start user page and stub more endpoints

app/routes/users.py

@@ -2,9 +2,10 @@ from flask import Blueprint, redirect, url_for, render_template, request, sessio
 from functools import wraps
 import time
 
-from ..auth import digest, verify, create_session, is_logged_in, parse_username, is_password_valid
+from ..auth import digest, verify, create_session, is_logged_in, parse_username, is_password_valid, login_required
 from ..models import Users
 from ..constants import PermissionLevel
+from secrets import compare_digest as compare_timesafe
 
 bp = Blueprint('users', __name__, url_prefix='/users/')
 
@@ -55,7 +56,7 @@ def sign_up_post():
     username = request.form.get('username', default='')
     if not username:
         return generic_error_page
-    if request.form.get('password', default=None) is None:
+    if request.form.get('password') is None:
         return generic_error_page
     if len(request.form.getlist('password')) != 2:
         return passwords_error_page
@@ -67,7 +68,7 @@ def sign_up_post():
     if potential_user:
         return invalid_username_error_page
 
-    if request.form.getlist('password')[0] != request.form.getlist('password')[1]:
+    if not compare_timesafe(request.form.getlist('password')[0], request.form.getlist('password')[1]):
         return passwords_error_page
 
     password_hash = digest(request.form.get('password'))
@@ -94,17 +95,36 @@ def sign_up_post():
 
 @bp.get('/<username>/')
 def user_page(username):
+    target_user = Users.find({'username': username})
+    if not target_user:
+        abort(404)
+    return render_template('users/user_page.html', target_user=target_user)
+
+@bp.get('/<username>/posts/')
+def posts(username):
     return 'stub'
 
-@bp.get('/<username>/settings')
+@bp.get('/<username>/threads/')
+def threads(username):
+    return 'stub'
+
+@bp.get('/<username>/comments/')
+def comments(username):
+    return 'stub'
+
+@bp.get('/<username>/settings/')
 def settings(username):
     return 'stub'
 
-@bp.get('/<username>/inbox')
+@bp.get('/<username>/inbox/')
 def inbox(username):
     return 'stub'
 
-@bp.get('/<username>/bookmarks')
+@bp.get('/<username>/bookmarks/')
 def bookmarks(username):
     return 'stub'
 
+@bp.post('/<username>/log_out/')
+@login_required
+def log_out(username):
+    return 'stub'