quart-security 2.0.0__tar.gz → 2.0.2__tar.gz

{quart_security-2.0.0 → quart_security-2.0.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: quart-security
-Version: 2.0.0
+Version: 2.0.2
 Summary: Native async auth for Quart
 Author: quart-security maintainers
 Requires-Python: >=3.11
@@ -19,7 +19,7 @@ Requires-Dist: aiosmtplib>=5.1.2
 Requires-Dist: blinker>=1.7
 Requires-Dist: email-validator>=2.0
 Requires-Dist: argon2-cffi>=23.1
-Requires-Dist: httpx>=0.27
+Requires-Dist: httpx2>=2.16
 Requires-Dist: pytest>=8.0 ; extra == "dev"
 Requires-Dist: pytest-asyncio>=0.23 ; extra == "dev"
 Requires-Dist: ruff>=0.6 ; extra == "dev"
@@ -358,3 +358,10 @@ Dependencies now include the Pillow, bcrypt, and SQLAlchemy asyncio extras and p
 minimum versions of aiosmtplib, cryptography, and cbor2. The release workflow runs
 lint and tests before building and publishing. CI tests Python 3.11 through 3.14.
 
+
+## TOTP encryption and key rotation
+
+Version 2.0.1 encrypts enrolled TOTP seeds and pending setup secrets with authenticated Fernet encryption. Legacy plaintext seeds remain readable and are encrypted on successful login or an authenticated request. Hosts should encrypt dormant records during upgrade using `encrypt_totp_secret(value, app=app)`. This requires no schema change for a 255-character seed column.
+
+By default, the key is derived from `SECRET_KEY` with a separate purpose label. Keep that key stable. For independent rotation, configure `SECURITY_TOTP_ENCRYPTION_KEYS` as a nonempty list of Fernet keys. The first key encrypts new data; all keys can decrypt existing data. Retain old keys while rotating existing seeds with `encrypt_totp_secret`, including active pending setup states until their five-minute expiry. Remove old keys only after all data and required backups have been handled. Never rotate `SECRET_KEY` without preserving the derived MFA key if using the default. `derive_totp_encryption_key(old_secret_key)` supplies that key for an explicit keyring. Protect the keyring separately from database backups.
+

{quart_security-2.0.0 → quart_security-2.0.2}/README.md

@@ -327,3 +327,10 @@ or SQLAlchemy model fields.
 Dependencies now include the Pillow, bcrypt, and SQLAlchemy asyncio extras and patched
 minimum versions of aiosmtplib, cryptography, and cbor2. The release workflow runs
 lint and tests before building and publishing. CI tests Python 3.11 through 3.14.
+
+
+## TOTP encryption and key rotation
+
+Version 2.0.1 encrypts enrolled TOTP seeds and pending setup secrets with authenticated Fernet encryption. Legacy plaintext seeds remain readable and are encrypted on successful login or an authenticated request. Hosts should encrypt dormant records during upgrade using `encrypt_totp_secret(value, app=app)`. This requires no schema change for a 255-character seed column.
+
+By default, the key is derived from `SECRET_KEY` with a separate purpose label. Keep that key stable. For independent rotation, configure `SECURITY_TOTP_ENCRYPTION_KEYS` as a nonempty list of Fernet keys. The first key encrypts new data; all keys can decrypt existing data. Retain old keys while rotating existing seeds with `encrypt_totp_secret`, including active pending setup states until their five-minute expiry. Remove old keys only after all data and required backups have been handled. Never rotate `SECRET_KEY` without preserving the derived MFA key if using the default. `derive_totp_encryption_key(old_secret_key)` supplies that key for an explicit keyring. Protect the keyring separately from database backups.

