Edit File: test_totp.py
"""passlib.tests -- test passlib.totp""" #============================================================================= # imports #============================================================================= # core import datetime from functools import partial import logging; log = logging.getLogger(__name__) import sys import time as _time # site # pkg from passlib import exc from passlib.utils.compat import unicode, u from passlib.tests.utils import TestCase, time_call # subject from passlib import totp as totp_module from passlib.totp import TOTP, AppWallet, AES_SUPPORT # local __all__ = [ "EngineTest", ] #============================================================================= # helpers #============================================================================= # XXX: python 3 changed what error base64.b16decode() throws, from TypeError to base64.Error(). # it wasn't until 3.3 that base32decode() also got changed. # really should normalize this in the code to a single BinaryDecodeError, # predicting this cross-version is getting unmanagable. Base32DecodeError = Base16DecodeError = TypeError if sys.version_info >= (3,0): from binascii import Error as Base16DecodeError if sys.version_info >= (3,3): from binascii import Error as Base32DecodeError PASS1 = "abcdef" PASS2 = b"\x00\xFF" KEY1 = '4AOGGDBBQSYHNTUZ' KEY1_RAW = b'\xe0\x1cc\x0c!\x84\xb0v\xce\x99' KEY2_RAW = b'\xee]\xcb9\x870\x06 D\xc8y/\xa54&\xe4\x9c\x13\xc2\x18' KEY3 = 'S3JDVB7QD2R7JPXX' # used in docstrings KEY4 = 'JBSWY3DPEHPK3PXP' # from google keyuri spec KEY4_RAW = b'Hello!\xde\xad\xbe\xef' # NOTE: for randtime() below, # * want at least 7 bits on fractional side, to test fractional times to at least 0.01s precision # * want at least 32 bits on integer side, to test for 32-bit epoch issues. # most systems *should* have 53 bit mantissa, leaving plenty of room on both ends, # so using (1<<37) as scale, to allocate 16 bits on fractional side, but generate reasonable # of > 1<<32 times. # sanity check that we're above 44 ensures minimum requirements (44 - 37 int = 7 frac) assert sys.float_info.radix == 2, "unexpected float_info.radix" assert sys.float_info.mant_dig >= 44, "double precision unexpectedly small" def _get_max_time_t(): """ helper to calc max_time_t constant (see below) """ value = 1 << 30 # even for 32 bit systems will handle this year = 0 while True: next_value = value << 1 try: next_year = datetime.datetime.utcfromtimestamp(next_value-1).year except (ValueError, OSError, OverflowError): # utcfromtimestamp() may throw any of the following: # # * year out of range for datetime: # py < 3.6 throws ValueError. # (py 3.6.0 returns odd value instead, see workaround below) # # * int out of range for host's gmtime/localtime: # py2 throws ValueError, py3 throws OSError. # # * int out of range for host's time_t: # py2 throws ValueError, py3 throws OverflowError. # break # Workaround for python 3.6.0 issue -- # Instead of throwing ValueError if year out of range for datetime, # Python 3.6 will do some weird behavior that masks high bits # e.g. (1<<40) -> year 36812, but (1<<41) -> year 6118. # (Appears to be bug http://bugs.python.org/issue29100) # This check stops at largest non-wrapping bit size. if next_year < year: break value = next_value # 'value-1' is maximum. value -= 1 # check for crazy case where we're beyond what datetime supports # (caused by bug 29100 again). compare to max value that datetime # module supports -- datetime.datetime(9999, 12, 31, 23, 59, 59, 999999) max_datetime_timestamp = 253402318800 return min(value, max_datetime_timestamp) #: Rough approximation of max value acceptable by hosts's time_t. #: This is frequently ~2**37 on 64 bit, and ~2**31 on 32 bit systems. max_time_t = _get_max_time_t() def to_b32_size(raw_size): return (raw_size * 8 + 4) // 5 #============================================================================= # wallet #============================================================================= class AppWalletTest(TestCase): descriptionPrefix = "passlib.totp.AppWallet" #============================================================================= # constructor #============================================================================= def