cronometer-api-mcp 0.2.2__tar.gz → 0.2.3__tar.gz

cronometer_api_mcp-0.2.3/.env.example

@@ -0,0 +1,6 @@
+CRONOMETER_USERNAME=
+CRONOMETER_PASSWORD=
+# Only for accounts with two-factor authentication: the base32 key shown at 2FA setup
+CRONOMETER_TOTP_SECRET=
+# Optional IANA timezone override, for example America/Los_Angeles
+CRONOMETER_ACCOUNT_TZ=

{cronometer_api_mcp-0.2.2 → cronometer_api_mcp-0.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: cronometer-api-mcp
-Version: 0.2.2
+Version: 0.2.3
 Summary: MCP server for Cronometer nutrition data using the mobile REST API
 Author: Randy
 License-Expression: MIT
@@ -59,6 +59,20 @@ export CRONOMETER_USERNAME="your@email.com"
 export CRONOMETER_PASSWORD="your-password"
 ```
 
+#### Optional: two-factor authentication
+
+If the account has two-factor authentication enabled, `/api/v2/login`
+answers `TOTP_CODE_REQUIRED` unless the request carries the current 6-digit
+code. Give the server the base32 key that Cronometer showed when 2FA was set
+up (the same key you scanned into your authenticator app) and it derives the
+code itself at every login (RFC 6238, SHA-1, 30 s period):
+
+```bash
+export CRONOMETER_TOTP_SECRET="ABCD EFGH IJKL MNOP QRST UVWX YZ23 4567"
+```
+
+Spaces and lowercase are fine. Leave it unset for accounts without 2FA.
+
 #### Optional: override the account timezone
 
 Diary entries are stamped in your Cronometer account's timezone, which the
@@ -88,7 +102,9 @@ cached session, so it also overrides a stale cached timezone.
       "command": ["uvx", "cronometer-api-mcp"],
       "environment": {
         "CRONOMETER_USERNAME": "{env:CRONOMETER_USERNAME}",
-        "CRONOMETER_PASSWORD": "{env:CRONOMETER_PASSWORD}"
+        "CRONOMETER_PASSWORD": "{env:CRONOMETER_PASSWORD}",
+        "CRONOMETER_TOTP_SECRET": "{env:CRONOMETER_TOTP_SECRET}",
+        "CRONOMETER_ACCOUNT_TZ": "{env:CRONOMETER_ACCOUNT_TZ}"
       },
       "enabled": true
     }
@@ -106,7 +122,9 @@ cached session, so it also overrides a stale cached timezone.
       "args": ["cronometer-api-mcp"],
       "env": {
         "CRONOMETER_USERNAME": "your@email.com",
-        "CRONOMETER_PASSWORD": "your-password"
+        "CRONOMETER_PASSWORD": "your-password",
+        "CRONOMETER_TOTP_SECRET": "your-base32-key",
+        "CRONOMETER_ACCOUNT_TZ": "America/Los_Angeles"
       }
     }
   }

{cronometer_api_mcp-0.2.2 → cronometer_api_mcp-0.2.3}/README.md

@@ -39,6 +39,20 @@ export CRONOMETER_USERNAME="your@email.com"
 export CRONOMETER_PASSWORD="your-password"
 ```
 
+#### Optional: two-factor authentication
+
+If the account has two-factor authentication enabled, `/api/v2/login`
+answers `TOTP_CODE_REQUIRED` unless the request carries the current 6-digit
+code. Give the server the base32 key that Cronometer showed when 2FA was set
+up (the same key you scanned into your authenticator app) and it derives the
+code itself at every login (RFC 6238, SHA-1, 30 s period):
+
+```bash
+export CRONOMETER_TOTP_SECRET="ABCD EFGH IJKL MNOP QRST UVWX YZ23 4567"
+```
+
+Spaces and lowercase are fine. Leave it unset for accounts without 2FA.
+
 #### Optional: override the account timezone
 
 Diary entries are stamped in your Cronometer account's timezone, which the
@@ -68,7 +82,9 @@ cached session, so it also overrides a stale cached timezone.
       "command": ["uvx", "cronometer-api-mcp"],
       "environment": {
         "CRONOMETER_USERNAME": "{env:CRONOMETER_USERNAME}",
-        "CRONOMETER_PASSWORD": "{env:CRONOMETER_PASSWORD}"
+        "CRONOMETER_PASSWORD": "{env:CRONOMETER_PASSWORD}",
+        "CRONOMETER_TOTP_SECRET": "{env:CRONOMETER_TOTP_SECRET}",
+        "CRONOMETER_ACCOUNT_TZ": "{env:CRONOMETER_ACCOUNT_TZ}"
       },
       "enabled": true
     }
@@ -86,7 +102,9 @@ cached session, so it also overrides a stale cached timezone.
       "args": ["cronometer-api-mcp"],
       "env": {
         "CRONOMETER_USERNAME": "your@email.com",
-        "CRONOMETER_PASSWORD": "your-password"
+        "CRONOMETER_PASSWORD": "your-password",
+        "CRONOMETER_TOTP_SECRET": "your-base32-key",
+        "CRONOMETER_ACCOUNT_TZ": "America/Los_Angeles"
       }
     }
   }

