django-pfx 1.7.6.dev29__tar.gz → 1.7.6.dev33__tar.gz

{django_pfx-1.7.6.dev29 → django_pfx-1.7.6.dev33}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: django-pfx
-Version: 1.7.6.dev29
+Version: 1.7.6.dev33
 Summary: Django PFX is a toolkit designed to streamline the development of RESTful APIs using the Django framework.
 Author: Hervé Martinet
 Author-email: herve.martinet@gmail.com

{django_pfx-1.7.6.dev29 → django_pfx-1.7.6.dev33}/django_pfx.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: django-pfx
-Version: 1.7.6.dev29
+Version: 1.7.6.dev33
 Summary: Django PFX is a toolkit designed to streamline the development of RESTful APIs using the Django framework.
 Author: Hervé Martinet
 Author-email: herve.martinet@gmail.com

django_pfx-1.7.6.dev33/django_pfx.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "1.7.5",
+  "distance": 33,
+  "node": "gcc4ff94bcc60ebba66f3ffe5034d8ffcdd15cdde",
+  "dirty": false,
+  "branch": "HEAD",
+  "node_date": "2026-10-14"
+}

{django_pfx-1.7.6.dev29 → django_pfx-1.7.6.dev33}/doc/source/authentication.md

@@ -188,6 +188,7 @@ removed.
 * `PFX_TOKEN_OTP_VALIDITY`: Validity for OTP tokens (corresponds to the maximum time to enter
   an OTP code after logging in with a password) (optional, default `{'minutes': 15}`)
 * `PFX_HOTP_CODE_VALIDITY`: Validity of HOTP codes in minutes (used to send code by email or SMS) (optional, default `15`).
+  A code is accepted only once: a new one must be requested for the next verification.
 * `PFX_OTP_VALID_WINDOW`: TOTP valid window (optional, default `1`).
   According to [RFC 6238 section 5.2](https://www.ietf.org/rfc/rfc6238.html#section-5.2).
 * `PFX_OTP_IMAGE`: An image https URL used by FreeOTP. See [FreeOTP URI](https://github.com/npmccallum/freeotp-android/blob/master/URI.md).

{django_pfx-1.7.6.dev29 → django_pfx-1.7.6.dev33}/pfx/emails/shortcuts.py

@@ -1,4 +1,5 @@
 import logging
+import mimetypes
 from pathlib import Path
 
 from django.conf import settings
@@ -105,7 +106,9 @@ def send_email_message(
 
     if attachments:
         for att in attachments:
-            if {'key', 'name', 'content-type'} <= att.file.keys():
+            if (isinstance(getattr(att, 'file', None), dict) and
+                    {'key', 'name', 'content-type'} <= att.file.keys()):
+                # Is a JSON (equivalent to MediaField)
                 fp = Path(settings.STORAGE_LOCAL_ROOT, att.file['key'])
                 if attachment_file_name and callable(attachment_file_name):
                     name = attachment_file_name(att)
@@ -118,9 +121,20 @@ def send_email_message(
                 except Exception as e:
                     logger.error(
                         "Error attaching file %s: %s", fp, str(e), exc_info=e)
+            elif isinstance(att, (tuple, list)):
+                # Is a tuple name, content, (mimetype)
+                if len(att) < 2:
+                    logger.error(
+                        "Tuple attachment must have min 2 values : %s values",
+                        len(att))
+                name, content, *rest = att
+                mimetype = rest[0] if rest else mimetypes.guess_type(name)[0]
+                email.attach(
+                    name, content, mimetype or 'application/octet-stream')
             else:
                 logger.error(
-                    "Attachment pk=%s missing required file keys: %s",
-                    att.pk, att.file.keys())
+                    "Attachment is invalid (must be a "
+                    "JSON MediaField or a tuple): %s",
+                    repr(att)[:100])
 
     email.send()

{django_pfx-1.7.6.dev29 → django_pfx-1.7.6.dev33}/pfx/pfxcore/models/mfa_device.py