{quart_security-2.0.0 → quart_security-2.0.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "flit_core.buildapi"
 
 [project]
 name = "quart-security"
-version = "2.0.0"
+version = "2.0.2"
 description = "Native async auth for Quart"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -26,7 +26,7 @@ dependencies = [
   "blinker>=1.7",
   "email-validator>=2.0",
   "argon2-cffi>=23.1",
-  "httpx>=0.27",
+  "httpx2>=2.16",
 ]
 
 [project.optional-dependencies]
@@ -49,7 +49,6 @@ dev = [
   "aiosqlite>=0.20",
   "pytest>=8.0",
   "pytest-asyncio>=0.23",
-  "respx>=0.23.1",
   "ruff>=0.6",
 ]
 

{quart_security-2.0.0 → quart_security-2.0.2}/quart_security/breach.py

@@ -5,7 +5,7 @@ from __future__ import annotations
 import hashlib
 import logging
 
-import httpx
+import httpx2
 
 logger = logging.getLogger(__name__)
 
@@ -32,7 +32,7 @@ async def password_is_breached(password: str, *, count_min: int = 1) -> bool | N
     prefix, suffix = sha1[:5], sha1[5:]
 
     try:
-        async with httpx.AsyncClient(timeout=_TIMEOUT) as client:
+        async with httpx2.AsyncClient(timeout=_TIMEOUT) as client:
             response = await client.get(
                 _HIBP_URL.format(prefix=prefix),
                 headers={"Add-Padding": "true"},

{quart_security-2.0.0 → quart_security-2.0.2}/quart_security/core.py

@@ -14,6 +14,7 @@ from .password import init_password_context
 from .proxies import AnonymousUser, current_user
 from .signals import user_authenticated, user_logged_out
 from .state import SQLAlchemyStateStore
+from .totp import encrypt_totp_secret, init_totp_encryption
 from .utils import maybe_await, naive_utcnow, url_for_security
 
 
@@ -119,6 +120,7 @@ class Security:
             app.config.get("SESSION_COOKIE_SAMESITE") or "Lax"
         )
         init_password_context(app)
+        init_totp_encryption(app)
 
         from .views import security_bp
 
@@ -228,6 +230,11 @@ class Security:
             session.clear()
             g._current_user = AnonymousUser()
             return
+        if getattr(user, "tf_totp_secret", None) and not user.tf_totp_secret.startswith(
+            "fernet$"
+        ):
+            user.tf_totp_secret = encrypt_totp_secret(user.tf_totp_secret)
+            await maybe_await(self.datastore.commit())
         g._current_user = user
 
     async def login_user(self, user, fresh=True):
@@ -248,6 +255,10 @@ class Security:
             user.current_login_ip = request.remote_addr
             user.login_count = (getattr(user, "login_count", None) or 0) + 1
 
+        if getattr(user, "tf_totp_secret", None) and not user.tf_totp_secret.startswith(
+            "fernet$"
+        ):
+            user.tf_totp_secret = encrypt_totp_secret(user.tf_totp_secret)
         await maybe_await(self.datastore.commit())
         token = await self.state_store.put(
             {"user_id": user_id},

