PyOTP 2.7.0__tar.gz → 2.9.0__tar.gz

{pyotp-2.7.0/src/pyotp.egg-info → pyotp-2.9.0}/PKG-INFO

@@ -1,11 +1,15 @@
 Metadata-Version: 2.1
 Name: pyotp
-Version: 2.7.0
+Version: 2.9.0
 Summary: Python One Time Password Library
 Home-page: https://github.com/pyotp/pyotp
 Author: PyOTP contributors
 Author-email: kislyuk@gmail.com
 License: MIT License
+Project-URL: Documentation, https://pyauth.github.io/pyotp
+Project-URL: Source Code, https://github.com/pyauth/pyotp
+Project-URL: Issue Tracker, https://github.com/pyauth/pyotp/issues
+Project-URL: Change Log, https://github.com/pyauth/pyotp/blob/master/Changes.rst
 Platform: MacOS X
 Platform: Posix
 Classifier: Intended Audience :: Developers
@@ -14,13 +18,14 @@ Classifier: Operating System :: MacOS :: MacOS X
 Classifier: Operating System :: POSIX
 Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.6
 Classifier: Programming Language :: Python :: 3.7
 Classifier: Programming Language :: Python :: 3.8
 Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
-Requires-Python: >=3.6
+Requires-Python: >=3.7
+Provides-Extra: test
 License-File: LICENSE
 
 PyOTP - The Python One-Time Password Library
@@ -43,19 +48,21 @@ minimum, application implementers should follow this checklist:
 
 - Ensure transport confidentiality by using HTTPS
 - Ensure HOTP/TOTP secret confidentiality by storing secrets in a controlled access database
-- Deny replay attacks by rejecting one-time passwords that have been used by the client (this requires storing the most 
-  recently authenticated timestamp, OTP, or hash of the OTP in your database, and rejecting the OTP when a match is seen)
-- Throttle (rate limit) brute-force attacks against your application's login functionality
+- Deny replay attacks by rejecting one-time passwords that have been used by the client (this requires storing the most
+  recently authenticated timestamp, OTP, or hash of the OTP in your database, and rejecting the OTP when a match is
+  seen)
+- Throttle (rate limit) brute-force attacks against your application's login functionality (see RFC 4226, section 7.3)
 - When implementing a "greenfield" application, consider supporting
   `FIDO U2F <https://en.wikipedia.org/wiki/Universal_2nd_Factor>`_/`WebAuthn <https://www.w3.org/TR/webauthn/>`_ in
   addition to HOTP/TOTP. U2F uses asymmetric cryptography to avoid using a shared secret design, which strengthens your
   MFA solution against server-side attacks. Hardware U2F also sequesters the client secret in a dedicated single-purpose
   device, which strengthens your clients against client-side attacks. And by automating scoping of credentials to
-  relying party IDs (application origin/domain names), U2F adds protection against phishing attacks. One implementation of
-  FIDO U2F/WebAuthn is PyOTP's sister project, `PyWARP <https://github.com/pyauth/pywarp>`_.
+  relying party IDs (application origin/domain names), U2F adds protection against phishing attacks. One implementation
+  of FIDO U2F/WebAuthn is PyOTP's sister project, `PyWARP <https://github.com/pyauth/pywarp>`_.
 
 We also recommend that implementers read the
-`OWASP Authentication Cheat Sheet <https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md>`_ and
+`OWASP Authentication Cheat Sheet
+<https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md>`_ and
 `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_ for a high level overview of
 authentication best practices.
 
@@ -64,8 +71,10 @@ Quick overview of using One Time Passwords on your phone
 
 * OTPs involve a shared secret, stored both on the phone and the server
 * OTPs can be generated on a phone without internet connectivity
-* OTPs should always be used as a second factor of authentication (if your phone is lost, you account is still secured with a password)
-* Google Authenticator and other OTP client apps allow you to store multiple OTP secrets and provision those using a QR Code
+* OTPs should always be used as a second factor of authentication (if your phone is lost, you account is still secured
+  with a password)
+* Google Authenticator and other OTP client apps allow you to store multiple OTP secrets and provision those using a QR
+  Code
 