@@ -66,11 +66,25 @@ class MFADevice(models.Model):
         return pyotp.hotp.HOTP(self.secret).at(self.hotp_count)
 
     def verify_hotp(self, otp_code):
-        """Verify a HOTP code against this device's counter and expiry."""
+        """Verify a HOTP code against this device's counter and expiry.
+
+        A valid code is consumed: the counter moves on, as RFC 4226
+        requires, so the same code is refused afterwards."""
         import pyotp
         if not otp_code or timezone.now() > self.hotp_expiry:
             return False
-        return pyotp.hotp.HOTP(self.secret).verify(otp_code, self.hotp_count)
+        if not pyotp.hotp.HOTP(self.secret).verify(
+                otp_code, self.hotp_count):
+            return False
+        # Conditional update: of two requests with the same code, only one
+        # gets it.
+        consumed = MFADevice.objects.filter(
+            pk=self.pk, hotp_count=self.hotp_count).update(
+                hotp_count=models.F('hotp_count') + 1)
+        if not consumed:
+            return False
+        self.hotp_count += 1
+        return True
 
     # --- TOTP (authenticator) ---
 

{django_pfx-1.7.6.dev29 → django_pfx-1.7.6.dev33}/tests/tests/test_emails_send_email_message.py

@@ -52,6 +52,29 @@ class TestEmailsSendEmailMessage(TestAssertMixin, TestCase):
         self.assertEqual(mail.outbox[0].attachments, [
             ('test.txt', 'A test file content.', 'text/plain')])
 
+    def test_send_email_message_in_memory_attachment(self):
+        att = "test.txt", b"A test file content.", "text/plain"
+
+        send_email_message(
+            'test@example.org', 'base_template',
+            data={'subject': "Test message"}, attachments=[att])
+
+        # Test first message
+        m = mail.outbox[0]
+        self.assertEqual(m.subject, "Test message")
+        self.assertEqual(m.to[0], 'test@example.org')
+        txt_msg = m.body
+        html_msg = m.alternatives[0][0]
+        self.assertIn(
+            '<img src="http://example.org/logo.png" alt="PFX"', html_msg)
+        self.assertIn(
+            'PFX, a DJango rest framework<br />', html_msg)
+        self.assertIn(
+            'PFX, a DJango rest framework', txt_msg)
+
+        self.assertEqual(mail.outbox[0].attachments, [
+            ('test.txt', 'A test file content.', 'text/plain')])
+
     def test_send_email_message_to_formats(self):
 
         send_email_message(

{django_pfx-1.7.6.dev29 → django_pfx-1.7.6.dev33}/tests/tests/test_mfa_login_api.py

@@ -386,6 +386,38 @@ class MFALoginTest(MFATestMixin, TestAssertMixin, TransactionTestCase):
         self.assertRC(response, 200)
         self.assertJE(response, 'user.mfa_setup_required', True)
 
+    @override_settings(PFX_MFA_BACKENDS=[SMS])
+    def test_otp_login_code_is_single_use(self):
+        """The code that logged the user in is spent.
+
+        It used to stay valid until it expired or a new one was sent: seen
+        once (over a shoulder, on a locked screen), it could log in again
+        or, from the open session, authorise a sensitive operation."""
+        self.add_device('sms', confirmed=True, target='+33612345678')
+        with patch(SMS_BACKEND):
+            response = self.do_login()
+        self.assertRC(response, 200)
+        otp_token = self.get_val(response, 'token')
+        otp_code = pyotp_hotp(self.get_device('sms'))
+
+        response = self.client.post('/api/auth/otp/login', dict(
+            token=otp_token, otp_code=otp_code, mfa_backend='sms'))
+        self.assertRC(response, 200)
+        session_token = self.get_val(response, 'token')
+
+        response = self.client.post('/api/auth/otp/login', dict(
+            token=otp_token, otp_code=otp_code, mfa_backend='sms'))
+        self.assertRC(response, 422)
+        self.assertJE(response, 'otp_code.@0', "Invalid code")
+
+        self.client.token = session_token
+        response = self.client.put(
+            '/api/auth/mfa/sms/disable',
+            {'otp_code': otp_code, 'mfa_backend': 'sms'})
+        self.assertRC(response, 422)
+        self.assertJE(response, 'otp_code.@0', "Invalid code")
+        self.assertTrue(self.get_device('sms').confirmed)
+
     # --- /auth/mfa/challenge endpoint ---
 
     def _get_otp_token(self):

django_pfx-1.7.6.dev29/django_pfx.egg-info/scm_version.json

@@ -1,8 +0,0 @@
-{
-  "tag": "1.7.5",
-  "distance": 29,
-  "node": "g3ac4d4252191bd4277a75095572cb9f46018b71f",
-  "dirty": false,
-  "branch": "HEAD",
-  "node_date": "2026-10-05"
-}