdminUserResponse(BaseResponseSchema):
"""
Schema for admin user view with stats
"""
email: str
full_name: str | None
company_name: str | None
is_active: bool
is_verified: bool
role: UserRole
reputation_score: int
program_count: int
report_count: int
class AdminUserListResponse(BaseSchema):
"""
Schema for paginated admin user list with stats
"""
items: list[AdminUserResponse]
total: int
page: int
size: int

303
PROJECTS/bug-bounty-platform/backend/app/admin/service.py Normal file
View File

@ -0,0 +1,303 @@
"""
ⒸAngelaMos | 2026
service.py
"""
from uuid import UUID
from sqlalchemy.ext.asyncio import AsyncSession
from config import ProgramStatus, ReportStatus, UserRole
from core.exceptions import ResourceNotFound
from .repository import AdminRepository
from .schemas import (
AdminProgramListResponse,
AdminProgramResponse,
AdminProgramUpdate,
AdminReportListResponse,
AdminReportResponse,
AdminReportUpdate,
AdminUserListResponse,
AdminUserResponse,
PlatformStatsResponse,
)
class AdminService:
"""
Service for admin operations
"""
def __init__(self, session: AsyncSession) -> None:
self.session = session
async def list_programs(
self,
page: int,
size: int,
status_filter: ProgramStatus | None = None,
) -> AdminProgramListResponse:
"""
List all programs with company info
"""
skip = (page - 1) * size
results = await AdminRepository.get_all_programs(
self.session,
skip = skip,
limit = size,
status_filter = status_filter,
)
total = await AdminRepository.count_all_programs(
self.session,
status_filter = status_filter,
)
items = [
AdminProgramResponse(
id = program.id,
created_at = program.created_at,
updated_at = program.updated_at,
company_id = program.company_id,
company_email = company.email,
company_name = company.company_name or company.full_name,
name = program.name,
slug = program.slug,
description = program.description,
status = program.status,
visibility = program.visibility,
response_sla_hours = program.response_sla_hours,
report_count = report_count,
) for program, company, report_count in results
]
return AdminProgramListResponse(
items = items,
total = total,
page = page,
size = size,
)
async def update_program(
self,
program_id: UUID,
data: AdminProgramUpdate,
) -> AdminProgramResponse:
"""
Update a program (admin override)
"""
program = await AdminRepository.get_program_by_id(
self.session,
program_id
)
if not program:
raise ResourceNotFound("Program", str(program_id))
update_data = data.model_dump(exclude_unset = True)
for key, value in update_data.items():
setattr(program, key, value)
await self.session.flush()
await self.session.refresh(program)
results = await AdminRepository.get_all_programs(
self.session,
skip = 0,
limit = 1,
status_filter = None
)
for p, company, report_count in results:
if p.id == program_id:
return AdminProgramResponse(
id = program.id,
created_at = program.created_at,
updated_at = program.updated_at,
company_id = program.company_id,
company_email = company.email,
company_name = company.company_name
or company.full_name,
name = program.name,
slug = program.slug,
description = program.description,
status = program.status,
visibility = program.visibility,
response_sla_hours = program.response_sla_hours,
report_count = report_count,
)
raise ResourceNotFound("Program", str(program_id))
async def delete_program(self, program_id: UUID) -> None:
"""
Delete a program (hard delete)
"""
program = await AdminRepository.get_program_by_id(
self.session,
program_id
)
if not program:
raise ResourceNotFound("Program", str(program_id))
await self.session.delete(program)
await self.session.flush()
async def list_reports(
self,
page: int,
size: int,
status_filter: ReportStatus | None = None,
severity_filter: str | None = None,
) -> AdminReportListResponse:
"""
List all reports with program/researcher info
"""
skip = (page - 1) * size
results = await AdminRepository.get_all_reports(
self.session,
skip = skip,
limit = size,
status_filter = status_filter,
severity_filter = severity_filter,
)
total = await AdminRepository.count_all_reports(
self.session,
status_filter = status_filter,
severity_filter = severity_filter,
)
items = [
AdminReportResponse(
id = report.id,
created_at = report.created_at,
updated_at = report.updated_at,
program_id = report.program_id,
program_name = program.name,
program_slug = program.slug,
researcher_id = report.researcher_id,
researcher_email = researcher.email,
researcher_name = researcher.full_name,
title = report.title,
severity_submitted = report.severity_submitted,
severity_final = report.severity_final,
status = report.status,
bounty_amount = report.bounty_amount,
triaged_at = report.triaged_at,
resolved_at = report.resolved_at,
) for report, program, researcher in results
]
return AdminReportListResponse(
items = items,
total = total,
page = page,
size = size,
)
async def update_report(
self,
report_id: UUID,
data: AdminReportUpdate,
) -> AdminReportResponse:
"""
Update a report (admin override)
"""
report = await AdminRepository.get_report_by_id(
self.session,
report_id
)
if not report:
raise ResourceNotFound("Report", str(report_id))
update_data = data.model_dump(
exclude_unset = True,
exclude = {"admin_notes"}
)
for key, value in update_data.items():
setattr(report, key, value)
await self.session.flush()
await self.session.refresh(report)
results = await AdminRepository.get_all_reports(
self.session,
skip = 0,
limit = 1000
)
for r, program, researcher in results:
if r.id == report_id:
return AdminReportResponse(
id = report.id,
created_at = report.created_at,
updated_at = report.updated_at,
program_id = report.program_id,
program_name = program.name,
program_slug = program.slug,
researcher_id = report.researcher_id,
researcher_email = researcher.email,
researcher_name = researcher.full_name,
title = report.title,
severity_submitted = report.severity_submitted,
severity_final = report.severity_final,
status = report.status,
bounty_amount = report.bounty_amount,
triaged_at = report.triaged_at,
resolved_at = report.resolved_at,
)
raise ResourceNotFound("Report", str(report_id))
async def list_users_with_stats(
self,
page: int,
size: int,
role_filter: UserRole | None = None,
) -> AdminUserListResponse:
"""
List all users with program/report counts
"""
skip = (page - 1) * size
results = await AdminRepository.get_all_users_with_stats(
self.session,
skip = skip,
limit = size,
role_filter = role_filter,
)
total = await AdminRepository.count_all_users(
self.session,
role_filter = role_filter,
)
items = [
AdminUserResponse(
id = user.id,
created_at = user.created_at,
updated_at = user.updated_at,
email = user.email,
full_name = user.full_name,
company_name = user.company_name,
is_active = user.is_active,
is_verified = user.is_verified,
role = user.role,
reputation_score = user.reputation_score,
program_count = program_count,
report_count = report_count,
) for user, program_count, report_count in results
]
return AdminUserListResponse(
items = items,
total = total,
page = page,
size = size,
)
async def get_platform_stats(self) -> PlatformStatsResponse:
"""
Get platform-wide statistics
"""
stats = await AdminRepository.get_platform_stats(self.session)
return PlatformStatsResponse(**stats)

117
PROJECTS/bug-bounty-platform/backend/app/auth/RefreshToken.py Normal file
View File

@ -0,0 +1,117 @@
"""
ⒸAngelaMos | 2025
RefreshToken.py
"""
from __future__ import annotations
from datetime import UTC, datetime
from typing import TYPE_CHECKING
from uuid import UUID
import uuid6
from sqlalchemy import (
DateTime,
ForeignKey,
String,
)
from sqlalchemy.orm import (
Mapped,
mapped_column,
relationship,
)
from config import (
DEVICE_ID_MAX_LENGTH,
DEVICE_NAME_MAX_LENGTH,
IP_ADDRESS_MAX_LENGTH,
TOKEN_HASH_LENGTH,
)
from core.Base import (
Base,
TimestampMixin,
UUIDMixin,
)
if TYPE_CHECKING:
from user.User import User
class RefreshToken(Base, UUIDMixin, TimestampMixin):
"""
Refresh token for JWT authentication
Tokens are stored as SHA 256 hashes, never raw
Family ID enables detection of token reuse attacks
"""
__tablename__ = "refresh_tokens"
token_hash: Mapped[str] = mapped_column(
String(TOKEN_HASH_LENGTH),
unique = True,
index = True,
)
user_id: Mapped[UUID] = mapped_column(
ForeignKey("users.id",
ondelete = "CASCADE"),
index = True,
)
family_id: Mapped[UUID] = mapped_column(
default = uuid6.uuid7,
index = True,
)
device_id: Mapped[str | None] = mapped_column(
String(DEVICE_ID_MAX_LENGTH),
default = None,
)
device_name: Mapped[str | None] = mapped_column(
String(DEVICE_NAME_MAX_LENGTH),
default = None,
)
ip_address: Mapped[str | None] = mapped_column(
String(IP_ADDRESS_MAX_LENGTH),
default = None,
)
expires_at: Mapped[datetime] = mapped_column(
DateTime(timezone = True),
index = True,
)
is_revoked: Mapped[bool] = mapped_column(default = False)
revoked_at: Mapped[datetime | None] = mapped_column(
DateTime(timezone = True),
default = None,
)
user: Mapped[User] = relationship(back_populates = "refresh_tokens")
def revoke(self) -> None:
"""
Revoke this token
"""
self.is_revoked = True
self.revoked_at = datetime.now(UTC)
@property
def is_expired(self) -> bool:
"""
Check if token has expired
Handles both timezone aware and naive datetimes for SQLite compatibility
"""
now = datetime.now(UTC)
expires = self.expires_at
if expires.tzinfo is None:
expires = expires.replace(tzinfo = UTC)
return now > expires
@property
def is_valid(self) -> bool:
"""
Check if token is usable
"""
return not self.is_revoked and not self.is_expired

4
PROJECTS/bug-bounty-platform/backend/app/auth/__init__.py Normal file
View File

@ -0,0 +1,4 @@
"""
ⒸAngelaMos | 2025
Auth Domain
"""

21
PROJECTS/bug-bounty-platform/backend/app/auth/dependencies.py Normal file
View File

@ -0,0 +1,21 @@
"""
ⒸAngelaMos | 2025
dependencies.py
"""
from typing import Annotated
from fastapi import Depends
from core.dependencies import DBSession
from .service import AuthService
def get_auth_service(db: DBSession) -> AuthService:
"""
Dependency to inject AuthService instance
"""
return AuthService(db)
AuthServiceDep = Annotated[AuthService, Depends(get_auth_service)]

0
PROJECTS/bug-bounty-platform/backend/app/auth/py.typed Normal file
View File

178
PROJECTS/bug-bounty-platform/backend/app/auth/repository.py Normal file
View File

@ -0,0 +1,178 @@
"""
ⒸAngelaMos | 2025
repository.py
"""
from uuid import UUID
from datetime import UTC, datetime
from sqlalchemy import select, update
from sqlalchemy.ext.asyncio import AsyncSession
from .RefreshToken import RefreshToken
from core.base_repository import BaseRepository
class RefreshTokenRepository(BaseRepository[RefreshToken]):
"""
Repository for RefreshToken model database operations
"""
model = RefreshToken
@classmethod
async def get_by_hash(
cls,
session: AsyncSession,
token_hash: str,
) -> RefreshToken | None:
"""
Get refresh token by its hash
"""
result = await session.execute(
select(RefreshToken).where(
RefreshToken.token_hash == token_hash
)
)
return result.scalars().first()
@classmethod
async def get_valid_by_hash(
cls,
session: AsyncSession,
token_hash: str,
) -> RefreshToken | None:
"""
Get valid (not revoked, not expired) refresh token by hash
"""
result = await session.execute(
select(RefreshToken).where(
RefreshToken.token_hash == token_hash,
RefreshToken.is_revoked == False,
RefreshToken.expires_at > datetime.now(UTC),
)
)
return result.scalars().first()
@classmethod
async def create_token(
cls,
session: AsyncSession,
user_id: UUID,
token_hash: str,
family_id: UUID,
expires_at: datetime,
device_id: str | None = None,
device_name: str | None = None,
ip_address: str | None = None,
) -> RefreshToken:
"""
Create a new refresh token
"""
token = RefreshToken(
user_id = user_id,
token_hash = token_hash,
family_id = family_id,
expires_at = expires_at,
device_id = device_id,
device_name = device_name,
ip_address = ip_address,
)
session.add(token)
await session.flush()
await session.refresh(token)
return token
@classmethod
async def revoke_token(
cls,
session: AsyncSession,
token: RefreshToken,
) -> RefreshToken:
"""
Revoke a single token
"""
token.revoke()
await session.flush()
await session.refresh(token)
return token
@classmethod
async def revoke_family(
cls,
session: AsyncSession,
family_id: UUID,
) -> int:
"""
Revoke all tokens in a family (for replay attack response)
Returns count of revoked tokens
"""
result = await session.execute(
update(RefreshToken).where(
RefreshToken.family_id == family_id,
RefreshToken.is_revoked == False,
).values(is_revoked = True,
revoked_at = datetime.now(UTC))
)
await session.flush()
return result.rowcount or 0
@classmethod
async def revoke_all_user_tokens(
cls,
session: AsyncSession,
user_id: UUID,
) -> int:
"""
Revoke all tokens for a user (logout all devices)
Returns count of revoked tokens
"""
result = await session.execute(
update(RefreshToken).where(
RefreshToken.user_id == user_id,
RefreshToken.is_revoked == False,
).values(is_revoked = True,
revoked_at = datetime.now(UTC))
)
await session.flush()
return result.rowcount or 0
@classmethod
async def get_user_active_sessions(
cls,
session: AsyncSession,
user_id: UUID,
) -> list[RefreshToken]:
"""
Get all active sessions for a user
"""
result = await session.execute(
select(RefreshToken).where(
RefreshToken.user_id == user_id,
RefreshToken.is_revoked == False,
RefreshToken.expires_at > datetime.now(UTC),
)
)
return list(result.scalars().all())
@classmethod
async def cleanup_expired(
cls,
session: AsyncSession,
) -> int:
"""
Delete expired tokens (for maintenance job)
Returns count of deleted tokens
"""
result = await session.execute(
select(RefreshToken).where(
RefreshToken.expires_at < datetime.now(UTC)
)
)
tokens = result.scalars().all()
for token in tokens:
await session.delete(token)
await session.flush()
return len(tokens)

154
PROJECTS/bug-bounty-platform/backend/app/auth/routes.py Normal file
View File

@ -0,0 +1,154 @@
"""
ⒸAngelaMos | 2025
routes.py
"""
from typing import Annotated
from fastapi import (
APIRouter,
Cookie,
Depends,
Request,
Response,
status,
)
from fastapi.security import (
OAuth2PasswordRequestForm,
)
from config import settings
from core.dependencies import (
ClientIP,
CurrentUser,
)
from core.security import (
clear_refresh_cookie,
set_refresh_cookie,
)
from core.rate_limit import limiter
from core.exceptions import TokenError
from .schemas import (
PasswordChange,
TokenResponse,
TokenWithUserResponse,
)
from user.schemas import UserResponse
from .dependencies import AuthServiceDep
from user.dependencies import UserServiceDep
from core.responses import AUTH_401
router = APIRouter(prefix = "/auth", tags = ["auth"])
@router.post(
"/login",
response_model = TokenWithUserResponse,
responses = {**AUTH_401}
)
@limiter.limit(settings.RATE_LIMIT_AUTH)
async def login(
request: Request,
response: Response,
auth_service: AuthServiceDep,
ip: ClientIP,
form_data: Annotated[OAuth2PasswordRequestForm,
Depends()],
) -> TokenWithUserResponse:
"""
Login with email and password
"""
result, refresh_token = await auth_service.login(
email=form_data.username,
password=form_data.password,
ip_address=ip,
)
set_refresh_cookie(response, refresh_token)
return result
@router.post(
"/refresh",
response_model = TokenResponse,
responses = {**AUTH_401}
)
async def refresh_token(
response: Response,
auth_service: AuthServiceDep,
ip: ClientIP,
refresh_token: str | None = Cookie(None),
) -> TokenResponse:
"""
Refresh access token
"""
if not refresh_token:
raise TokenError("Refresh token required")
result, new_refresh_token = await auth_service.refresh_tokens(
refresh_token,
ip_address = ip
)
set_refresh_cookie(response, new_refresh_token)
return result
@router.post(
"/logout",
status_code = status.HTTP_204_NO_CONTENT,
responses = {**AUTH_401}
)
async def logout(
response: Response,
auth_service: AuthServiceDep,
refresh_token: str | None = Cookie(None),
) -> None:
"""
Logout current session
"""
if not refresh_token:
raise TokenError("Refresh token required")
await auth_service.logout(refresh_token)
clear_refresh_cookie(response)
@router.post("/logout-all", responses = {**AUTH_401})
async def logout_all(
response: Response,
auth_service: AuthServiceDep,
current_user: CurrentUser,
) -> dict[str,
int]:
"""
Logout from all devices
"""
count = await auth_service.logout_all(current_user)
clear_refresh_cookie(response)
return {"revoked_sessions": count}
@router.get("/me", response_model = UserResponse, responses = {**AUTH_401})
async def get_current_user(current_user: CurrentUser) -> UserResponse:
"""
Get current authenticated user
"""
return UserResponse.model_validate(current_user)
@router.post(
"/change-password",
status_code = status.HTTP_204_NO_CONTENT,
responses = {**AUTH_401}
)
async def change_password(
user_service: UserServiceDep,
current_user: CurrentUser,
data: PasswordChange,
) -> None:
"""
Change current user password
"""
await user_service.change_password(
current_user,
data.current_password,
data.new_password,
)

78
PROJECTS/bug-bounty-platform/backend/app/auth/schemas.py Normal file
View File

@ -0,0 +1,78 @@
"""
ⒸAngelaMos | 2025
schemas.py
"""
from pydantic import (
Field,
EmailStr,
)
from config import (
PASSWORD_MAX_LENGTH,
PASSWORD_MIN_LENGTH,
)
from core.base_schema import BaseSchema
from user.schemas import UserResponse
class LoginRequest(BaseSchema):
"""
Schema for login request
"""
email: EmailStr
password: str = Field(
min_length = PASSWORD_MIN_LENGTH,
max_length = PASSWORD_MAX_LENGTH
)
class TokenResponse(BaseSchema):
"""
Schema for token response
"""
access_token: str
token_type: str = "bearer"
class TokenWithUserResponse(TokenResponse):
"""
Schema for login response with user data
"""
user: UserResponse
class RefreshTokenRequest(BaseSchema):
"""
Schema for refresh token request via body
"""
refresh_token: str
class PasswordResetRequest(BaseSchema):
"""
Schema for password reset request
"""
email: EmailStr
class PasswordResetConfirm(BaseSchema):
"""
Schema for password reset confirmation
"""
token: str
new_password: str = Field(
min_length = PASSWORD_MIN_LENGTH,
max_length = PASSWORD_MAX_LENGTH
)
class PasswordChange(BaseSchema):
"""
Schema for changing password while authenticated
"""
current_password: str
new_password: str = Field(
min_length = PASSWORD_MIN_LENGTH,
max_length = PASSWORD_MAX_LENGTH
)

213
PROJECTS/bug-bounty-platform/backend/app/auth/service.py Normal file
View File

@ -0,0 +1,213 @@
"""
ⒸAngelaMos | 2025
service.py
"""
import uuid6
from sqlalchemy.ext.asyncio import (
AsyncSession,
)
from core.exceptions import (
InvalidCredentials,
TokenError,
TokenRevokedError,
)
from core.security import (
hash_token,
create_access_token,
create_refresh_token,
verify_password_with_timing_safety,
)
from user.User import User
from user.repository import UserRepository
from .repository import RefreshTokenRepository
from .schemas import (
TokenResponse,
TokenWithUserResponse,
)
from user.schemas import UserResponse
class AuthService:
"""
Business logic for authentication operations
"""
def __init__(self, session: AsyncSession) -> None:
self.session = session
async def authenticate(
self,
email: str,
password: str,
device_id: str | None = None,
device_name: str | None = None,
ip_address: str | None = None,
) -> tuple[str,
str,
User]:
"""
Authenticate user and create tokens
"""
user = await UserRepository.get_by_email(self.session, email)
hashed_password = user.hashed_password if user else None
is_valid, new_hash = await verify_password_with_timing_safety(
password, hashed_password
)
if not is_valid or user is None:
raise InvalidCredentials()
if not user.is_active:
raise InvalidCredentials()
if new_hash:
await UserRepository.update_password(
self.session,
user,
new_hash
)
access_token = create_access_token(user.id, user.token_version)
family_id = uuid6.uuid7()
raw_refresh, token_hash, expires_at = create_refresh_token(user.id, family_id)
await RefreshTokenRepository.create_token(
self.session,
user_id = user.id,
token_hash = token_hash,
family_id = family_id,
expires_at = expires_at,
device_id = device_id,
device_name = device_name,
ip_address = ip_address,
)
return access_token, raw_refresh, user
async def login(
self,
email: str,
password: str,
device_id: str | None = None,
device_name: str | None = None,
ip_address: str | None = None,
) -> tuple[TokenWithUserResponse,
str]:
"""
Login and return tokens with user data
"""
access_token, refresh_token, user = await self.authenticate(
email,
password,
device_id,
device_name,
ip_address,
)
response = TokenWithUserResponse(
access_token = access_token,
user = UserResponse.model_validate(user),
)
return response, refresh_token
async def refresh_tokens(
self,
refresh_token: str,
device_id: str | None = None,
device_name: str | None = None,
ip_address: str | None = None,
) -> tuple[TokenResponse,
str]:
"""
Refresh access token using refresh token
Implements token rotation with replay attack detection
"""
token_hash = hash_token(refresh_token)
stored_token = await RefreshTokenRepository.get_by_hash(
self.session,
token_hash
)
if stored_token is None:
raise TokenError(message = "Invalid refresh token")
if stored_token.is_revoked:
await RefreshTokenRepository.revoke_family(
self.session,
stored_token.family_id
)
raise TokenRevokedError()
if stored_token.is_expired:
raise TokenError(message = "Refresh token expired")
user = await UserRepository.get_by_id(
self.session,
stored_token.user_id
)
if user is None or not user.is_active:
raise TokenError(message = "User not found or inactive")
await RefreshTokenRepository.revoke_token(
self.session,
stored_token
)
access_token = create_access_token(user.id, user.token_version)
new_raw_token, new_hash, expires_at = create_refresh_token(
user.id, stored_token.family_id
)
await RefreshTokenRepository.create_token(
self.session,
user_id = user.id,
token_hash = new_hash,
family_id = stored_token.family_id,
expires_at = expires_at,
device_id = device_id,
device_name = device_name,
ip_address = ip_address,
)
return TokenResponse(access_token = access_token), new_raw_token
async def logout(
self,
refresh_token: str,
) -> None:
"""
Logout by revoking refresh token
Silently succeeds if token is already revoked or doesn't exist
"""
token_hash = hash_token(refresh_token)
stored_token = await RefreshTokenRepository.get_by_hash(
self.session,
token_hash
)
if stored_token and not stored_token.is_revoked:
await RefreshTokenRepository.revoke_token(
self.session,
stored_token
)
async def logout_all(
self,
user: User,
) -> int:
"""
Logout from all devices
Returns count of revoked sessions
"""
await UserRepository.increment_token_version(self.session, user)
return await RefreshTokenRepository.revoke_all_user_tokens(
self.session,
user.id
)

