daddy/modbison
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

PC3 Phase 3.2: real age verification (date of birth, not a checkbox)

Browse Source 
POST /api/auth/register now requires a real date_of_birth (ISO YYYY-MM-DD).
The server computes age (auth.calculate_age) and rejects under-18s with 403;
a future/nonsensical date is 400. The DOB is stored and surfaced only to
that user (/api/auth/me).

Still self-attested (a user can enter a false DOB) -- but a concrete,
stored, legally-meaningful data point and the seam for a future ID-check
pass. Encryption-at-rest for the column and the Tier-2 hook are not done;
the limitation is stated plainly in docs/architecture/content_moderation.md 5.2.

- auth.py: RegisterRequest.date_of_birth (date); MIN_AGE=18; register()
  computes + enforces; UserResponse.date_of_birth typed `date | None`
  (the old `str | None` would have 500'd /me once a DOB was actually stored).
- api_client.gd / main_menu.gd: the Over18 checkbox is now a
  "Date of birth (YYYY-MM-DD)" field with a client-side sanity check.
- tests: test_auth_age_gate.py rewritten around the endpoint + age math
  (adult/minor/exactly-18/future-dob/stored); ~25 over_18 references across
  6 backend test files + 6 game smoke tests updated. Backend 74 passed;
  game smokes green (auth 6/6, menu_full_flow 12/12, e2e 4/4, etc.);
  fresh-clone boot PASS.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015jtxAiu5dAW4WxCNdGkrkJ
This commit is contained in:
daddy
2026-09-05 22:18:38 +00:00
parent 855311e731
commit 7bd8124199
19 changed files with 194 additions and 150 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/app/routers/auth.py
+25 -15
View File
@@ -21,6 +21,9 @@ pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
router = APIRouter()
## Minimum age to register. This platform is adults-only.
MIN_AGE = 18
# --- Pydantic schemas ---
@@ -39,14 +42,19 @@ class RegisterRequest(BaseModel):
username: str
email: EmailStr
password: str
over_18: bool # Simple boolean confirmation instead of date_of_birth
# Real date of birth -- the server computes age from it and rejects
# anyone under MIN_AGE. Still self-attested (no document check yet), but
# a concrete, stored, legally-meaningful data point rather than a
# throwaway checkbox, and the seam for a future hard ID-verification
# pass. See docs/architecture/content_moderation.md 5.2.
date_of_birth: date
class UserResponse(BaseModel):
id: int
username: str
email: str
date_of_birth: str | None = None
date_of_birth: date | None = None
is_active: bool
created_at: datetime | None = None
@@ -108,15 +116,9 @@ def hash_password(password: str) -> str:
def calculate_age(birth_date: date, today: date | None = None) -> int:
"""Calculate age in years from a birth date.
Not called by /register anymore (that endpoint now just trusts the
client's over_18 boolean, see RegisterRequest) -- kept as a real,
tested utility since date-of-birth storage/verification is coming
back in a future pass (real age math, not just a client-side claim,
the user explicitly wants to revisit this design). Removing it broke
backend/tests/test_auth_age_gate.py's collection entirely (ImportError
on `from app.routers.auth import calculate_age`) for zero benefit --
restoring it is the lower-risk path over rewriting or deleting 17
tests for logic this codebase will need again.
Used by /register (PC3 Phase 3) to compute age from the submitted
date_of_birth and enforce the 18+ gate. See
docs/architecture/content_moderation.md 5.2.
Args:
birth_date: The person's date of birth.
@@ -155,12 +157,20 @@ def _issue_refresh_token(user_id: int, db: AsyncSession) -> str:
async def register(req: RegisterRequest, db: AsyncSession = Depends(get_db)):
"""Register a new user and return access + refresh tokens.
Requires over_18 boolean confirmation; rejects users who are not 18+.
Requires a date of birth; the server computes age and rejects anyone
under MIN_AGE (18). See docs/architecture/content_moderation.md for the
verification design and its self-attestation limitation.
