48 lines
1.7 KiB
Python
48 lines
1.7 KiB
Python
## Copyright © 2026 Olaf Kolkman
|
|
## SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
import base64
|
|
import hashlib
|
|
import hmac
|
|
import secrets
|
|
import time
|
|
from urllib.parse import quote
|
|
|
|
|
|
def create_secret() -> str:
|
|
return base64.b32encode(secrets.token_bytes(20)).decode('ascii').rstrip('=')
|
|
|
|
|
|
def provisioning_uri(secret: str, username: str, issuer: str = 'LinkLog') -> str:
|
|
return f'otpauth://totp/{quote(issuer)}:{quote(username)}?secret={secret}&issuer={quote(issuer)}'
|
|
|
|
|
|
def current_code(secret: str, timestamp: float | None = None) -> str:
|
|
padded_secret = secret + '=' * (-len(secret) % 8)
|
|
key = base64.b32decode(padded_secret, casefold=True)
|
|
counter = int(timestamp if timestamp is not None else time.time()) // 30
|
|
digest = hmac.new(key, counter.to_bytes(8, 'big'), hashlib.sha1).digest()
|
|
index = digest[-1] & 0x0f
|
|
value = (int.from_bytes(digest[index:index + 4], 'big') & 0x7fffffff) % 1_000_000
|
|
return f'{value:06d}'
|
|
|
|
|
|
def verify_code(secret: str | None, code: str | None) -> bool:
|
|
if not secret or not code:
|
|
return False
|
|
normalized_code = code.strip()
|
|
if len(normalized_code) != 6 or not normalized_code.isdigit():
|
|
return False
|
|
padded_secret = secret + '=' * (-len(secret) % 8)
|
|
try:
|
|
key = base64.b32decode(padded_secret, casefold=True)
|
|
except (ValueError, base64.binascii.Error):
|
|
return False
|
|
counter = int(time.time()) // 30
|
|
for offset in (-1, 0, 1):
|
|
digest = hmac.new(key, (counter + offset).to_bytes(8, 'big'), hashlib.sha1).digest()
|
|
index = digest[-1] & 0x0f
|
|
value = (int.from_bytes(digest[index:index + 4], 'big') & 0x7fffffff) % 1_000_000
|
|
if hmac.compare_digest(f'{value:06d}', normalized_code):
|
|
return True
|
|
return False |