{cronometer_api_mcp-0.2.2 → cronometer_api_mcp-0.2.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "cronometer-api-mcp"
-version = "0.2.2"
+version = "0.2.3"
 description = "MCP server for Cronometer nutrition data using the mobile REST API"
 readme = "README.md"
 license = "MIT"

{cronometer_api_mcp-0.2.2 → cronometer_api_mcp-0.2.3}/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/rwestergren/cronometer-api-mcp",
     "source": "github"
   },
-  "version": "0.2.2",
+  "version": "0.2.3",
   "packages": [
     {
       "registryType": "pypi",
       "identifier": "cronometer-api-mcp",
-      "version": "0.2.2",
+      "version": "0.2.3",
       "transport": {
         "type": "stdio"
       },
@@ -27,6 +27,18 @@
           "description": "Your Cronometer account password",
           "isRequired": true,
           "isSecret": true
+        },
+        {
+          "name": "CRONOMETER_TOTP_SECRET",
+          "description": "Base32 key for accounts with two-factor authentication",
+          "isRequired": false,
+          "isSecret": true
+        },
+        {
+          "name": "CRONOMETER_ACCOUNT_TZ",
+          "description": "Optional IANA timezone override, for example America/Los_Angeles",
+          "isRequired": false,
+          "isSecret": false
         }
       ]
     }

{cronometer_api_mcp-0.2.2 → cronometer_api_mcp-0.2.3}/src/cronometer_api_mcp/client.py

@@ -9,9 +9,13 @@ Frida-based traffic capture that established the auth flow and initial
 endpoints.
 """
 
+import base64
+import hashlib
+import hmac
 import json
 import logging
 import os
+import struct
 import threading
 import time
 from datetime import date, datetime
@@ -24,9 +28,9 @@ logger = logging.getLogger(__name__)
 
 BASE_URL = "https://mobile.cronometer.com"
 
-# Fallback timezone used only if the account's timezone can't be resolved from
-# the login response. Matches the value historically assumed by this client.
-_DEFAULT_TIMEZONE = "America/New_York"
+# Only when the zone can't be resolved at all. UTC, not a plausible zone to
+# make fallback more obvious
+_FALLBACK_TIMEZONE = "UTC"
 
 # Optional deploy-time override for the account timezone. When set to a valid
 # IANA zone name it is authoritative over both the login response and any
@@ -120,6 +124,23 @@ class CronometerError(Exception):
     """Raised when a Cronometer API call fails."""
 
 
+def _totp_code(secret: str, for_time: float | None = None) -> str:
+    """Current RFC 6238 TOTP code (SHA-1, 30 s period, 6 digits) for `secret`.
+
+    `secret` is the base32 key shown by Cronometer when enabling two-factor
+    authentication; authenticator apps display it grouped and sometimes
+    lowercased, so whitespace and case are normalized before decoding.
+    """
+    normalized = "".join(secret.split()).upper()
+    normalized += "=" * (-len(normalized) % 8)
+    key = base64.b32decode(normalized)
+    counter = int((time.time() if for_time is None else for_time) // 30)
+    digest = hmac.new(key, struct.pack(">Q", counter), hashlib.sha1).digest()
+    offset = digest[-1] & 0x0F
+    code = int.from_bytes(digest[offset : offset + 4], "big") & 0x7FFFFFFF
+    return f"{code % 1_000_000:06d}"
+
+
 class CronometerClient:
     """Stateful client for the Cronometer mobile API.
 
@@ -185,10 +206,13 @@ class CronometerClient:
             return
         token = data.get("token")
         user_id = data.get("user_id")
-        timezone = data.get("timezone")
-        # Reject caches that lack a stored timezone (pre-timezone schema) so we
-        # re-login once and pick up the account zone rather than guessing.
-        if not isinstance(timezone, str):
+        # Missing key is the pre-timezone schema: re-login to learn the zone.
+        # Explicit null means the account has none, so honour the cache instead
+        # of re-logging in every start against a rate-limited endpoint.
+        if "timezone" not in data:
+            return
+        timezone = data["timezone"]
+        if timezone is not None and not isinstance(timezone, str):
             return
         if isinstance(token, str) and isinstance(user_id, int):
             self._user_id = user_id
@@ -251,6 +275,11 @@ class CronometerClient:
             )
         return username, password
 
+    @staticmethod
+    def _totp_user_code() -> str | None:
+        secret = os.getenv("CRONOMETER_TOTP_SECRET")
+        return _totp_code(secret) if secret else None
+
     def login(self) -> None:
         """Authenticate with Cronometer and cache the session token.
 