 Installation
 ------------
@@ -80,6 +89,9 @@ Time-based OTPs
 ~~~~~~~~~~~~~~~
 ::
 
+    import pyotp
+    import time
+
     totp = pyotp.TOTP('base32secret3232')
     totp.now() # => '492039'
 
@@ -92,6 +104,8 @@ Counter-based OTPs
 ~~~~~~~~~~~~~~~~~~
 ::
 
+    import pyotp
+    
     hotp = pyotp.HOTP('base32secret3232')
     hotp.at(0) # => '260182'
     hotp.at(1) # => '055283'
@@ -103,7 +117,8 @@ Counter-based OTPs
 
 Generating a Secret Key
 ~~~~~~~~~~~~~~~~~~~~~~~
-A helper function is provided to generate a 32-character base32 secret, compatible with Google Authenticator and other OTP apps::
+A helper function is provided to generate a 32-character base32 secret, compatible with Google Authenticator and other
+OTP apps::
 
     pyotp.random_base32()
 
@@ -114,8 +129,8 @@ Some applications want the secret key to be formatted as a hex-encoded string::
 Google Authenticator Compatible
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-PyOTP works with the Google Authenticator iPhone and Android app, as well as other OTP apps like Authy. PyOTP includes the
-ability to generate provisioning URIs for use with the QR Code scanner built into these MFA client apps::
+PyOTP works with the Google Authenticator iPhone and Android app, as well as other OTP apps like Authy. PyOTP includes
+the ability to generate provisioning URIs for use with the QR Code scanner built into these MFA client apps::
 
     pyotp.totp.TOTP('JBSWY3DPEHPK3PXP').provisioning_uri(name='alice@google.com', issuer_name='Secure App')
 
@@ -125,8 +140,8 @@ ability to generate provisioning URIs for use with the QR Code scanner built int
 
     >>> 'otpauth://hotp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure%20App&counter=0'
 
-This URL can then be rendered as a QR Code (for example, using https://github.com/soldair/node-qrcode) which can then be scanned
-and added to the users list of OTP credentials.
+This URL can then be rendered as a QR Code (for example, using https://github.com/soldair/node-qrcode) which can then be
+scanned and added to the users list of OTP credentials.
 
 Parsing these URLs is also supported::
 
@@ -151,6 +166,13 @@ Now run the following and compare the output::
     totp = pyotp.TOTP("JBSWY3DPEHPK3PXP")
     print("Current OTP:", totp.now())
 
+Third-party contributions
+~~~~~~~~~~~~~~~~~~~~~~~~~
+The following third-party contributions are not described by a standard, not officially supported, and provided for
+reference only:
+
+* ``pyotp.contrib.Steam()``: An implementation of Steam TOTP. Uses the same API as `pyotp.TOTP()`.
+
 Links
 ~~~~~
 
@@ -170,6 +192,13 @@ For new applications:
 * `WebAuthn <https://www.w3.org/TR/webauthn/>`_
 * `PyWARP <https://github.com/pyauth/pywarp>`_
 
+Versioning
+~~~~~~~~~~
+This package follows the `Semantic Versioning 2.0.0 <http://semver.org/>`_ standard. To control changes, it is
+recommended that application developers pin the package version and manage it using `pip-tools
+<https://github.com/jazzband/pip-tools>`_ or similar. For library developers, pinning the major version is
+recommended.
+
 .. image:: https://github.com/pyauth/pyotp/workflows/Python%20package/badge.svg
         :target: https://github.com/pyauth/pyotp/actions
 .. image:: https://img.shields.io/codecov/c/github/pyauth/pyotp/master.svg

{pyotp-2.7.0 → pyotp-2.9.0}/README.rst

@@ -18,19 +18,21 @@ minimum, application implementers should follow this checklist:
 
