Open
Conversation
This adds a boolean option `return_timecode` to TOTP.verify that changes its return value on success to an integer containing the timecode that was used to generate the matching OTP. This is especially useful when `valid_window` is not 0, as then several values might be valid at the same moment. If an implementation compares just the bare OTP, replaying a recent value is possible. By comparing timecodes, that can be prevented, as they are strictly increasing. The patch also fixes a minor typing issue, as the `for_time` argument can also be an number - there even is a test that calls it like this. Finally, the special case for `valid_window == 0` has been removed as it is a micro-optimization that only leads to repeated code.
Tests were already passing -29.5 to `TOTP.at`; note that casting a float to an int in Python just strips off the fractional part (like `floor(3)`). Because TOTP intervals are integers, this means that this rounding off operation does not change which interval the timestamp is in so we can do this safely.
This allows mypy to infer that the called methods actually exist. Note that two self.assertIsInstance got replaced by these; the tests will still fail on type mismatch.
This accidentally worked but the typing police does not like it.
This removes a bunch of test calls against compare_digest which is imported from the standard library, and not exposed to users of this library. Mypy also did not like this.
jap
force-pushed
the
typing-improvements
branch
from
8143db2 to
acd7917
Compare
Member
|
Thanks for the PR! Unfortunately it can't be merged in its current form.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This series of commits brings some typing improvements, but also adds the option to return the timecode that matched when verifying a TOTP, which is a feature in
passlib.totpbut that project appears to no longer be maintained.