@@ -271,7 +300,9 @@ class CronometerClient:
             # leaves the account setting untouched and the response echoes the
             # account's real zone.
             "timezone": None,
-            "userCode": None,
+            # 6-digit TOTP code for accounts with two-factor authentication,
+            # derived from CRONOMETER_TOTP_SECRET; null when 2FA is not in use.
+            "userCode": self._totp_user_code(),
             "build": "4.48.2 b2807-a",
             "device": "Android 14 (SDK 34), Google Pixel 6 Pro",
             "firebaseToken": "",
@@ -295,6 +326,12 @@ class CronometerClient:
             data = resp.json()
 
             if data.get("result") != "SUCCESS" and "sessionKey" not in data:
+                if data.get("error") == "TOTP_CODE_REQUIRED":
+                    raise CronometerError(
+                        "Login failed: the account has two-factor authentication "
+                        "enabled; set CRONOMETER_TOTP_SECRET to the base32 key "
+                        "shown when 2FA was set up"
+                    )
                 raise CronometerError(f"Login failed: {data}")
 
             self._user_id = data["id"]
@@ -463,38 +500,52 @@ class CronometerClient:
             return None
         return name
 
-    def _resolve_timezone(self, response_tz: str | None) -> str:
-        """Resolve the account timezone by priority.
+    def _resolve_timezone(self, response_tz: str | None) -> str | None:
+        """Env override, else the login response. None when neither is usable.
 
-        1. CRONOMETER_ACCOUNT_TZ env override (authoritative escape hatch).
-        2. The value from the login response (trustworthy now that login()
-           no longer overwrites the account's server-side zone; see #29).
-        3. The historical default.
+        Validates the response: storing an unknown name defers the failure to
+        ``_tzinfo``, where it is no longer attributable to Cronometer.
         """
         env = self._env_timezone()
         if env:
             return env
         if isinstance(response_tz, str) and response_tz:
-            return response_tz
-        return _DEFAULT_TIMEZONE
+            try:
+                ZoneInfo(response_tz)
+                return response_tz
+            except ZoneInfoNotFoundError, ValueError:
+                logger.warning(
+                    "Cronometer reported unknown timezone %r; ignoring", response_tz
+                )
+        return None
 
     def _tzinfo(self) -> ZoneInfo:
-        """Return the account's timezone, falling back to the default.
+        """The account's zone, logging in if that's the only way to learn it.
 
-        Resolved from the login response (or restored session cache). If the
-        stored name is unset or unknown (e.g. a zone missing from the system
-        tzdata), log once and fall back so stamping never hard-fails.
+        Every consumer funnels through here, so this is where the zone has to
+        be guaranteed resolved: callers used to read the clock pre-auth and get
+        the fallback, correcting only once something else triggered login.
+
+        Env override first, so an injected zone needs no network.
         """
-        name = self._timezone or _DEFAULT_TIMEZONE
+        name = self._env_timezone()
+        if not name:
+            self._ensure_auth()
+            name = self._timezone
+        if not name:
+            logger.warning(
+                "No account timezone available; stamping in %s", _FALLBACK_TIMEZONE
+            )
+            return ZoneInfo(_FALLBACK_TIMEZONE)
         try:
             return ZoneInfo(name)
         except ZoneInfoNotFoundError, ValueError:
             logger.warning(
-                "Unknown account timezone %r; falling back to %s",
+                "Unknown account timezone %r; stamping in %s",
                 name,
-                _DEFAULT_TIMEZONE,
+                _FALLBACK_TIMEZONE,
             )
-            return ZoneInfo(_DEFAULT_TIMEZONE)
+            return ZoneInfo(_FALLBACK_TIMEZONE)
 
     def now(self) -> datetime:
         """Current wall-clock time in the account's timezone (aware)."""

{cronometer_api_mcp-0.2.2 → cronometer_api_mcp-0.2.3}/tests/test_timezone.py

@@ -14,7 +14,7 @@ from zoneinfo import ZoneInfo
 
 import pytest
 
-from cronometer_api_mcp.client import CronometerClient
+from cronometer_api_mcp.client import _FALLBACK_TIMEZONE, CronometerClient
 
