django-pfx 1.4.dev46__tar.gz → 1.4.dev48__tar.gz

{django_pfx-1.4.dev46 → django_pfx-1.4.dev48}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: django-pfx
-Version: 1.4.dev46
+Version: 1.4.dev48
 Summary: Django PFX is a toolkit designed to streamline the development of RESTful APIs using the Django framework.
 Author: Hervé Martinet
 Author-email: herve.martinet@gmail.com

{django_pfx-1.4.dev46 → django_pfx-1.4.dev48}/django_pfx.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: django-pfx
-Version: 1.4.dev46
+Version: 1.4.dev48
 Summary: Django PFX is a toolkit designed to streamline the development of RESTful APIs using the Django framework.
 Author: Hervé Martinet
 Author-email: herve.martinet@gmail.com

{django_pfx-1.4.dev46 → django_pfx-1.4.dev48}/pfx/pfxcore/default_settings.py

@@ -2,6 +2,7 @@ PFX_TOKEN_SHORT_VALIDITY = {'hours': 12}
 PFX_TOKEN_LONG_VALIDITY = {'days': 30}
 PFX_TOKEN_OTP_VALIDITY = {'minutes': 15}
 PFX_HOTP_CODE_VALIDITY = 15
+PFX_OTP_VALID_WINDOW = 1
 PFX_OTP_IMAGE = None
 
 PFX_COOKIE_DOMAIN = None

{django_pfx-1.4.dev46 → django_pfx-1.4.dev48}/pfx/pfxcore/models/otp_user_mixin.py

@@ -87,7 +87,8 @@ class OtpUserMixin(models.Model):
         """
         import pyotp
         totp = pyotp.parse_uri(self.get_otp_setup_uri(tmp=tmp))
-        valid = totp.verify(otp_code)
+        valid = totp.verify(
+            otp_code, valid_window=settings.PFX_OTP_VALID_WINDOW)
         if not valid and timezone.now() <= self.hotp_expiry:
             hotp = pyotp.hotp.HOTP(
                 tmp and self.otp_secret_token_tmp or

{django_pfx-1.4.dev46 → django_pfx-1.4.dev48}/tests/tests/test_auth_api.py

@@ -8,6 +8,7 @@ from django.conf import settings
 from django.contrib.auth.tokens import default_token_generator
 from django.core import mail
 from django.test import TransactionTestCase, modify_settings, override_settings
+from django.utils import timezone
 from django.utils.encoding import force_bytes
 from django.utils.http import urlsafe_base64_encode
 
@@ -1088,6 +1089,51 @@ class AuthAPITest(TestAssertMixin, TransactionTestCase):
                 datetime.fromtimestamp(decoded['exp']),
                 datetime(2023, 5, 2, 8, 10))
 
+    @override_settings(
+        PFX_OTP_VALID_WINDOW=0,
+        PFX_TOKEN_SHORT_VALIDITY={'minutes': 30})
+    def test_otp_login_valid_window_0(self):
+        totp = self.enable_otp(self.user1)
+
+        with freeze_time("2023-05-01 08:00:00"):
+            response = self.client.post('/api/auth/login', dict(
+                username='jrr.tolkien',
+                password='RIGHT PASSWORD'))
+            self.assertRC(response, 200)
+            token = self.get_val(response, 'token')
+
+            response = self.client.post('/api/auth/otp/login', dict(
+                token=token, otp_code=totp.at(
+                    timezone.now() - timedelta(seconds=1))))
+            self.assertRC(response, 422)
+
+            response = self.client.post('/api/auth/otp/login', dict(
+                token=token, otp_code=totp.at(timezone.now())))
+            self.assertRC(response, 200)
+
+    @override_settings(
+        PFX_OTP_VALID_WINDOW=1,
+        PFX_TOKEN_SHORT_VALIDITY={'minutes': 30})
+    def test_otp_login_valid_window_1(self):
+        totp = self.enable_otp(self.user1)
+
+        with freeze_time("2023-05-01 08:00:00"):
+            response = self.client.post('/api/auth/login', dict(
+                username='jrr.tolkien',
+                password='RIGHT PASSWORD'))
+            self.assertRC(response, 200)
+            token = self.get_val(response, 'token')
+
+            response = self.client.post('/api/auth/otp/login', dict(
+                token=token, otp_code=totp.at(
+                    timezone.now() - timedelta(seconds=31))))
+            self.assertRC(response, 422)
+
+            response = self.client.post('/api/auth/otp/login', dict(
+                token=token, otp_code=totp.at(
+                    timezone.now() - timedelta(seconds=30))))
+            self.assertRC(response, 200)
+
     @override_settings(
         PFX_TOKEN_SHORT_VALIDITY={'minutes': 30},
         PFX_LOGIN_BAN_FAILED_NUMBER=2,