213
PROJECTS/bug-bounty-platform/backend/app/config.py Normal file
View File

@ -0,0 +1,213 @@
"""
ⒸAngelaMos | 2026
config.py
"""
from pathlib import Path
from typing import Literal
from functools import lru_cache
from pydantic import (
EmailStr,
Field,
RedisDsn,
SecretStr,
PostgresDsn,
model_validator,
)
from pydantic_settings import (
BaseSettings,
SettingsConfigDict,
)
from core.constants import (
API_PREFIX,
API_VERSION,
ASSET_DESCRIPTION_MAX_LENGTH,
ASSET_IDENTIFIER_MAX_LENGTH,
BIO_MAX_LENGTH,
COMMENT_MAX_LENGTH,
COMPANY_NAME_MAX_LENGTH,
CURRENCY_MAX_LENGTH,
CWE_ID_MAX_LENGTH,
DEVICE_ID_MAX_LENGTH,
DEVICE_NAME_MAX_LENGTH,
EMAIL_MAX_LENGTH,
FILENAME_MAX_LENGTH,
FULL_NAME_MAX_LENGTH,
IP_ADDRESS_MAX_LENGTH,
MIME_TYPE_MAX_LENGTH,
PASSWORD_HASH_MAX_LENGTH,
PASSWORD_MAX_LENGTH,
PASSWORD_MIN_LENGTH,
PROGRAM_DESCRIPTION_MAX_LENGTH,
PROGRAM_NAME_MAX_LENGTH,
PROGRAM_RULES_MAX_LENGTH,
PROGRAM_SLUG_MAX_LENGTH,
REPORT_DESCRIPTION_MAX_LENGTH,
REPORT_IMPACT_MAX_LENGTH,
REPORT_STEPS_MAX_LENGTH,
REPORT_TITLE_MAX_LENGTH,
STORAGE_PATH_MAX_LENGTH,
TOKEN_HASH_LENGTH,
WEBSITE_MAX_LENGTH,
)
from core.enums import (
AssetType,
Environment,
HealthStatus,
ProgramStatus,
ProgramVisibility,
ReportStatus,
SafeEnum,
Severity,
TokenType,
UserRole,
)
__all__ = [
"API_PREFIX",
"API_VERSION",
"ASSET_DESCRIPTION_MAX_LENGTH",
"ASSET_IDENTIFIER_MAX_LENGTH",
"BIO_MAX_LENGTH",
"COMMENT_MAX_LENGTH",
"COMPANY_NAME_MAX_LENGTH",
"CURRENCY_MAX_LENGTH",
"CWE_ID_MAX_LENGTH",
"DEVICE_ID_MAX_LENGTH",
"DEVICE_NAME_MAX_LENGTH",
"EMAIL_MAX_LENGTH",
"FILENAME_MAX_LENGTH",
"FULL_NAME_MAX_LENGTH",
"IP_ADDRESS_MAX_LENGTH",
"MIME_TYPE_MAX_LENGTH",
"PASSWORD_HASH_MAX_LENGTH",
"PASSWORD_MAX_LENGTH",
"PASSWORD_MIN_LENGTH",
"PROGRAM_DESCRIPTION_MAX_LENGTH",
"PROGRAM_NAME_MAX_LENGTH",
"PROGRAM_RULES_MAX_LENGTH",
"PROGRAM_SLUG_MAX_LENGTH",
"REPORT_DESCRIPTION_MAX_LENGTH",
"REPORT_IMPACT_MAX_LENGTH",
"REPORT_STEPS_MAX_LENGTH",
"REPORT_TITLE_MAX_LENGTH",
"STORAGE_PATH_MAX_LENGTH",
"TOKEN_HASH_LENGTH",
"WEBSITE_MAX_LENGTH",
"AssetType",
"Environment",
"HealthStatus",
"ProgramStatus",
"ProgramVisibility",
"ReportStatus",
"SafeEnum",
"Settings",
"Severity",
"TokenType",
"UserRole",
"get_settings",
"settings",
]
_PROJECT_ROOT = Path(__file__).resolve().parent.parent.parent
_ENV_FILE = _PROJECT_ROOT / ".env"
class Settings(BaseSettings):
"""
Application settings loaded from environment variables
"""
model_config = SettingsConfigDict(
env_file = _ENV_FILE,
env_file_encoding = "utf-8",
case_sensitive = False,
extra = "ignore",
)
APP_NAME: str = "bug-bounty-platform"
APP_VERSION: str = "1.0.0"
APP_SUMMARY: str = "Developed CarterPerez-dev"
APP_DESCRIPTION: str = "FastAPI async first boilerplate - JWT, Asyncdb, PostgreSQL"
APP_CONTACT_NAME: str = "AngelaMos LLC"
APP_CONTACT_EMAIL: str = "support@certgames.com"
APP_LICENSE_NAME: str = "MIT"
APP_LICENSE_URL: str = "https://github.com/CarterPerez-dev/Cybersecurity-Projects/blob/main/LICENSE"
ENVIRONMENT: Environment = Environment.DEVELOPMENT
DEBUG: bool = False
HOST: str = "0.0.0.0"
PORT: int = 8000
RELOAD: bool = True
DATABASE_URL: PostgresDsn
DB_POOL_SIZE: int = Field(default = 20, ge = 5, le = 100)
DB_MAX_OVERFLOW: int = Field(default = 10, ge = 0, le = 50)
DB_POOL_TIMEOUT: int = Field(default = 30, ge = 10)
DB_POOL_RECYCLE: int = Field(default = 1800, ge = 300)
SECRET_KEY: SecretStr = Field(..., min_length = 32)
JWT_ALGORITHM: Literal["HS256", "HS384", "HS512"] = "HS256"
ACCESS_TOKEN_EXPIRE_MINUTES: int = Field(default = 15, ge = 5, le = 60)
REFRESH_TOKEN_EXPIRE_DAYS: int = Field(default = 7, ge = 1, le = 30)
ADMIN_EMAIL: EmailStr | None = None
REDIS_URL: RedisDsn | None = None
CORS_ORIGINS: list[str] = [
"http://localhost",
"http://localhost:3420",
"http://localhost:8420",
]
CORS_ALLOW_CREDENTIALS: bool = True
CORS_ALLOW_METHODS: list[str] = [
"GET",
"POST",
"PUT",
"PATCH",
"DELETE",
"OPTIONS"
]
CORS_ALLOW_HEADERS: list[str] = ["*"]
RATE_LIMIT_DEFAULT: str = "100/minute"
RATE_LIMIT_AUTH: str = "20/minute"
PAGINATION_DEFAULT_SIZE: int = Field(default = 20, ge = 1, le = 100)
PAGINATION_MAX_SIZE: int = Field(default = 100, ge = 1, le = 500)
LOG_LEVEL: Literal["DEBUG",
"INFO",
"WARNING",
"ERROR",
"CRITICAL"] = "INFO"
LOG_JSON_FORMAT: bool = True
@model_validator(mode = "after")
def validate_production_settings(self) -> "Settings":
"""
Enforce security constraints in production environment.
"""
if self.ENVIRONMENT == Environment.PRODUCTION:
if self.DEBUG:
raise ValueError("DEBUG must be False in production")
if self.CORS_ORIGINS == ["*"]:
raise ValueError(
"CORS_ORIGINS cannot be ['*'] in production"
)
return self
@lru_cache
def get_settings() -> Settings:
"""
Cached settings instance to avoid repeated env parsing
"""
return Settings()
settings = get_settings()

84
PROJECTS/bug-bounty-platform/backend/app/core/Base.py Normal file
View File

@ -0,0 +1,84 @@
"""
ⒸAngelaMos | 2025
Base.py
"""
from uuid import UUID
from datetime import UTC, datetime
import uuid6
from sqlalchemy.orm import (
Mapped,
mapped_column,
DeclarativeBase,
)
from sqlalchemy import (
DateTime,
MetaData,
func,
)
from sqlalchemy.ext.asyncio import AsyncAttrs
NAMING_CONVENTION = {
"ix": "ix_%(column_0_label)s",
"uq": "uq_%(table_name)s_%(column_0_name)s",
"ck": "ck_%(table_name)s_%(constraint_name)s",
"fk": "fk_%(table_name)s_%(column_0_name)s_%(referred_table_name)s",
"pk": "pk_%(table_name)s",
}
class Base(AsyncAttrs, DeclarativeBase):
"""
Base class for all SQLAlchemy models
"""
metadata = MetaData(naming_convention = NAMING_CONVENTION)
class UUIDMixin:
"""
Mixin for UUID v7 primary key
UUID v7 is time sortable and distributed safe, optimal for B tree indexes
"""
id: Mapped[UUID] = mapped_column(
primary_key = True,
default = uuid6.uuid7,
)
class TimestampMixin:
"""
Mixin for created_at and updated_at timestamps
"""
created_at: Mapped[datetime] = mapped_column(
DateTime(timezone = True),
default = lambda: datetime.now(UTC),
server_default = func.now(),
)
updated_at: Mapped[datetime | None] = mapped_column(
DateTime(timezone = True),
default = None,
onupdate = lambda: datetime.now(UTC),
server_onupdate = func.now(),
)
class SoftDeleteMixin:
"""
Mixin for soft delete functionality
"""
deleted_at: Mapped[datetime | None] = mapped_column(
DateTime(timezone = True),
default = None,
)
is_deleted: Mapped[bool] = mapped_column(default = False)
def soft_delete(self) -> None:
self.is_deleted = True
self.deleted_at = datetime.now(UTC)
def restore(self) -> None:
self.is_deleted = False
self.deleted_at = None

4
PROJECTS/bug-bounty-platform/backend/app/core/__init__.py Normal file
View File

@ -0,0 +1,4 @@
"""
ⒸAngelaMos | 2025
__init__.py
"""

106
PROJECTS/bug-bounty-platform/backend/app/core/base_repository.py Normal file
View File

@ -0,0 +1,106 @@
"""
ⒸAngelaMos | 2025
base_repository.py
"""
from collections.abc import Sequence
from typing import (
Any,
Generic,
TypeVar,
)
from uuid import UUID
from sqlalchemy import func, select
from sqlalchemy.ext.asyncio import AsyncSession
from .Base import Base
ModelT = TypeVar("ModelT", bound = Base)
class BaseRepository(Generic[ModelT]):
"""
Generic repository with common CRUD operations
"""
model: type[ModelT]
@classmethod
async def get_by_id(
cls,
session: AsyncSession,
id: UUID,
) -> ModelT | None:
"""
Get a single record by ID
"""
return await session.get(cls.model, id)
@classmethod
async def get_multi(
cls,
session: AsyncSession,
skip: int = 0,
limit: int = 100,
) -> Sequence[ModelT]:
"""
Get multiple records with pagination
"""
result = await session.execute(
select(cls.model).offset(skip).limit(limit)
)
return result.scalars().all()
@classmethod
async def count(cls, session: AsyncSession) -> int:
"""
Count total records
"""
result = await session.execute(
select(func.count()).select_from(cls.model)
)
return result.scalar_one()
@classmethod
async def create(
cls,
session: AsyncSession,
**kwargs: Any,
) -> ModelT:
"""
Create a new record
"""
instance = cls.model(**kwargs)
session.add(instance)
await session.flush()
await session.refresh(instance)
return instance
@classmethod
async def update(
cls,
session: AsyncSession,
instance: ModelT,
**kwargs: Any,
) -> ModelT:
"""
Update an existing record
"""
for key, value in kwargs.items():
setattr(instance, key, value)
await session.flush()
await session.refresh(instance)
return instance
@classmethod
async def delete(
cls,
session: AsyncSession,
instance: ModelT,
) -> None:
"""
Delete a record
"""
await session.delete(instance)
await session.flush()

50
PROJECTS/bug-bounty-platform/backend/app/core/base_schema.py Normal file
View File

@ -0,0 +1,50 @@
"""
ⒸAngelaMos | 2025
base.py
"""
from typing import Any
from collections.abc import Callable
from decimal import Decimal
from uuid import UUID
from datetime import datetime
from pydantic import (
BaseModel,
ConfigDict,
field_serializer,
)
class BaseSchema(BaseModel):
"""
Base schema with common configuration
"""
model_config = ConfigDict(
from_attributes = True,
str_strip_whitespace = True,
)
@field_serializer('*', mode = 'wrap', when_used = 'json')
def serialize_decimals(
self,
value: Any,
nxt: Callable[[Any],
Any],
_info: Any,
) -> Any:
"""
Serialize Decimal fields as float for JSON compatibility
"""
if isinstance(value, Decimal):
return float(value)
return nxt(value)
class BaseResponseSchema(BaseSchema):
"""
Base schema for API responses with common fields
"""
id: UUID
created_at: datetime
updated_at: datetime | None = None

34
PROJECTS/bug-bounty-platform/backend/app/core/common_schemas.py Normal file
View File

@ -0,0 +1,34 @@
"""
ⒸAngelaMos | 2025
common_schemas.py
"""
from config import HealthStatus
from .base_schema import BaseSchema
class HealthResponse(BaseSchema):
"""
Health check response
"""
status: HealthStatus
environment: str
version: str
class HealthDetailedResponse(HealthResponse):
"""
Detailed health check with component status
"""
database: HealthStatus
redis: HealthStatus | None = None
class AppInfoResponse(BaseSchema):
"""
Root endpoint response with API information
"""
name: str
version: str
environment: str
docs_url: str | None

44
PROJECTS/bug-bounty-platform/backend/app/core/constants.py Normal file
View File

@ -0,0 +1,44 @@
"""
ⒸAngelaMos | 2025
constants.py
"""
EMAIL_MAX_LENGTH = 320
PASSWORD_MIN_LENGTH = 8
PASSWORD_MAX_LENGTH = 128
PASSWORD_HASH_MAX_LENGTH = 1024
FULL_NAME_MAX_LENGTH = 255
TOKEN_HASH_LENGTH = 64
DEVICE_ID_MAX_LENGTH = 255
DEVICE_NAME_MAX_LENGTH = 100
IP_ADDRESS_MAX_LENGTH = 45
API_VERSION = "v1"
API_PREFIX = f"/{API_VERSION}"
COMPANY_NAME_MAX_LENGTH = 255
BIO_MAX_LENGTH = 2000
WEBSITE_MAX_LENGTH = 500
PROGRAM_NAME_MAX_LENGTH = 255
PROGRAM_SLUG_MAX_LENGTH = 100
PROGRAM_DESCRIPTION_MAX_LENGTH = 10000
PROGRAM_RULES_MAX_LENGTH = 50000
ASSET_IDENTIFIER_MAX_LENGTH = 500
ASSET_DESCRIPTION_MAX_LENGTH = 2000
CURRENCY_MAX_LENGTH = 3
REPORT_TITLE_MAX_LENGTH = 500
REPORT_DESCRIPTION_MAX_LENGTH = 50000
REPORT_STEPS_MAX_LENGTH = 50000
REPORT_IMPACT_MAX_LENGTH = 10000
CWE_ID_MAX_LENGTH = 20
COMMENT_MAX_LENGTH = 20000
FILENAME_MAX_LENGTH = 255
STORAGE_PATH_MAX_LENGTH = 500
MIME_TYPE_MAX_LENGTH = 100

160
PROJECTS/bug-bounty-platform/backend/app/core/database.py Normal file
View File

@ -0,0 +1,160 @@
"""
ⒸAngelaMos | 2025
database.py
"""
import contextlib
from collections.abc import (
AsyncIterator,
Iterator,
)
from sqlalchemy import create_engine
from sqlalchemy.engine import Engine
from sqlalchemy.engine.url import make_url
from sqlalchemy.ext.asyncio import (
AsyncEngine,
AsyncSession,
AsyncConnection,
async_sessionmaker,
create_async_engine,
)
from sqlalchemy.orm import Session, sessionmaker
from config import settings
class DatabaseSessionManager:
"""
Manages database connections and sessions for both sync and async contexts
"""
def __init__(self) -> None:
self._async_engine: AsyncEngine | None = None
self._sync_engine: Engine | None = None
self._async_sessionmaker: async_sessionmaker[AsyncSession
] | None = None
self._sync_sessionmaker: sessionmaker[Session] | None = None
def init(self, database_url: str) -> None:
"""
Initialize database engines and session factories
"""
base_url = make_url(database_url)
async_url = base_url.set(drivername = "postgresql+asyncpg")
self._async_engine = create_async_engine(
async_url,
pool_size = settings.DB_POOL_SIZE,
max_overflow = settings.DB_MAX_OVERFLOW,
pool_timeout = settings.DB_POOL_TIMEOUT,
pool_recycle = settings.DB_POOL_RECYCLE,
pool_pre_ping = True,
echo = settings.DEBUG,
)
self._async_sessionmaker = async_sessionmaker(
bind = self._async_engine,
class_ = AsyncSession,
autocommit = False,
autoflush = False,
expire_on_commit = False,
)
sync_url = base_url.set(drivername = "postgresql+psycopg2")
self._sync_engine = create_engine(
sync_url,
pool_size = settings.DB_POOL_SIZE,
max_overflow = settings.DB_MAX_OVERFLOW,
pool_timeout = settings.DB_POOL_TIMEOUT,
pool_recycle = settings.DB_POOL_RECYCLE,
pool_pre_ping = True,
echo = settings.DEBUG,
)
self._sync_sessionmaker = sessionmaker(
bind = self._sync_engine,
autocommit = False,
autoflush = False,
expire_on_commit = False,
)
async def close(self) -> None:
"""
Dispose of all database connections
"""
if self._async_engine:
await self._async_engine.dispose()
self._async_engine = None
self._async_sessionmaker = None
if self._sync_engine:
self._sync_engine.dispose()
self._sync_engine = None
self._sync_sessionmaker = None
@contextlib.asynccontextmanager
async def session(self) -> AsyncIterator[AsyncSession]:
"""
Async context manager for database sessions
Handles commit on success, rollback on exception
"""
if self._async_sessionmaker is None:
raise RuntimeError("DatabaseSessionManager is not initialized")
session = self._async_sessionmaker()
try:
yield session
await session.commit()
except Exception:
await session.rollback()
raise
finally:
await session.close()
@contextlib.asynccontextmanager
async def connect(self) -> AsyncIterator[AsyncConnection]:
"""
Async context manager for raw database connections
"""
if self._async_engine is None:
raise RuntimeError("DatabaseSessionManager is not initialized")
async with self._async_engine.begin() as connection:
yield connection
@property
def sync_engine(self) -> Engine:
"""
Sync engine for Alembic migrations
"""
if self._sync_engine is None:
raise RuntimeError("DatabaseSessionManager is not initialized")
return self._sync_engine
@contextlib.contextmanager
def sync_session(self) -> Iterator[Session]:
"""
Sync context manager for migrations and CLI tools
"""
if self._sync_sessionmaker is None:
raise RuntimeError("DatabaseSessionManager is not initialized")
session = self._sync_sessionmaker()
try:
yield session
session.commit()
except Exception:
session.rollback()
raise
finally:
session.close()
sessionmanager = DatabaseSessionManager()
async def get_db_session() -> AsyncIterator[AsyncSession]:
"""
FastAPI dependency for database sessions
"""
async with sessionmanager.session() as session:
yield session

146
PROJECTS/bug-bounty-platform/backend/app/core/dependencies.py Normal file
View File

@ -0,0 +1,146 @@
"""
ⒸAngelaMos | 2025
dependencies.py
"""
from __future__ import annotations
from typing import Annotated
from uuid import UUID
import jwt
from fastapi import Depends, Request
from fastapi.security import OAuth2PasswordBearer
from sqlalchemy.ext.asyncio import AsyncSession
from config import (
API_PREFIX,
TokenType,
UserRole,
)
from .database import get_db_session
from .exceptions import (
InactiveUser,
PermissionDenied,
TokenError,
TokenRevokedError,
UserNotFound,
)
from user.User import User
from .security import decode_access_token
from user.repository import UserRepository
oauth2_scheme = OAuth2PasswordBearer(
tokenUrl = f"{API_PREFIX}/auth/login",
auto_error = True,
)
oauth2_scheme_optional = OAuth2PasswordBearer(
tokenUrl = f"{API_PREFIX}/auth/login",
auto_error = False,
)
DBSession = Annotated[AsyncSession, Depends(get_db_session)]
async def get_current_user(
token: Annotated[str,
Depends(oauth2_scheme)],
db: DBSession,
) -> User:
"""
Validate access token and return current user
"""
try:
payload = decode_access_token(token)
except jwt.InvalidTokenError as e:
raise TokenError(message = str(e)) from e
if payload.get("type") != TokenType.ACCESS.value:
raise TokenError(message = "Invalid token type")
user_id = UUID(payload["sub"])
user = await UserRepository.get_by_id(db, user_id)
if user is None:
raise UserNotFound(identifier = str(user_id))
if payload.get("token_version") != user.token_version:
raise TokenRevokedError()
return user
async def get_current_active_user(
user: Annotated[User,
Depends(get_current_user)],
) -> User:
"""
Ensure user is active
"""
if not user.is_active:
raise InactiveUser()
return user
async def get_optional_user(
token: Annotated[str | None,
Depends(oauth2_scheme_optional)],
db: DBSession,
) -> User | None:
"""
Return current user if authenticated, None otherwise
"""
if token is None:
return None
try:
payload = decode_access_token(token)
if payload.get("type") != TokenType.ACCESS.value:
return None
user_id = UUID(payload["sub"])
user = await UserRepository.get_by_id(db, user_id)
if user and user.token_version == payload.get("token_version"):
return user
except (jwt.InvalidTokenError, ValueError):
pass
return None
class RequireRole:
"""
Dependency class to check user role
"""
def __init__(self, *allowed_roles: UserRole) -> None:
self.allowed_roles = allowed_roles
async def __call__(
self,
user: Annotated[User,
Depends(get_current_active_user)],
) -> User:
if user.role not in self.allowed_roles:
raise PermissionDenied(
message =
f"Requires one of roles: {', '.join(r.value for r in self.allowed_roles)}",
)
return user
CurrentUser = Annotated["User", Depends(get_current_active_user)]
OptionalUser = Annotated["User | None", Depends(get_optional_user)]
def get_client_ip(request: Request) -> str:
"""
Extract client IP considering proxy headers
"""
forwarded = request.headers.get("X-Forwarded-For")
if forwarded:
return forwarded.split(",")[0].strip()
return request.client.host if request.client else "unknown"
ClientIP = Annotated[str, Depends(get_client_ip)]