"""
if not req.over_18:
age = calculate_age(req.date_of_birth)
if age < 0 or req.date_of_birth > date.today():
raise HTTPException(
status_code=status.HTTP_400_BAD_REQUEST,
detail="Must be 18 or older to register",
detail="Invalid date of birth",
)
if age < MIN_AGE:
raise HTTPException(
status_code=status.HTTP_403_FORBIDDEN,
detail=f"You must be at least {MIN_AGE} to use this platform",
)
# Check if username already exists
@@ -183,7 +193,7 @@ async def register(req: RegisterRequest, db: AsyncSession = Depends(get_db)):
username=req.username,
email=req.email,
hashed_password=hash_password(req.password),
date_of_birth=None, # No longer collecting DOB
date_of_birth=req.date_of_birth,
)
db.add(user)
await db.flush() # flush to get user.id before creating refresh token
backend/tests/test_auth_age_gate.py
+76 -66
View File
@@ -3,92 +3,102 @@
from datetime import date, timedelta
import pytest
from fastapi.testclient import TestClient
from app.routers.auth import calculate_age
from app.main import app
from app.routers.auth import calculate_age, MIN_AGE, RegisterRequest
class TestCalculateAge:
"""Unit tests for the calculate_age helper."""
def test_exactly_18(self):
"""A person born exactly 18 years ago today is 18."""
today = date(2025, 6, 15)
today = date(2026, 6, 15)
dob = today.replace(year=today.year - 18)
assert calculate_age(dob, today=today) == 18
def test_just_turned_18(self):
"""A person who turned 18 yesterday is 18."""
today = date(2025, 6, 15)
today = date(2026, 6, 15)
dob = today.replace(year=today.year - 18) - timedelta(days=1)
assert calculate_age(dob, today=today) == 18
def test_one_day_short_of_18(self):
"""A person born one day after their 18th birthday is 17."""
today = date(2025, 6, 15)
today = date(2026, 6, 15)
dob = today.replace(year=today.year - 18) + timedelta(days=1)
assert calculate_age(dob, today=today) == 17
def test_17_years_old(self):
"""A person who is 17 years old today is 17."""
today = date(2025, 6, 15)
dob = date(2008, 6, 15)
assert calculate_age(dob, today=today) == 17
def test_leap_day_birthday_before(self):
assert calculate_age(date(2000, 2, 29), today=date(2024, 2, 28)) == 23
def test_65_years_old(self):
"""A person who is 65 is correctly calculated."""
today = date(2025, 6, 15)
dob = today.replace(year=today.year - 65)
assert calculate_age(dob, today=today) == 65
def test_newborn(self):
"""A newborn is 0."""
today = date(2025, 6, 15)
dob = today
assert calculate_age(dob, today=today) == 0
def test_birthday_not_yet_this_year(self):
"""Person born Dec 31, 2000 — on Jan 1, 2025 they are still 24."""
dob = date(2000, 12, 31)
assert calculate_age(dob, today=date(2025, 1, 1)) == 24
def test_birthday_today(self):
"""Person born Dec 31, 2000 — on Dec 31, 2024 they turn 24."""
dob = date(2000, 12, 31)
assert calculate_age(dob, today=date(2024, 12, 31)) == 24
def test_leap_day_birthday_after(self):
assert calculate_age(date(2000, 2, 29), today=date(2024, 3, 1)) == 24
class TestRegisterRequestOver18Field:
"""Tests for RegisterRequest's over_18 field.
class TestRegisterRequestDob:
def test_dob_parsed_from_iso_string(self):
req = RegisterRequest(username="u", email="u@example.com", password="p",
date_of_birth="1990-01-01")
assert req.date_of_birth == date(1990, 1, 1)
Replaces TestRegisterRequestDateValidation -- date_of_birth and its
field_validator were removed from RegisterRequest 2026-08-20 (interim
simplification: a plain client-side over_18 confirmation instead of
collecting/validating an actual date of birth; see calculate_age's
own docstring in app/routers/auth.py for why that function is still
here even though this endpoint no longer calls it). There's no date
format left to validate, so the equivalent coverage is just: the
field exists, is a real bool, and is required."""
