PyOTP 2.5.0__tar.gz → 2.6.0__tar.gz

{pyotp-2.5.0 → pyotp-2.6.0}/LICENSE

@@ -1,4 +1,4 @@
-Copyright (C) 2011-2017 Mark Percival <m@mdp.im>,
+Copyright (C) 2011-2021 Mark Percival <m@mdp.im>,
 Nathan Reynolds <email@nreynolds.co.uk>, Andrey Kislyuk <kislyuk@gmail.com>,
 and PyOTP contributors
 

{pyotp-2.5.0/src/pyotp.egg-info → pyotp-2.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 1.1
 Name: pyotp
-Version: 2.5.0
+Version: 2.6.0
 Summary: Python One Time Password Library
 Home-page: https://github.com/pyotp/pyotp
 Author: PyOTP contributors

{pyotp-2.5.0 → pyotp-2.6.0}/setup.py

@@ -7,7 +7,7 @@ install_requires = [line.rstrip() for line in open(os.path.join(os.path.dirname(
 
 setup(
     name="pyotp",
-    version="2.5.0",
+    version="2.6.0",
     url="https://github.com/pyotp/pyotp",
     license="MIT License",
     author="PyOTP contributors",

{pyotp-2.5.0 → pyotp-2.6.0}/src/pyotp/__init__.py

@@ -9,9 +9,12 @@ from .otp import OTP as OTP
 from .totp import TOTP as TOTP
 
 
-def random_base32(length: int = 26, chars: Sequence[str] = list('ABCDEFGHIJKLMNOPQRSTUVWXYZ234567')) -> str:
-    if length < 26:
-        raise ValueError("Secrets should be at least 128 bits")
+def random_base32(length: int = 32, chars: Sequence[str] = list('ABCDEFGHIJKLMNOPQRSTUVWXYZ234567')) -> str:
+    # Note: the otpauth scheme DOES NOT use base32 padding for secret lengths not divisible by 8.
+    # Some third-party tools have bugs when dealing with such secrets.
+    # We might consider warning the user when generating a secret of length not divisible by 8.
+    if length < 32:
+        raise ValueError("Secrets should be at least 160 bits")
 
     return ''.join(
         random.choice(chars)
@@ -19,9 +22,9 @@ def random_base32(length: int = 26, chars: Sequence[str] = list('ABCDEFGHIJKLMNO
     )
 
 
-def random_hex(length: int = 32, chars: Sequence[str] = list('ABCDEF0123456789')) -> str:
-    if length < 32:
-        raise ValueError("Secrets should be at least 128 bits")
+def random_hex(length: int = 40, chars: Sequence[str] = list('ABCDEF0123456789')) -> str:
+    if length < 40:
+        raise ValueError("Secrets should be at least 160 bits")
     return random_base32(length=length, chars=chars)
 
 
@@ -82,7 +85,7 @@ def parse_uri(uri: str) -> OTP:
             otp_data['interval'] = int(value)
         elif key == 'counter':
             otp_data['initial_count'] = int(value)
-        else:
+        elif key != 'image':
             raise ValueError('{} is not a valid parameter'.format(key))
 
     if not secret:

{pyotp-2.5.0 → pyotp-2.6.0}/src/pyotp/otp.py

@@ -37,10 +37,11 @@ class OTP(object):
         return str_code
 
     def byte_secret(self) -> bytes:
-        missing_padding = len(self.secret) % 8
+        secret = self.secret
+        missing_padding = len(secret) % 8
         if missing_padding != 0:
-            self.secret += '=' * (8 - missing_padding)
-        return base64.b32decode(self.secret, casefold=True)
+            secret += '=' * (8 - missing_padding)
+        return base64.b32decode(secret, casefold=True)
 
     @staticmethod
     def int_to_bytestring(i: int, padding: int = 8) -> bytes:

{pyotp-2.5.0 → pyotp-2.6.0/src/pyotp.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 1.1
 Name: pyotp
-Version: 2.5.0
+Version: 2.6.0
 Summary: Python One Time Password Library
 Home-page: https://github.com/pyotp/pyotp
 Author: PyOTP contributors

{pyotp-2.5.0 → pyotp-2.6.0}/test.py

@@ -7,7 +7,7 @@ from warnings import warn
 from urllib.parse import urlparse, parse_qsl
 
 sys.path.insert(0, os.path.join(os.path.dirname(__file__), 'src'))
-import pyotp
+import pyotp  # noqa
 
 
 class HOTPExampleValuesFromTheRFC(unittest.TestCase):
@@ -118,6 +118,11 @@ class HOTPExampleValuesFromTheRFC(unittest.TestCase):
             ).provisioning_uri()
         )
 
+        code = pyotp.totp.TOTP("S46SQCPPTCNPROMHWYBDCTBZXV")
+        self.assertEqual(code.provisioning_uri(), "otpauth://totp/Secret?secret=S46SQCPPTCNPROMHWYBDCTBZXV")
+        code.verify("123456")
+        self.assertEqual(code.provisioning_uri(), "otpauth://totp/Secret?secret=S46SQCPPTCNPROMHWYBDCTBZXV")
+
     def test_other_secret(self):
         hotp = pyotp.HOTP(
             'N3OVNIBRERIO5OHGVCMDGS4V4RJ3AUZOUN34J6FRM4P6JIFCG3ZA')
@@ -291,14 +296,14 @@ class TOTPExampleValuesFromTheRFC(unittest.TestCase):
         )
 
     def test_random_key_generation(self):
-        self.assertEqual(len(pyotp.random_base32()), 26)
-        self.assertEqual(len(pyotp.random_base32(length=32)), 32)
-        self.assertEqual(len(pyotp.random_hex()), 32)
-        self.assertEqual(len(pyotp.random_hex(length=64)), 64)
+        self.assertEqual(len(pyotp.random_base32()), 32)
+        self.assertEqual(len(pyotp.random_base32(length=34)), 34)
+        self.assertEqual(len(pyotp.random_hex()), 40)
+        self.assertEqual(len(pyotp.random_hex(length=42)), 42)
         with self.assertRaises(ValueError):
-            pyotp.random_base32(length=25)
+            pyotp.random_base32(length=31)
         with self.assertRaises(ValueError):
-            pyotp.random_hex(length=31)
+            pyotp.random_hex(length=39)
 
 
 class CompareDigestTest(unittest.TestCase):
@@ -412,11 +417,17 @@ class ParseUriTest(unittest.TestCase):
         self.assertEqual(otp.at(0), '816660')
         self.assertEqual(otp.at(9000), '524153')
 
-        self.assertEqual(otp.provisioning_uri(name='n', issuer_name='i', image='https://test.net/test.png'),
-                        'otpauth://totp/i:n?secret=GEZDGNBV&issuer=i&algorithm=SHA512&image=https%3A%2F%2Ftest.net%2Ftest.png')
+        self.assertEqual(
+            otp.provisioning_uri(name='n', issuer_name='i', image='https://test.net/test.png'),
+            'otpauth://totp/i:n?secret=GEZDGNBV&issuer=i&algorithm=SHA512&image=https%3A%2F%2Ftest.net%2Ftest.png'
+        )
         with self.assertRaises(ValueError):
             otp.provisioning_uri(name='n', issuer_name='i', image='nourl')
 
+        otp = pyotp.parse_uri(otp.provisioning_uri(name='n', issuer_name='i', image='https://test.net/test.png'))
+        self.assertEqual(hashlib.sha512, otp.digest)
+
+
 class Timecop(object):
     """
     Half-assed clone of timecop.rb, just enough to pass our tests.