139
PROJECTS/bug-bounty-platform/backend/app/core/enums.py Normal file
View File

@ -0,0 +1,139 @@
"""
ⒸAngelaMos | 2025
enums.py
"""
from enum import Enum
from typing import Any
import sqlalchemy as sa
def enum_values_callable(enum_class: type[Enum]) -> list[str]:
"""
Returns enum VALUES (not names) for SQLAlchemy storage
Prevents the common trap where SQLAlchemy stores enum NAMES by default,
causing database breakage if you rename an enum member
"""
return [str(item.value) for item in enum_class]
class SafeEnum(sa.Enum):
"""
SQLAlchemy Enum type that stores VALUES and handles unknown values gracefully
https://blog.wrouesnel.com/posts/sqlalchemy-enums-careful-what-goes-into-the-database/
"""
def __init__(self, *enums: type[Enum], **kw: Any) -> None:
if "values_callable" not in kw:
kw["values_callable"] = enum_values_callable
super().__init__(*enums, **kw)
self._unknown_value = (
kw["_adapted_from"]._unknown_value
if "_adapted_from" in kw else kw.get("unknown_value")
)
def _object_value_for_elem(self, elem: str) -> Enum:
"""
Override to return unknown_value instead of raising LookupError
"""
try:
return self._object_lookup[elem]
except LookupError:
if self._unknown_value is not None:
return self._unknown_value
raise
class Environment(str, Enum):
"""
Application environment.
"""
DEVELOPMENT = "development"
STAGING = "staging"
PRODUCTION = "production"
class UserRole(str, Enum):
"""
User roles for authorization.
"""
UNKNOWN = "unknown"
USER = "user"
COMPANY = "company"
ADMIN = "admin"
class TokenType(str, Enum):
"""
JWT token types.
"""
ACCESS = "access"
REFRESH = "refresh"
class HealthStatus(str, Enum):
"""
Health check status values.
"""
HEALTHY = "healthy"
UNHEALTHY = "unhealthy"
DEGRADED = "degraded"
class ProgramStatus(str, Enum):
"""
Bug bounty program lifecycle status.
"""
DRAFT = "draft"
ACTIVE = "active"
PAUSED = "paused"
CLOSED = "closed"
class ProgramVisibility(str, Enum):
"""
Bug bounty program visibility level.
"""
PUBLIC = "public"
PRIVATE = "private"
INVITE_ONLY = "invite_only"
class AssetType(str, Enum):
"""
Type of asset in a bug bounty program scope.
"""
DOMAIN = "domain"
API = "api"
MOBILE_APP = "mobile_app"
SOURCE_CODE = "source_code"
HARDWARE = "hardware"
OTHER = "other"
class Severity(str, Enum):
"""
Vulnerability severity levels aligned with CVSS.
"""
CRITICAL = "critical"
HIGH = "high"
MEDIUM = "medium"
LOW = "low"
INFORMATIONAL = "informational"
class ReportStatus(str, Enum):
"""
Vulnerability report lifecycle status.
"""
NEW = "new"
TRIAGING = "triaging"
NEEDS_MORE_INFO = "needs_more_info"
ACCEPTED = "accepted"
DUPLICATE = "duplicate"
INFORMATIVE = "informative"
NOT_APPLICABLE = "not_applicable"
RESOLVED = "resolved"
DISCLOSED = "disclosed"

27
PROJECTS/bug-bounty-platform/backend/app/core/error_schemas.py Normal file
View File

@ -0,0 +1,27 @@
"""
ⒸAngelaMos | 2025
errors.py
"""
from typing import ClassVar
from pydantic import Field, ConfigDict
from core.base_schema import BaseSchema
class ErrorDetail(BaseSchema):
"""
Standard error response format
"""
detail: str = Field(..., description = "Human readable error message")
type: str = Field(..., description = "Exception class name")
model_config: ClassVar[ConfigDict] = ConfigDict(
json_schema_extra = {
"examples": [
{
"detail": "User with id '123' not found",
"type": "UserNotFound"
}
]
}
)

340
PROJECTS/bug-bounty-platform/backend/app/core/exceptions.py Normal file
View File

@ -0,0 +1,340 @@
"""
ⒸAngelaMos | 2025
exceptions.py
"""
from typing import Any
class BaseAppException(Exception):
"""
Base exception for all application specific errors
"""
def __init__(
self,
message: str,
status_code: int = 500,
extra: dict[str,
Any] | None = None,
) -> None:
self.message = message
self.status_code = status_code
self.extra = extra or {}
super().__init__(self.message)
class ResourceNotFound(BaseAppException):
"""
Raised when a requested resource does not exist
"""
def __init__(
self,
resource: str,
identifier: str | int,
extra: dict[str,
Any] | None = None,
) -> None:
super().__init__(
message = f"{resource} with id '{identifier}' not found",
status_code = 404,
extra = extra,
)
self.resource = resource
self.identifier = identifier
class ConflictError(BaseAppException):
"""
Raised when an operation conflicts with existing state
"""
def __init__(
self,
message: str,
extra: dict[str,
Any] | None = None,
) -> None:
super().__init__(
message = message,
status_code = 409,
extra = extra
)
class ValidationError(BaseAppException):
"""
Raised when input validation fails outside of Pydantic
"""
def __init__(
self,
message: str,
field: str | None = None,
extra: dict[str,
Any] | None = None,
) -> None:
super().__init__(
message = message,
status_code = 422,
extra = extra
)
self.field = field
class AuthenticationError(BaseAppException):
"""
Raised when authentication fails
"""
def __init__(
self,
message: str = "Authentication failed",
extra: dict[str,
Any] | None = None,
) -> None:
super().__init__(
message = message,
status_code = 401,
extra = extra
)
class TokenError(AuthenticationError):
"""
Raised for JWT token specific errors
"""
def __init__(
self,
message: str = "Invalid or expired token",
extra: dict[str,
Any] | None = None,
) -> None:
super().__init__(message = message, extra = extra)
class TokenRevokedError(TokenError):
"""
Raised when a revoked token is used
"""
def __init__(self, extra: dict[str, Any] | None = None) -> None:
super().__init__(message = "Token has been revoked", extra = extra)
class PermissionDenied(BaseAppException):
"""
Raised when user lacks required permissions
"""
def __init__(
self,
message: str = "Permission denied",
required_permission: str | None = None,
extra: dict[str,
Any] | None = None,
) -> None:
super().__init__(
message = message,
status_code = 403,
extra = extra
)
self.required_permission = required_permission
class RateLimitExceeded(BaseAppException):
"""
Raised when rate limit is exceeded
"""
def __init__(
self,
message: str = "Calm down a little bit...",
retry_after: int | None = None,
extra: dict[str,
Any] | None = None,
) -> None:
super().__init__(
message = message,
status_code = 420,
extra = extra
)
self.retry_after = retry_after
class UserNotFound(ResourceNotFound):
"""
Raised when a user is not found
"""
def __init__(
self,
identifier: str | int,
extra: dict[str,
Any] | None = None,
) -> None:
super().__init__(
resource = "User",
identifier = identifier,
extra = extra
)
class EmailAlreadyExists(ConflictError):
"""
Raised when attempting to register with an existing email
"""
def __init__(
self,
email: str,
extra: dict[str,
Any] | None = None
) -> None:
super().__init__(
message = f"Email '{email}' is already registered",
extra = extra,
)
self.email = email
class InvalidCredentials(AuthenticationError):
"""
Raised when login credentials are invalid
"""
def __init__(self, extra: dict[str, Any] | None = None) -> None:
super().__init__(
message = "Invalid email or password",
extra = extra
)
class InactiveUser(AuthenticationError):
"""
Raised when an inactive user attempts to authenticate.
"""
def __init__(self, extra: dict[str, Any] | None = None) -> None:
super().__init__(
message = "User account is inactive",
extra = extra
)
class ProgramNotFound(ResourceNotFound):
"""
Raised when a program is not found
"""
def __init__(
self,
identifier: str | int,
extra: dict[str,
Any] | None = None,
) -> None:
super().__init__(
resource = "Program",
identifier = identifier,
extra = extra
)
class SlugAlreadyExists(ConflictError):
"""
Raised when attempting to create a program with existing slug
"""
def __init__(
self,
slug: str,
extra: dict[str,
Any] | None = None
) -> None:
super().__init__(
message = f"Program with slug '{slug}' already exists",
extra = extra,
)
self.slug = slug
class AssetNotFound(ResourceNotFound):
"""
Raised when an asset is not found
"""
def __init__(
self,
identifier: str | int,
extra: dict[str,
Any] | None = None,
) -> None:
super().__init__(
resource = "Asset",
identifier = identifier,
extra = extra
)
class NotProgramOwner(PermissionDenied):
"""
Raised when user tries to modify a program they don't own
"""
def __init__(self, extra: dict[str, Any] | None = None) -> None:
super().__init__(
message = "You are not the owner of this program",
extra = extra
)
class ReportNotFound(ResourceNotFound):
"""
Raised when a report is not found
"""
def __init__(
self,
identifier: str | int,
extra: dict[str,
Any] | None = None,
) -> None:
super().__init__(
resource = "Report",
identifier = identifier,
extra = extra
)
class NotReportOwner(PermissionDenied):
"""
Raised when user tries to modify a report they don't own
"""
def __init__(self, extra: dict[str, Any] | None = None) -> None:
super().__init__(
message = "You are not the owner of this report",
extra = extra
)
class ProgramNotActive(ValidationError):
"""
Raised when trying to submit to an inactive program
"""
def __init__(self, extra: dict[str, Any] | None = None) -> None:
super().__init__(
message = "This program is not accepting submissions",
extra = extra
)
class CannotSubmitToOwnProgram(ValidationError):
"""
Raised when user tries to submit a report to their own program
"""
def __init__(self, extra: dict[str, Any] | None = None) -> None:
super().__init__(
message = "You cannot submit reports to your own program",
extra = extra
)
class InvalidStatusTransition(ValidationError):
"""
Raised when an invalid status transition is attempted
"""
def __init__(
self,
current: str,
target: str,
extra: dict[str,
Any] | None = None
) -> None:
super().__init__(
message = f"Cannot transition from '{current}' to '{target}'",
extra = extra
)

79
PROJECTS/bug-bounty-platform/backend/app/core/health_routes.py Normal file
View File

@ -0,0 +1,79 @@
"""
ⒸAngelaMos | 2025
health_routes.py
"""
from fastapi import (
APIRouter,
status,
)
import redis.asyncio as redis
from sqlalchemy import text
from config import (
settings,
HealthStatus,
)
from .common_schemas import (
HealthResponse,
HealthDetailedResponse,
)
from .database import sessionmanager
router = APIRouter(tags = ["health"])
@router.get(
"/health",
response_model = HealthResponse,
status_code = status.HTTP_200_OK,
)
async def health_check() -> HealthResponse:
"""
Basic health check
"""
return HealthResponse(
status = HealthStatus.HEALTHY,
environment = settings.ENVIRONMENT.value,
version = settings.APP_VERSION,
)
@router.get(
"/health/detailed",
response_model = HealthDetailedResponse,
status_code = status.HTTP_200_OK,
)
async def health_check_detailed() -> HealthDetailedResponse:
"""
Detailed health check including database connectivity
"""
db_status = HealthStatus.UNHEALTHY
redis_status = None
try:
async with sessionmanager.connect() as conn:
await conn.execute(text("SELECT 1"))
db_status = HealthStatus.HEALTHY
except Exception:
db_status = HealthStatus.UNHEALTHY
if settings.REDIS_URL:
try:
r = redis.from_url(str(settings.REDIS_URL))
await r.ping()
redis_status = HealthStatus.HEALTHY
await r.close()
except Exception:
redis_status = HealthStatus.UNHEALTHY
overall = HealthStatus.HEALTHY if db_status == HealthStatus.HEALTHY else HealthStatus.DEGRADED
return HealthDetailedResponse(
status = overall,
environment = settings.ENVIRONMENT.value,
version = settings.APP_VERSION,
database = db_status,
redis = redis_status,
)

79
PROJECTS/bug-bounty-platform/backend/app/core/logging.py Normal file
View File

@ -0,0 +1,79 @@
"""
ⒸAngelaMos | 2025
logging.py
"""
import logging
import sys
import structlog
from structlog.types import Processor
from config import (
settings,
Environment,
)
def configure_logging() -> None:
"""
Structlog with appropriate processors for the environment
"""
shared_processors: list[Processor] = [
structlog.contextvars.merge_contextvars,
structlog.stdlib.add_log_level,
structlog.stdlib.add_logger_name,
structlog.processors.TimeStamper(fmt = "iso"),
structlog.processors.StackInfoRenderer(),
structlog.processors.UnicodeDecoder(),
]
if settings.ENVIRONMENT == Environment.PRODUCTION:
shared_processors.append(structlog.processors.format_exc_info)
renderer: Processor = structlog.processors.JSONRenderer()
else:
renderer = structlog.dev.ConsoleRenderer(colors = True)
structlog.configure(
processors = shared_processors + [
structlog.stdlib.ProcessorFormatter.wrap_for_formatter,
],
logger_factory = structlog.stdlib.LoggerFactory(),
wrapper_class = structlog.stdlib.BoundLogger,
cache_logger_on_first_use = True,
)
formatter = structlog.stdlib.ProcessorFormatter(
foreign_pre_chain = shared_processors,
processors = [
structlog.stdlib.ProcessorFormatter.remove_processors_meta,
renderer,
],
)
handler = logging.StreamHandler(sys.stdout)
handler.setFormatter(formatter)
root_logger = logging.getLogger()
root_logger.handlers.clear()
root_logger.addHandler(handler)
root_logger.setLevel(settings.LOG_LEVEL)
for logger_name in ["uvicorn",
"uvicorn.access",
"uvicorn.error",
"sqlalchemy.engine"]:
logger = logging.getLogger(logger_name)
logger.handlers.clear()
logger.addHandler(handler)
logger.propagate = False
if settings.ENVIRONMENT != Environment.DEVELOPMENT:
logging.getLogger("sqlalchemy.engine").setLevel(logging.WARNING)
def get_logger(name: str | None = None) -> structlog.stdlib.BoundLogger:
"""
Get a structured logger instance
"""
return structlog.get_logger(name)

0
PROJECTS/bug-bounty-platform/backend/app/core/py.typed Normal file
View File

44
PROJECTS/bug-bounty-platform/backend/app/core/rate_limit.py Normal file
View File

@ -0,0 +1,44 @@
"""
ⒸAngelaMos | 2025
rate_limit.py
"""
import jwt
from slowapi import Limiter
from slowapi.util import get_remote_address
from starlette.requests import Request
from config import settings
def get_identifier(request: Request) -> str:
"""
Get rate limit identifier
Uses user ID if authenticated, otherwise falls back to IP address
(Will add more fingerprinting if needed depending on project)
"""
auth_header = request.headers.get("Authorization")
if auth_header and auth_header.startswith("Bearer "):
try:
token = auth_header.split(" ")[1]
payload = jwt.decode(
token,
options = {"verify_signature": False},
)
user_id = payload.get("sub")
if user_id:
return f"user:{user_id}"
except Exception:
pass
return get_remote_address(request)
limiter = Limiter(
key_func = get_identifier,
storage_uri = str(settings.REDIS_URL) if settings.REDIS_URL else None,
default_limits = [settings.RATE_LIMIT_DEFAULT],
headers_enabled = True,
in_memory_fallback_enabled = True,
)

45
PROJECTS/bug-bounty-platform/backend/app/core/responses.py Normal file
View File

@ -0,0 +1,45 @@
"""
ⒸAngelaMos | 2025
responses.py
"""
from typing import Any
from .error_schemas import ErrorDetail
AUTH_401: dict[int | str,
dict[str,
Any]] = {
401: {
"model": ErrorDetail,
"description": "Authentication failed"
},
}
FORBIDDEN_403: dict[int | str,
dict[str,
Any]] = {
403: {
"model": ErrorDetail,
"description": "Permission denied"
},
}
NOT_FOUND_404: dict[int | str,
dict[str,
Any]] = {
404: {
"model": ErrorDetail,
"description": "Resource not found"
},
}
CONFLICT_409: dict[int | str,
dict[str,
Any]] = {
409: {
"model": ErrorDetail,
"description": "Resource conflict"
},
}

190
PROJECTS/bug-bounty-platform/backend/app/core/security.py Normal file
View File

@ -0,0 +1,190 @@
"""
ⒸAngelaMos | 2025
security.py
"""
import asyncio
import hashlib
import secrets
from datetime import (
UTC,
datetime,
timedelta,
)
from typing import Any
from uuid import UUID
import jwt
from fastapi import Response
from pwdlib import PasswordHash
from config import (
settings,
TokenType,
)
password_hasher = PasswordHash.recommended()
async def hash_password(password: str) -> str:
"""
Hash password using Argon2id
Runs in thread pool to avoid blocking the async event loop
since Argon2 is CPU intensive by design
"""
return await asyncio.to_thread(password_hasher.hash, password)
async def verify_password(plain_password: str,
hashed_password: str) -> tuple[bool,
str | None]:
"""
Verify password and check if rehash is needed
Returns:
Tuple of (is_valid, new_hash_if_needs_rehash)
If password is valid but hash params are outdated, returns new hash
"""
try:
return await asyncio.to_thread(
password_hasher.verify_and_update,
plain_password,
hashed_password
)
except Exception:
return False, None
DUMMY_HASH = password_hasher.hash(
"dummy_password_for_timing_attack_prevention"
)
async def verify_password_with_timing_safety(
plain_password: str,
hashed_password: str | None,
) -> tuple[bool,
str | None]:
"""
Verify password with constant time behavior to prevent user enumeration
If no hash is provided (user doesn't exist), still performs a dummy
hash operation to prevent timing attacks
"""
if hashed_password is None:
await asyncio.to_thread(
password_hasher.verify,
plain_password,
DUMMY_HASH
)
return False, None
return await verify_password(plain_password, hashed_password)
def create_access_token(
user_id: UUID,
token_version: int,
extra_claims: dict[str,
Any] | None = None,
) -> str:
"""
Create a short lived access token
"""
now = datetime.now(UTC)
payload = {
"sub": str(user_id),
"type": TokenType.ACCESS.value,
"token_version": token_version,
"iat": now,
"exp":
now + timedelta(minutes = settings.ACCESS_TOKEN_EXPIRE_MINUTES),
}
if extra_claims:
payload.update(extra_claims)
return jwt.encode(
payload,
settings.SECRET_KEY.get_secret_value(),
algorithm = settings.JWT_ALGORITHM,
)
def create_refresh_token(
user_id: UUID,
family_id: UUID,
) -> tuple[str,
str,
datetime]:
"""
Create a long lived refresh token
Returns:
Tuple of (raw_token, token_hash, expires_at)
Raw token is sent to client, hash is stored in database
"""
raw_token = secrets.token_urlsafe(32)
token_hash = hashlib.sha256(raw_token.encode()).hexdigest()
expires_at = datetime.now(UTC) + timedelta(
days = settings.REFRESH_TOKEN_EXPIRE_DAYS
)
return raw_token, token_hash, expires_at
def decode_access_token(token: str) -> dict[str, Any]:
"""
Decode and validate an access token
Raises:
jwt.InvalidTokenError: If token is invalid or expired
"""
return jwt.decode(
token,
settings.SECRET_KEY.get_secret_value(),
algorithms = [settings.JWT_ALGORITHM],
options = {
"require": ["exp",
"sub",
"iat",
"type",
"token_version"]
},
)
def hash_token(token: str) -> str:
"""
Hash a token for secure storage
"""
return hashlib.sha256(token.encode()).hexdigest()
def generate_secure_token(nbytes: int = 32) -> str:
"""
Generate a cryptographically secure random token
"""
return secrets.token_urlsafe(nbytes)
def set_refresh_cookie(response: Response, token: str) -> None:
"""
Set refresh token as HttpOnly cookie
"""
response.set_cookie(
key = "refresh_token",
value = token,
httponly = True,
secure = settings.ENVIRONMENT.value != "development",
samesite = "strict",
max_age = settings.REFRESH_TOKEN_EXPIRE_DAYS * 24 * 60 * 60,
path = "/",
)
def clear_refresh_cookie(response: Response) -> None:
"""
Clear refresh token cookie
"""
response.delete_cookie(key = "refresh_token", path = "/")

145
PROJECTS/bug-bounty-platform/backend/app/factory.py Normal file
View File

@ -0,0 +1,145 @@
"""
ⒸAngelaMos | 2025
factory.py
"""
from collections.abc import AsyncIterator
from contextlib import asynccontextmanager
from fastapi import FastAPI, Request
from fastapi.middleware.cors import CORSMiddleware
from fastapi.responses import JSONResponse
from slowapi import _rate_limit_exceeded_handler
from slowapi.errors import RateLimitExceeded
from config import settings, Environment, API_PREFIX
from core.database import sessionmanager
from core.exceptions import BaseAppException
from core.logging import configure_logging
from core.rate_limit import limiter
from middleware.correlation import CorrelationIdMiddleware
from core.common_schemas import AppInfoResponse
from core.health_routes import router as health_router
from user.routes import router as user_router
from auth.routes import router as auth_router
from admin.routes import router as admin_router
from program.routes import router as program_router
from report.routes import router as report_router
@asynccontextmanager
async def lifespan(app: FastAPI) -> AsyncIterator[None]:
"""
Application lifespan handler for startup and shutdown
"""
configure_logging()
sessionmanager.init(str(settings.DATABASE_URL))
yield
await sessionmanager.close()
OPENAPI_TAGS = [
{
"name": "root",
"description": "API information"
},
{
"name": "health",
"description": "Health check endpoints"
},
{
"name": "auth",
"description": "Authentication and authorization"
},
{
"name": "users",
"description": "User registration and profile management"
},
{
"name": "programs",
"description": "Bug bounty program management"
},
{
"name": "reports",
"description": "Vulnerability report submission and triage"
},
{
"name": "admin",
"description": "Admin only operations"
},
]
def create_app() -> FastAPI:
"""
Application factory
"""
is_production = settings.ENVIRONMENT == Environment.PRODUCTION
app = FastAPI(
title = settings.APP_NAME,
summary = settings.APP_SUMMARY,
description = settings.APP_DESCRIPTION,
version = settings.APP_VERSION,
contact = {
"name": settings.APP_CONTACT_NAME,
"email": settings.APP_CONTACT_EMAIL,
},
license_info = {
"name": settings.APP_LICENSE_NAME,
"url": settings.APP_LICENSE_URL,
},
openapi_tags = OPENAPI_TAGS,
openapi_version = "3.1.0",
lifespan = lifespan,
root_path = "/api",
openapi_url = "/openapi.json",
docs_url = "/docs",
redoc_url = "/redoc",
)
app.add_middleware(CorrelationIdMiddleware)
app.add_middleware(
CORSMiddleware,
allow_origins = settings.CORS_ORIGINS,
allow_credentials = settings.CORS_ALLOW_CREDENTIALS,
allow_methods = settings.CORS_ALLOW_METHODS,
allow_headers = settings.CORS_ALLOW_HEADERS,
)
app.state.limiter = limiter
app.add_exception_handler(
RateLimitExceeded,
_rate_limit_exceeded_handler
)
@app.exception_handler(BaseAppException)
async def app_exception_handler(
request: Request,
exc: BaseAppException,
) -> JSONResponse:
return JSONResponse(
status_code = exc.status_code,
content = {
"detail": exc.message,
"type": exc.__class__.__name__,
},
)
@app.get("/", response_model = AppInfoResponse, tags = ["root"])
async def root() -> AppInfoResponse:
return AppInfoResponse(
name = settings.APP_NAME,
version = settings.APP_VERSION,
environment = settings.ENVIRONMENT.value,
docs_url = "/docs",
)
app.include_router(health_router)
app.include_router(admin_router, prefix = API_PREFIX)
app.include_router(auth_router, prefix = API_PREFIX)
app.include_router(user_router, prefix = API_PREFIX)
app.include_router(program_router, prefix = API_PREFIX)
app.include_router(report_router, prefix = API_PREFIX)
return app

11
PROJECTS/bug-bounty-platform/backend/app/middleware/__init__.py Normal file
View File

@ -0,0 +1,11 @@
"""
AngelaMos | 2025
__init__.py
"""
from .correlation import CorrelationIdMiddleware
__all__ = [
"CorrelationIdMiddleware",
]

43
PROJECTS/bug-bounty-platform/backend/app/middleware/correlation.py Normal file
View File

@ -0,0 +1,43 @@
"""
ⒸAngelaMos | 2025
correlation.py
"""
import uuid
from collections.abc import (
Awaitable,
Callable,
)
import structlog
from starlette.requests import Request
from starlette.responses import Response
from starlette.middleware.base import BaseHTTPMiddleware
RequestResponseEndpoint = Callable[[Request], Awaitable[Response]]
class CorrelationIdMiddleware(BaseHTTPMiddleware):
"""
Correlation ID to requests for distributed tracing
"""
async def dispatch(
self,
request: Request,
call_next: RequestResponseEndpoint,
) -> Response:
correlation_id = request.headers.get(
"X-Correlation-ID",
str(uuid.uuid4())
)
structlog.contextvars.clear_contextvars()
structlog.contextvars.bind_contextvars(
correlation_id = correlation_id,
method = request.method,
path = request.url.path,
)
response = await call_next(request)
response.headers["X-Correlation-ID"] = correlation_id
return response