 
 class FakeResp:
@@ -306,4 +306,179 @@ def test_pre_timezone_cache_is_rejected(tmp_path, monkeypatch):
 def test_unknown_timezone_falls_back(tmp_path):
     """An unresolvable zone name falls back rather than raising."""
     client = _client(tmp_path, "Not/AZone")
-    assert client._tzinfo() == ZoneInfo("America/New_York")
+    assert client._tzinfo() == ZoneInfo(_FALLBACK_TIMEZONE)
+
+
+# ---- cold start: the clock must not be read before the zone is known -------
+#
+# Regression: callers read the clock pre-auth, so the first entry in a fresh
+# container stamped in the fallback zone and later ones were correct -- which
+# read as intermittent drift.
+
+
+def _cold_client(
+    tmp_path: Path, response_tz: str | None
+) -> tuple[CronometerClient, dict]:
+    """An unauthenticated client plus a captured-payload dict.
+
+    Stubs login and add_serving on one fake. Nothing pre-seeds ``_timezone`` --
+    that is the condition under test.
+    """
+    client = CronometerClient(session_path=tmp_path / "session.json")
+    captured: dict = {"logins": 0}
+
+    def fake_post(endpoint, json=None):
+        if endpoint == "/api/v2/login":
+            captured["logins"] += 1
+            body = {"result": "SUCCESS", "id": 123, "sessionKey": "TOKEN"}
+            if response_tz is not None:
+                body["timezone"] = response_tz
+            return FakeResp(body)
+        captured["endpoint"] = endpoint
+        captured["payload"] = json
+        return FakeResp({"result": "SUCCESS", "id": 999})
+
+    client._http.post = fake_post  # type: ignore[method-assign]
+    return client, captured
+
+
+def test_first_add_serving_in_a_cold_client_stamps_in_account_zone(
+    tmp_path, frozen_utc, monkeypatch
+):
+    """The prod regression: 18:01 UTC is 11:01 PDT, not 14:01 Eastern."""
+    monkeypatch.setenv("CRONOMETER_USERNAME", "u@example.com")
+    monkeypatch.setenv("CRONOMETER_PASSWORD", "pw")
+    monkeypatch.delenv("CRONOMETER_ACCOUNT_TZ", raising=False)
+    client, captured = _cold_client(tmp_path, "America/Los_Angeles")
+
+    assert client._timezone is None  # nothing resolved yet
+    client.add_serving(food_id=1, measure_id=0, grams=100.0)
+
+    serving = captured["payload"]["serving"]
+    assert serving["time"] == "11:1:30"
+    assert serving["day"] == "2026-7-27"
+    # Lunch; Eastern would have made it Dinner.
+    assert serving["order"] == (2 << 16) | 1
+
+
+def test_cold_client_day_bucketing_uses_account_zone(tmp_path, monkeypatch):
+    """A late-evening PDT entry must not slip a day, as a fallback zone would."""
+    monkeypatch.setenv("CRONOMETER_USERNAME", "u@example.com")
+    monkeypatch.setenv("CRONOMETER_PASSWORD", "pw")
+    monkeypatch.delenv("CRONOMETER_ACCOUNT_TZ", raising=False)
+
+    class LateEvening(_dt.datetime):
+        # 05:30 UTC on the 28th == 22:30 PDT on the 27th.
+        _fixed_utc = _dt.datetime(2026, 7, 28, 5, 30, 0, tzinfo=_dt.UTC)
+
+        @classmethod
+        def now(cls, tz=None):
+            if tz is None:
+                return cls._fixed_utc.replace(tzinfo=None)
+            return cls._fixed_utc.astimezone(tz)
+
+    monkeypatch.setattr("cronometer_api_mcp.client.datetime", LateEvening)
+    client, captured = _cold_client(tmp_path, "America/Los_Angeles")
+
+    client.add_serving(food_id=1, measure_id=0, grams=100.0)
+
+    assert captured["payload"]["serving"]["day"] == "2026-7-27"
+
+
+def test_env_override_needs_no_login_to_stamp(tmp_path, frozen_utc, monkeypatch):
+    """An injected zone leaves nothing to learn, so no login -- which is what
+    makes a cold container correct on its first entry."""
+    monkeypatch.setenv("CRONOMETER_ACCOUNT_TZ", "America/Los_Angeles")
+    client, captured = _cold_client(tmp_path, "America/New_York")
+
+    assert client._tzinfo() == ZoneInfo("America/Los_Angeles")
+    assert captured["logins"] == 0
+
+
+def test_tzinfo_authenticates_when_zone_is_unknown(tmp_path, frozen_utc, monkeypatch):
+    """Without an override the login response is the only source."""
+    monkeypatch.setenv("CRONOMETER_USERNAME", "u@example.com")
+    monkeypatch.setenv("CRONOMETER_PASSWORD", "pw")
+    monkeypatch.delenv("CRONOMETER_ACCOUNT_TZ", raising=False)
+    client, captured = _cold_client(tmp_path, "America/Los_Angeles")
+
+    assert client._tzinfo() == ZoneInfo("America/Los_Angeles")
+    assert captured["logins"] == 1
+
+
+def test_cold_today_uses_account_zone(tmp_path, frozen_utc, monkeypatch):
+    """today() defaults a date for many tools, so it must resolve too."""
+    monkeypatch.setenv("CRONOMETER_USERNAME", "u@example.com")
+    monkeypatch.setenv("CRONOMETER_PASSWORD", "pw")
+    monkeypatch.delenv("CRONOMETER_ACCOUNT_TZ", raising=False)
+    client, _ = _cold_client(tmp_path, "America/Los_Angeles")
+
+    assert client.today() == _dt.date(2026, 7, 27)
+
+
+# ---- fallback must not look plausible -------------------------------------
+
+
+def test_missing_response_zone_falls_back_to_utc(tmp_path, frozen_utc, monkeypatch):
+    """No reported zone -> UTC. Eastern was a silent 3h lie for a PDT user."""
+    monkeypatch.setenv("CRONOMETER_USERNAME", "u@example.com")
+    monkeypatch.setenv("CRONOMETER_PASSWORD", "pw")
+    monkeypatch.delenv("CRONOMETER_ACCOUNT_TZ", raising=False)
+    client, _ = _cold_client(tmp_path, None)
+
+    assert client._tzinfo() == ZoneInfo("UTC")
+
+
+def test_unresolvable_response_zone_is_rejected_at_the_boundary(
+    tmp_path, frozen_utc, monkeypatch
+):
+    """Rejected where it's still attributable to Cronometer."""
+    monkeypatch.setenv("CRONOMETER_USERNAME", "u@example.com")
+    monkeypatch.setenv("CRONOMETER_PASSWORD", "pw")
+    monkeypatch.delenv("CRONOMETER_ACCOUNT_TZ", raising=False)
+    client, _ = _cold_client(tmp_path, "Mars/Olympus_Mons")
+
+    client.login()
+    assert client._timezone is None
+    assert client._tzinfo() == ZoneInfo("UTC")
+
+
+def test_unknown_stored_zone_falls_back_to_utc(tmp_path):
+    """A zone this tzdata build can't construct is our problem, not theirs."""
+    client = _client(tmp_path, "Not/AZone")
+    assert client._tzinfo() == ZoneInfo("UTC")
+
+
+# ---- session cache must not thrash logins for zoneless accounts ------------
+
+
+def test_cache_with_null_timezone_is_reused(tmp_path, monkeypatch):
+    """None is now a legitimate resolved value, persisted as null. Treating it
+    like the legacy schema would re-login on every container start."""
+    import json
+
+    monkeypatch.setenv("CRONOMETER_USERNAME", "")
+    monkeypatch.delenv("CRONOMETER_ACCOUNT_TZ", raising=False)
+    (tmp_path / "session.json").write_text(
+        json.dumps({"username": "", "user_id": 123, "token": "TOKEN", "timezone": None})
+    )
+
+    client = CronometerClient(session_path=tmp_path / "session.json")
+
+    assert client._token == "TOKEN"
+    assert client._timezone is None
+    assert client._tzinfo() == ZoneInfo(_FALLBACK_TIMEZONE)
+
+
+def test_cache_predating_timezone_support_is_still_rejected(tmp_path, monkeypatch):
+    """No timezone key is the legacy schema: re-login to learn the zone."""
+    import json
+
+    monkeypatch.setenv("CRONOMETER_USERNAME", "")
+    (tmp_path / "session.json").write_text(
+        json.dumps({"username": "", "user_id": 123, "token": "TOKEN"})
+    )
+
+    client = CronometerClient(session_path=tmp_path / "session.json")
+
+    assert client._token is None