def test_over_18_true_accepted(self):
from app.routers.auth import RegisterRequest
req = RegisterRequest(username="u", email="u@example.com", password="p", over_18=True)
assert req.over_18 is True
def test_over_18_false_accepted(self):
"""False is a valid value at the schema level -- the endpoint,
not the schema, is what rejects it (see
TestRegister::test_register_rejects_not_over_18 in
test_auth_endpoints.py)."""
from app.routers.auth import RegisterRequest
req = RegisterRequest(username="u", email="u@example.com", password="p", over_18=False)
assert req.over_18 is False
def test_over_18_missing_rejected(self):
"""over_18 has no default -- omitting it entirely is a validation error."""
from app.routers.auth import RegisterRequest
from pydantic import ValidationError
with pytest.raises(ValidationError):
def test_dob_required(self):
with pytest.raises(Exception):
RegisterRequest(username="u", email="u@example.com", password="p")
def test_bad_dob_string_rejected(self):
with pytest.raises(Exception):
RegisterRequest(username="u", email="u@example.com", password="p",
date_of_birth="not-a-date")
class TestRegisterAgeGate:
"""End-to-end: the /register endpoint computes age from the DOB."""
def _dob_for_age(self, years: int) -> str:
return (date.today().replace(year=date.today().year - years)).isoformat()
def test_adult_accepted(self):
client = TestClient(app)
r = client.post("/api/auth/register", json={
"username": "gate_adult", "email": "gate_adult@e.com",
"password": "secret123", "date_of_birth": self._dob_for_age(25),
})
assert r.status_code == 201, r.text
def test_minor_rejected(self):
client = TestClient(app)
r = client.post("/api/auth/register", json={
"username": "gate_minor", "email": "gate_minor@e.com",
"password": "secret123", "date_of_birth": self._dob_for_age(15),
})
assert r.status_code == 403
assert str(MIN_AGE) in r.json()["detail"]
def test_exactly_18_accepted(self):
client = TestClient(app)
r = client.post("/api/auth/register", json={
"username": "gate_18", "email": "gate_18@e.com",
"password": "secret123",
"date_of_birth": (date.today().replace(year=date.today().year - 18) - timedelta(days=1)).isoformat(),
})
assert r.status_code == 201, r.text
def test_future_dob_rejected(self):
client = TestClient(app)
r = client.post("/api/auth/register", json={
"username": "gate_future", "email": "gate_future@e.com",
"password": "secret123", "date_of_birth": "2999-01-01",
})
assert r.status_code == 400
def test_dob_is_stored(self):
client = TestClient(app)
dob = self._dob_for_age(30)
reg = client.post("/api/auth/register", json={
"username": "gate_stored", "email": "gate_stored@e.com",
"password": "secret123", "date_of_birth": dob,
})
assert reg.status_code == 201
me = client.get("/api/auth/me", headers={
"Authorization": f"Bearer {reg.json()['access_token']}"
})
assert me.json()["date_of_birth"] == dob
backend/tests/test_auth_endpoints.py
+16 -24
View File
@@ -73,7 +73,7 @@ class TestRegister:
"username": "newuser",
"email": "new@example.com",
"password": "secret123",
"over_18": True,
"date_of_birth": "1990-01-01",
},
)
assert resp.status_code == 201
@@ -81,26 +81,23 @@ class TestRegister:
assert "access_token" in data
assert data["token_type"] == "bearer"
def test_register_rejects_not_over_18(self):
"""over_18=false gets a 400 with a detail message.