 - Ensure transport confidentiality by using HTTPS
 - Ensure HOTP/TOTP secret confidentiality by storing secrets in a controlled access database
-- Deny replay attacks by rejecting one-time passwords that have been used by the client (this requires storing the most 
-  recently authenticated timestamp, OTP, or hash of the OTP in your database, and rejecting the OTP when a match is seen)
-- Throttle (rate limit) brute-force attacks against your application's login functionality
+- Deny replay attacks by rejecting one-time passwords that have been used by the client (this requires storing the most
+  recently authenticated timestamp, OTP, or hash of the OTP in your database, and rejecting the OTP when a match is
+  seen)
+- Throttle (rate limit) brute-force attacks against your application's login functionality (see RFC 4226, section 7.3)
 - When implementing a "greenfield" application, consider supporting
   `FIDO U2F <https://en.wikipedia.org/wiki/Universal_2nd_Factor>`_/`WebAuthn <https://www.w3.org/TR/webauthn/>`_ in
   addition to HOTP/TOTP. U2F uses asymmetric cryptography to avoid using a shared secret design, which strengthens your
   MFA solution against server-side attacks. Hardware U2F also sequesters the client secret in a dedicated single-purpose
   device, which strengthens your clients against client-side attacks. And by automating scoping of credentials to
-  relying party IDs (application origin/domain names), U2F adds protection against phishing attacks. One implementation of
-  FIDO U2F/WebAuthn is PyOTP's sister project, `PyWARP <https://github.com/pyauth/pywarp>`_.
+  relying party IDs (application origin/domain names), U2F adds protection against phishing attacks. One implementation
+  of FIDO U2F/WebAuthn is PyOTP's sister project, `PyWARP <https://github.com/pyauth/pywarp>`_.
 
 We also recommend that implementers read the
-`OWASP Authentication Cheat Sheet <https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md>`_ and
+`OWASP Authentication Cheat Sheet
+<https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md>`_ and
 `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_ for a high level overview of
 authentication best practices.
 
@@ -39,8 +41,10 @@ Quick overview of using One Time Passwords on your phone
 
 * OTPs involve a shared secret, stored both on the phone and the server
 * OTPs can be generated on a phone without internet connectivity
-* OTPs should always be used as a second factor of authentication (if your phone is lost, you account is still secured with a password)
-* Google Authenticator and other OTP client apps allow you to store multiple OTP secrets and provision those using a QR Code
+* OTPs should always be used as a second factor of authentication (if your phone is lost, you account is still secured
+  with a password)
+* Google Authenticator and other OTP client apps allow you to store multiple OTP secrets and provision those using a QR
+  Code
 
 Installation
 ------------
@@ -55,6 +59,9 @@ Time-based OTPs
 ~~~~~~~~~~~~~~~
 ::
 
+    import pyotp
+    import time
+
     totp = pyotp.TOTP('base32secret3232')
     totp.now() # => '492039'
 
@@ -67,6 +74,8 @@ Counter-based OTPs
 ~~~~~~~~~~~~~~~~~~
 ::
 
+    import pyotp
+    
     hotp = pyotp.HOTP('base32secret3232')
     hotp.at(0) # => '260182'
     hotp.at(1) # => '055283'
@@ -78,7 +87,8 @@ Counter-based OTPs
 
 Generating a Secret Key
 ~~~~~~~~~~~~~~~~~~~~~~~
-A helper function is provided to generate a 32-character base32 secret, compatible with Google Authenticator and other OTP apps::
+A helper function is provided to generate a 32-character base32 secret, compatible with Google Authenticator and other
+OTP apps::
 
     pyotp.random_base32()
 
@@ -89,8 +99,8 @@ Some applications want the secret key to be formatted as a hex-encoded string::
 Google Authenticator Compatible
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-PyOTP works with the Google Authenticator iPhone and Android app, as well as other OTP apps like Authy. PyOTP includes the
-ability to generate provisioning URIs for use with the QR Code scanner built into these MFA client apps::
+PyOTP works with the Google Authenticator iPhone and Android app, as well as other OTP apps like Authy. PyOTP includes
+the ability to generate provisioning URIs for use with the QR Code scanner built into these MFA client apps::
 
     pyotp.totp.TOTP('JBSWY3DPEHPK3PXP').provisioning_uri(name='alice@google.com', issuer_name='Secure App')
 
@@ -100,8 +110,8 @@ ability to generate provisioning URIs for use with the QR Code scanner built int
 
     >>> 'otpauth://hotp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure%20App&counter=0'
 
-This URL can then be rendered as a QR Code (for example, using https://github.com/soldair/node-qrcode) which can then be scanned
-and added to the users list of OTP credentials.
+This URL can then be rendered as a QR Code (for example, using https://github.com/soldair/node-qrcode) which can then be
+scanned and added to the users list of OTP credentials.
 
 Parsing these URLs is also supported::
 
@@ -126,6 +136,13 @@ Now run the following and compare the output::
     totp = pyotp.TOTP("JBSWY3DPEHPK3PXP")
     print("Current OTP:", totp.now())
 
+Third-party contributions
+~~~~~~~~~~~~~~~~~~~~~~~~~
+The following third-party contributions are not described by a standard, not officially supported, and provided for
+reference only:
+
+* ``pyotp.contrib.Steam()``: An implementation of Steam TOTP. Uses the same API as `pyotp.TOTP()`.
+
 Links
 ~~~~~
 
