django-pfx 1.4.dev48__tar.gz → 1.4.dev50__tar.gz

{django_pfx-1.4.dev48 → django_pfx-1.4.dev50}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: django-pfx
-Version: 1.4.dev48
+Version: 1.4.dev50
 Summary: Django PFX is a toolkit designed to streamline the development of RESTful APIs using the Django framework.
 Author: Hervé Martinet
 Author-email: herve.martinet@gmail.com

{django_pfx-1.4.dev48 → django_pfx-1.4.dev50}/django_pfx.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: django-pfx
-Version: 1.4.dev48
+Version: 1.4.dev50
 Summary: Django PFX is a toolkit designed to streamline the development of RESTful APIs using the Django framework.
 Author: Hervé Martinet
 Author-email: herve.martinet@gmail.com

{django_pfx-1.4.dev48 → django_pfx-1.4.dev50}/doc/source/authentication.md

@@ -97,6 +97,10 @@ class MyUser(OtpUserMixin, AbstractPFXBaseUser):
 * `PFX_TOKEN_OTP_VALIDITY`: Validity for OTP tokens (corresponds to the maximum time to enter
   an OTP code after logging in with a password) (optional, default `{'minutes': 15}`)
 * `PFX_HOTP_CODE_VALIDITY`: Validity of HOTP codes in minutes (used to send code by email) (optional, default `15`).
+* `PFX_OTP_VALID_WINDOW`: TOTP valid window (optional, default `1`).
+  According to [RFC 6238 section 5.2](https://www.ietf.org/rfc/rfc6238.html#section-5.2).
+* `PFX_OTP_IMAGE`: An image https URL used by FreeOTP. See [FreeOTP URI](https://github.com/npmccallum/freeotp-android/blob/master/URI.md).
+* `PFX_OTP_COLOR`: A brand color (in RRGGBB format) for used by FreeOTP. See [FreeOTP URI](https://github.com/npmccallum/freeotp-android/blob/master/URI.md).
 
 The user can then enable or disable the OTP auth using the [services documented below](#enable-mfa-otp).
 

{django_pfx-1.4.dev48 → django_pfx-1.4.dev50}/pfx/pfxcore/default_settings.py

@@ -4,6 +4,7 @@ PFX_TOKEN_OTP_VALIDITY = {'minutes': 15}
 PFX_HOTP_CODE_VALIDITY = 15
 PFX_OTP_VALID_WINDOW = 1
 PFX_OTP_IMAGE = None
+PFX_OTP_COLOR = None
 
 PFX_COOKIE_DOMAIN = None
 PFX_COOKIE_SECURE = True

{django_pfx-1.4.dev48 → django_pfx-1.4.dev50}/pfx/pfxcore/models/otp_user_mixin.py

@@ -65,7 +65,7 @@ class OtpUserMixin(models.Model):
         self.otp_secret_token = None
         self.save(update_fields=['otp_secret_token'])
 
-    def get_otp_setup_uri(self, tmp=False):
+    def get_otp_setup_uri(self, tmp=False, with_color=True):
         """Return the setup URL for OTP activation.
         """
         import pyotp
@@ -73,9 +73,14 @@ class OtpUserMixin(models.Model):
             name=self.get_username(), issuer_name=settings.PFX_SITE_NAME)
         if settings.PFX_OTP_IMAGE:
             args['image'] = settings.PFX_OTP_IMAGE
-        return pyotp.totp.TOTP(
+        uri = pyotp.totp.TOTP(
             tmp and self.otp_secret_token_tmp or
             self.otp_secret_token).provisioning_uri(**args)
+        if with_color and settings.PFX_OTP_COLOR:
+            # TODO: Can be put in provisioning_uri args if
+            # https://github.com/pyauth/pyotp/pull/164 is merge and published.
+            uri = f"{uri}&color={settings.PFX_OTP_COLOR}"
+        return uri
 
     def is_otp_valid(self, otp_code, tmp=False):
         """Verify an OTP code.
@@ -86,7 +91,11 @@ class OtpUserMixin(models.Model):
         :returns: `True` if the code is valid, `False` otherwise.
         """
         import pyotp
-        totp = pyotp.parse_uri(self.get_otp_setup_uri(tmp=tmp))
+
+        # TODO : The with_color paramter can be removed if
+        # https://github.com/pyauth/pyotp/pull/164 is merge and published.
+        totp = pyotp.parse_uri(
+            self.get_otp_setup_uri(tmp=tmp, with_color=False))
         valid = totp.verify(
             otp_code, valid_window=settings.PFX_OTP_VALID_WINDOW)
         if not valid and timezone.now() <= self.hotp_expiry:

{django_pfx-1.4.dev48 → django_pfx-1.4.dev50}/tests/tests/test_auth_api.py

@@ -895,7 +895,9 @@ class AuthAPITest(TestAssertMixin, TransactionTestCase):
         self.assertRC(response, 200)
         self.client.token = self.get_val(response, 'token')
 
-    @override_settings(PFX_OTP_IMAGE="https://example.org/fake.png")
+    @override_settings(
+        PFX_OTP_IMAGE="https://example.org/fake.png",
+        PFX_OTP_COLOR="FF0000")
     def test_otp_enable(self):
         self.client.login(username='jrr.tolkien', password='RIGHT PASSWORD')
 
@@ -905,6 +907,7 @@ class AuthAPITest(TestAssertMixin, TransactionTestCase):
         self.assertJIn(response, 'setup_uri', "otpauth://totp/")
         self.assertJIn(response, 'setup_uri', "Books%20Demo:jrr.tolkien")
         self.assertJIn(response, 'setup_uri', "issuer=Books%20Demo")
+        self.assertJIn(response, 'setup_uri', "color=FF0000")
         self.assertJIn(
             response, 'setup_uri',
             "image=https%3A%2F%2Fexample.org%2Ffake.png")