The interim design (2026-08-20) trusts a client-side boolean
confirmation instead of collecting/validating an actual date of
birth -- this only checks that the flag is respected, not real
age math (there's no date to verify against anymore). Real DOB
collection/verification may come back in a future pass."""
def test_register_rejects_under_18(self):
"""A DOB that computes to under 18 gets a 403 (see test_auth_age_gate
for the age-math coverage)."""
from datetime import date
client = TestClient(app)
minor_dob = date.today().replace(year=date.today().year - 14).isoformat()
resp = client.post(
"/api/auth/register",
json={
"username": "kid",
"email": "kid@example.com",
"password": "secret123",
"over_18": False,
"date_of_birth": minor_dob,
},
)
assert resp.status_code == 400
assert "18 or older" in resp.json()["detail"]
assert resp.status_code == 403
assert "at least 18" in resp.json()["detail"]
def test_register_rejects_duplicate_username(self):
"""Registering the same username twice returns 409."""
@@ -112,7 +109,7 @@ class TestRegister:
"username": "duplicate",
"email": "dup1@example.com",
"password": "secret123",
"over_18": True,
"date_of_birth": "1990-01-01",
},
)
# Second registration with same username, different email
@@ -122,7 +119,7 @@ class TestRegister:
"username": "duplicate",
"email": "dup2@example.com",
"password": "secret123",
"over_18": True,
"date_of_birth": "1990-01-01",
},
)
assert resp.status_code == 409
@@ -137,7 +134,7 @@ class TestRegister:
"username": "user1",
"email": "same@example.com",
"password": "secret123",
"over_18": True,
"date_of_birth": "1990-01-01",
},
)
resp = client.post(
@@ -146,19 +143,14 @@ class TestRegister:
"username": "user2",
"email": "same@example.com",
"password": "secret123",
"over_18": True,
"date_of_birth": "1990-01-01",
},
)
assert resp.status_code == 409
assert "Email already registered" in resp.json()["detail"]
def test_register_missing_over_18(self):
"""Missing the required over_18 field returns 422.
Replaces the old test_register_invalid_date_format -- there's no
date format to get wrong anymore (no date field at all), so the
closest equivalent "malformed request" case is the required
over_18 boolean being absent entirely."""
def test_register_missing_dob(self):
"""Missing the required date_of_birth field returns 422."""
client = TestClient(app)
resp = client.post(
"/api/auth/register",
@@ -189,7 +181,7 @@ class TestLogin:
"username": username,
"email": email,
"password": password,
"over_18": True,
"date_of_birth": "1990-01-01",
},
)
assert resp.status_code == 201
backend/tests/test_auth_expired_token.py
+1 -1
View File
@@ -93,7 +93,7 @@ def _register_user(client: TestClient, username: str) -> str:
"username": username,
"email": f"{username}@example.com",
"password": "secret123",
"over_18": True,
"date_of_birth": "1990-01-01",
},
)
assert resp.status_code == 201
backend/tests/test_avatar_loadout.py
+1 -1
View File
@@ -18,7 +18,7 @@ def _auth_headers(client: TestClient, username: str) -> dict:
"username": username,
"email": f"{username}@example.com",
"password": "secret123",
"over_18": True,
"date_of_birth": "1990-01-01",
},
)
assert resp.status_code == 201, resp.text
backend/tests/test_refresh_endpoint.py
+2 -2
View File
@@ -59,7 +59,7 @@ class TestRefresh:
"username": username,
"email": email,
"password": password,
"over_18": True,
"date_of_birth": "1990-01-01",
},
)
assert resp.status_code == 201
@@ -143,7 +143,7 @@ class TestRefresh:
"username": "refep_loginrefuser",
"email": "loginref@example.com",
"password": "secret123",
"over_18": True,
"date_of_birth": "1990-01-01",
},
)
# Login to get a refresh token
backend/tests/test_world_join.py
+1 -1
View File
@@ -13,7 +13,7 @@ from app.main import app
def _auth(client: TestClient, name: str) -> tuple[dict, int]:
r = client.post("/api/auth/register", json={
"username": name, "email": f"{name}@e.com", "password": "secret123", "over_18": True,
"username": name, "email": f"{name}@e.com", "password": "secret123", "date_of_birth": "1990-01-01",
})
assert r.status_code == 201, r.text
headers = {"Authorization": f"Bearer {r.json()['access_token']}"}