@@ -145,6 +162,13 @@ For new applications:
 * `WebAuthn <https://www.w3.org/TR/webauthn/>`_
 * `PyWARP <https://github.com/pyauth/pywarp>`_
 
+Versioning
+~~~~~~~~~~
+This package follows the `Semantic Versioning 2.0.0 <http://semver.org/>`_ standard. To control changes, it is
+recommended that application developers pin the package version and manage it using `pip-tools
+<https://github.com/jazzband/pip-tools>`_ or similar. For library developers, pinning the major version is
+recommended.
+
 .. image:: https://github.com/pyauth/pyotp/workflows/Python%20package/badge.svg
         :target: https://github.com/pyauth/pyotp/actions
 .. image:: https://img.shields.io/codecov/c/github/pyauth/pyotp/master.svg

{pyotp-2.7.0 → pyotp-2.9.0}/pyproject.toml

@@ -1,5 +1,9 @@
 [tool.black]
 line-length = 120
+
 [tool.isort]
 profile = "black"
 line_length = 120
+
+[tool.ruff]
+line-length = 120

pyotp-2.9.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

{pyotp-2.7.0 → pyotp-2.9.0}/setup.py

@@ -4,15 +4,24 @@ from setuptools import setup
 
 setup(
     name="pyotp",
-    version="2.7.0",
+    version="2.9.0",
     url="https://github.com/pyotp/pyotp",
+    project_urls={
+        "Documentation": "https://pyauth.github.io/pyotp",
+        "Source Code": "https://github.com/pyauth/pyotp",
+        "Issue Tracker": "https://github.com/pyauth/pyotp/issues",
+        "Change Log": "https://github.com/pyauth/pyotp/blob/master/Changes.rst",
+    },
     license="MIT License",
     author="PyOTP contributors",
     author_email="kislyuk@gmail.com",
     description="Python One Time Password Library",
     long_description=open("README.rst").read(),
-    python_requires=">=3.6",
+    python_requires=">=3.7",
     install_requires=[],
+    extras_require={
+        "test": ["coverage", "wheel", "ruff", "mypy"],
+    },
     packages=["pyotp", "pyotp.contrib"],
     package_dir={"": "src"},
     package_data={"pyotp": ["py.typed"]},
@@ -26,11 +35,11 @@ setup(
         "Operating System :: POSIX",
         "Programming Language :: Python",
         "Programming Language :: Python :: 3",
-        "Programming Language :: Python :: 3.6",
         "Programming Language :: Python :: 3.7",
         "Programming Language :: Python :: 3.8",
         "Programming Language :: Python :: 3.9",
         "Programming Language :: Python :: 3.10",
+        "Programming Language :: Python :: 3.11",
         "Topic :: Software Development :: Libraries :: Python Modules",
     ],
 )

{pyotp-2.7.0 → pyotp-2.9.0}/src/pyotp/__init__.py

@@ -40,8 +40,14 @@ def parse_uri(uri: str) -> OTP:
     # Secret (to be filled in later)
     secret = None
 
+    # Encoder (to be filled in later)
+    encoder = None
+
+    # Digits (to be filled in later)
+    digits = None
+
     # Data we'll parse to the correct constructor
-    otp_data = {}  # type: Dict[str, Any]
+    otp_data: Dict[str, Any] = {}
 
