buntu 0.1.0__tar.gz → 0.2.0__tar.gz

{buntu-0.1.0/src/buntu.egg-info → buntu-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: buntu
-Version: 0.1.0
+Version: 0.2.0
 Summary: OAuth 2.1 and OpenID Connect provider
 Author: Ibrahima Touré
 License-Expression: MIT

{buntu-0.1.0 → buntu-0.2.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "buntu"
-version = "0.1.0"
+version = "0.2.0"
 description = "OAuth 2.1 and OpenID Connect provider"
 readme = "README.md"
 license = "MIT"

{buntu-0.1.0 → buntu-0.2.0/src/buntu.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: buntu
-Version: 0.1.0
+Version: 0.2.0
 Summary: OAuth 2.1 and OpenID Connect provider
 Author: Ibrahima Touré
 License-Expression: MIT

{buntu-0.1.0 → buntu-0.2.0}/tests/test_account_attacks.py

@@ -7,7 +7,7 @@ from typing import Any
 
 from flask import Flask
 from flask.testing import FlaskClient
-from test_mfa import enable, password_step
+from test_mfa import enable, password_step, wrong_code
 
 from idp.security import totp
 from idp.services import mail
@@ -34,7 +34,7 @@ def test_replaying_an_old_cookie_does_not_reset_the_two_step_limit(
     cookie = other.get_cookie(COOKIE)
     assert cookie is not None
     for _ in range(8):
-        api(_with_cookie(app, cookie.value), "POST", "/api/mfa/verify", {"code": "000000"}, csrf)
+        api(_with_cookie(app, cookie.value), "POST", "/api/mfa/verify", {"code": wrong_code(secret)}, csrf)
     good = totp.code_at(secret, totp.current_step() + 1)  # the setup used the current step
     last = api(_with_cookie(app, cookie.value), "POST", "/api/mfa/verify", {"code": good}, csrf)
     assert last.status_code == 400 and last.json["error"] == "too_many_attempts", last.json
@@ -47,7 +47,7 @@ def test_the_two_step_limit_also_holds_across_fresh_password_steps(
     for _ in range(2):
         other, csrf, _ = password_step(app)
         for _ in range(5):
-            api(other, "POST", "/api/mfa/verify", {"code": "000000"}, csrf)
+            api(other, "POST", "/api/mfa/verify", {"code": wrong_code(secret)}, csrf)
     other, csrf, _ = password_step(app)
     good = totp.code_at(secret, totp.current_step() + 1)
     late = api(other, "POST", "/api/mfa/verify", {"code": good}, csrf)
@@ -67,7 +67,7 @@ def test_the_account_owner_gets_in_again_after_the_pause(
     secret, _ = enable(browser, sign_up(browser, outbox))
     other, csrf, _ = password_step(app)
     for _ in range(5):
-        api(other, "POST", "/api/mfa/verify", {"code": "000000"}, csrf)
+        api(other, "POST", "/api/mfa/verify", {"code": wrong_code(secret)}, csrf)
     with app.app_context():
         db().execute(update(User).values(second_factor_failed_at=utcnow() - timedelta(minutes=16)))
         db().commit()

{buntu-0.1.0 → buntu-0.2.0}/tests/test_mfa.py

@@ -31,14 +31,18 @@ def test_a_code_works_once_and_only_inside_the_window() -> None:
     assert totp.matching_step(secret, old, None, now) is None
 
 
+def wrong_code(secret: str) -> str:
+    """A code no step around now produces, so a refusal never depends on chance or the clock."""
+    here = totp.current_step()
+    taken = {totp.code_at(secret, step) for step in range(here - 2, here + 3)}
+    return next(c for c in ("000000", "111111", "222222", "333333", "444444", "555555") if c not in taken)
+
+
 def enable(browser: FlaskClient, csrf: str) -> tuple[str, list[str]]:
     setup = api(browser, "POST", "/api/mfa/totp", {}, csrf).json
     assert setup["qr"].startswith("data:image/svg+xml") and setup["uri"].startswith("otpauth://totp/")
-    wrong = api(browser, "POST", "/api/mfa/totp/confirm", {"code": "000000"}, csrf)
-    assert (
-        wrong.json == {"error": "invalid_code"}
-        or totp.code_at(setup["secret"], totp.current_step()) == "000000"
-    )
+    wrong = api(browser, "POST", "/api/mfa/totp/confirm", {"code": wrong_code(setup["secret"])}, csrf)
+    assert wrong.json == {"error": "invalid_code"}
     code = totp.code_at(setup["secret"], totp.current_step())
     done = api(browser, "POST", "/api/mfa/totp/confirm", {"code": code}, csrf)
     assert done.status_code == 200, done.json
@@ -99,7 +103,7 @@ def test_five_wrong_codes_start_over(app: Flask, browser: FlaskClient, outbox: l
 def test_disabling_needs_a_code(app: Flask, browser: FlaskClient, outbox: list[mail.Message]) -> None:
     csrf = sign_up(browser, outbox)
     secret, _ = enable(browser, csrf)
-    assert api(browser, "POST", "/api/mfa/disable", {"code": "000001"}, csrf).status_code == 400
+    assert api(browser, "POST", "/api/mfa/disable", {"code": wrong_code(secret)}, csrf).status_code == 400
     code = totp.code_at(secret, totp.current_step() + 1)
     assert api(browser, "POST", "/api/mfa/disable", {"code": code}, csrf).json == {"enabled": False}
     _, _, reply = password_step(app)