0
PROJECTS/bug-bounty-platform/backend/app/middleware/py.typed Normal file
View File

64
PROJECTS/bug-bounty-platform/backend/app/program/Asset.py Normal file
View File

@ -0,0 +1,64 @@
"""
ⒸAngelaMos | 2025
Asset.py
"""
from __future__ import annotations
from typing import TYPE_CHECKING
from uuid import UUID
from sqlalchemy import ForeignKey, String, Text
from sqlalchemy.orm import (
Mapped,
mapped_column,
relationship,
)
from config import (
ASSET_IDENTIFIER_MAX_LENGTH,
AssetType,
SafeEnum,
)
from core.Base import (
Base,
TimestampMixin,
UUIDMixin,
)
if TYPE_CHECKING:
from program.Program import Program
class Asset(Base, UUIDMixin, TimestampMixin):
"""
Target asset within a bug bounty program scope
"""
__tablename__ = "assets"
program_id: Mapped[UUID] = mapped_column(
ForeignKey("programs.id",
ondelete = "CASCADE"),
index = True,
)
asset_type: Mapped[AssetType] = mapped_column(
SafeEnum(AssetType),
default = AssetType.DOMAIN,
)
identifier: Mapped[str] = mapped_column(
String(ASSET_IDENTIFIER_MAX_LENGTH),
)
in_scope: Mapped[bool] = mapped_column(default = True)
description: Mapped[str | None] = mapped_column(
Text,
default = None,
)
program: Mapped[Program] = relationship(
back_populates = "assets",
lazy = "raise",
)

114
PROJECTS/bug-bounty-platform/backend/app/program/Program.py Normal file
View File

@ -0,0 +1,114 @@
"""
ⒸAngelaMos | 2025
Program.py
"""
from __future__ import annotations
from typing import TYPE_CHECKING
from uuid import UUID
from sqlalchemy import ForeignKey, String, Text
from sqlalchemy.orm import (
Mapped,
mapped_column,
relationship,
)
from config import (
PROGRAM_NAME_MAX_LENGTH,
PROGRAM_SLUG_MAX_LENGTH,
ProgramStatus,
ProgramVisibility,
SafeEnum,
)
from core.Base import (
Base,
TimestampMixin,
UUIDMixin,
)
if TYPE_CHECKING:
from program.Asset import Asset
from program.RewardTier import RewardTier
from report.Report import Report
from user.User import User
class Program(Base, UUIDMixin, TimestampMixin):
"""
Bug bounty program hosted by a company or individual
"""
__tablename__ = "programs"
company_id: Mapped[UUID] = mapped_column(
ForeignKey("users.id",
ondelete = "CASCADE"),
index = True,
)
name: Mapped[str] = mapped_column(
String(PROGRAM_NAME_MAX_LENGTH),
)
slug: Mapped[str] = mapped_column(
String(PROGRAM_SLUG_MAX_LENGTH),
unique = True,
index = True,
)
description: Mapped[str | None] = mapped_column(
Text,
default = None,
)
rules: Mapped[str | None] = mapped_column(
Text,
default = None,
)
response_sla_hours: Mapped[int] = mapped_column(default = 72)
status: Mapped[ProgramStatus] = mapped_column(
SafeEnum(ProgramStatus),
default = ProgramStatus.DRAFT,
index = True,
)
visibility: Mapped[ProgramVisibility] = mapped_column(
SafeEnum(ProgramVisibility),
default = ProgramVisibility.PUBLIC,
)
company: Mapped[User] = relationship(
back_populates = "programs",
lazy = "raise",
)
assets: Mapped[list[Asset]] = relationship(
back_populates = "program",
cascade = "all, delete-orphan",
lazy = "raise",
)
reward_tiers: Mapped[list[RewardTier]] = relationship(
back_populates = "program",
cascade = "all, delete-orphan",
lazy = "raise",
)
reports: Mapped[list[Report]] = relationship(
back_populates = "program",
cascade = "all, delete-orphan",
lazy = "raise",
)
@property
def is_active(self) -> bool:
"""
Check if program is accepting submissions
"""
return self.status == ProgramStatus.ACTIVE
@property
def is_public(self) -> bool:
"""
Check if program is publicly visible
"""
return self.visibility == ProgramVisibility.PUBLIC

60
PROJECTS/bug-bounty-platform/backend/app/program/RewardTier.py Normal file
View File

@ -0,0 +1,60 @@
"""
ⒸAngelaMos | 2025
RewardTier.py
"""
from __future__ import annotations
from typing import TYPE_CHECKING
from uuid import UUID
from sqlalchemy import ForeignKey, String
from sqlalchemy.orm import (
Mapped,
mapped_column,
relationship,
)
from config import (
CURRENCY_MAX_LENGTH,
SafeEnum,
Severity,
)
from core.Base import (
Base,
TimestampMixin,
UUIDMixin,
)
if TYPE_CHECKING:
from program.Program import Program
class RewardTier(Base, UUIDMixin, TimestampMixin):
"""
Bounty reward tier by severity for a program
"""
__tablename__ = "reward_tiers"
program_id: Mapped[UUID] = mapped_column(
ForeignKey("programs.id",
ondelete = "CASCADE"),
index = True,
)
severity: Mapped[Severity] = mapped_column(
SafeEnum(Severity),
)
min_bounty: Mapped[int] = mapped_column(default = 0)
max_bounty: Mapped[int] = mapped_column(default = 0)
currency: Mapped[str] = mapped_column(
String(CURRENCY_MAX_LENGTH),
default = "USD",
)
program: Mapped[Program] = relationship(
back_populates = "reward_tiers",
lazy = "raise",
)

4
PROJECTS/bug-bounty-platform/backend/app/program/__init__.py Normal file
View File

@ -0,0 +1,4 @@
"""
ⒸAngelaMos | 2025
__init__.py
"""

21
PROJECTS/bug-bounty-platform/backend/app/program/dependencies.py Normal file
View File

@ -0,0 +1,21 @@
"""
ⒸAngelaMos | 2025
dependencies.py
"""
from typing import Annotated
from fastapi import Depends
from core.dependencies import DBSession
from .service import ProgramService
def get_program_service(db: DBSession) -> ProgramService:
"""
Dependency to inject ProgramService instance
"""
return ProgramService(db)
ProgramServiceDep = Annotated[ProgramService, Depends(get_program_service)]

232
PROJECTS/bug-bounty-platform/backend/app/program/repository.py Normal file
View File

@ -0,0 +1,232 @@
"""
ⒸAngelaMos | 2025
repository.py
"""
from collections.abc import Sequence
from uuid import UUID
from sqlalchemy import func, select
from sqlalchemy.ext.asyncio import AsyncSession
from sqlalchemy.orm import selectinload
from config import ProgramStatus, ProgramVisibility
from core.base_repository import BaseRepository
from .Program import Program
from .Asset import Asset
from .RewardTier import RewardTier
class ProgramRepository(BaseRepository[Program]):
"""
Repository for Program model database operations
"""
model = Program
@classmethod
async def get_by_slug(
cls,
session: AsyncSession,
slug: str,
) -> Program | None:
"""
Get program by slug
"""
result = await session.execute(
select(Program).where(Program.slug == slug)
)
return result.scalars().first()
@classmethod
async def get_by_slug_with_details(
cls,
session: AsyncSession,
slug: str,
) -> Program | None:
"""
Get program by slug with assets and reward tiers
"""
result = await session.execute(
select(Program).where(Program.slug == slug).options(
selectinload(Program.assets),
selectinload(Program.reward_tiers),
)
)
return result.scalars().first()
@classmethod
async def get_by_id_with_details(
cls,
session: AsyncSession,
program_id: UUID,
) -> Program | None:
"""
Get program by ID with assets and reward tiers
"""
result = await session.execute(
select(Program).where(Program.id == program_id).options(
selectinload(Program.assets),
selectinload(Program.reward_tiers),
)
)
return result.scalars().first()
@classmethod
async def slug_exists(
cls,
session: AsyncSession,
slug: str,
) -> bool:
"""
Check if slug is already taken
"""
result = await session.execute(
select(Program.id).where(Program.slug == slug)
)
return result.scalars().first() is not None
@classmethod
async def get_public_programs(
cls,
session: AsyncSession,
skip: int = 0,
limit: int = 20,
) -> Sequence[Program]:
"""
Get active public programs
"""
result = await session.execute(
select(Program).where(
Program.status == ProgramStatus.ACTIVE,
Program.visibility == ProgramVisibility.PUBLIC,
).order_by(Program.created_at.desc()
).offset(skip).limit(limit)
)
return result.scalars().all()
@classmethod
async def count_public_programs(
cls,
session: AsyncSession,
) -> int:
"""
Count active public programs
"""
result = await session.execute(
select(func.count()).select_from(Program).where(
Program.status == ProgramStatus.ACTIVE,
Program.visibility == ProgramVisibility.PUBLIC,
)
)
return result.scalar_one()
@classmethod
async def get_by_company(
cls,
session: AsyncSession,
company_id: UUID,
skip: int = 0,
limit: int = 20,
) -> Sequence[Program]:
"""
Get programs by company/owner
"""
result = await session.execute(
select(Program).where(Program.company_id == company_id
).order_by(Program.created_at.desc()
).offset(skip).limit(limit)
)
return result.scalars().all()
@classmethod
async def count_by_company(
cls,
session: AsyncSession,
company_id: UUID,
) -> int:
"""
Count programs by company
"""
result = await session.execute(
select(func.count()).select_from(Program).where(
Program.company_id == company_id
)
)
return result.scalar_one()
class AssetRepository(BaseRepository[Asset]):
"""
Repository for Asset model database operations
"""
model = Asset
@classmethod
async def get_by_program(
cls,
session: AsyncSession,
program_id: UUID,
) -> Sequence[Asset]:
"""
Get all assets for a program
"""
result = await session.execute(
select(Asset).where(
Asset.program_id == program_id
).order_by(Asset.in_scope.desc(),
Asset.created_at)
)
return result.scalars().all()
class RewardTierRepository(BaseRepository[RewardTier]):
"""
Repository for RewardTier model database operations
"""
model = RewardTier
@classmethod
async def get_by_program(
cls,
session: AsyncSession,
program_id: UUID,
) -> Sequence[RewardTier]:
"""
Get all reward tiers for a program
"""
result = await session.execute(
select(RewardTier).where(RewardTier.program_id == program_id)
)
return result.scalars().all()
@classmethod
async def get_by_program_and_severity(
cls,
session: AsyncSession,
program_id: UUID,
severity: str,
) -> RewardTier | None:
"""
Get reward tier by program and severity
"""
result = await session.execute(
select(RewardTier).where(
RewardTier.program_id == program_id,
RewardTier.severity == severity,
)
)
return result.scalars().first()
@classmethod
async def delete_by_program(
cls,
session: AsyncSession,
program_id: UUID,
) -> None:
"""
Delete all reward tiers for a program
"""
tiers = await cls.get_by_program(session, program_id)
for tier in tiers:
await session.delete(tier)
await session.flush()

279
PROJECTS/bug-bounty-platform/backend/app/program/routes.py Normal file
View File

@ -0,0 +1,279 @@
"""
ⒸAngelaMos | 2025
routes.py
"""
from uuid import UUID
from fastapi import APIRouter, Query, status
from core.dependencies import CurrentUser
from core.responses import (
AUTH_401,
CONFLICT_409,
FORBIDDEN_403,
NOT_FOUND_404,
)
from .schemas import (
AssetCreate,
AssetResponse,
AssetUpdate,
ProgramCreate,
ProgramDetailResponse,
ProgramListResponse,
ProgramResponse,
ProgramUpdate,
RewardTierCreate,
RewardTierResponse,
)
from .dependencies import ProgramServiceDep
router = APIRouter(prefix = "/programs", tags = ["programs"])
@router.post(
"",
response_model = ProgramResponse,
status_code = status.HTTP_201_CREATED,
responses = {
**AUTH_401,
**CONFLICT_409
},
)
async def create_program(
program_service: ProgramServiceDep,
current_user: CurrentUser,
program_data: ProgramCreate,
) -> ProgramResponse:
"""
Create a new bug bounty program
"""
return await program_service.create_program(current_user, program_data)
@router.get(
"",
response_model = ProgramListResponse,
)
async def list_programs(
program_service: ProgramServiceDep,
page: int = Query(default = 1,
ge = 1),
size: int = Query(default = 20,
ge = 1,
le = 100),
) -> ProgramListResponse:
"""
List active public programs
"""
return await program_service.list_public_programs(page, size)
@router.get(
"/mine",
response_model = ProgramListResponse,
responses = {**AUTH_401},
)
async def list_my_programs(
program_service: ProgramServiceDep,
current_user: CurrentUser,
page: int = Query(default = 1,
ge = 1),
size: int = Query(default = 20,
ge = 1,
le = 100),
) -> ProgramListResponse:
"""
List programs owned by current user
"""
return await program_service.list_my_programs(current_user, page, size)
@router.get(
"/{slug}",
response_model = ProgramDetailResponse,
responses = {**NOT_FOUND_404},
)
async def get_program(
program_service: ProgramServiceDep,
slug: str,
) -> ProgramDetailResponse:
"""
Get program by slug with full details
"""
return await program_service.get_program_by_slug(slug)
@router.patch(
"/{program_id}",
response_model = ProgramResponse,
responses = {
**AUTH_401,
**FORBIDDEN_403,
**NOT_FOUND_404
},
)
async def update_program(
program_service: ProgramServiceDep,
current_user: CurrentUser,
program_id: UUID,
program_data: ProgramUpdate,
) -> ProgramResponse:
"""
Update program details
"""
return await program_service.update_program(
current_user,
program_id,
program_data
)
@router.delete(
"/{program_id}",
status_code = status.HTTP_204_NO_CONTENT,
responses = {
**AUTH_401,
**FORBIDDEN_403,
**NOT_FOUND_404
},
)
async def delete_program(
program_service: ProgramServiceDep,
current_user: CurrentUser,
program_id: UUID,
) -> None:
"""
Delete a program
"""
await program_service.delete_program(current_user, program_id)
@router.get(
"/{program_id}/assets",
response_model = list[AssetResponse],
responses = {**NOT_FOUND_404},
)
async def list_assets(
program_service: ProgramServiceDep,
program_id: UUID,
) -> list[AssetResponse]:
"""
List program assets (scope)
"""
return await program_service.list_assets(program_id)
@router.post(
"/{program_id}/assets",
response_model = AssetResponse,
status_code = status.HTTP_201_CREATED,
responses = {
**AUTH_401,
**FORBIDDEN_403,
**NOT_FOUND_404
},
)
async def add_asset(
program_service: ProgramServiceDep,
current_user: CurrentUser,
program_id: UUID,
asset_data: AssetCreate,
) -> AssetResponse:
"""
Add asset to program scope
"""
return await program_service.add_asset(
current_user,
program_id,
asset_data
)
@router.patch(
"/{program_id}/assets/{asset_id}",
response_model = AssetResponse,
responses = {
**AUTH_401,
**FORBIDDEN_403,
**NOT_FOUND_404
},
)
async def update_asset(
program_service: ProgramServiceDep,
current_user: CurrentUser,
program_id: UUID,
asset_id: UUID,
asset_data: AssetUpdate,
) -> AssetResponse:
"""
Update an asset
"""
return await program_service.update_asset(
current_user,
program_id,
asset_id,
asset_data
)
@router.delete(
"/{program_id}/assets/{asset_id}",
status_code = status.HTTP_204_NO_CONTENT,
responses = {
**AUTH_401,
**FORBIDDEN_403,
**NOT_FOUND_404
},
)
async def delete_asset(
program_service: ProgramServiceDep,
current_user: CurrentUser,
program_id: UUID,
asset_id: UUID,
) -> None:
"""
Delete an asset
"""
await program_service.delete_asset(current_user, program_id, asset_id)
@router.get(
"/{program_id}/rewards",
response_model = list[RewardTierResponse],
responses = {**NOT_FOUND_404},
)
async def list_reward_tiers(
program_service: ProgramServiceDep,
program_id: UUID,
) -> list[RewardTierResponse]:
"""
List program reward tiers
"""
return await program_service.list_reward_tiers(program_id)
@router.put(
"/{program_id}/rewards",
response_model = list[RewardTierResponse],
responses = {
**AUTH_401,
**FORBIDDEN_403,
**NOT_FOUND_404
},
)
async def set_reward_tiers(
program_service: ProgramServiceDep,
current_user: CurrentUser,
program_id: UUID,
tiers: list[RewardTierCreate],
) -> list[RewardTierResponse]:
"""
Set reward tiers for program (replaces existing)
"""
return await program_service.set_reward_tiers(
current_user,
program_id,
tiers
)

179
PROJECTS/bug-bounty-platform/backend/app/program/schemas.py Normal file
View File

@ -0,0 +1,179 @@
"""
ⒸAngelaMos | 2025
schemas.py
"""
from uuid import UUID
from decimal import Decimal
from pydantic import Field, field_validator, ValidationInfo
from config import (
ASSET_IDENTIFIER_MAX_LENGTH,
AssetType,
PROGRAM_DESCRIPTION_MAX_LENGTH,
PROGRAM_NAME_MAX_LENGTH,
PROGRAM_RULES_MAX_LENGTH,
PROGRAM_SLUG_MAX_LENGTH,
ProgramStatus,
ProgramVisibility,
Severity,
)
from core.base_schema import (
BaseSchema,
BaseResponseSchema,
)
class RewardTierCreate(BaseSchema):
"""
Schema for creating a reward tier
"""
severity: Severity
min_bounty: int = Field(ge = 0, default = 0)
max_bounty: int = Field(ge = 0, default = 0)
currency: str = Field(default = "USD", max_length = 3)
@field_validator("max_bounty")
@classmethod
def max_gte_min(cls, v: int, info: ValidationInfo) -> int:
"""
Ensure max bounty is greater than or equal to min bounty
"""
if "min_bounty" in info.data and v < info.data["min_bounty"]:
raise ValueError("max_bounty must be >= min_bounty")
return v
class RewardTierResponse(BaseResponseSchema):
"""
Schema for reward tier API responses
"""
program_id: UUID
severity: Severity
min_bounty: int
max_bounty: int
currency: str
class AssetCreate(BaseSchema):
"""
Schema for creating an asset
"""
asset_type: AssetType = AssetType.DOMAIN
identifier: str = Field(max_length = ASSET_IDENTIFIER_MAX_LENGTH)
in_scope: bool = True
description: str | None = None
class AssetUpdate(BaseSchema):
"""
Schema for updating an asset
"""
asset_type: AssetType | None = None
identifier: str | None = Field(
default = None,
max_length = ASSET_IDENTIFIER_MAX_LENGTH
)
in_scope: bool | None = None
description: str | None = None
class AssetResponse(BaseResponseSchema):
"""
Schema for asset API responses
"""
program_id: UUID
asset_type: AssetType
identifier: str
in_scope: bool
description: str | None
class ProgramCreate(BaseSchema):
"""
Schema for creating a program
"""
name: str = Field(max_length = PROGRAM_NAME_MAX_LENGTH)
slug: str = Field(
max_length = PROGRAM_SLUG_MAX_LENGTH,
pattern = r"^[a-z0-9-]+$"
)
description: str | None = Field(
default = None,
max_length = PROGRAM_DESCRIPTION_MAX_LENGTH
)
rules: str | None = Field(
default = None,
max_length = PROGRAM_RULES_MAX_LENGTH
)
response_sla_hours: int = Field(default = 72, ge = 1, le = 720)
visibility: ProgramVisibility = ProgramVisibility.PUBLIC
class ProgramUpdate(BaseSchema):
"""
Schema for updating a program
"""
name: str | None = Field(
default = None,
max_length = PROGRAM_NAME_MAX_LENGTH
)
description: str | None = Field(
default = None,
max_length = PROGRAM_DESCRIPTION_MAX_LENGTH
)
rules: str | None = Field(
default = None,
max_length = PROGRAM_RULES_MAX_LENGTH
)
response_sla_hours: int | None = Field(
default = None,
ge = 1,
le = 720
)
status: ProgramStatus | None = None
visibility: ProgramVisibility | None = None
class ProgramResponse(BaseResponseSchema):
"""
Schema for program API responses
"""
company_id: UUID
name: str
slug: str
description: str | None
rules: str | None
response_sla_hours: int
status: ProgramStatus
visibility: ProgramVisibility
class ProgramDetailResponse(ProgramResponse):
"""
Schema for program detail with assets and rewards
"""
assets: list[AssetResponse]
reward_tiers: list[RewardTierResponse]
class ProgramListResponse(BaseSchema):
"""
Schema for paginated program list
"""
items: list[ProgramResponse]
total: int
page: int
size: int
class ProgramStatsResponse(BaseSchema):
"""
Schema for program statistics
"""
total_reports: int
open_reports: int
resolved_reports: int
total_paid: int
average_response_hours: Decimal | None