     # Parse with URLlib
     parsed_uri = urlparse(unquote(uri))
@@ -74,10 +80,10 @@ def parse_uri(uri: str) -> OTP:
                 otp_data["digest"] = hashlib.sha512
             else:
                 raise ValueError("Invalid value for algorithm, must be SHA1, SHA256 or SHA512")
+        elif key == "encoder":
+            encoder = value
         elif key == "digits":
             digits = int(value)
-            if digits not in [6, 7, 8]:
-                raise ValueError("Digits may only be 6, 7, or 8")
             otp_data["digits"] = digits
         elif key == "period":
             otp_data["interval"] = int(value)
@@ -85,11 +91,17 @@ def parse_uri(uri: str) -> OTP:
             otp_data["initial_count"] = int(value)
         elif key != "image":
             raise ValueError("{} is not a valid parameter".format(key))
-
+    
+    if encoder != "steam":
+        if digits is not None and digits not in [6, 7, 8]:
+            raise ValueError("Digits may only be 6, 7, or 8")
+    
     if not secret:
         raise ValueError("No secret found in URI")
 
     # Create objects
+    if encoder == "steam":
+        return contrib.Steam(secret, **otp_data)
     if parsed_uri.netloc == "totp":
         return TOTP(secret, **otp_data)
     elif parsed_uri.netloc == "hotp":

{pyotp-2.7.0 → pyotp-2.9.0}/src/pyotp/contrib/steam.py

@@ -12,7 +12,14 @@ class Steam(TOTP):
     Steam's custom TOTP. Subclass of `pyotp.totp.TOTP`.
     """
 
-    def __init__(self, s: str, name: Optional[str] = None, issuer: Optional[str] = None, interval: int = 30) -> None:
+    def __init__(
+        self,
+        s: str,
+        name: Optional[str] = None,
+        issuer: Optional[str] = None,
+        interval: int = 30,
+        digits: int = 5
+    ) -> None:
         """
         :param s: secret in base32 format
         :param interval: the time interval in seconds for OTP. This defaults to 30.

{pyotp-2.7.0 → pyotp-2.9.0}/src/pyotp/hotp.py

@@ -14,7 +14,7 @@ class HOTP(OTP):
         self,
         s: str,
         digits: int = 6,
-        digest: Any = hashlib.sha1,
+        digest: Any = None,
         name: Optional[str] = None,
         issuer: Optional[str] = None,
         initial_count: int = 0,
@@ -23,10 +23,13 @@ class HOTP(OTP):
         :param s: secret in base32 format
         :param initial_count: starting HMAC counter value, defaults to 0
         :param digits: number of integers in the OTP. Some apps expect this to be 6 digits, others support more.
-        :param digest: digest function to use in the HMAC (expected to be sha1)
+        :param digest: digest function to use in the HMAC (expected to be SHA1)
         :param name: account name
         :param issuer: issuer
         """
+        if digest is None:
+            digest = hashlib.sha1
+
         self.initial_count = initial_count
         super().__init__(s=s, digits=digits, digest=digest, name=name, issuer=issuer)
 

{pyotp-2.7.0 → pyotp-2.9.0}/src/pyotp/otp.py

@@ -18,6 +18,8 @@ class OTP(object):
         issuer: Optional[str] = None,
     ) -> None:
         self.digits = digits
+        if digits > 10:
+            raise ValueError("digits must be no greater than 10")
         self.digest = digest
         self.secret = s
         self.name = name or "Secret"
@@ -39,11 +41,8 @@ class OTP(object):
             | (hmac_hash[offset + 2] & 0xFF) << 8
             | (hmac_hash[offset + 3] & 0xFF)
         )
-        str_code = str(code % 10**self.digits)
-        while len(str_code) < self.digits:
-            str_code = "0" + str_code
-
-        return str_code
+        str_code = str(10_000_000_000 + (code % 10**self.digits))
+        return str_code[-self.digits :]
 
     def byte_secret(self) -> bytes:
         secret = self.secret

{pyotp-2.7.0 → pyotp-2.9.0}/src/pyotp/totp.py

@@ -17,7 +17,7 @@ class TOTP(OTP):
         self,
         s: str,
         digits: int = 6,
-        digest: Any = hashlib.sha1,
+        digest: Any = None,
         name: Optional[str] = None,
         issuer: Optional[str] = None,
         interval: int = 30,
@@ -26,10 +26,13 @@ class TOTP(OTP):
         :param s: secret in base32 format
         :param interval: the time interval in seconds for OTP. This defaults to 30.
         :param digits: number of integers in the OTP. Some apps expect this to be 6 digits, others support more.
-        :param digest: digest function to use in the HMAC (expected to be sha1)
+        :param digest: digest function to use in the HMAC (expected to be SHA1)
         :param name: account name
         :param issuer: issuer
         """
+        if digest is None:
+            digest = hashlib.sha1
+
         self.interval = interval
         super().__init__(s=s, digits=digits, digest=digest, name=name, issuer=issuer)
 
@@ -37,7 +40,9 @@ class TOTP(OTP):
         """
         Accepts either a Unix timestamp integer or a datetime object.
 
