update altcha

Author: slashburygin

CODEOWNERS

@@ -2,4 +2,4 @@
 # Each line is a pattern followed by one or more owners
 
 # Default owners for the entire repository
-* @gmelikov @phantomii @akremenetsky @slashburygin
+* @exordos/code_owners

exordos_core/tests/functional/restapi/iam/test_user_creation_security.py

@@ -1,20 +1,31 @@
+#    Copyright 2026 Genesis Corporation.
+#
+#    All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
 import json
-import sys
+import time
 from unittest import mock
 from urllib.parse import urljoin
 
+import altcha
 from gcl_iam.tests.functional import clients as iam_clients
-import pytest
 import requests
 
 from exordos_core.tests.functional.restapi.iam import base
 from exordos_core.user_api.security.dm import models as security_models
 
-pytestmark = pytest.mark.skipif(
-    sys.version_info < (3, 9),
-    reason="altcha 0.2.x in security actions require Python 3.9+",
-)
-
 CREATE_USER_PATH = "iam/users/"
 
 
@@ -154,7 +165,14 @@ def test_create_user_firebase_or_captcha_or_admin_bypass(
 
         # altcha is imported inside action, so patch its global function
         with mock.patch("altcha.verify_solution") as mock_verify_solution:
-            mock_verify_solution.return_value = (True, None)
+            mock_verify_solution.return_value = altcha.VerifySolutionResult(
+                expired=False,
+                invalid_signature=None,
+                invalid_solution=None,
+                time=time.time(),
+                verified=True,
+                error=None,
+            )
             headers = {
                 "Authorization": f"Bearer {admin_token}",
                 "X-Captcha": captcha_payload,

exordos_core/user_api/security/dm/models.py

@@ -214,12 +214,11 @@ def execute(self, context):
             LOG.exception("Failed to parse CAPTCHA payload.")
             return False
 
-        verified, _error = altcha.verify_solution(
+        result = altcha.verify_solution(
             payload,
-            hmac_key=self.hmac_key,
-            check_expires=True,
+            hmac_secret=self.hmac_key,
         )
-        return bool(verified)
+        return result.verified
 
 
 class AdminBypassVerifier(AbstractVerifier):

pyproject.toml

@@ -36,7 +36,7 @@ dependencies = [
     "netaddr>=1.3.0,<2.0.0",  # BSD License (BSD License)
     "cryptography>=45.0.5,<47.0.0",  # BSD-3
     "firebase-admin>=6.0.0,<7.0.0",  # Apache-2.0
-    "altcha>=0.2.0,<0.3.0",  # MIT License
+    "altcha>=0.2.0,<2.1.0",  # MIT License
     "openapi-schema-validator>=0.8.1",  # BSD-3
 ]
 [project.urls]