cronometer_api_mcp-0.2.3/tests/test_totp.py

@@ -0,0 +1,107 @@
+"""Tests for optional TOTP (two-factor) support at login.
+
+Accounts with two-factor authentication enabled get `{"result": "FAIL",
+"error": "TOTP_CODE_REQUIRED"}` from /api/v2/login unless the request carries
+the current 6-digit code in `userCode`. When CRONOMETER_TOTP_SECRET is set the
+client derives that code itself (RFC 6238, SHA-1, 30 s period, 6 digits).
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from cronometer_api_mcp.client import CronometerClient, CronometerError, _totp_code
+
+# RFC 6238 Appendix B test vectors (SHA-1). The secret is the ASCII string
+# "12345678901234567890"; the 6-digit codes are the last six digits of the
+# 8-digit values listed in the RFC.
+RFC6238_SECRET_B32 = "GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ"
+RFC6238_VECTORS = [
+    (59, "287082"),
+    (1111111109, "081804"),
+    (1234567890, "005924"),
+    (2000000000, "279037"),
+]
+
+SUCCESS_BODY = {
+    "result": "SUCCESS",
+    "id": 123,
+    "sessionKey": "TOKEN",
+    "timezone": "UTC",
+}
+TOTP_REQUIRED_BODY = {"result": "FAIL", "error": "TOTP_CODE_REQUIRED"}
+
+
+class FakeResp:
+    def __init__(self, body) -> None:
+        self._body = body
+        self.status_code = 200
+
+    def raise_for_status(self) -> None:  # pragma: no cover - trivial
+        pass
+
+    def json(self):
+        return self._body
+
+
+def make_client(tmp_path: Path, body: dict):
+    """Client whose login POST is captured and answered with `body`."""
+    client = CronometerClient(session_path=tmp_path / "session.json")
+    captured: dict = {}
+
+    def fake_post(endpoint, json=None):
+        captured["endpoint"] = endpoint
+        captured["payload"] = json
+        return FakeResp(body)
+
+    client._http.post = fake_post  # type: ignore[method-assign]
+    return client, captured
+
+
+@pytest.fixture
+def credentials(monkeypatch):
+    monkeypatch.setenv("CRONOMETER_USERNAME", "user@example.com")
+    monkeypatch.setenv("CRONOMETER_PASSWORD", "secret")
+    monkeypatch.delenv("CRONOMETER_TOTP_SECRET", raising=False)
+
+
+@pytest.mark.parametrize(("at", "expected"), RFC6238_VECTORS)
+def test_totp_code_matches_rfc6238_sha1_vectors(at, expected):
+    assert _totp_code(RFC6238_SECRET_B32, at) == expected
+
+
+def test_totp_code_accepts_lowercase_and_spaced_secret():
+    """Authenticator apps display the key grouped and sometimes lowercased."""
+    spaced = "gezd gnbv gy3t qojq gezd gnbv gy3t qojq"
+    assert _totp_code(spaced, 59) == "287082"
+
+
+def test_login_sends_null_user_code_without_secret(credentials, tmp_path):
+    client, captured = make_client(tmp_path, SUCCESS_BODY)
+
+    client.login()
+
+    assert captured["endpoint"] == "/api/v2/login"
+    assert captured["payload"]["userCode"] is None
+
+
+def test_login_sends_current_totp_code_when_secret_set(
+    credentials, tmp_path, monkeypatch
+):
+    monkeypatch.setenv("CRONOMETER_TOTP_SECRET", RFC6238_SECRET_B32)
+    client, captured = make_client(tmp_path, SUCCESS_BODY)
+
+    client.login()
+
+    code = captured["payload"]["userCode"]
+    assert isinstance(code, str) and len(code) == 6 and code.isdigit()
+    assert code == _totp_code(RFC6238_SECRET_B32)
+
+
+def test_login_totp_required_without_secret_points_at_env_var(credentials, tmp_path):
+    client, _ = make_client(tmp_path, TOTP_REQUIRED_BODY)
+
+    with pytest.raises(CronometerError, match="CRONOMETER_TOTP_SECRET"):
+        client.login()