375
PROJECTS/bug-bounty-platform/backend/app/program/service.py Normal file
View File

@ -0,0 +1,375 @@
"""
ⒸAngelaMos | 2025
service.py
"""
from uuid import UUID
from sqlalchemy.ext.asyncio import AsyncSession
from core.exceptions import (
AssetNotFound,
NotProgramOwner,
ProgramNotFound,
SlugAlreadyExists,
)
from user.User import User
from .schemas import (
AssetCreate,
AssetResponse,
AssetUpdate,
ProgramCreate,
ProgramDetailResponse,
ProgramListResponse,
ProgramResponse,
ProgramUpdate,
RewardTierCreate,
RewardTierResponse,
)
from .repository import (
AssetRepository,
ProgramRepository,
RewardTierRepository,
)
class ProgramService:
"""
Business logic for program operations
"""
def __init__(self, session: AsyncSession) -> None:
self.session = session
async def create_program(
self,
user: User,
program_data: ProgramCreate,
) -> ProgramResponse:
"""
Create a new bug bounty program
"""
if await ProgramRepository.slug_exists(self.session,
program_data.slug):
raise SlugAlreadyExists(program_data.slug)
program = await ProgramRepository.create(
self.session,
company_id = user.id,
name = program_data.name,
slug = program_data.slug,
description = program_data.description,
rules = program_data.rules,
response_sla_hours = program_data.response_sla_hours,
visibility = program_data.visibility,
)
return ProgramResponse.model_validate(program)
async def get_program_by_slug(
self,
slug: str,
) -> ProgramDetailResponse:
"""
Get program by slug with full details
"""
program = await ProgramRepository.get_by_slug_with_details(
self.session,
slug
)
if not program:
raise ProgramNotFound(slug)
return ProgramDetailResponse(
id = program.id,
created_at = program.created_at,
updated_at = program.updated_at,
company_id = program.company_id,
name = program.name,
slug = program.slug,
description = program.description,
rules = program.rules,
response_sla_hours = program.response_sla_hours,
status = program.status,
visibility = program.visibility,
assets = [
AssetResponse.model_validate(a) for a in program.assets
],
reward_tiers = [
RewardTierResponse.model_validate(r)
for r in program.reward_tiers
],
)
async def get_program_by_id(
self,
program_id: UUID,
) -> ProgramResponse:
"""
Get program by ID
"""
program = await ProgramRepository.get_by_id(
self.session,
program_id
)
if not program:
raise ProgramNotFound(str(program_id))
return ProgramResponse.model_validate(program)
async def list_public_programs(
self,
page: int,
size: int,
) -> ProgramListResponse:
"""
List active public programs
"""
skip = (page - 1) * size
programs = await ProgramRepository.get_public_programs(
self.session,
skip = skip,
limit = size,
)
total = await ProgramRepository.count_public_programs(self.session)
return ProgramListResponse(
items = [ProgramResponse.model_validate(p) for p in programs],
total = total,
page = page,
size = size,
)
async def list_my_programs(
self,
user: User,
page: int,
size: int,
) -> ProgramListResponse:
"""
List programs owned by user
"""
skip = (page - 1) * size
programs = await ProgramRepository.get_by_company(
self.session,
company_id = user.id,
skip = skip,
limit = size,
)
total = await ProgramRepository.count_by_company(
self.session,
user.id
)
return ProgramListResponse(
items = [ProgramResponse.model_validate(p) for p in programs],
total = total,
page = page,
size = size,
)
async def update_program(
self,
user: User,
program_id: UUID,
program_data: ProgramUpdate,
) -> ProgramResponse:
"""
Update program details
"""
program = await ProgramRepository.get_by_id(
self.session,
program_id
)
if not program:
raise ProgramNotFound(str(program_id))
if program.company_id != user.id:
raise NotProgramOwner()
update_dict = program_data.model_dump(exclude_unset = True)
updated = await ProgramRepository.update(
self.session,
program,
**update_dict,
)
return ProgramResponse.model_validate(updated)
async def delete_program(
self,
user: User,
program_id: UUID,
) -> None:
"""
Delete a program
"""
program = await ProgramRepository.get_by_id(
self.session,
program_id
)
if not program:
raise ProgramNotFound(str(program_id))
if program.company_id != user.id:
raise NotProgramOwner()
await ProgramRepository.delete(self.session, program)
async def add_asset(
self,
user: User,
program_id: UUID,
asset_data: AssetCreate,
) -> AssetResponse:
"""
Add asset to program scope
"""
program = await ProgramRepository.get_by_id(
self.session,
program_id
)
if not program:
raise ProgramNotFound(str(program_id))
if program.company_id != user.id:
raise NotProgramOwner()
asset = await AssetRepository.create(
self.session,
program_id = program_id,
asset_type = asset_data.asset_type,
identifier = asset_data.identifier,
in_scope = asset_data.in_scope,
description = asset_data.description,
)
return AssetResponse.model_validate(asset)
async def update_asset(
self,
user: User,
program_id: UUID,
asset_id: UUID,
asset_data: AssetUpdate,
) -> AssetResponse:
"""
Update an asset
"""
program = await ProgramRepository.get_by_id(
self.session,
program_id
)
if not program:
raise ProgramNotFound(str(program_id))
if program.company_id != user.id:
raise NotProgramOwner()
asset = await AssetRepository.get_by_id(self.session, asset_id)
if not asset or asset.program_id != program_id:
raise AssetNotFound(str(asset_id))
update_dict = asset_data.model_dump(exclude_unset = True)
updated = await AssetRepository.update(
self.session,
asset,
**update_dict,
)
return AssetResponse.model_validate(updated)
async def delete_asset(
self,
user: User,
program_id: UUID,
asset_id: UUID,
) -> None:
"""
Delete an asset
"""
program = await ProgramRepository.get_by_id(
self.session,
program_id
)
if not program:
raise ProgramNotFound(str(program_id))
if program.company_id != user.id:
raise NotProgramOwner()
asset = await AssetRepository.get_by_id(self.session, asset_id)
if not asset or asset.program_id != program_id:
raise AssetNotFound(str(asset_id))
await AssetRepository.delete(self.session, asset)
async def list_assets(
self,
program_id: UUID,
) -> list[AssetResponse]:
"""
List all assets for a program
"""
program = await ProgramRepository.get_by_id(
self.session,
program_id
)
if not program:
raise ProgramNotFound(str(program_id))
assets = await AssetRepository.get_by_program(
self.session,
program_id
)
return [AssetResponse.model_validate(a) for a in assets]
async def set_reward_tiers(
self,
user: User,
program_id: UUID,
tiers: list[RewardTierCreate],
) -> list[RewardTierResponse]:
"""
Set reward tiers for a program (replaces existing)
"""
program = await ProgramRepository.get_by_id(
self.session,
program_id
)
if not program:
raise ProgramNotFound(str(program_id))
if program.company_id != user.id:
raise NotProgramOwner()
await RewardTierRepository.delete_by_program(
self.session,
program_id
)
created_tiers = []
for tier_data in tiers:
tier = await RewardTierRepository.create(
self.session,
program_id = program_id,
severity = tier_data.severity,
min_bounty = tier_data.min_bounty,
max_bounty = tier_data.max_bounty,
currency = tier_data.currency,
)
created_tiers.append(RewardTierResponse.model_validate(tier))
return created_tiers
async def list_reward_tiers(
self,
program_id: UUID,
) -> list[RewardTierResponse]:
"""
List reward tiers for a program
"""
program = await ProgramRepository.get_by_id(
self.session,
program_id
)
if not program:
raise ProgramNotFound(str(program_id))
tiers = await RewardTierRepository.get_by_program(
self.session,
program_id
)
return [RewardTierResponse.model_validate(t) for t in tiers]

0
PROJECTS/bug-bounty-platform/backend/app/py.typed Normal file
View File

64
PROJECTS/bug-bounty-platform/backend/app/report/Attachment.py Normal file
View File

@ -0,0 +1,64 @@
"""
ⒸAngelaMos | 2025
Attachment.py
"""
from __future__ import annotations
from typing import TYPE_CHECKING
from uuid import UUID
from sqlalchemy import BigInteger, ForeignKey, String
from sqlalchemy.orm import (
Mapped,
mapped_column,
relationship,
)
from config import (
FILENAME_MAX_LENGTH,
MIME_TYPE_MAX_LENGTH,
STORAGE_PATH_MAX_LENGTH,
)
from core.Base import (
Base,
TimestampMixin,
UUIDMixin,
)
if TYPE_CHECKING:
from report.Report import Report
class Attachment(Base, UUIDMixin, TimestampMixin):
"""
File attachment on a vulnerability report
"""
__tablename__ = "attachments"
report_id: Mapped[UUID] = mapped_column(
ForeignKey("reports.id",
ondelete = "CASCADE"),
index = True,
)
comment_id: Mapped[UUID | None] = mapped_column(
ForeignKey("comments.id",
ondelete = "SET NULL"),
default = None,
)
filename: Mapped[str] = mapped_column(
String(FILENAME_MAX_LENGTH),
)
storage_path: Mapped[str] = mapped_column(
String(STORAGE_PATH_MAX_LENGTH),
)
mime_type: Mapped[str] = mapped_column(
String(MIME_TYPE_MAX_LENGTH),
)
size_bytes: Mapped[int] = mapped_column(BigInteger)
report: Mapped[Report] = relationship(
back_populates = "attachments",
lazy = "raise",
)

54
PROJECTS/bug-bounty-platform/backend/app/report/Comment.py Normal file
View File

@ -0,0 +1,54 @@
"""
ⒸAngelaMos | 2025
Comment.py
"""
from __future__ import annotations
from typing import TYPE_CHECKING
from uuid import UUID
from sqlalchemy import ForeignKey, Text
from sqlalchemy.orm import (
Mapped,
mapped_column,
relationship,
)
from core.Base import (
Base,
TimestampMixin,
UUIDMixin,
)
if TYPE_CHECKING:
from report.Report import Report
from user.User import User
class Comment(Base, UUIDMixin, TimestampMixin):
"""
Comment on a vulnerability report
"""
__tablename__ = "comments"
report_id: Mapped[UUID] = mapped_column(
ForeignKey("reports.id",
ondelete = "CASCADE"),
index = True,
)
author_id: Mapped[UUID] = mapped_column(
ForeignKey("users.id",
ondelete = "CASCADE"),
index = True,
)
content: Mapped[str] = mapped_column(Text)
is_internal: Mapped[bool] = mapped_column(default = False)
report: Mapped[Report] = relationship(
back_populates = "comments",
lazy = "raise",
)
author: Mapped[User] = relationship(lazy = "raise")

185
PROJECTS/bug-bounty-platform/backend/app/report/Report.py Normal file
View File

@ -0,0 +1,185 @@
"""
ⒸAngelaMos | 2025
Report.py
"""
from __future__ import annotations
from datetime import UTC, datetime
from decimal import Decimal
from typing import TYPE_CHECKING
from uuid import UUID
from sqlalchemy import DateTime, ForeignKey, Numeric, String, Text
from sqlalchemy.orm import (
Mapped,
mapped_column,
relationship,
)
from config import (
CWE_ID_MAX_LENGTH,
REPORT_TITLE_MAX_LENGTH,
ReportStatus,
SafeEnum,
Severity,
)
from core.Base import (
Base,
TimestampMixin,
UUIDMixin,
)
if TYPE_CHECKING:
from program.Program import Program
from report.Attachment import Attachment
from report.Comment import Comment
from user.User import User
class Report(Base, UUIDMixin, TimestampMixin):
"""
Vulnerability report submitted by a researcher
"""
__tablename__ = "reports"
program_id: Mapped[UUID] = mapped_column(
ForeignKey("programs.id",
ondelete = "CASCADE"),
index = True,
)
researcher_id: Mapped[UUID] = mapped_column(
ForeignKey("users.id",
ondelete = "CASCADE"),
index = True,
)
title: Mapped[str] = mapped_column(
String(REPORT_TITLE_MAX_LENGTH),
)
description: Mapped[str] = mapped_column(Text)
steps_to_reproduce: Mapped[str | None] = mapped_column(
Text,
default = None,
)
impact: Mapped[str | None] = mapped_column(
Text,
default = None,
)
severity_submitted: Mapped[Severity] = mapped_column(
SafeEnum(Severity),
default = Severity.MEDIUM,
)
severity_final: Mapped[Severity | None] = mapped_column(
SafeEnum(Severity),
default = None,
)
status: Mapped[ReportStatus] = mapped_column(
SafeEnum(ReportStatus),
default = ReportStatus.NEW,
index = True,
)
cvss_score: Mapped[Decimal | None] = mapped_column(
Numeric(precision = 3,
scale = 1),
default = None,
)
cwe_id: Mapped[str | None] = mapped_column(
String(CWE_ID_MAX_LENGTH),
default = None,
)
bounty_amount: Mapped[int | None] = mapped_column(default = None)
duplicate_of_id: Mapped[UUID | None] = mapped_column(
ForeignKey("reports.id",
ondelete = "SET NULL"),
default = None,
)
triaged_at: Mapped[datetime | None] = mapped_column(
DateTime(timezone = True),
default = None,
)
resolved_at: Mapped[datetime | None] = mapped_column(
DateTime(timezone = True),
default = None,
)
disclosed_at: Mapped[datetime | None] = mapped_column(
DateTime(timezone = True),
default = None,
)
program: Mapped[Program] = relationship(
back_populates = "reports",
lazy = "raise",
)
researcher: Mapped[User] = relationship(
back_populates = "reports",
lazy = "raise",
)
comments: Mapped[list[Comment]] = relationship(
back_populates = "report",
cascade = "all, delete-orphan",
lazy = "raise",
)
attachments: Mapped[list[Attachment]] = relationship(
back_populates = "report",
cascade = "all, delete-orphan",
lazy = "raise",
)
duplicate_of: Mapped[Report | None] = relationship(
remote_side = "Report.id",
lazy = "raise",
)
def mark_triaging(self) -> None:
"""
Transition report to triaging status
"""
self.status = ReportStatus.TRIAGING
self.triaged_at = datetime.now(UTC)
def mark_resolved(self) -> None:
"""
Transition report to resolved status
"""
self.status = ReportStatus.RESOLVED
self.resolved_at = datetime.now(UTC)
def mark_disclosed(self) -> None:
"""
Transition report to disclosed status
"""
self.status = ReportStatus.DISCLOSED
self.disclosed_at = datetime.now(UTC)
@property
def is_open(self) -> bool:
"""
Check if report is still open for action
"""
return self.status in (
ReportStatus.NEW,
ReportStatus.TRIAGING,
ReportStatus.NEEDS_MORE_INFO,
)
@property
def is_closed(self) -> bool:
"""
Check if report has reached a terminal state
"""
return self.status in (
ReportStatus.ACCEPTED,
ReportStatus.DUPLICATE,
ReportStatus.INFORMATIVE,
ReportStatus.NOT_APPLICABLE,
ReportStatus.RESOLVED,
ReportStatus.DISCLOSED,
)

4
PROJECTS/bug-bounty-platform/backend/app/report/__init__.py Normal file
View File

@ -0,0 +1,4 @@
"""
ⒸAngelaMos | 2025
__init__.py
"""

21
PROJECTS/bug-bounty-platform/backend/app/report/dependencies.py Normal file
View File

@ -0,0 +1,21 @@
"""
ⒸAngelaMos | 2025
dependencies.py
"""
from typing import Annotated
from fastapi import Depends
from core.dependencies import DBSession
from .service import ReportService
def get_report_service(db: DBSession) -> ReportService:
"""
Dependency to inject ReportService instance
"""
return ReportService(db)
ReportServiceDep = Annotated[ReportService, Depends(get_report_service)]

256
PROJECTS/bug-bounty-platform/backend/app/report/repository.py Normal file
View File

@ -0,0 +1,256 @@
"""
ⒸAngelaMos | 2025
repository.py
"""
from typing import Any
from collections.abc import Sequence
from uuid import UUID
from sqlalchemy import func, select
from sqlalchemy.ext.asyncio import AsyncSession
from sqlalchemy.orm import selectinload
from config import ReportStatus
from core.base_repository import BaseRepository
from program.Program import Program
from .Report import Report
from .Comment import Comment
from .Attachment import Attachment
class ReportRepository(BaseRepository[Report]):
"""
Repository for Report model database operations
"""
model = Report
@classmethod
async def get_by_id_with_details(
cls,
session: AsyncSession,
report_id: UUID,
) -> Report | None:
"""
Get report by ID with comments and attachments
"""
result = await session.execute(
select(Report).where(Report.id == report_id).options(
selectinload(Report.comments),
selectinload(Report.attachments),
)
)
return result.scalars().first()
@classmethod
async def get_by_researcher(
cls,
session: AsyncSession,
researcher_id: UUID,
skip: int = 0,
limit: int = 20,
) -> Sequence[Report]:
"""
Get reports by researcher
"""
result = await session.execute(
select(Report).where(Report.researcher_id == researcher_id
).order_by(Report.created_at.desc()
).offset(skip).limit(limit)
)
return result.scalars().all()
@classmethod
async def count_by_researcher(
cls,
session: AsyncSession,
researcher_id: UUID,
) -> int:
"""
Count reports by researcher
"""
result = await session.execute(
select(func.count()).select_from(Report).where(
Report.researcher_id == researcher_id
)
)
return result.scalar_one()
@classmethod
async def get_by_program(
cls,
session: AsyncSession,
program_id: UUID,
skip: int = 0,
limit: int = 20,
status_filter: ReportStatus | None = None,
) -> Sequence[Report]:
"""
Get reports for a program (inbox view)
"""
query = select(Report).where(Report.program_id == program_id)
if status_filter:
query = query.where(Report.status == status_filter)
result = await session.execute(
query.order_by(Report.created_at.desc()
).offset(skip).limit(limit)
)
return result.scalars().all()
@classmethod
async def count_by_program(
cls,
session: AsyncSession,
program_id: UUID,
status_filter: ReportStatus | None = None,
) -> int:
"""
Count reports for a program
"""
query = (
select(func.count()).select_from(Report).where(
Report.program_id == program_id
)
)
if status_filter:
query = query.where(Report.status == status_filter)
result = await session.execute(query)
return result.scalar_one()
@classmethod
async def get_inbox_for_company(
cls,
session: AsyncSession,
company_id: UUID,
skip: int = 0,
limit: int = 20,
) -> Sequence[Report]:
"""
Get all reports across all programs owned by company
"""
result = await session.execute(
select(Report).join(Program,
Report.program_id == Program.id).where(
Program.company_id == company_id
).order_by(Report.created_at.desc()
).offset(skip).limit(limit)
)
return result.scalars().all()
@classmethod
async def count_inbox_for_company(
cls,
session: AsyncSession,
company_id: UUID,
) -> int:
"""
Count all reports for company's programs
"""
result = await session.execute(
select(func.count()).select_from(Report).join(
Program,
Report.program_id == Program.id
).where(Program.company_id == company_id)
)
return result.scalar_one()
@classmethod
async def get_researcher_stats(
cls,
session: AsyncSession,
researcher_id: UUID,
) -> dict[str,
Any]:
"""
Get statistics for a researcher
"""
total_result = await session.execute(
select(func.count()).select_from(Report).where(
Report.researcher_id == researcher_id
)
)
total = total_result.scalar_one()
accepted_result = await session.execute(
select(func.count()).select_from(Report).where(
Report.researcher_id == researcher_id,
Report.status.in_(
[
ReportStatus.ACCEPTED,
ReportStatus.RESOLVED,
ReportStatus.DISCLOSED,
]
)
)
)
accepted = accepted_result.scalar_one()
earned_result = await session.execute(
select(func.coalesce(func.sum(Report.bounty_amount),
0)).where(
Report.researcher_id == researcher_id,
Report.bounty_amount.isnot(None),
)
)
earned = earned_result.scalar_one()
return {
"total_reports": total,
"accepted_reports": accepted,
"total_earned": earned,
}
class CommentRepository(BaseRepository[Comment]):
"""
Repository for Comment model database operations
"""
model = Comment
@classmethod
async def get_by_report(
cls,
session: AsyncSession,
report_id: UUID,
include_internal: bool = False,
) -> Sequence[Comment]:
"""
Get comments for a report
"""
query = select(Comment).where(Comment.report_id == report_id)
if not include_internal:
query = query.where(Comment.is_internal == False)
result = await session.execute(
query.order_by(Comment.created_at.asc())
)
return result.scalars().all()
class AttachmentRepository(BaseRepository[Attachment]):
"""
Repository for Attachment model database operations
"""
model = Attachment
@classmethod
async def get_by_report(
cls,
session: AsyncSession,
report_id: UUID,
) -> Sequence[Attachment]:
"""
Get attachments for a report
"""
result = await session.execute(
select(Attachment).where(Attachment.report_id == report_id
).order_by(
Attachment.created_at.asc()
)
)
return result.scalars().all()

251
PROJECTS/bug-bounty-platform/backend/app/report/routes.py Normal file
View File

@ -0,0 +1,251 @@
"""
ⒸAngelaMos | 2025
routes.py
"""
from uuid import UUID
from fastapi import APIRouter, Query, status
from config import ReportStatus
from core.dependencies import CurrentUser
from core.responses import (
AUTH_401,
FORBIDDEN_403,
NOT_FOUND_404,
)
from .schemas import (
CommentCreate,
CommentResponse,
ReportCreate,
ReportDetailResponse,
ReportListResponse,
ReportResponse,
ReportStatsResponse,
ReportTriageUpdate,
ReportUpdate,
)
from .dependencies import ReportServiceDep
router = APIRouter(prefix = "/reports", tags = ["reports"])
@router.post(
"",
response_model = ReportResponse,
status_code = status.HTTP_201_CREATED,
responses = {
**AUTH_401,
**NOT_FOUND_404
},
)
async def submit_report(
report_service: ReportServiceDep,
current_user: CurrentUser,
report_data: ReportCreate,
) -> ReportResponse:
"""
Submit a new vulnerability report
"""
return await report_service.submit_report(current_user, report_data)
@router.get(
"",
response_model = ReportListResponse,
responses = {**AUTH_401},
)
async def list_my_reports(
report_service: ReportServiceDep,
current_user: CurrentUser,
page: int = Query(default = 1,
ge = 1),
size: int = Query(default = 20,
ge = 1,
le = 100),
) -> ReportListResponse:
"""
List reports submitted by current user
"""
return await report_service.list_my_reports(current_user, page, size)
@router.get(
"/inbox",
response_model = ReportListResponse,
responses = {**AUTH_401},
)
async def list_inbox(
report_service: ReportServiceDep,
current_user: CurrentUser,
page: int = Query(default = 1,
ge = 1),
size: int = Query(default = 20,
ge = 1,
le = 100),
) -> ReportListResponse:
"""
List all reports across user's programs (company inbox)
"""
return await report_service.list_inbox(current_user, page, size)
@router.get(
"/stats",
response_model = ReportStatsResponse,
responses = {**AUTH_401},
)
async def get_my_stats(
report_service: ReportServiceDep,
current_user: CurrentUser,
) -> ReportStatsResponse:
"""
Get current user's report statistics
"""
return await report_service.get_my_stats(current_user)
@router.get(
"/program/{program_id}",
response_model = ReportListResponse,
responses = {
**AUTH_401,
**FORBIDDEN_403,
**NOT_FOUND_404
},
)
async def list_program_reports(
report_service: ReportServiceDep,
current_user: CurrentUser,
program_id: UUID,
page: int = Query(default = 1,
ge = 1),
size: int = Query(default = 20,
ge = 1,
le = 100),
status_filter: ReportStatus | None = None,
) -> ReportListResponse:
"""
List reports for a specific program (program owner only)
"""
return await report_service.list_program_reports(
current_user,
program_id,
page,
size,
status_filter,
)
@router.get(
"/{report_id}",
response_model = ReportDetailResponse,
responses = {
**AUTH_401,
**NOT_FOUND_404
},
)
async def get_report(
report_service: ReportServiceDep,
current_user: CurrentUser,
report_id: UUID,
) -> ReportDetailResponse:
"""
Get report by ID with full details
"""
return await report_service.get_report(current_user, report_id)
@router.patch(
"/{report_id}",
response_model = ReportResponse,
responses = {
**AUTH_401,
**FORBIDDEN_403,
**NOT_FOUND_404
},
)
async def update_report(
report_service: ReportServiceDep,
current_user: CurrentUser,
report_id: UUID,
report_data: ReportUpdate,
) -> ReportResponse:
"""
Update report (researcher only, only if still open)
"""
return await report_service.update_report(
current_user,
report_id,
report_data
)
@router.patch(
"/{report_id}/triage",
response_model = ReportResponse,
responses = {
**AUTH_401,
**FORBIDDEN_403,
**NOT_FOUND_404
},
)
async def triage_report(
report_service: ReportServiceDep,
current_user: CurrentUser,
report_id: UUID,
triage_data: ReportTriageUpdate,
) -> ReportResponse:
"""
Triage a report (program owner only)
"""
return await report_service.triage_report(
current_user,
report_id,
triage_data
)
@router.get(
"/{report_id}/comments",
response_model = list[CommentResponse],
responses = {
**AUTH_401,
**NOT_FOUND_404
},
)
async def list_comments(
report_service: ReportServiceDep,
current_user: CurrentUser,
report_id: UUID,
) -> list[CommentResponse]:
"""
List comments for a report
"""
return await report_service.list_comments(current_user, report_id)
@router.post(
"/{report_id}/comments",
response_model = CommentResponse,
status_code = status.HTTP_201_CREATED,
responses = {
**AUTH_401,
**NOT_FOUND_404
},
)
async def add_comment(
report_service: ReportServiceDep,
current_user: CurrentUser,
report_id: UUID,
comment_data: CommentCreate,
) -> CommentResponse:
"""
Add comment to a report
"""
return await report_service.add_comment(
current_user,
report_id,
comment_data
)

