Passwordless Authentication with Magic Links — Eliminating Passwords from API Auth

import secrets, hashlib, datetime, jwt
from flask import Flask, request, jsonify, redirect
from sendgrid import SendGridAPIClient
from sendgrid.helpers.mail import Mail

app = Flask(__name__)
SECRET = "magic-link-secret"

# Magic link store
magic_links = {}

def generate_magic_token():
    """Generate a cryptographically secure one-time token."""
    return secrets.token_urlsafe(48)

def create_magic_link(email, redirect_to="/dashboard"):
    """Create a one-time magic link for the given email."""
    token = generate_magic_token()
    token_hash = hashlib.sha256(token.encode()).hexdigest()

    expires_at = datetime.datetime.utcnow() + datetime.timedelta(minutes=15)

    magic_links[token_hash] = {
        "email": email,
        "expires_at": expires_at,
        "used": False,
        "created_at": datetime.datetime.utcnow()
    }

    magic_link = f"https://api.durga-antivirus.com/auth/verify?token={token}&redirect={redirect_to}"
    return magic_link, token_hash

@app.route("/api/auth/magic-link", methods=["POST"])
def request_magic_link():
    """Send a magic link to the user's email."""
    email = request.json.get("email", "")
    redirect_to = request.json.get("redirect", "/dashboard")

    if not email or "@" not in email:
        return jsonify({"error": "Valid email required"}), 400

    # Always return success to prevent email enumeration
    magic_link, token_hash = create_magic_link(email, redirect_to)

    try:
        send_magic_link_email(email, magic_link)
    except Exception as e:
        print(f"Failed to send email: {e}")

    return jsonify({
        "message": "If the email is registered, a magic link has been sent.",
        "expires_in": 900
    })

def send_magic_link_email(to_email, magic_link):
    """Send magic link via SendGrid."""
    message = Mail(
        from_email="noreply@durga-antivirus.com",
        to_entries=[to_email],
        subject="Your login link for Durga Antivirus",
        html_content=f"""
        <p>Click the link below to log in to your Durga Antivirus account:</p>
        <p><a href="{magic_link}">{magic_link}</a></p>
        <p>This link expires in 15 minutes.</p>
        <p>If you did not request this, please ignore this email.</p>
        """
    )
    sg = SendGridAPIClient(os.environ.get("SENDGRID_API_KEY"))
    sg.send(message)

@app.route("/auth/verify", methods=["GET"])
def verify_magic_link():
    """Verify a magic link token and issue session."""
    token = request.args.get("token", "")
    redirect_to = request.args.get("redirect", "/dashboard")

    if not token:
        return jsonify({"error": "Missing token"}), 400

    token_hash = hashlib.sha256(token.encode()).hexdigest()
    stored = magic_links.get(token_hash)

    if not stored:
        return jsonify({"error": "Invalid or expired magic link"}), 401

    if stored["used"]:
        return jsonify({"error": "Magic link already used"}), 401

    if datetime.datetime.utcnow() > stored["expires_at"]:
        del magic_links[token_hash]
        return jsonify({"error": "Magic link expired"}), 401

    # Mark as used
    stored["used"] = True

    # Issue JWT session token
    access_token = jwt.encode({
        "sub": stored["email"],
        "auth_method": "magic_link",
        "iat": datetime.datetime.utcnow(),
        "exp": datetime.datetime.utcnow() + datetime.timedelta(hours=24),
        "jti": secrets.token_hex(16)
    }, SECRET, algorithm="HS256")

    # Redirect with token
    return redirect(f"{redirect_to}?access_token={access_token}&expires_in=86400")

@app.route("/api/auth/magic-link/status", methods=["GET"])
def check_link_status():
    """Check if a magic link has been used (for polling clients)."""
    token = request.args.get("token", "")
    token_hash = hashlib.sha256(token.encode()).hexdigest()
    stored = magic_links.get(token_hash)

    if not stored or stored["used"]:
        return jsonify({"status": "consumed"})

    if datetime.datetime.utcnow() > stored["expires_at"]:
        return jsonify({"status": "expired"})

    return jsonify({"status": "pending", "expires_in": int((stored["expires_at"] - datetime.datetime.utcnow()).total_seconds())})

class PasswordlessAuth {
  constructor(apiBase) {
    this.apiBase = apiBase;
    this.pollInterval = null;
  }

  async requestLogin(email) {
    const resp = await fetch(`${this.apiBase}/api/auth/magic-link`, {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ email, redirect: window.location.origin + '/callback' })
    });
    return resp.json();
  }

  async checkTokenFromUrl() {
    const params = new URLSearchParams(window.location.search);
    const token = params.get('access_token');
    if (token) {
      // Clean URL
      window.history.replaceState({}, '', window.location.pathname);
      return { access_token: token, expires_in: parseInt(params.get('expires_in')) };
    }
    return null;
  }

  // For apps that open email link in the same browser
  async pollForToken(requestId) {
    return new Promise((resolve, reject) => {
      this.pollInterval = setInterval(async () => {
        const token = await this.checkTokenFromUrl();
        if (token) {
          clearInterval(this.pollInterval);
          resolve(token);
        }
      }, 1000);

      // Timeout after 5 minutes
      setTimeout(() => {
        clearInterval(this.pollInterval);
        reject(new Error('Login timeout'));
      }, 300000);
    });
  }
}

// Usage
const auth = new PasswordlessAuth('https://api.durga-antivirus.com');
const result = await auth.requestLogin('user@example.com');
// Wait for user to click link in email