{cronometer_api_mcp-0.2.2 → cronometer_api_mcp-0.2.3}/uv.lock

@@ -554,27 +554,27 @@ wheels = [
 
 [[package]]
 name = "ruff"
-version = "0.16.4"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/00/8f/d8074b1f25e003164087a8bfe79a0f1a3945135764dbb6aaab04103dcaf9/ruff-0.16.4.tar.gz", hash = "sha256:13171aa9d9af2240ee3504e639de73122c67e74036de5ba2e1d01422cd17e3dc", size = 4899731, upload-time = "2026-08-20T17:43:59.196Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/ff/80/779895ef584e089d22f2c6df0d0e99a65ec2df0805f1fffd439415b8c1f0/ruff-0.16.4-py3-none-linux_armv6l.whl", hash = "sha256:df4075f71ddac40b9934af60c3ec8a53047dd5a5fdc43224e6e4e8e9a27cb6f7", size = 10006909, upload-time = "2026-08-20T17:43:16.888Z" },
-    { url = "https://files.pythonhosted.org/packages/a9/e6/f553199b5e8927a05cb5c422d921fd0656b29ab976e91c44802107c6b0da/ruff-0.16.4-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:0c95538517af68004306b0fb3214ff2f2af67a65092aee77cd9eb86db6656604", size = 10240201, upload-time = "2026-08-20T17:43:19.337Z" },
-    { url = "https://files.pythonhosted.org/packages/1c/70/4a6dc4bb34da4dee35e30f09bbd1bfbdd26f33b62fb9b8df31f08a199cd2/ruff-0.16.4-py3-none-macosx_11_0_arm64.whl", hash = "sha256:963f83df8e69e575b64d67dd447ebbc917db41a14bf38d4593a4183e7aaa8255", size = 9835122, upload-time = "2026-08-20T17:43:21.708Z" },
-    { url = "https://files.pythonhosted.org/packages/24/12/c6e22d686372c15bcb7af99831f1a1be96df696491babf4f24e4f942c527/ruff-0.16.4-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:32a5057c7ff3f6e6480a48fccfb3a412a690f48a3d03ac5cf08177d6c2da3ade", size = 9977162, upload-time = "2026-08-20T17:43:24.236Z" },
-    { url = "https://files.pythonhosted.org/packages/46/49/72b10ec912f5ab5854992eaf7aa7cd36729b6937d9dc4e0fb41b3bf428ec/ruff-0.16.4-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:b3dce8d9b0c57c265b91885a66a567d8ea1372e8eb4e250fa8e5e3f579e99cff", size = 9829789, upload-time = "2026-08-20T17:43:26.966Z" },
-    { url = "https://files.pythonhosted.org/packages/fa/80/0f30e32e7f6ee26edc39075502db9d368d788a44a79b55f763eb4ab03796/ruff-0.16.4-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:7dc651db49283c69f8e72c834eec4fe5573e4c646856aebece0ce385dceb2a80", size = 10527949, upload-time = "2026-08-20T17:43:29.384Z" },
-    { url = "https://files.pythonhosted.org/packages/52/3d/86e8ad3542169e56cac3859a343afdb9df2ad54d35a59ce1e67baee83421/ruff-0.16.4-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:3817b87dbcabc92f13b05019257c5b89b5b4d51b5fb20f56fb5235ceb723cd07", size = 11333695, upload-time = "2026-08-20T17:43:31.872Z" },
-    { url = "https://files.pythonhosted.org/packages/d0/16/481c29b380c20a0054a8261066665e1b3488e23636c49d0a43e75975b9bb/ruff-0.16.4-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:e9fce1499134b2c8c68e5166f95705a5812062bb93aacc5f9873bb1a27084bc7", size = 10727741, upload-time = "2026-08-20T17:43:34.596Z" },
-    { url = "https://files.pythonhosted.org/packages/5e/b6/56bc0b8cf45b54b28b3a5e6381c8945d51b5b18adf659454c32295209a31/ruff-0.16.4-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:f2d812e482f5a7e02eee26cd73d2a37ebbdf47d795ea63ba1b89110ae93e9fb3", size = 10286522, upload-time = "2026-08-20T17:43:37.288Z" },
-    { url = "https://files.pythonhosted.org/packages/e8/8b/b345b4fb110f2fbe2bd31eabd271e5e8b3b7e4ee6c0e02f2dc6be78db000/ruff-0.16.4-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:6baaf984aa7976edf93d3b627fe2d1d22ee94bbca05fa6f90fc76d73924e3454", size = 10584182, upload-time = "2026-08-20T17:43:39.984Z" },
-    { url = "https://files.pythonhosted.org/packages/29/e5/827b34041c35f58774a9681a4213994c164fc987800f4dddabcf451da0bf/ruff-0.16.4-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:bdfcf0b28662eb890372d50f92c283bb94e67e7635ed93c7fd533970acff7b2b", size = 10134195, upload-time = "2026-08-20T17:43:42.351Z" },