-        To get the time until the next timecode change (seconds until the current OTP expires), use this instead::
+        To get the time until the next timecode change (seconds until the current OTP expires), use this instead:
+
+        .. code:: python
 
             totp = pyotp.TOTP(...)
             time_remaining = totp.interval - datetime.datetime.now().timestamp() % totp.interval

{pyotp-2.7.0 → pyotp-2.9.0}/src/pyotp/utils.py

@@ -49,7 +49,7 @@ def build_uri(
     otp_type = "hotp" if is_initial_count_present else "totp"
     base_uri = "otpauth://{0}/{1}?{2}"
 
-    url_args = {"secret": secret}  # type: Dict[str, Union[None, int, str]]
+    url_args: Dict[str, Union[None, int, str]] = {"secret": secret}
 
     label = quote(name)
     if issuer is not None:

{pyotp-2.7.0 → pyotp-2.9.0/src/pyotp.egg-info}/PKG-INFO

@@ -1,11 +1,15 @@
 Metadata-Version: 2.1
 Name: pyotp
-Version: 2.7.0
+Version: 2.9.0
 Summary: Python One Time Password Library
 Home-page: https://github.com/pyotp/pyotp
 Author: PyOTP contributors
 Author-email: kislyuk@gmail.com
 License: MIT License
+Project-URL: Documentation, https://pyauth.github.io/pyotp
+Project-URL: Source Code, https://github.com/pyauth/pyotp
+Project-URL: Issue Tracker, https://github.com/pyauth/pyotp/issues
+Project-URL: Change Log, https://github.com/pyauth/pyotp/blob/master/Changes.rst
 Platform: MacOS X
 Platform: Posix
 Classifier: Intended Audience :: Developers
@@ -14,13 +18,14 @@ Classifier: Operating System :: MacOS :: MacOS X
 Classifier: Operating System :: POSIX
 Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.6
 Classifier: Programming Language :: Python :: 3.7
 Classifier: Programming Language :: Python :: 3.8
 Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
-Requires-Python: >=3.6
+Requires-Python: >=3.7
+Provides-Extra: test
 License-File: LICENSE
 
 PyOTP - The Python One-Time Password Library
@@ -43,19 +48,21 @@ minimum, application implementers should follow this checklist:
 
 - Ensure transport confidentiality by using HTTPS
 - Ensure HOTP/TOTP secret confidentiality by storing secrets in a controlled access database
-- Deny replay attacks by rejecting one-time passwords that have been used by the client (this requires storing the most 
-  recently authenticated timestamp, OTP, or hash of the OTP in your database, and rejecting the OTP when a match is seen)
-- Throttle (rate limit) brute-force attacks against your application's login functionality
+- Deny replay attacks by rejecting one-time passwords that have been used by the client (this requires storing the most
+  recently authenticated timestamp, OTP, or hash of the OTP in your database, and rejecting the OTP when a match is
+  seen)
+- Throttle (rate limit) brute-force attacks against your application's login functionality (see RFC 4226, section 7.3)
 - When implementing a "greenfield" application, consider supporting
   `FIDO U2F <https://en.wikipedia.org/wiki/Universal_2nd_Factor>`_/`WebAuthn <https://www.w3.org/TR/webauthn/>`_ in
   addition to HOTP/TOTP. U2F uses asymmetric cryptography to avoid using a shared secret design, which strengthens your
   MFA solution against server-side attacks. Hardware U2F also sequesters the client secret in a dedicated single-purpose
   device, which strengthens your clients against client-side attacks. And by automating scoping of credentials to
-  relying party IDs (application origin/domain names), U2F adds protection against phishing attacks. One implementation of
-  FIDO U2F/WebAuthn is PyOTP's sister project, `PyWARP <https://github.com/pyauth/pywarp>`_.
+  relying party IDs (application origin/domain names), U2F adds protection against phishing attacks. One implementation
+  of FIDO U2F/WebAuthn is PyOTP's sister project, `PyWARP <https://github.com/pyauth/pywarp>`_.
 