141
PROJECTS/bug-bounty-platform/backend/app/report/schemas.py Normal file
View File

@ -0,0 +1,141 @@
"""
ⒸAngelaMos | 2025
schemas.py
"""
from uuid import UUID
from datetime import datetime
from decimal import Decimal
from pydantic import Field
from config import (
CWE_ID_MAX_LENGTH,
REPORT_TITLE_MAX_LENGTH,
ReportStatus,
Severity,
)
from core.base_schema import (
BaseSchema,
BaseResponseSchema,
)
class ReportCreate(BaseSchema):
"""
Schema for submitting a vulnerability report
"""
program_id: UUID
title: str = Field(max_length = REPORT_TITLE_MAX_LENGTH)
description: str
steps_to_reproduce: str | None = None
impact: str | None = None
severity_submitted: Severity = Severity.MEDIUM
class ReportUpdate(BaseSchema):
"""
Schema for researcher updating their report
"""
title: str | None = Field(
default = None,
max_length = REPORT_TITLE_MAX_LENGTH
)
description: str | None = None
steps_to_reproduce: str | None = None
impact: str | None = None
severity_submitted: Severity | None = None
class ReportTriageUpdate(BaseSchema):
"""
Schema for company triaging a report
"""
status: ReportStatus | None = None
severity_final: Severity | None = None
cvss_score: Decimal | None = Field(default = None, ge = 0, le = 10)
cwe_id: str | None = Field(
default = None,
max_length = CWE_ID_MAX_LENGTH
)
bounty_amount: int | None = Field(default = None, ge = 0)
duplicate_of_id: UUID | None = None
class ReportResponse(BaseResponseSchema):
"""
Schema for report API responses
"""
program_id: UUID
researcher_id: UUID
title: str
description: str
steps_to_reproduce: str | None
impact: str | None
severity_submitted: Severity
severity_final: Severity | None
status: ReportStatus
cvss_score: Decimal | None
cwe_id: str | None
bounty_amount: int | None
duplicate_of_id: UUID | None
triaged_at: datetime | None
resolved_at: datetime | None
disclosed_at: datetime | None
class ReportListResponse(BaseSchema):
"""
Schema for paginated report list
"""
items: list[ReportResponse]
total: int
page: int
size: int
class CommentCreate(BaseSchema):
"""
Schema for adding a comment to a report
"""
content: str
is_internal: bool = False
class CommentResponse(BaseResponseSchema):
"""
Schema for comment API responses
"""
report_id: UUID
author_id: UUID
content: str
is_internal: bool
class AttachmentResponse(BaseResponseSchema):
"""
Schema for attachment API responses
"""
report_id: UUID
comment_id: UUID | None
filename: str
mime_type: str
size_bytes: int
class ReportDetailResponse(ReportResponse):
"""
Schema for report detail with comments
"""
comments: list[CommentResponse]
attachments: list[AttachmentResponse]
class ReportStatsResponse(BaseSchema):
"""
Schema for researcher stats
"""
total_reports: int
accepted_reports: int
total_earned: int
reputation_score: int

381
PROJECTS/bug-bounty-platform/backend/app/report/service.py Normal file
View File

@ -0,0 +1,381 @@
"""
ⒸAngelaMos | 2025
service.py
"""
from uuid import UUID
from sqlalchemy.ext.asyncio import AsyncSession
from config import ReportStatus
from core.exceptions import (
CannotSubmitToOwnProgram,
NotProgramOwner,
NotReportOwner,
ProgramNotActive,
ProgramNotFound,
ReportNotFound,
)
from program.repository import ProgramRepository
from user.User import User
from .schemas import (
AttachmentResponse,
CommentCreate,
CommentResponse,
ReportCreate,
ReportDetailResponse,
ReportListResponse,
ReportResponse,
ReportStatsResponse,
ReportTriageUpdate,
ReportUpdate,
)
from .repository import (
CommentRepository,
ReportRepository,
)
class ReportService:
"""
Business logic for report operations
"""
def __init__(self, session: AsyncSession) -> None:
self.session = session
async def submit_report(
self,
user: User,
report_data: ReportCreate,
) -> ReportResponse:
"""
Submit a new vulnerability report
"""
program = await ProgramRepository.get_by_id(
self.session,
report_data.program_id
)
if not program:
raise ProgramNotFound(str(report_data.program_id))
if not program.is_active:
raise ProgramNotActive()
if program.company_id == user.id:
raise CannotSubmitToOwnProgram()
report = await ReportRepository.create(
self.session,
program_id = report_data.program_id,
researcher_id = user.id,
title = report_data.title,
description = report_data.description,
steps_to_reproduce = report_data.steps_to_reproduce,
impact = report_data.impact,
severity_submitted = report_data.severity_submitted,
)
return ReportResponse.model_validate(report)
async def get_report(
self,
user: User,
report_id: UUID,
) -> ReportDetailResponse:
"""
Get report by ID with details
"""
report = await ReportRepository.get_by_id_with_details(
self.session,
report_id
)
if not report:
raise ReportNotFound(str(report_id))
program = await ProgramRepository.get_by_id(
self.session,
report.program_id
)
is_researcher = report.researcher_id == user.id
is_program_owner = program and program.company_id == user.id
if not is_researcher and not is_program_owner:
raise ReportNotFound(str(report_id))
comments = report.comments
if is_researcher and not is_program_owner:
comments = [c for c in comments if not c.is_internal]
return ReportDetailResponse(
id = report.id,
created_at = report.created_at,
updated_at = report.updated_at,
program_id = report.program_id,
researcher_id = report.researcher_id,
title = report.title,
description = report.description,
steps_to_reproduce = report.steps_to_reproduce,
impact = report.impact,
severity_submitted = report.severity_submitted,
severity_final = report.severity_final,
status = report.status,
cvss_score = report.cvss_score,
cwe_id = report.cwe_id,
bounty_amount = report.bounty_amount,
duplicate_of_id = report.duplicate_of_id,
triaged_at = report.triaged_at,
resolved_at = report.resolved_at,
disclosed_at = report.disclosed_at,
comments = [
CommentResponse.model_validate(c) for c in comments
],
attachments = [
AttachmentResponse.model_validate(a)
for a in report.attachments
],
)
async def list_my_reports(
self,
user: User,
page: int,
size: int,
) -> ReportListResponse:
"""
List reports submitted by current user
"""
skip = (page - 1) * size
reports = await ReportRepository.get_by_researcher(
self.session,
researcher_id = user.id,
skip = skip,
limit = size,
)
total = await ReportRepository.count_by_researcher(
self.session,
user.id
)
return ReportListResponse(
items = [ReportResponse.model_validate(r) for r in reports],
total = total,
page = page,
size = size,
)
async def list_program_reports(
self,
user: User,
program_id: UUID,
page: int,
size: int,
status_filter: ReportStatus | None = None,
) -> ReportListResponse:
"""
List reports for a program (program owner only)
"""
program = await ProgramRepository.get_by_id(
self.session,
program_id
)
if not program:
raise ProgramNotFound(str(program_id))
if program.company_id != user.id:
raise NotProgramOwner()
skip = (page - 1) * size
reports = await ReportRepository.get_by_program(
self.session,
program_id = program_id,
skip = skip,
limit = size,
status_filter = status_filter,
)
total = await ReportRepository.count_by_program(
self.session,
program_id,
status_filter
)
return ReportListResponse(
items = [ReportResponse.model_validate(r) for r in reports],
total = total,
page = page,
size = size,
)
async def list_inbox(
self,
user: User,
page: int,
size: int,
) -> ReportListResponse:
"""
List all reports across user's programs
"""
skip = (page - 1) * size
reports = await ReportRepository.get_inbox_for_company(
self.session,
company_id = user.id,
skip = skip,
limit = size,
)
total = await ReportRepository.count_inbox_for_company(
self.session,
user.id
)
return ReportListResponse(
items = [ReportResponse.model_validate(r) for r in reports],
total = total,
page = page,
size = size,
)
async def update_report(
self,
user: User,
report_id: UUID,
report_data: ReportUpdate,
) -> ReportResponse:
"""
Update report (researcher only, only if still open)
"""
report = await ReportRepository.get_by_id(self.session, report_id)
if not report:
raise ReportNotFound(str(report_id))
if report.researcher_id != user.id:
raise NotReportOwner()
if not report.is_open:
raise ReportNotFound(str(report_id))
update_dict = report_data.model_dump(exclude_unset = True)
updated = await ReportRepository.update(
self.session,
report,
**update_dict,
)
return ReportResponse.model_validate(updated)
async def triage_report(
self,
user: User,
report_id: UUID,
triage_data: ReportTriageUpdate,
) -> ReportResponse:
"""
Triage a report (program owner only)
"""
report = await ReportRepository.get_by_id(self.session, report_id)
if not report:
raise ReportNotFound(str(report_id))
program = await ProgramRepository.get_by_id(
self.session,
report.program_id
)
if not program or program.company_id != user.id:
raise NotProgramOwner()
update_dict = triage_data.model_dump(exclude_unset = True)
if "status" in update_dict:
new_status = update_dict["status"]
if new_status == ReportStatus.TRIAGING and report.triaged_at is None:
report.mark_triaging()
elif new_status == ReportStatus.RESOLVED:
report.mark_resolved()
elif new_status == ReportStatus.DISCLOSED:
report.mark_disclosed()
updated = await ReportRepository.update(
self.session,
report,
**update_dict,
)
return ReportResponse.model_validate(updated)
async def add_comment(
self,
user: User,
report_id: UUID,
comment_data: CommentCreate,
) -> CommentResponse:
"""
Add comment to a report
"""
report = await ReportRepository.get_by_id(self.session, report_id)
if not report:
raise ReportNotFound(str(report_id))
program = await ProgramRepository.get_by_id(
self.session,
report.program_id
)
is_researcher = report.researcher_id == user.id
is_program_owner = program and program.company_id == user.id
if not is_researcher and not is_program_owner:
raise ReportNotFound(str(report_id))
if comment_data.is_internal and not is_program_owner:
comment_data.is_internal = False
comment = await CommentRepository.create(
self.session,
report_id = report_id,
author_id = user.id,
content = comment_data.content,
is_internal = comment_data.is_internal,
)
return CommentResponse.model_validate(comment)
async def list_comments(
self,
user: User,
report_id: UUID,
) -> list[CommentResponse]:
"""
List comments for a report
"""
report = await ReportRepository.get_by_id(self.session, report_id)
if not report:
raise ReportNotFound(str(report_id))
program = await ProgramRepository.get_by_id(
self.session,
report.program_id
)
is_researcher = report.researcher_id == user.id
is_program_owner = bool(program and program.company_id == user.id)
if not is_researcher and not is_program_owner:
raise ReportNotFound(str(report_id))
include_internal = is_program_owner
comments = await CommentRepository.get_by_report(
self.session,
report_id,
include_internal = include_internal,
)
return [CommentResponse.model_validate(c) for c in comments]
async def get_my_stats(
self,
user: User,
) -> ReportStatsResponse:
"""
Get current user's report statistics
"""
stats = await ReportRepository.get_researcher_stats(
self.session,
user.id
)
return ReportStatsResponse(
total_reports = stats["total_reports"],
accepted_reports = stats["accepted_reports"],
total_earned = stats["total_earned"],
reputation_score = user.reputation_score,
)

126
PROJECTS/bug-bounty-platform/backend/app/user/User.py Normal file
View File

@ -0,0 +1,126 @@
"""
ⒸAngelaMos | 2025
User.py
"""
from __future__ import annotations
from typing import TYPE_CHECKING
from sqlalchemy import String, Text
from sqlalchemy.orm import (
Mapped,
mapped_column,
relationship,
)
from config import (
COMPANY_NAME_MAX_LENGTH,
EMAIL_MAX_LENGTH,
FULL_NAME_MAX_LENGTH,
PASSWORD_HASH_MAX_LENGTH,
SafeEnum,
UserRole,
WEBSITE_MAX_LENGTH,
)
from core.Base import (
Base,
TimestampMixin,
UUIDMixin,
)
if TYPE_CHECKING:
from auth.RefreshToken import RefreshToken
from program.Program import Program
from report.Report import Report
class User(Base, UUIDMixin, TimestampMixin):
"""
User account model supporting both researchers and companies
"""
__tablename__ = "users"
email: Mapped[str] = mapped_column(
String(EMAIL_MAX_LENGTH),
unique = True,
index = True,
)
hashed_password: Mapped[str] = mapped_column(
String(PASSWORD_HASH_MAX_LENGTH)
)
full_name: Mapped[str | None] = mapped_column(
String(FULL_NAME_MAX_LENGTH),
default = None,
)
is_active: Mapped[bool] = mapped_column(default = True)
is_verified: Mapped[bool] = mapped_column(default = False)
role: Mapped[UserRole] = mapped_column(
SafeEnum(UserRole,
unknown_value = UserRole.UNKNOWN),
default = UserRole.USER,
)
token_version: Mapped[int] = mapped_column(default = 0)
company_name: Mapped[str | None] = mapped_column(
String(COMPANY_NAME_MAX_LENGTH),
default = None,
)
bio: Mapped[str | None] = mapped_column(
Text,
default = None,
)
website: Mapped[str | None] = mapped_column(
String(WEBSITE_MAX_LENGTH),
default = None,
)
reputation_score: Mapped[int] = mapped_column(default = 0)
refresh_tokens: Mapped[list[RefreshToken]] = relationship(
back_populates = "user",
cascade = "all, delete-orphan",
lazy = "raise",
)
programs: Mapped[list[Program]] = relationship(
back_populates = "company",
cascade = "all, delete-orphan",
lazy = "raise",
)
reports: Mapped[list[Report]] = relationship(
back_populates = "researcher",
cascade = "all, delete-orphan",
lazy = "raise",
)
def increment_token_version(self) -> None:
"""
Invalidate all existing tokens for this user
"""
self.token_version += 1
@property
def is_verified_company(self) -> bool:
"""
Check if user is a verified organization (optional upgrade)
"""
return self.role == UserRole.COMPANY
@property
def can_submit_reports(self) -> bool:
"""
Any authenticated user can submit reports
"""
return self.role != UserRole.UNKNOWN
@property
def can_create_program(self) -> bool:
"""
Any authenticated user can create a program
"""
return self.role != UserRole.UNKNOWN

4
PROJECTS/bug-bounty-platform/backend/app/user/__init__.py Normal file
View File

@ -0,0 +1,4 @@
"""
ⒸAngelaMos | 2025
User Domain
"""

21
PROJECTS/bug-bounty-platform/backend/app/user/dependencies.py Normal file
View File

@ -0,0 +1,21 @@
"""
ⒸAngelaMos | 2025
dependencies.py
"""
from typing import Annotated
from fastapi import Depends
from core.dependencies import DBSession
from .service import UserService
def get_user_service(db: DBSession) -> UserService:
"""
Dependency to inject UserService instance
"""
return UserService(db)
UserServiceDep = Annotated[UserService, Depends(get_user_service)]

0
PROJECTS/bug-bounty-platform/backend/app/user/py.typed Normal file
View File

111
PROJECTS/bug-bounty-platform/backend/app/user/repository.py Normal file
View File

@ -0,0 +1,111 @@
"""
ⒸAngelaMos | 2025
repository.py
"""
from uuid import UUID
from sqlalchemy import select
from sqlalchemy.ext.asyncio import AsyncSession
from config import UserRole
from .User import User
from core.base_repository import BaseRepository
class UserRepository(BaseRepository[User]):
"""
Repository for User model database operations
"""
model = User
@classmethod
async def get_by_email(
cls,
session: AsyncSession,
email: str,
) -> User | None:
"""
Get user by email address
"""
result = await session.execute(
select(User).where(User.email == email)
)
return result.scalars().first()
@classmethod
async def get_by_id(
cls,
session: AsyncSession,
id: UUID,
) -> User | None:
"""
Get user by ID
"""
return await session.get(User, id)
@classmethod
async def email_exists(
cls,
session: AsyncSession,
email: str,
) -> bool:
"""
Check if email is already registered
"""
result = await session.execute(
select(User.id).where(User.email == email)
)
return result.scalars().first() is not None
@classmethod
async def create_user(
cls,
session: AsyncSession,
email: str,
hashed_password: str,
full_name: str | None = None,
role: UserRole = UserRole.USER,
) -> User:
"""
Create a new user
"""
user = User(
email = email,
hashed_password = hashed_password,
full_name = full_name,
role = role,
)
session.add(user)
await session.flush()
await session.refresh(user)
return user
@classmethod
async def update_password(
cls,
session: AsyncSession,
user: User,
hashed_password: str,
) -> User:
"""
Update user password and increment token version
"""
user.hashed_password = hashed_password
user.increment_token_version()
await session.flush()
await session.refresh(user)
return user
@classmethod
async def increment_token_version(
cls,
session: AsyncSession,
user: User,
) -> User:
"""
Invalidate all user tokens
"""
user.increment_token_version()
await session.flush()
await session.refresh(user)
return user

78
PROJECTS/bug-bounty-platform/backend/app/user/routes.py Normal file
View File

@ -0,0 +1,78 @@
"""
ⒸAngelaMos | 2025
routes.py
"""
from uuid import UUID
from fastapi import (
APIRouter,
status,
)
from core.dependencies import CurrentUser
from core.responses import (
AUTH_401,
CONFLICT_409,
NOT_FOUND_404,
)
from .schemas import (
UserCreate,
UserResponse,
UserUpdate,
)
from .dependencies import UserServiceDep
router = APIRouter(prefix = "/users", tags = ["users"])
@router.post(
"",
response_model = UserResponse,
status_code = status.HTTP_201_CREATED,
responses = {**CONFLICT_409},
)
async def create_user(
user_service: UserServiceDep,
user_data: UserCreate,
) -> UserResponse:
"""
Register a new user
"""
return await user_service.create_user(user_data)
@router.get(
"/{user_id}",
response_model = UserResponse,
responses = {
**AUTH_401,
**NOT_FOUND_404
},
)
async def get_user(
user_service: UserServiceDep,
user_id: UUID,
_: CurrentUser,
) -> UserResponse:
"""
Get user by ID
"""
return await user_service.get_user_by_id(user_id)
@router.patch(
"/me",
response_model = UserResponse,
responses = {**AUTH_401},
)
async def update_current_user(
user_service: UserServiceDep,
current_user: CurrentUser,
user_data: UserUpdate,
) -> UserResponse:
"""
Update current user profile
"""
return await user_service.update_user(current_user, user_data)

109
PROJECTS/bug-bounty-platform/backend/app/user/schemas.py Normal file
View File

@ -0,0 +1,109 @@
"""
ⒸAngelaMos | 2025
schemas.py
"""
from pydantic import (
Field,
EmailStr,
field_validator,
)
from config import (
UserRole,
FULL_NAME_MAX_LENGTH,
PASSWORD_MAX_LENGTH,
PASSWORD_MIN_LENGTH,
)
from core.base_schema import (
BaseSchema,
BaseResponseSchema,
)
class UserCreate(BaseSchema):
"""
Schema for user registration
"""
email: EmailStr
password: str = Field(
min_length = PASSWORD_MIN_LENGTH,
max_length = PASSWORD_MAX_LENGTH
)
full_name: str | None = Field(
default = None,
max_length = FULL_NAME_MAX_LENGTH
)
@field_validator("password")
@classmethod
def validate_password_strength(cls, v: str) -> str:
"""
Ensure password has minimum complexity
"""
if not any(c.isupper() for c in v):
raise ValueError(
"Password must contain at least one uppercase letter"
)
if not any(c.isdigit() for c in v):
raise ValueError("Password must contain at least one digit")
return v
class UserUpdate(BaseSchema):
"""
Schema for updating user profile
"""
full_name: str | None = Field(
default = None,
max_length = FULL_NAME_MAX_LENGTH
)
class UserUpdateAdmin(UserUpdate):
"""
Schema for admin updating user
"""
email: EmailStr | None = None
is_active: bool | None = None
is_verified: bool | None = None
role: UserRole | None = None
class AdminUserCreate(BaseSchema):
"""
Schema for admin creating a user
"""
email: EmailStr
password: str = Field(
min_length = PASSWORD_MIN_LENGTH,
max_length = PASSWORD_MAX_LENGTH
)
full_name: str | None = Field(
default = None,
max_length = FULL_NAME_MAX_LENGTH
)
role: UserRole = UserRole.USER
is_active: bool = True
is_verified: bool = False
class UserResponse(BaseResponseSchema):
"""
Schema for user API responses
"""
email: EmailStr
full_name: str | None
is_active: bool
is_verified: bool
role: UserRole
class UserListResponse(BaseSchema):
"""
Schema for paginated user list
"""
items: list[UserResponse]
total: int
page: int
size: int

221
PROJECTS/bug-bounty-platform/backend/app/user/service.py Normal file
View File

@ -0,0 +1,221 @@
"""
ⒸAngelaMos | 2025
service.py
"""
from uuid import UUID
from sqlalchemy.ext.asyncio import (
AsyncSession,
)
from config import settings, UserRole
from core.exceptions import (
EmailAlreadyExists,
InvalidCredentials,
UserNotFound,
)
from core.security import (
hash_password,
verify_password,
)
from .schemas import (
AdminUserCreate,
UserCreate,
UserListResponse,
UserResponse,
UserUpdate,
UserUpdateAdmin,
)
from .User import User
from .repository import UserRepository
class UserService:
"""
Business logic for user operations
"""
def __init__(self, session: AsyncSession) -> None:
self.session = session
async def create_user(
self,
user_data: UserCreate,
) -> UserResponse:
"""
Register a new user
"""
if await UserRepository.email_exists(self.session,
user_data.email):
raise EmailAlreadyExists(user_data.email)
role = UserRole.USER
if settings.ADMIN_EMAIL and user_data.email.lower(
) == settings.ADMIN_EMAIL.lower():
role = UserRole.ADMIN
hashed = await hash_password(user_data.password)
user = await UserRepository.create_user(
self.session,
email = user_data.email,
hashed_password = hashed,
full_name = user_data.full_name,
role = role,
)
return UserResponse.model_validate(user)
async def get_user_by_id(
self,
user_id: UUID,
) -> UserResponse:
"""
Get user by ID
"""
user = await UserRepository.get_by_id(self.session, user_id)
if not user:
raise UserNotFound(str(user_id))
return UserResponse.model_validate(user)
async def get_user_model_by_id(
self,
user_id: UUID,
) -> User:
"""
Get user model by ID (for internal use)
"""
user = await UserRepository.get_by_id(self.session, user_id)
if not user:
raise UserNotFound(str(user_id))
return user
async def update_user(
self,
user: User,
user_data: UserUpdate,
) -> UserResponse:
"""
Update user profile
"""
update_dict = user_data.model_dump(exclude_unset = True)
updated_user = await UserRepository.update(
self.session,
user,
**update_dict
)
return UserResponse.model_validate(updated_user)
async def change_password(
self,
user: User,
current_password: str,
new_password: str,
) -> None:
"""
Change user password
"""
is_valid, _ = await verify_password(current_password, user.hashed_password)
if not is_valid:
raise InvalidCredentials()
hashed = await hash_password(new_password)
await UserRepository.update_password(self.session, user, hashed)
async def deactivate_user(
self,
user: User,
) -> UserResponse:
"""
Deactivate user account
"""
updated = await UserRepository.update(
self.session,
user,
is_active = False
)
return UserResponse.model_validate(updated)
async def list_users(
self,
page: int,
size: int,
) -> UserListResponse:
"""
List users with pagination
"""
skip = (page - 1) * size
users = await UserRepository.get_multi(
self.session,
skip = skip,
limit = size
)
total = await UserRepository.count(self.session)
return UserListResponse(
items = [UserResponse.model_validate(u) for u in users],
total = total,
page = page,
size = size,
)
async def admin_create_user(
self,
user_data: AdminUserCreate,
) -> UserResponse:
"""
Admin creates a new user
"""
if await UserRepository.email_exists(self.session,
user_data.email):
raise EmailAlreadyExists(user_data.email)
hashed = await hash_password(user_data.password)
user = await UserRepository.create(
self.session,
email = user_data.email,
hashed_password = hashed,
full_name = user_data.full_name,
role = user_data.role,
is_active = user_data.is_active,
is_verified = user_data.is_verified,
)
return UserResponse.model_validate(user)
async def admin_update_user(
self,
user_id: UUID,
user_data: UserUpdateAdmin,
) -> UserResponse:
"""
Admin updates a user
"""
user = await UserRepository.get_by_id(self.session, user_id)
if not user:
raise UserNotFound(str(user_id))
update_dict = user_data.model_dump(exclude_unset = True)
if "email" in update_dict:
existing = await UserRepository.get_by_email(
self.session,
update_dict["email"]
)
if existing and existing.id != user_id:
raise EmailAlreadyExists(update_dict["email"])
updated_user = await UserRepository.update(
self.session,
user,
**update_dict
)
return UserResponse.model_validate(updated_user)
async def admin_delete_user(
self,
user_id: UUID,
) -> None:
"""
Admin deletes a user (hard delete)
"""
user = await UserRepository.get_by_id(self.session, user_id)
if not user:
raise UserNotFound(str(user_id))
await UserRepository.delete(self.session, user)