{quart_security-2.0.0 → quart_security-2.0.2}/quart_security/totp.py

@@ -9,6 +9,53 @@ import io
 import secrets
 import time
 
+_TOTP_CIPHER_PREFIX = "fernet$"
+
+
+def derive_totp_encryption_key(secret_key):
+    if isinstance(secret_key, str):
+        secret_key = secret_key.encode()
+    if not secret_key:
+        raise RuntimeError("TOTP encryption requires SECRET_KEY")
+    return base64.urlsafe_b64encode(
+        hmac.digest(secret_key, b"quart-security/totp-encryption/v1", "sha256")
+    )
+
+
+def init_totp_encryption(app):
+    from cryptography.fernet import Fernet, MultiFernet
+
+    keys = app.config.get("SECURITY_TOTP_ENCRYPTION_KEYS")
+    if keys is None:
+        keys = [derive_totp_encryption_key(app.secret_key)]
+    if not isinstance(keys, (list, tuple)) or not keys:
+        raise ValueError("SECURITY_TOTP_ENCRYPTION_KEYS must be a nonempty key list")
+    app.extensions["quart_security_totp"] = MultiFernet([Fernet(key) for key in keys])
+
+
+def _totp_cipher(app=None):
+    from quart import current_app
+
+    return (app or current_app).extensions["quart_security_totp"]
+
+
+def encrypt_totp_secret(secret, *, app=None):
+    cipher = _totp_cipher(app)
+    if secret.startswith(_TOTP_CIPHER_PREFIX):
+        token = cipher.rotate(secret[len(_TOTP_CIPHER_PREFIX) :].encode())
+    else:
+        token = cipher.encrypt(secret.encode())
+    return _TOTP_CIPHER_PREFIX + token.decode()
+
+
+def decrypt_totp_secret(secret, *, app=None):
+    # Legacy seeds remain readable until the host encrypts existing records.
+    if not secret.startswith(_TOTP_CIPHER_PREFIX):
+        return secret
+    return (
+        _totp_cipher(app).decrypt(secret[len(_TOTP_CIPHER_PREFIX) :].encode()).decode()
+    )
+
 
 def _require_pyotp():
     try:
@@ -24,6 +71,7 @@ def generate_totp_secret() -> str:
 
 
 def get_totp_uri(secret: str, email: str, issuer: str) -> str:
+    secret = decrypt_totp_secret(secret)
     pyotp = _require_pyotp()
     return pyotp.totp.TOTP(secret).provisioning_uri(name=email, issuer_name=issuer)
 
@@ -46,6 +94,7 @@ def verify_totp(secret: str, token: str) -> bool:
 
 
 def matching_totp_step(secret: str, token: str) -> int | None:
+    secret = decrypt_totp_secret(secret)
     pyotp = _require_pyotp()
     totp = pyotp.TOTP(secret)
     step = int(time.time()) // totp.interval

{quart_security-2.0.0 → quart_security-2.0.2}/quart_security/views.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import asyncio
 import datetime
 import hashlib
 import hmac
@@ -165,6 +166,10 @@ def _webauthn_rp_name() -> str:
 
 async def _set_wan_state(key: str, **payload):
     await _pop_wan_state(key)
+    if key == "tf_setup_state":
+        from .totp import encrypt_totp_secret
+
+        payload["secret"] = encrypt_totp_secret(payload["secret"])
     session[key] = await _security.state_store.put(payload, ttl=300)
 
 
@@ -174,10 +179,11 @@ async def _pop_wan_state(key: str) -> dict | None:
 
 
 async def _verify_totp_once(secret, token):
-    from .totp import matching_totp_step
+    from .totp import decrypt_totp_secret, matching_totp_step
 
     if not secret or not token:
         return False
+    secret = decrypt_totp_secret(secret)
     step = matching_totp_step(secret, token)
     if step is None:
         return False
@@ -592,7 +598,9 @@ async def two_factor_setup():
                 and token
                 and await _verify_totp_once(pending_secret, token)
             ):
-                current_user.tf_totp_secret = pending_secret
+                from .totp import encrypt_totp_secret
+
+                current_user.tf_totp_secret = encrypt_totp_secret(pending_secret)
                 current_user.tf_primary_method = "authenticator"
 
                 raw_codes = []
@@ -642,11 +650,13 @@ async def two_factor_setup():
                 "tf_setup_state", secret=pending_secret, user_id=current_user.get_id()
             )
         else:
-            pending_secret = pending["secret"]
+            from .totp import decrypt_totp_secret
+
+            pending_secret = decrypt_totp_secret(pending["secret"])
         authr_key = pending_secret
         issuer = current_app.config.get("SECURITY_TOTP_ISSUER", "Quart")
         uri = get_totp_uri(pending_secret, current_user.email, issuer)
-        authr_qrcode = generate_qr_code(uri)
+        authr_qrcode = await asyncio.to_thread(generate_qr_code, uri)
 
     return await render_template(
         "security/two_factor_setup.html",