 We also recommend that implementers read the
-`OWASP Authentication Cheat Sheet <https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md>`_ and
+`OWASP Authentication Cheat Sheet
+<https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md>`_ and
 `NIST SP 800-63-3: Digital Authentication Guideline <https://pages.nist.gov/800-63-3/>`_ for a high level overview of
 authentication best practices.
 
@@ -64,8 +71,10 @@ Quick overview of using One Time Passwords on your phone
 
 * OTPs involve a shared secret, stored both on the phone and the server
 * OTPs can be generated on a phone without internet connectivity
-* OTPs should always be used as a second factor of authentication (if your phone is lost, you account is still secured with a password)
-* Google Authenticator and other OTP client apps allow you to store multiple OTP secrets and provision those using a QR Code
+* OTPs should always be used as a second factor of authentication (if your phone is lost, you account is still secured
+  with a password)
+* Google Authenticator and other OTP client apps allow you to store multiple OTP secrets and provision those using a QR
+  Code
 
 Installation
 ------------
@@ -80,6 +89,9 @@ Time-based OTPs
 ~~~~~~~~~~~~~~~
 ::
 
+    import pyotp
+    import time
+
     totp = pyotp.TOTP('base32secret3232')
     totp.now() # => '492039'
 
@@ -92,6 +104,8 @@ Counter-based OTPs
 ~~~~~~~~~~~~~~~~~~
 ::
 
+    import pyotp
+    
     hotp = pyotp.HOTP('base32secret3232')
     hotp.at(0) # => '260182'
     hotp.at(1) # => '055283'
@@ -103,7 +117,8 @@ Counter-based OTPs
 
 Generating a Secret Key
 ~~~~~~~~~~~~~~~~~~~~~~~
-A helper function is provided to generate a 32-character base32 secret, compatible with Google Authenticator and other OTP apps::
+A helper function is provided to generate a 32-character base32 secret, compatible with Google Authenticator and other
+OTP apps::
 
     pyotp.random_base32()
 
@@ -114,8 +129,8 @@ Some applications want the secret key to be formatted as a hex-encoded string::
 Google Authenticator Compatible
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-PyOTP works with the Google Authenticator iPhone and Android app, as well as other OTP apps like Authy. PyOTP includes the
-ability to generate provisioning URIs for use with the QR Code scanner built into these MFA client apps::
+PyOTP works with the Google Authenticator iPhone and Android app, as well as other OTP apps like Authy. PyOTP includes
+the ability to generate provisioning URIs for use with the QR Code scanner built into these MFA client apps::
 
     pyotp.totp.TOTP('JBSWY3DPEHPK3PXP').provisioning_uri(name='alice@google.com', issuer_name='Secure App')
 
@@ -125,8 +140,8 @@ ability to generate provisioning URIs for use with the QR Code scanner built int
 
     >>> 'otpauth://hotp/Secure%20App:alice%40google.com?secret=JBSWY3DPEHPK3PXP&issuer=Secure%20App&counter=0'
 
-This URL can then be rendered as a QR Code (for example, using https://github.com/soldair/node-qrcode) which can then be scanned
-and added to the users list of OTP credentials.
+This URL can then be rendered as a QR Code (for example, using https://github.com/soldair/node-qrcode) which can then be
+scanned and added to the users list of OTP credentials.
 
 Parsing these URLs is also supported::
 
@@ -151,6 +166,13 @@ Now run the following and compare the output::
     totp = pyotp.TOTP("JBSWY3DPEHPK3PXP")
     print("Current OTP:", totp.now())
 
+Third-party contributions
+~~~~~~~~~~~~~~~~~~~~~~~~~
+The following third-party contributions are not described by a standard, not officially supported, and provided for
+reference only:
+
+* ``pyotp.contrib.Steam()``: An implementation of Steam TOTP. Uses the same API as `pyotp.TOTP()`.
+
 Links
 ~~~~~
 