291
PROJECTS/bug-bounty-platform/backend/conftest.py Normal file
View File

@ -0,0 +1,291 @@
"""
©AngelaMos | 2025
conftest.py
Test configuration, fixtures, and factories
"""
import sys
from pathlib import Path
sys.path.insert(0, str(Path(__file__).parent / "app"))
import hashlib
import secrets
from datetime import (
UTC,
datetime,
timedelta,
)
from uuid import uuid4
from collections.abc import AsyncIterator
import pytest
from httpx import (
AsyncClient,
ASGITransport,
)
import pytest_asyncio
from sqlalchemy.ext.asyncio import (
AsyncSession,
create_async_engine,
)
from sqlalchemy.pool import StaticPool
from core.security import (
hash_password,
create_access_token,
)
from config import UserRole
from core.database import get_db_session
from core.Base import Base
from user.User import User
from auth.RefreshToken import RefreshToken
@pytest_asyncio.fixture(scope = "session", loop_scope = "session")
async def test_engine():
"""
Session scoped async engine with in memory SQLite
StaticPool keeps single connection so DB persists
"""
engine = create_async_engine(
"sqlite+aiosqlite:///:memory:",
poolclass = StaticPool,
connect_args = {"check_same_thread": False},
echo = False,
)
async with engine.begin() as conn:
await conn.run_sync(Base.metadata.create_all)
yield engine
await engine.dispose()
@pytest.fixture
async def db_session(test_engine) -> AsyncIterator[AsyncSession]:
"""
Per test session with transaction rollback for isolation
App commits become savepoints that rollback with test
"""
async with test_engine.connect() as conn:
await conn.begin()
session = AsyncSession(
bind = conn,
expire_on_commit = False,
join_transaction_mode = "create_savepoint",
)
yield session
await session.close()
await conn.rollback()
@pytest.fixture
async def client(db_session: AsyncSession) -> AsyncIterator[AsyncClient]:
"""
Async HTTP client with DB session override
"""
from factory import create_app
app = create_app()
async def override_get_db():
yield db_session
app.dependency_overrides[get_db_session] = override_get_db
async with AsyncClient(
transport = ASGITransport(app = app),
base_url = "http://test",
) as ac:
yield ac
app.dependency_overrides.clear()
@pytest.fixture
def auth_headers(access_token: str) -> dict[str, str]:
"""
Authorization headers for authenticated requests
"""
return {"Authorization": f"Bearer {access_token}"}
@pytest.fixture
def admin_auth_headers(admin_access_token: str) -> dict[str, str]:
"""
Authorization headers for admin requests
"""
return {"Authorization": f"Bearer {admin_access_token}"}
class UserFactory:
"""
Factory for creating test users
"""
_counter = 0
@classmethod
async def create(
cls,
session: AsyncSession,
*,
email: str | None = None,
password: str = "TestPass123",
full_name: str | None = None,
role: UserRole = UserRole.USER,
is_active: bool = True,
is_verified: bool = True,
) -> User:
cls._counter += 1
user = User(
email = email or f"user{cls._counter}@test.com",
hashed_password = await hash_password(password),
full_name = full_name or f"Test User {cls._counter}",
role = role,
is_active = is_active,
is_verified = is_verified,
)
session.add(user)
await session.flush()
await session.refresh(user)
return user
@classmethod
def reset(cls) -> None:
cls._counter = 0
class RefreshTokenFactory:
"""
Factory for creating test refresh tokens
"""
@classmethod
async def create(
cls,
session: AsyncSession,
user: User,
*,
is_revoked: bool = False,
expires_delta: timedelta = timedelta(days = 7),
) -> tuple[RefreshToken,
str]:
raw_token = secrets.token_urlsafe(32)
token_hash = hashlib.sha256(raw_token.encode()).hexdigest()
token = RefreshToken(
user_id = user.id,
token_hash = token_hash,
family_id = uuid4(),
expires_at = datetime.now(UTC) + expires_delta,
is_revoked = is_revoked,
)
session.add(token)
await session.flush()
await session.refresh(token)
return token, raw_token
@pytest.fixture
async def test_user(db_session: AsyncSession) -> User:
"""
Standard test user
"""
return await UserFactory.create(db_session)
@pytest.fixture
async def admin_user(db_session: AsyncSession) -> User:
"""
Admin test user
"""
return await UserFactory.create(
db_session,
email = "admin@test.com",
role = UserRole.ADMIN,
)
@pytest.fixture
async def inactive_user(db_session: AsyncSession) -> User:
"""
Inactive test user
"""
return await UserFactory.create(
db_session,
email = "inactive@test.com",
is_active = False,
)
@pytest.fixture
def access_token(test_user: User) -> str:
"""
Valid access token for test_user
"""
return create_access_token(test_user.id, test_user.token_version)
@pytest.fixture
def admin_access_token(admin_user: User) -> str:
"""
Valid access token for admin_user
"""
return create_access_token(admin_user.id, admin_user.token_version)
@pytest.fixture
async def refresh_token_pair(
db_session: AsyncSession,
test_user: User,
) -> tuple[RefreshToken,
str]:
"""
Refresh token DB record and raw token string
"""
return await RefreshTokenFactory.create(db_session, test_user)
@pytest.fixture
async def expired_refresh_token_pair(
db_session: AsyncSession,
test_user: User,
) -> tuple[RefreshToken,
str]:
"""
Expired refresh token for testing
"""
return await RefreshTokenFactory.create(
db_session,
test_user,
expires_delta = timedelta(days = -1),
)
@pytest.fixture
async def revoked_refresh_token_pair(
db_session: AsyncSession,
test_user: User,
) -> tuple[RefreshToken,
str]:
"""
Revoked refresh token for testing
"""
return await RefreshTokenFactory.create(
db_session,
test_user,
is_revoked = True,
)
@pytest.fixture(autouse = True)
def reset_factories():
"""
Reset factory counters between tests
"""
yield
UserFactory.reset()

287
PROJECTS/bug-bounty-platform/backend/pyproject.toml Normal file
View File

@ -0,0 +1,287 @@
[project]
name = "bug-bounty-platform"
version = "1.0.0"
description = "Full stack bug bounty platform"
requires-python = ">=3.12"
dependencies = [
"fastapi[standard]>=0.123.0,<1.0.0",
"pydantic>=2.12.5,<3.0.0",
"pydantic-settings>=2.12.0,<3.0.0",
"psycopg2-binary>=2.9.11",
"sqlalchemy>=2.0.44,<3.0.0",
"alembic>=1.17.0,<2.0.0",
"asyncpg>=0.31.0,<1.0.0",
"python-multipart>=0.0.20",
"pyjwt>=2.10.0",
"pwdlib[argon2]>=0.3.0",
"uuid6>=2025.0.1",
"slowapi>=0.1.9",
"redis>=7.1.0",
"structlog>=24.4.0",
"gunicorn>=23.0.0",
"uvicorn[standard]>=0.38.0",
]
[project.optional-dependencies]
dev = [
"pytest>=9.0.2",
"pytest-asyncio>=1.3.0",
"pytest-cov>=6.0.0",
"httpx>=0.28.1",
"aiosqlite>=0.21.0",
"asgi-lifespan>=2.1.0",
"mypy>=1.19.0",
"types-redis>=4.6.0",
"ruff>=0.14.8",
"pylint>=4.0.4",
"pylint-pydantic>=0.4.1",
"pylint-per-file-ignores>=3.2.0",
"ty>=0.0.1a32",
"pre-commit>=4.2.0",
]
[project.urls]
Homepage = "https://bugbountyplatform.sh"
Repository = "https://github.com/CarterPerez-dev/Cybersecurity-Projects"
Issues = "https://github.com/CarterPerez-dev/Cybersecurity-Projects/issues"
[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"
[tool.hatch.build.targets.wheel]
packages = ["app"]
[tool.ruff]
target-version = "py312"
line-length = 88
src = ["app"]
exclude = ["alembic"]
[tool.ruff.lint]
select = [
"E", # pycodestyle errors
"W", # pycodestyle warnings
"F", # pyflakes
"B", # flake8-bugbear
"C4", # flake8-comprehensions
"UP", # pyupgrade
"ARG", # flake8-unused-arguments
"SIM", # flake8-simplify
"PTH", # flake8-use-pathlib
"RUF", # ruff-specific
"ASYNC", # flake8-async
"S", # flake8-bandit (security)
"N", # pep8-naming
]
ignore = [
"E501", # line too long (formatter handles this)
"B008", # function call in default argument (FastAPI Depends)
"S101", # assert usage (needed for tests)
"S104", # 0.0.0.0 binding (intentional for Docker)
"S105", # "bearer" token_type is not a password
"ARG001", # unused function argument (common in FastAPI deps)
"E712", # == False is REQUIRED for SQLAlchemy WHERE clauses
"N999", # PascalCase module names (intentional: Base.py, User.py)
"N818", # exception naming convention (style preference)
"UP046", # Generic[T] syntax (keep for compatibility)
"RUF005", # list concatenation style (preference)
]
[tool.ruff.lint.per-file-ignores]
"tests/**/*.py" = ["S101", "ARG001"]
"conftest.py" = ["S107"]
"app/core/rate_limit.py" = ["S110"]
"app/config.py" = ["F401"]
"app/**/schemas.py" = ["RUF012"]
"app/core/error_schemas.py" = ["RUF012"]
[tool.mypy]
python_version = "3.12"
strict = true
warn_return_any = true
warn_unused_ignores = true
disallow_untyped_defs = true
disallow_incomplete_defs = true
plugins = ["pydantic.mypy"]
exclude = ["alembic", ".venv", "venv"]
[[tool.mypy.overrides]]
module = ["tests.*", "conftest"]
ignore_errors = true
[[tool.mypy.overrides]]
module = ["core.logging"]
disable_error_code = ["no-any-return"]
[[tool.mypy.overrides]]
module = [
"uuid6",
"structlog",
"structlog.*",
"pwdlib",
"slowapi",
"slowapi.*",
]
ignore_missing_imports = true
[[tool.mypy.overrides]]
module = ["pydantic_settings.*"]
ignore_missing_imports = true
[[tool.mypy.overrides]]
module = ["config"]
implicit_reexport = true
[[tool.mypy.overrides]]
module = ["core.enums", "core.security"]
disable_error_code = ["return-value", "no-any-return"]
[[tool.mypy.overrides]]
module = ["user.repository", "auth.repository", "core.base_repository"]
disable_error_code = ["return-value", "no-any-return", "attr-defined"]
[[tool.mypy.overrides]]
module = ["user.service", "auth.service"]
disable_error_code = ["no-any-return"]
[[tool.mypy.overrides]]
module = ["factory"]
disable_error_code = ["arg-type"]
[[tool.mypy.overrides]]
module = ["auth.routes"]
disable_error_code = ["misc"]
[tool.pydantic-mypy]
init_forbid_extra = true
init_typed = true
warn_required_dynamic_aliases = true
[tool.pylint.main]
py-version = "3.11"
jobs = 4
load-plugins = [
"pylint_pydantic",
"pylint_per_file_ignores",
]
persistent = true
ignore = [
"alembic",
"venv",
".venv",
"__pycache__",
"build",
"dist",
".git",
".pytest_cache",
".mypy_cache",
".ruff_cache",
]
ignore-paths = [
"^alembic/.*",
"^venv/.*",
"^.venv/.*",
"^build/.*",
"^dist/.*",
]
[tool.pylint.messages_control]
disable = [
"C0103", # invalid-name
"C0116", # missing-function-docstring (we use minimal docs)
"C0121", # singleton-comparison (== False required for SQLAlchemy)
"C0301", # line-too-long
"C0302", # too-many-lines
"C0303", # trailing-whitespace
"C0304", # final-newline-missing
"C0305", # trailing-newlines
"C0411", # wrong-import-order
"C0412", # ungrouped-imports (style preference)
"E0401", # import-error (uuid6/structlog/pwdlib not found by pylint)
"E0611", # no-name-in-module (false positive for config re-exports)
"E1102", # not-callable (false positive for SQLAlchemy func.now/count)
"E1136", # unsubscriptable-object (false positive for generics)
"R0801", # similar-lines
"R0901", # too-many-ancestors (SQLAlchemy inheritance)
"R0903", # too-few-public-methods
"R0917", # too-many-positional-arguments (FastAPI patterns)
"W0611", # unused-import (handled by ruff, config.py re-exports)
"W0612", # unused-variable (handled by ruff)
"W0613", # unused-argument (handled by ruff)
"W0621", # redefined-outer-name (FastAPI route/param naming)
"W0622", # redefined-builtin
"W0718", # broad-exception-caught (intentional in health/rate-limit)
]
[tool.pylint-per-file-ignores]
"alembic/env.py" = "no-member"
"conftest.py" = "import-outside-toplevel"
"app/__main__.py" = "pointless-string-statement"
[tool.pylint.format]
max-line-length = 95
[tool.pylint.design]
max-args = 12
max-attributes = 10
max-branches = 15
max-locals = 20
max-statements = 55
[tool.pytest.ini_options]
asyncio_mode = "auto"
asyncio_default_fixture_loop_scope = "function"
testpaths = ["tests"]
addopts = "-ra -q"
filterwarnings = [
"ignore::DeprecationWarning",
]
[tool.coverage.run]
branch = true
source = ["src"]
[tool.coverage.report]
exclude_lines = [
"pragma: no cover",
"if TYPE_CHECKING:",
"raise NotImplementedError",
]
[tool.ty.src]
include = ["app", "tests"]
exclude = ["alembic/versions/**", ".venv/**"]
respect-ignore-files = true
[tool.ty.environment]
python-version = "3.12"
root = ["./app"]
python = "./.venv"
[tool.ty.rules]
possibly-missing-attribute = "error"
possibly-missing-import = "error"
unused-ignore-comment = "warn"
redundant-cast = "warn"
undefined-reveal = "warn"
[[tool.ty.overrides]]
include = ["tests/**"]
[tool.ty.overrides.rules]
unresolved-reference = "warn"
invalid-argument-type = "warn"
[[tool.ty.overrides]]
include = ["app/repositories/**", "app/services/**"]
[tool.ty.overrides.rules]
unresolved-attribute = "warn"
[tool.ty.terminal]
error-on-warning = false
output-format = "full"

4
PROJECTS/bug-bounty-platform/backend/tests/__init__.py Normal file
View File

@ -0,0 +1,4 @@
"""
AngelaMos | 2025
__init__.py
"""

4
PROJECTS/bug-bounty-platform/backend/tests/integration/__init__.py Normal file
View File

@ -0,0 +1,4 @@
"""
AngelaMos | 2025
__init__.py
"""

256
PROJECTS/bug-bounty-platform/backend/tests/integration/test_admin.py Normal file
View File

@ -0,0 +1,256 @@
"""
©AngelaMos | 2025
test_admin.py
"""
import pytest
from httpx import AsyncClient
from user.User import User
URL_ADMIN_USERS = "/v1/admin/users"
def url_admin_user_by_id(user_id: str) -> str:
return f"{URL_ADMIN_USERS}/{user_id}"
@pytest.mark.asyncio
async def test_admin_create_user(
client: AsyncClient,
admin_user: User,
admin_auth_headers: dict[str, str],
):
"""
Admin can create a new user
"""
response = await client.post(
URL_ADMIN_USERS,
headers = admin_auth_headers,
json = {
"email": "adminmade@test.com",
"password": "ValidPass123",
"full_name": "Admin Created User",
},
)
assert response.status_code == 201
data = response.json()
assert data["email"] == "adminmade@test.com"
assert data["full_name"] == "Admin Created User"
assert "id" in data
assert "hashed_password" not in data
@pytest.mark.asyncio
async def test_admin_create_user_non_admin_forbidden(
client: AsyncClient,
test_user: User,
auth_headers: dict[str, str],
):
"""
Non admin cannot create user via admin endpoint
"""
response = await client.post(
URL_ADMIN_USERS,
headers = auth_headers,
json = {
"email": "shouldfail@test.com",
"password": "ValidPass123",
},
)
assert response.status_code == 403
@pytest.mark.asyncio
async def test_admin_create_user_duplicate_email(
client: AsyncClient,
admin_user: User,
admin_auth_headers: dict[str, str],
test_user: User,
):
"""
Admin create with duplicate email returns 409
"""
response = await client.post(
URL_ADMIN_USERS,
headers = admin_auth_headers,
json = {
"email": test_user.email,
"password": "ValidPass123",
},
)
assert response.status_code == 409
@pytest.mark.asyncio
async def test_admin_get_user_by_id(
client: AsyncClient,
admin_user: User,
admin_auth_headers: dict[str, str],
test_user: User,
):
"""
Admin can get any user by ID
"""
response = await client.get(
url_admin_user_by_id(str(test_user.id)),
headers = admin_auth_headers,
)
assert response.status_code == 200
data = response.json()
assert data["id"] == str(test_user.id)
assert data["email"] == test_user.email
@pytest.mark.asyncio
async def test_admin_get_user_not_found(
client: AsyncClient,
admin_user: User,
admin_auth_headers: dict[str, str],
):
"""
Admin get non existent user returns 404
"""
fake_id = "00000000-0000-0000-0000-000000000000"
response = await client.get(
url_admin_user_by_id(fake_id),
headers = admin_auth_headers,
)
assert response.status_code == 404
@pytest.mark.asyncio
async def test_admin_update_user(
client: AsyncClient,
admin_user: User,
admin_auth_headers: dict[str, str],
test_user: User,
):
"""
Admin can update any user
"""
response = await client.patch(
url_admin_user_by_id(str(test_user.id)),
headers = admin_auth_headers,
json = {"full_name": "Admin Updated Name"},
)
assert response.status_code == 200
data = response.json()
assert data["full_name"] == "Admin Updated Name"
assert data["id"] == str(test_user.id)
@pytest.mark.asyncio
async def test_admin_update_user_not_found(
client: AsyncClient,
admin_user: User,
admin_auth_headers: dict[str, str],
):
"""
Admin update non existent user returns 404
"""
fake_id = "00000000-0000-0000-0000-000000000000"
response = await client.patch(
url_admin_user_by_id(fake_id),
headers = admin_auth_headers,
json = {"full_name": "Should Fail"},
)
assert response.status_code == 404
@pytest.mark.asyncio
async def test_admin_update_user_non_admin_forbidden(
client: AsyncClient,
test_user: User,
auth_headers: dict[str, str],
):
"""
Non admin cannot update via admin endpoint
"""
response = await client.patch(
url_admin_user_by_id(str(test_user.id)),
headers = auth_headers,
json = {"full_name": "Should Fail"},
)
assert response.status_code == 403
@pytest.mark.asyncio
async def test_admin_delete_user(
client: AsyncClient,
admin_user: User,
admin_auth_headers: dict[str, str],
db_session,
):
"""
Admin can delete a user
"""
from user.User import User as UserModel
from core.security import hash_password
user_to_delete = UserModel(
email = "deleteme@test.com",
hashed_password = await hash_password("TestPass123"),
full_name = "Delete Me",
)
db_session.add(user_to_delete)
await db_session.flush()
await db_session.refresh(user_to_delete)
user_id = str(user_to_delete.id)
response = await client.delete(
url_admin_user_by_id(user_id),
headers = admin_auth_headers,
)
assert response.status_code == 204
get_response = await client.get(
url_admin_user_by_id(user_id),
headers = admin_auth_headers,
)
assert get_response.status_code == 404
@pytest.mark.asyncio
async def test_admin_delete_user_not_found(
client: AsyncClient,
admin_user: User,
admin_auth_headers: dict[str, str],
):
"""
Admin delete non existent user returns 404
"""
fake_id = "00000000-0000-0000-0000-000000000000"
response = await client.delete(
url_admin_user_by_id(fake_id),
headers = admin_auth_headers,
)
assert response.status_code == 404
@pytest.mark.asyncio
async def test_admin_delete_user_non_admin_forbidden(
client: AsyncClient,
test_user: User,
auth_headers: dict[str, str],
):
"""
Non admin cannot delete users
"""
response = await client.delete(
url_admin_user_by_id(str(test_user.id)),
headers = auth_headers,
)
assert response.status_code == 403