-    { url = "https://files.pythonhosted.org/packages/0f/10/d0bffcdd6729b87afc82ba0ef377173356a7dc8e972f5179968cf2fdf98c/ruff-0.16.4-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:b66b02cb9b04f537643cadf5768e5f98dc461890d530cb67113d71c8c76e605d", size = 9825821, upload-time = "2026-08-20T17:43:44.532Z" },
-    { url = "https://files.pythonhosted.org/packages/f5/32/0db2a863b796ca62d83e92a07a3ccf00921b14db02059347576a2fda3d4b/ruff-0.16.4-py3-none-musllinux_1_2_i686.whl", hash = "sha256:8528bf9a4b291a60bf02ea453511e8ce6215bd2b982ee80405b66b008b6c30a0", size = 10267658, upload-time = "2026-08-20T17:43:46.989Z" },
-    { url = "https://files.pythonhosted.org/packages/b2/a0/fbdeb59e48c6261f523e56c8f12e9c08fbe693786595cc7e3959207a9232/ruff-0.16.4-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:fbd85d2875fdd67e833213a651f613bbf25303abf6aa822a5121f4531195678d", size = 10697071, upload-time = "2026-08-20T17:43:49.891Z" },
-    { url = "https://files.pythonhosted.org/packages/aa/28/0c6dd865859c6d17bc8ccc34cb72b0e02d6c7eb25e8a1e22b5bea681e2c0/ruff-0.16.4-py3-none-win32.whl", hash = "sha256:312769988007aaeb8e189b443ccdd03c0e6374489e053467be6d96518ebff76e", size = 10021687, upload-time = "2026-08-20T17:43:52.281Z" },
-    { url = "https://files.pythonhosted.org/packages/a3/03/e724450f621698117f9aa6dd241c94d0274ae96781378dc86745ae29f0e7/ruff-0.16.4-py3-none-win_amd64.whl", hash = "sha256:05d9d27a18c4bcbefada602480ec9e01e0bc949d432e0ced5df77edac195919c", size = 10567657, upload-time = "2026-08-20T17:43:54.78Z" },
-    { url = "https://files.pythonhosted.org/packages/0e/fe/da8b9e1347696bb22120b77280ec5ce25d500ca5cb39d5ad6e5c18de19c1/ruff-0.16.4-py3-none-win_arm64.whl", hash = "sha256:a3a61621c9b6f6a89573e938a080e648f1695baa3f58570a3a707bc51ff65a21", size = 10451579, upload-time = "2026-08-20T17:43:57.135Z" },
+version = "0.16.6"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/a4/7c/6adb35d70e7c027e308274557901c7e00fb3407750faf3620c184ae058cb/ruff-0.16.6.tar.gz", hash = "sha256:dcf8a73d2ff77e99dde91244b4da16feba7f14e6beeb4015dee7c5a909e99050", size = 4921251, upload-time = "2026-09-03T16:57:29.037Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/a4/28/9cc1b79639e284ec103f43c88c644db4eb58cbd0ea1ca11f1193435369ac/ruff-0.16.6-py3-none-linux_armv6l.whl", hash = "sha256:61c368c26bf8e973e5ab14a2772de587bc068ea3f9a277f673380749b4898fb8", size = 10015638, upload-time = "2026-09-03T16:56:40.986Z" },
+    { url = "https://files.pythonhosted.org/packages/71/11/627d342ef727ea7794edf74fe23d60a074b02c3acc2e9436684e782286ca/ruff-0.16.6-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:ecf4f068e2e123e43a26e9db4e19524cc56563912404e83bbfca375757e45a32", size = 10220762, upload-time = "2026-09-03T16:56:44.681Z" },
+    { url = "https://files.pythonhosted.org/packages/43/d9/b75668ce41e4c8d073d18d6d08672ba6906ce45d5c06ea4fdb2e84ce3853/ruff-0.16.6-py3-none-macosx_11_0_arm64.whl", hash = "sha256:99b62ea33baf130f50368798d841f0d95527b6d817bf31817b65dd058f1d314c", size = 9835082, upload-time = "2026-09-03T16:56:47.142Z" },
+    { url = "https://files.pythonhosted.org/packages/99/97/123ab10b05cde889c107c20f5a9774955104b5552796a2a8584b089ae8eb/ruff-0.16.6-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:7fbf89013f2bb3f6835a6038ff658dc8a1b38c98dc8e724b964168ad4e881876", size = 9949304, upload-time = "2026-09-03T16:56:49.813Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/58/a4a2c59dd2e5b85929c912d9cac3056eb9ee8c7e75e9b9fe3e109174966b/ruff-0.16.6-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:56a67065e22efa6bc4d498299d3bb06c0c90aace8fac2068b5a12f9dc4d8d51d", size = 9840612, upload-time = "2026-09-03T16:56:52.368Z" },