@@ -170,6 +192,13 @@ For new applications:
 * `WebAuthn <https://www.w3.org/TR/webauthn/>`_
 * `PyWARP <https://github.com/pyauth/pywarp>`_
 
+Versioning
+~~~~~~~~~~
+This package follows the `Semantic Versioning 2.0.0 <http://semver.org/>`_ standard. To control changes, it is
+recommended that application developers pin the package version and manage it using `pip-tools
+<https://github.com/jazzband/pip-tools>`_ or similar. For library developers, pinning the major version is
+recommended.
+
 .. image:: https://github.com/pyauth/pyotp/workflows/Python%20package/badge.svg
         :target: https://github.com/pyauth/pyotp/actions
 .. image:: https://img.shields.io/codecov/c/github/pyauth/pyotp/master.svg

{pyotp-2.7.0 → pyotp-2.9.0}/src/pyotp.egg-info/SOURCES.txt

@@ -2,7 +2,6 @@ LICENSE
 MANIFEST.in
 README.rst
 pyproject.toml
-setup.cfg
 setup.py
 test.py
 src/pyotp/__init__.py
@@ -16,6 +15,7 @@ src/pyotp.egg-info/PKG-INFO
 src/pyotp.egg-info/SOURCES.txt
 src/pyotp.egg-info/dependency_links.txt
 src/pyotp.egg-info/not-zip-safe
+src/pyotp.egg-info/requires.txt
 src/pyotp.egg-info/top_level.txt
 src/pyotp/contrib/__init__.py
 src/pyotp/contrib/steam.py

pyotp-2.9.0/src/pyotp.egg-info/requires.txt

@@ -0,0 +1,6 @@
+
+[test]
+coverage
+wheel
+ruff
+mypy

{pyotp-2.7.0 → pyotp-2.9.0}/test.py

@@ -364,6 +364,13 @@ class ParseUriTest(unittest.TestCase):
         with self.assertRaises(ValueError) as cm:
             pyotp.parse_uri("otpauth://totp?algorithm=aes")
         self.assertEqual("Invalid value for algorithm, must be SHA1, SHA256 or SHA512", str(cm.exception))
+    
+    def test_parse_steam(self):
+        otp = pyotp.parse_uri("otpauth://totp/Steam:?secret=SOME_SECRET&encoder=steam")
+        self.assertEqual(type(otp), pyotp.contrib.Steam)
+
+        otp = pyotp.parse_uri("otpauth://totp/Steam:?secret=SOME_SECRET")
+        self.assertNotEqual(type(otp), pyotp.contrib.Steam)
 
     @unittest.skipIf(sys.version_info < (3, 6), "Skipping test that requires deterministic dict key enumeration")
     def test_algorithms(self):
@@ -420,6 +427,20 @@ class ParseUriTest(unittest.TestCase):
         otp = pyotp.parse_uri(otp.provisioning_uri(name="n", issuer_name="i", image="https://test.net/test.png"))
         self.assertEqual(hashlib.sha512, otp.digest)
 
+        otp = pyotp.parse_uri("otpauth://totp/Steam:?secret=FMXNK4QEGKVPULRTADY6JIDK5VHUBGZW&encoder=steam")
+        self.assertEqual(type(otp), pyotp.contrib.Steam)
+        self.assertEqual(otp.at(0), "C5V56")
+        self.assertEqual(otp.at(30), "QJY8Y")
+        self.assertEqual(otp.at(60), "R3WQY")
+        self.assertEqual(otp.at(90), "JG3T3")
+
+        # period and digits should be ignored
+        otp = pyotp.parse_uri("otpauth://totp/Steam:?secret=FMXNK4QEGKVPULRTADY6JIDK5VHUBGZW&period=15&digits=7&encoder=steam")
+        self.assertEqual(type(otp), pyotp.contrib.Steam)
+        self.assertEqual(otp.at(0), "C5V56")
+        self.assertEqual(otp.at(30), "QJY8Y")
+        self.assertEqual(otp.at(60), "R3WQY")
+        self.assertEqual(otp.at(90), "JG3T3")
 
 class Timecop(object):
     """

pyotp-2.7.0/setup.cfg

@@ -1,8 +0,0 @@
-[flake8]
-max-line-length = 120
-extend-ignore = E203
-
-[egg_info]
-tag_build = 
-tag_date = 0
-