288
PROJECTS/bug-bounty-platform/backend/tests/integration/test_auth.py Normal file
View File

@ -0,0 +1,288 @@
"""
©AngelaMos | 2025
test_auth.py
"""
import pytest
from httpx import AsyncClient
from user.User import User
from auth.RefreshToken import RefreshToken
URL_LOGIN = "/v1/auth/login"
URL_REFRESH = "/v1/auth/refresh"
URL_LOGOUT = "/v1/auth/logout"
URL_LOGOUT_ALL = "/v1/auth/logout-all"
URL_ME = "/v1/auth/me"
URL_CHANGE_PASSWORD = "/v1/auth/change-password"
@pytest.mark.asyncio
async def test_login_success(client: AsyncClient, test_user: User):
"""
Valid credentials return access token and set refresh cookie
"""
response = await client.post(
URL_LOGIN,
data = {
"username": test_user.email,
"password": "TestPass123",
},
)
assert response.status_code == 200
data = response.json()
assert "access_token" in data
assert data["token_type"] == "bearer"
assert "user" in data
assert data["user"]["email"] == test_user.email
assert "refresh_token" in response.cookies
@pytest.mark.asyncio
async def test_login_invalid_password(
client: AsyncClient,
test_user: User
):
"""
Wrong password returns 401
"""
response = await client.post(
URL_LOGIN,
data = {
"username": test_user.email,
"password": "WrongPassword123",
},
)
assert response.status_code == 401
@pytest.mark.asyncio
async def test_login_invalid_email(client: AsyncClient):
"""
Non-existent email returns 401
"""
response = await client.post(
URL_LOGIN,
data = {
"username": "nonexistent@test.com",
"password": "TestPass123",
},
)
assert response.status_code == 401
@pytest.mark.asyncio
async def test_login_inactive_user(
client: AsyncClient,
inactive_user: User
):
"""
Inactive user cannot login
"""
response = await client.post(
URL_LOGIN,
data = {
"username": inactive_user.email,
"password": "TestPass123",
},
)
assert response.status_code == 401
@pytest.mark.asyncio
async def test_refresh_token_success(
client: AsyncClient,
refresh_token_pair: tuple[RefreshToken,
str],
):
"""
Valid refresh token returns new access token
"""
_, raw_token = refresh_token_pair
response = await client.post(
URL_REFRESH,
cookies = {"refresh_token": raw_token},
)
assert response.status_code == 200
data = response.json()
assert "access_token" in data
assert data["token_type"] == "bearer"
@pytest.mark.asyncio
async def test_refresh_token_missing_returns_401(client: AsyncClient):
"""
Missing refresh token cookie returns 401, not 422.
"""
response = await client.post(URL_REFRESH)
assert response.status_code == 401
@pytest.mark.asyncio
async def test_refresh_token_expired(
client: AsyncClient,
expired_refresh_token_pair: tuple[RefreshToken,
str],
):
"""
Expired refresh token returns 401
"""
_, raw_token = expired_refresh_token_pair
response = await client.post(
URL_REFRESH,
cookies = {"refresh_token": raw_token},
)
assert response.status_code == 401
@pytest.mark.asyncio
async def test_refresh_token_revoked(
client: AsyncClient,
revoked_refresh_token_pair: tuple[RefreshToken,
str],
):
"""
Revoked refresh token returns 401.
"""
_, raw_token = revoked_refresh_token_pair
response = await client.post(
URL_REFRESH,
cookies = {"refresh_token": raw_token},
)
assert response.status_code == 401
@pytest.mark.asyncio
async def test_logout_success(
client: AsyncClient,
refresh_token_pair: tuple[RefreshToken,
str],
):
"""
Logout revokes refresh token and clears cookie.
"""
_, raw_token = refresh_token_pair
response = await client.post(
URL_LOGOUT,
cookies = {"refresh_token": raw_token},
)
assert response.status_code == 204
@pytest.mark.asyncio
async def test_logout_missing_token_returns_401(client: AsyncClient):
"""
Logout without refresh token returns 401, not 422.
"""
response = await client.post(URL_LOGOUT)
assert response.status_code == 401
@pytest.mark.asyncio
async def test_logout_all(
client: AsyncClient,
test_user: User,
auth_headers: dict[str,
str],
):
"""
Logout all revokes all user sessions.
"""
response = await client.post(
URL_LOGOUT_ALL,
headers = auth_headers,
)
assert response.status_code == 200
data = response.json()
assert "revoked_sessions" in data
@pytest.mark.asyncio
async def test_get_current_user(
client: AsyncClient,
test_user: User,
auth_headers: dict[str,
str],
):
"""
/me returns current authenticated user.
"""
response = await client.get(
URL_ME,
headers = auth_headers,
)
assert response.status_code == 200
data = response.json()
assert data["email"] == test_user.email
assert data["id"] == str(test_user.id)
@pytest.mark.asyncio
async def test_get_current_user_unauthenticated(client: AsyncClient):
"""
/me without auth returns 401.
"""
response = await client.get(URL_ME)
assert response.status_code == 401
@pytest.mark.asyncio
async def test_change_password(
client: AsyncClient,
test_user: User,
auth_headers: dict[str,
str],
):
"""
Password change works with valid current password.
"""
response = await client.post(
URL_CHANGE_PASSWORD,
headers = auth_headers,
json = {
"current_password": "TestPass123",
"new_password": "NewTestPass456",
},
)
assert response.status_code == 204
@pytest.mark.asyncio
async def test_change_password_wrong_current(
client: AsyncClient,
test_user: User,
auth_headers: dict[str,
str],
):
"""
Password change fails with wrong current password.
"""
response = await client.post(
URL_CHANGE_PASSWORD,
headers = auth_headers,
json = {
"current_password": "WrongPassword123",
"new_password": "NewTestPass456",
},
)
assert response.status_code == 401

40
PROJECTS/bug-bounty-platform/backend/tests/integration/test_health.py Normal file
View File

@ -0,0 +1,40 @@
"""
©AngelaMos | 2025
test_health.py
"""
import pytest
from httpx import AsyncClient
URL_HEALTH = "/health"
URL_HEALTH_DETAILED = "/health/detailed"
@pytest.mark.asyncio
async def test_health_basic(client: AsyncClient):
"""
Basic health check returns 200 with healthy status
"""
response = await client.get(URL_HEALTH)
assert response.status_code == 200
data = response.json()
assert data["status"] == "healthy"
assert "environment" in data
assert "version" in data
@pytest.mark.asyncio
async def test_health_detailed(client: AsyncClient):
"""
Detailed health check includes database status
"""
response = await client.get(URL_HEALTH_DETAILED)
assert response.status_code == 200
data = response.json()
assert data["status"] in ["healthy", "degraded"]
assert "database" in data
assert "environment" in data
assert "version" in data

240
PROJECTS/bug-bounty-platform/backend/tests/integration/test_users.py Normal file
View File

@ -0,0 +1,240 @@
"""
©AngelaMos | 2025
test_users.py
"""
import pytest
from httpx import AsyncClient
from user.User import User
URL_USERS = "/v1/users"
URL_ADMIN_USERS = "/v1/admin/users"
URL_USER_ME = "/v1/users/me"
def url_user_by_id(user_id: str) -> str:
return f"{URL_USERS}/{user_id}"
def url_admin_user_by_id(user_id: str) -> str:
return f"{URL_ADMIN_USERS}/{user_id}"
@pytest.mark.asyncio
async def test_create_user(client: AsyncClient):
"""
User registration creates new user
"""
response = await client.post(
URL_USERS,
json = {
"email": "newuser@test.com",
"password": "ValidPass123",
"full_name": "New User",
},
)
assert response.status_code == 201
data = response.json()
assert data["email"] == "newuser@test.com"
assert data["full_name"] == "New User"
assert "id" in data
assert "hashed_password" not in data
@pytest.mark.asyncio
async def test_create_user_duplicate_email(
client: AsyncClient,
test_user: User
):
"""
Duplicate email returns 409 conflict
"""
response = await client.post(
URL_USERS,
json = {
"email": test_user.email,
"password": "ValidPass123",
},
)
assert response.status_code == 409
@pytest.mark.asyncio
async def test_create_user_weak_password(client: AsyncClient):
"""
Weak password (no uppercase/digit) returns 422
"""
response = await client.post(
URL_USERS,
json = {
"email": "weakpass@test.com",
"password": "weakpassword",
},
)
assert response.status_code == 422
@pytest.mark.asyncio
async def test_get_user_by_id(
client: AsyncClient,
test_user: User,
auth_headers: dict[str,
str],
):
"""
Get user by ID returns user data
"""
response = await client.get(
url_user_by_id(str(test_user.id)),
headers = auth_headers,
)
assert response.status_code == 200
data = response.json()
assert data["email"] == test_user.email
assert data["id"] == str(test_user.id)
@pytest.mark.asyncio
async def test_get_user_unauthenticated(
client: AsyncClient,
test_user: User
):
"""
Get user without auth returns 401
"""
response = await client.get(url_user_by_id(str(test_user.id)))
assert response.status_code == 401
@pytest.mark.asyncio
async def test_get_user_not_found(
client: AsyncClient,
auth_headers: dict[str,
str],
):
"""
Get non existent user returns 404
"""
fake_id = "00000000-0000-0000-0000-000000000000"
response = await client.get(
url_user_by_id(fake_id),
headers = auth_headers,
)
assert response.status_code == 404
@pytest.mark.asyncio
async def test_update_current_user(
client: AsyncClient,
test_user: User,
auth_headers: dict[str,
str],
):
"""
Update current user profile
"""
response = await client.patch(
URL_USER_ME,
headers = auth_headers,
json = {"full_name": "Updated Name"},
)
assert response.status_code == 200
data = response.json()
assert data["full_name"] == "Updated Name"
@pytest.mark.asyncio
async def test_update_user_clear_field(
client: AsyncClient,
test_user: User,
auth_headers: dict[str,
str],
):
"""
Setting field to null clears it
"""
response = await client.patch(
URL_USER_ME,
headers = auth_headers,
json = {"full_name": None},
)
assert response.status_code == 200
data = response.json()
assert data["full_name"] is None
@pytest.mark.asyncio
async def test_list_users_admin_only(
client: AsyncClient,
test_user: User,
auth_headers: dict[str,
str],
):
"""
Non admin cannot list users (403).
"""
response = await client.get(
URL_ADMIN_USERS,
headers = auth_headers,
)
assert response.status_code == 403
@pytest.mark.asyncio
async def test_list_users_as_admin(
client: AsyncClient,
admin_user: User,
admin_auth_headers: dict[str,
str],
):
"""
Admin can list users with pagination
"""
response = await client.get(
URL_ADMIN_USERS,
headers = admin_auth_headers,
)
assert response.status_code == 200
data = response.json()
assert "items" in data
assert "total" in data
assert "page" in data
assert "size" in data
assert isinstance(data["items"], list)
@pytest.mark.asyncio
async def test_list_users_pagination(
client: AsyncClient,
admin_user: User,
admin_auth_headers: dict[str,
str],
):
"""
Pagination params work correctly
"""
response = await client.get(
URL_ADMIN_USERS,
headers = admin_auth_headers,
params = {
"page": 1,
"size": 5
},
)
assert response.status_code == 200
data = response.json()
assert data["page"] == 1
assert data["size"] == 5

4
PROJECTS/bug-bounty-platform/backend/tests/unit/__init__.py Normal file
View File

@ -0,0 +1,4 @@
"""
AngelaMos | 2025
__init__.py
"""

2068
PROJECTS/bug-bounty-platform/backend/uv.lock Normal file
View File

File diff suppressed because it is too large Load Diff

158
PROJECTS/bug-bounty-platform/compose.yml Normal file
View File

@ -0,0 +1,158 @@
# =========================================
# AngelaMos | 2026
# Production | compose.yml
# =========================================
name: ${APP_NAME:-template}
services:
# Nginx + Frontend
nginx:
build:
context: .
dockerfile: infra/docker/frontend-builder.prod
args:
- VITE_API_URL=${VITE_API_URL:-/api}
- VITE_APP_TITLE=${VITE_APP_TITLE:-My App}
container_name: ${APP_NAME:-template}-nginx
ports:
- "${NGINX_HOST_PORT:-8420}:80"
depends_on:
backend:
condition: service_healthy
networks:
- frontend
- backend
deploy:
resources:
limits:
cpus: '1.0'
memory: 256M
reservations:
cpus: '0.25'
memory: 64M
restart: unless-stopped
# FastAPI backend
backend:
build:
context: ./backend
dockerfile: ../infra/docker/fastapi.prod
container_name: ${APP_NAME:-template}-backend
expose:
- "8000"
env_file:
- .env
environment:
- ENVIRONMENT=production
- DEBUG=false
- RELOAD=false
depends_on:
db:
condition: service_healthy
redis:
condition: service_healthy
networks:
- backend
deploy:
resources:
limits:
cpus: '2.0'
memory: 1G
reservations:
cpus: '0.5'
memory: 256M
healthcheck:
test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')"]
interval: 30s
timeout: 5s
retries: 3
start_period: 40s
restart: unless-stopped
# PostgreSQL DB
db:
image: postgres:18-alpine
container_name: ${APP_NAME:-template}-db
ports:
- "${POSTGRES_HOST_PORT:-3420}:5432"
volumes:
- postgres_data:/var/lib/postgresql/data
environment:
- POSTGRES_USER=${POSTGRES_USER:-postgres}
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-postgres}
- POSTGRES_DB=${POSTGRES_DB:-app_db}
networks:
- backend
deploy:
resources:
limits:
cpus: '1.0'
memory: 512M
reservations:
cpus: '0.25'
memory: 128M
healthcheck:
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-postgres} -d ${POSTGRES_DB:-app_db}"]
interval: 10s
timeout: 5s
retries: 5
start_period: 30s
restart: unless-stopped
# Redis
redis:
image: redis:7-alpine
container_name: ${APP_NAME:-template}-redis
ports:
- "${REDIS_HOST_PORT:-6420}:6379"
volumes:
- redis_data:/data
command: redis-server --appendonly yes ${REDIS_PASSWORD:+--requirepass ${REDIS_PASSWORD}}
networks:
- backend
deploy:
resources:
limits:
cpus: '0.5'
memory: 256M
reservations:
cpus: '0.1'
memory: 64M
healthcheck:
test: ["CMD", "redis-cli", "ping"]
interval: 10s
timeout: 5s
retries: 5
restart: unless-stopped
# Cloudflare Tunnel
cloudflared:
image: cloudflare/cloudflared:latest
container_name: ${APP_NAME:-template}-tunnel
command: tunnel run --token ${CLOUDFLARE_TUNNEL_TOKEN}
networks:
- backend
depends_on:
nginx:
condition: service_started
deploy:
resources:
limits:
cpus: '0.5'
memory: 128M
reservations:
cpus: '0.1'
memory: 32M
restart: unless-stopped
networks:
frontend:
driver: bridge
backend:
driver: bridge
volumes:
postgres_data:
redis_data:

128
PROJECTS/bug-bounty-platform/dev.compose.yml Normal file
View File

@ -0,0 +1,128 @@
# =============================================================================
# AngelaMos | 2026
# dev.compose.yml
# =============================================================================
name: ${APP_NAME:-template}-dev
services:
# Nginx
nginx:
image: nginx:1.27-alpine
container_name: ${APP_NAME:-template}-nginx-dev
ports:
- "${NGINX_HOST_PORT:-8420}:80"
volumes:
- ./infra/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
- ./infra/nginx/dev.nginx:/etc/nginx/conf.d/default.conf:ro
depends_on:
backend:
condition: service_healthy
frontend:
condition: service_started
networks:
- frontend
- backend
restart: unless-stopped
# FastAPI
backend:
build:
context: ./backend
dockerfile: ../infra/docker/fastapi.dev
container_name: ${APP_NAME:-template}-backend-dev
ports:
- "${BACKEND_HOST_PORT:-5420}:8000"
volumes:
- ./backend:/app
- backend_cache:/app/.venv
env_file:
- .env
environment:
- ENVIRONMENT=development
- DEBUG=true
- RELOAD=true
depends_on:
db:
condition: service_healthy
redis:
condition: service_healthy
networks:
- backend
healthcheck:
test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')"]
interval: 10s
timeout: 5s
retries: 5
start_period: 30s
restart: unless-stopped
# Vite dev server
frontend:
build:
context: ./frontend
dockerfile: ../infra/docker/vite.dev
container_name: ${APP_NAME:-template}-frontend-dev
ports:
- "${FRONTEND_HOST_PORT:-3420}:5173"
volumes:
- ./frontend:/app
- frontend_modules:/app/node_modules
environment:
- VITE_API_URL=${VITE_API_URL:-/api}
- VITE_APP_TITLE=${VITE_APP_TITLE:-My App}
networks:
- frontend
restart: unless-stopped
# PostgreSQL DB
db:
image: postgres:16-alpine
container_name: ${APP_NAME:-template}-db-dev
ports:
- "${POSTGRES_HOST_PORT:-3420}:5432"
volumes:
- postgres_data:/var/lib/postgresql/data
environment:
- POSTGRES_USER=${POSTGRES_USER:-postgres}
- POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-postgres}
- POSTGRES_DB=${POSTGRES_DB:-app_db}
networks:
- backend
healthcheck:
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-postgres} -d ${POSTGRES_DB:-app_db}"]
interval: 10s
timeout: 5s
retries: 5
start_period: 30s
restart: unless-stopped
# Redis
redis:
image: redis:7-alpine
container_name: ${APP_NAME:-template}-redis-dev
ports:
- "${REDIS_HOST_PORT:-6420}:6379"
volumes:
- redis_data:/data
command: redis-server --appendonly yes
networks:
- backend
healthcheck:
test: ["CMD", "redis-cli", "ping"]
interval: 10s
timeout: 5s
retries: 5
restart: unless-stopped
networks:
frontend:
driver: bridge
backend:
driver: bridge
volumes:
postgres_data:
redis_data:
backend_cache:
frontend_modules:

15
PROJECTS/bug-bounty-platform/frontend/.dockerignore Normal file
View File

@ -0,0 +1,15 @@
node_modules
build
dist
.git
.gitignore
*.md
.env*
.vscode
.idea
*.log
npm-debug.log*
pnpm-debug.log*
.DS_Store
coverage
.nyc_output

25
PROJECTS/bug-bounty-platform/frontend/.gitignore vendored Normal file
View File

@ -0,0 +1,25 @@
# Logs
logs
*.log
npm-debug.log*
yarn-debug.log*
yarn-error.log*
pnpm-debug.log*
lerna-debug.log*
node_modules
dist
dist-ssr
*.local
.vite
# Editor directories and files
.vscode/*
!.vscode/extensions.json
.idea
.DS_Store
*.suo
*.ntvs*
*.njsproj
*.sln
*.sw?

22
PROJECTS/bug-bounty-platform/frontend/.stylelintignore Executable file
View File

@ -0,0 +1,22 @@
# ©AngelaMos | 2026
# .stylelintignore
# Dependencies
node_modules/
# Production builds
dist/
build/
out/
# JS/TS files
**/*.js
**/*.jsx
**/*.ts
**/*.tsx
# Generated files
*.min.css
# Error system styles - ignore from linting
src/core/app/_toastStyles.scss

94
PROJECTS/bug-bounty-platform/frontend/biome.json Normal file
View File

@ -0,0 +1,94 @@
{
"$schema": "https://biomejs.dev/schemas/2.3.11/schema.json",
"vcs": {
"enabled": true,
"clientKind": "git",
"useIgnoreFile": true
},
"files": {
"includes": ["**/*.ts", "**/*.tsx", "**/*.js", "**/*.jsx", "**/*.json"]
},
"formatter": {
"enabled": true,
"indentStyle": "space",
"indentWidth": 2,
"lineWidth": 82,
"lineEnding": "lf"
},
"javascript": {
"formatter": {
"quoteStyle": "single",
"jsxQuoteStyle": "double",
"semicolons": "asNeeded",
"trailingCommas": "es5",
"arrowParentheses": "always"
}
},
"linter": {
"enabled": true,
"rules": {
"recommended": true,
"complexity": {
"noExcessiveCognitiveComplexity": {
"level": "error",
"options": { "maxAllowedComplexity": 25 }
},
"noForEach": "off",
"useLiteralKeys": "off"
},
"correctness": {
"noUnusedVariables": "error",
"noUnusedImports": "error",
"useExhaustiveDependencies": "warn",
"useHookAtTopLevel": "error",
"noUndeclaredVariables": "error"
},
"style": {
"useImportType": "error",
"useConst": "error",
"useTemplate": "error",
"useSelfClosingElements": "error",
"useFragmentSyntax": "error",
"noNonNullAssertion": "error",
"useConsistentArrayType": {
"level": "error",
"options": { "syntax": "shorthand" }
},
"useNamingConvention": "off"
},
"suspicious": {
"noExplicitAny": "error",
"noDebugger": "error",
"noConsole": "warn",
"noArrayIndexKey": "warn",
"noAssignInExpressions": "error",
"noDoubleEquals": "error",
"noRedeclare": "error",
"noVar": "error"
},
"security": {
"noDangerouslySetInnerHtml": "error"
},
"a11y": {
"useAltText": "error",
"useAnchorContent": "error",
"useKeyWithClickEvents": "error",
"noStaticElementInteractions": "error",
"useButtonType": "error",
"useValidAnchor": "error"
}
}
},
"overrides": [
{
"includes": ["src/main.tsx"],
"linter": {
"rules": {
"style": {
"noNonNullAssertion": "off"
}
}
}
}
]
}

48
PROJECTS/bug-bounty-platform/frontend/index.html Normal file
View File

@ -0,0 +1,48 @@
<!doctype html>
<html lang="en">
<head>
<!--
Bug Bounty Platform
Author(s): © AngelaMos, CarterPerez-dev
-->
<meta charset="UTF-8" />
<link
rel="icon"
type="image/x-icon"
href="/assets/favicon.ico"
/>
<link
rel="apple-touch-icon"
type="image/png"
href="/assets/apple-touch-icon.png"
/>
<link
rel="manifest"
href="/assets/site.webmanifest"
/>
<meta
name="viewport"
content="width=device-width, initial-scale=1.0"
/>
<meta
http-equiv="Content-Security-Policy"
content="default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self' github.com api.github.com; form-action 'self' github.com; worker-src 'self' blob:;"
/>
<title>Bug Bounty Platform</title>
<meta
name="description"
content="*Cracked*"
/>
<meta
name="author"
content=" ©AngelaMos | 2026 | CarterPerez-dev"
/>
</head>
<body>
<div id="root"></div>
<script
type="module"
src="/src/main.tsx"
></script>
</body>
</html>

50
PROJECTS/bug-bounty-platform/frontend/package.json Normal file
View File

@ -0,0 +1,50 @@
{
"name": "bug-bounty-platform",
"private": true,
"version": "1.0.0",
"type": "module",
"scripts": {
"dev": "vite",
"build": "tsc -b && vite build",
"preview": "vite preview",
"lint": "biome check .",
"lint:fix": "biome check --write .",
"format": "biome format --write .",
"typecheck": "tsc --noEmit",
"lint:scss": "stylelint '**/*.scss'",
"lint:scss:fix": "stylelint '**/*.scss' --fix"
},
"dependencies": {
"@tanstack/react-query": "^5.90.12",
"axios": "^1.13.0",
"react": "^19.2.1",
"react-dom": "^19.2.0",
"react-error-boundary": "^6.0.0",
"react-icon": "^1.0.0",
"react-icons": "^5.5.0",
"react-router-dom": "^7.1.1",
"sonner": "^2.0.7",
"zod": "^4.1.13",
"zustand": "^5.0.9"
},
"devDependencies": {
"@biomejs/biome": "^2.3.8",
"@tanstack/react-query-devtools": "^5.91.1",
"@types/node": "^24.10.2",
"@types/react": "^19.2.7",
"@types/react-dom": "^19.2.3",
"@vitejs/plugin-react": "^5.1.1",
"sass": "^1.95.0",
"stylelint": "^16.26.1",
"stylelint-config-prettier-scss": "^1.0.0",
"stylelint-config-standard-scss": "^16.0.0",
"typescript": "~5.9.3",
"vite": "npm:rolldown-vite@7.2.5",
"vite-tsconfig-paths": "^5.1.0"
},
"pnpm": {
"overrides": {
"vite": "npm:rolldown-vite@7.2.5"
}
}
}

2598
PROJECTS/bug-bounty-platform/frontend/pnpm-lock.yaml Normal file
View File

File diff suppressed because it is too large Load Diff

BIN
PROJECTS/bug-bounty-platform/frontend/public/assets/android-chrome-192x192.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 25 KiB

BIN
PROJECTS/bug-bounty-platform/frontend/public/assets/android-chrome-512x512.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 72 KiB

BIN
PROJECTS/bug-bounty-platform/frontend/public/assets/apple-touch-icon.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 22 KiB

BIN
PROJECTS/bug-bounty-platform/frontend/public/assets/favicon-16x16.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 746 B

Some files were not shown because too many files have changed in this diff Show More