+    { url = "https://files.pythonhosted.org/packages/61/6a/ff8c8626a786c4f49d48ced4a752dadbca65f5263005f9c2416578194694/ruff-0.16.6-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:e25cc89174874b176a157e4428d66761c2c0c006654419bf384f967f361ff1b1", size = 10543465, upload-time = "2026-09-03T16:56:55.089Z" },
+    { url = "https://files.pythonhosted.org/packages/ad/bb/c47535923365f337b82e28192e4e9eef2176511007cfd99a62fc22df5dad/ruff-0.16.6-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:0700580ed5303723cb3c11c2f1d2a8913ce77b7ea86646dddb887f5417a9ba70", size = 11267576, upload-time = "2026-09-03T16:56:57.791Z" },
+    { url = "https://files.pythonhosted.org/packages/ba/50/e5119a5212b5cd63b51e1f4b25e7bd636a6668fc069a3160b108ad7e3c16/ruff-0.16.6-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:15f1d0b6e165a6e56567befb6629f8209271311d990bae0f37e6d065035ef5f3", size = 10781993, upload-time = "2026-09-03T16:57:00.666Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/98/083d8b4ef3c51a0d19db84367791cbe9f44e4b53343d19dfa83556e1cd9a/ruff-0.16.6-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:d72c591a96986ee4268860e2b7235082129ca5e4cb9cbba653a4b57c11893757", size = 10317748, upload-time = "2026-09-03T16:57:03.428Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/29/68f7ff2c5ad95f19f00627ac2de95644e25fe47371ea60b2db1fd952315e/ruff-0.16.6-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:65a006baa18f33324325814c864daef03541d51564b98c517610ea756ab7003e", size = 10540096, upload-time = "2026-09-03T16:57:06.182Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/f9/79a8f6de85968641d68a7863aeec577551924ef066a990a48ff93167beab/ruff-0.16.6-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:cd02a7bf1a21a8735228a3e8c95a9dc5cf86bd2a52194f4aaae2a5755b4de0f4", size = 10100494, upload-time = "2026-09-03T16:57:09.194Z" },
+    { url = "https://files.pythonhosted.org/packages/d9/e8/b81a22d9b90c00b892ccf2fa2ac36fa95de4c13ab85aea3e73795cfe4651/ruff-0.16.6-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:31b36f1e5ad85e0737f09d2be4e512e2e283583c14015da3b9dc07359ac0fc88", size = 9843663, upload-time = "2026-09-03T16:57:12.168Z" },
+    { url = "https://files.pythonhosted.org/packages/39/aa/54f516ec5e5a11c4afdceb1c454ebb054ffb96e4f4a1705580b4346abd35/ruff-0.16.6-py3-none-musllinux_1_2_i686.whl", hash = "sha256:61029b4ab4aa723fd3064fab96b1d814492596bf0c792679fffcbde1e1679953", size = 10282461, upload-time = "2026-09-03T16:57:15.077Z" },
+    { url = "https://files.pythonhosted.org/packages/52/0b/38d0aa8aa32372b96dc44f97b22e576c4147808271aab7b2cb1e353d4445/ruff-0.16.6-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:9ac8998457832c2061709d900856b7ad271dace0cb41f346588d540162bfa718", size = 10728808, upload-time = "2026-09-03T16:57:17.797Z" },
+    { url = "https://files.pythonhosted.org/packages/5e/e5/9e274e24eeb027640ffc7442f21239f16d17f47acec15ae34f32e03a5c79/ruff-0.16.6-py3-none-win32.whl", hash = "sha256:0b87d9d16fcb63e8018423ca1d50b7260f15cb2da33e30db4baad4183a948c25", size = 10049212, upload-time = "2026-09-03T16:57:20.55Z" },
+    { url = "https://files.pythonhosted.org/packages/22/31/72472449414223ed1a2da236b992adbb1a2ae59e34794574810f60ce068e/ruff-0.16.6-py3-none-win_amd64.whl", hash = "sha256:10d21c51c3495d8eaea7b703a16592117ea6eb1d649e36335aa965ff1173eb39", size = 10556402, upload-time = "2026-09-03T16:57:23.501Z" },
+    { url = "https://files.pythonhosted.org/packages/fc/07/d781f8f8e1ac24bef9f3269cf62ffb1407ca24c3a8f12e5e22874f90528c/ruff-0.16.6-py3-none-win_arm64.whl", hash = "sha256:7a976c79b958f94e50a022a19f0f8c87387448020935ec14fc74331bd0a7f2c5", size = 10412850, upload-time = "2026-09-03T16:57:26.416Z" },
 ]
 
 [[package]]

cronometer_api_mcp-0.2.2/.env.example

@@ -1,2 +0,0 @@
-CRONOMETER_USERNAME=
-CRONOMETER_PASSWORD=