test_secrets_types(self): """constructor -- 'secrets' param -- input types""" # no secrets wallet = AppWallet() self.assertEqual(wallet._secrets, {}) self.assertFalse(wallet.has_secrets) # dict ref = {"1": b"aaa", "2": b"bbb"} wallet = AppWallet(ref) self.assertEqual(wallet._secrets, ref) self.assertTrue(wallet.has_secrets) # # list # wallet = AppWallet(list(ref.items())) # self.assertEqual(wallet._secrets, ref) # # iter # wallet = AppWallet(iter(ref.items())) # self.assertEqual(wallet._secrets, ref) # "tag:value" string wallet = AppWallet("\n 1: aaa\n# comment\n \n2: bbb ") self.assertEqual(wallet._secrets, ref) # ensure ":" allowed in secret wallet = AppWallet("1: aaa: bbb \n# comment\n \n2: bbb ") self.assertEqual(wallet._secrets, {"1": b"aaa: bbb", "2": b"bbb"}) # json dict wallet = AppWallet('{"1":"aaa","2":"bbb"}') self.assertEqual(wallet._secrets, ref) # # json list # wallet = AppWallet('[["1","aaa"],["2","bbb"]]') # self.assertEqual(wallet._secrets, ref) # invalid type self.assertRaises(TypeError, AppWallet, 123) # invalid json obj self.assertRaises(TypeError, AppWallet, "[123]") # # invalid list items # self.assertRaises(ValueError, AppWallet, ["1", b"aaa"]) # forbid empty secret self.assertRaises(ValueError, AppWallet, {"1": "aaa", "2": ""}) def test_secrets_tags(self): """constructor -- 'secrets' param -- tag/value normalization""" # test reference ref = {"1": b"aaa", "02": b"bbb", "C": b"ccc"} wallet = AppWallet(ref) self.assertEqual(wallet._secrets, ref) # accept unicode wallet = AppWallet({u("1"): b"aaa", u("02"): b"bbb", u("C"): b"ccc"}) self.assertEqual(wallet._secrets, ref) # normalize int tags wallet = AppWallet({1: b"aaa", "02": b"bbb", "C": b"ccc"}) self.assertEqual(wallet._secrets, ref) # forbid non-str/int tags self.assertRaises(TypeError, AppWallet, {(1,): "aaa"}) # accept valid tags wallet = AppWallet({"1-2_3.4": b"aaa"}) # forbid invalid tags self.assertRaises(ValueError, AppWallet, {"-abc": "aaa"}) self.assertRaises(ValueError, AppWallet, {"ab*$": "aaa"}) # coerce value to bytes wallet = AppWallet({"1": u("aaa"), "02": "bbb", "C": b"ccc"}) self.assertEqual(wallet._secrets, ref) # forbid invalid value types self.assertRaises(TypeError, AppWallet, {"1": 123}) self.assertRaises(TypeError, AppWallet, {"1": None}) self.assertRaises(TypeError, AppWallet, {"1": []}) # TODO: test secrets_path def test_default_tag(self): """constructor -- 'default_tag' param""" # should sort numerically wallet = AppWallet({"1": "one", "02": "two"}) self.assertEqual(wallet.default_tag, "02") self.assertEqual(wallet.get_secret(wallet.default_tag), b"two") # should sort alphabetically if non-digit present wallet = AppWallet({"1": "one", "02": "two", "A": "aaa"}) self.assertEqual(wallet.default_tag, "A") self.assertEqual(wallet.get_secret(wallet.default_tag), b"aaa") # should use honor custom tag wallet = AppWallet({"1": "one", "02": "two", "A": "aaa"}, default_tag="1") self.assertEqual(wallet.default_tag, "1") self.assertEqual(wallet.get_secret(wallet.default_tag), b"one") # throw error on unknown value self.assertRaises(KeyError, AppWallet, {"1": "one", "02": "two", "A": "aaa"}, default_tag="B") # should be empty wallet = AppWallet() self.assertEqual(wallet.default_tag, None) self.assertRaises(KeyError, wallet.get_secret, None) # TODO: test 'cost' param #============================================================================= # encrypt_key() & decrypt_key() helpers #============================================================================= def require_aes_support(self, canary=None): if AES_SUPPORT: canary and canary() else: canary and self.assertRaises(RuntimeError, canary) raise self.skipTest("'cryptography' package not installed") def test_decrypt_key(self): """.decrypt_key()""" wallet = AppWallet({"1": PASS1, "2": PASS2}) # check for support CIPHER1 = dict(v=1, c=13, s='6D7N7W53O7HHS37NLUFQ', k='MHCTEGSNPFN5CGBJ', t='1') self.require_aes_support(canary=partial(wallet.decrypt_key, CIPHER1)) # reference key self.assertEqual(wallet.decrypt_key(CIPHER1)[0], KEY1_RAW) # different salt used to encrypt same raw key CIPHER2 = dict(v=1, c=13, s='SPZJ54Y6IPUD2BYA4C6A', k='ZGDXXTVQOWYLC2AU', t='1') self.assertEqual(wallet.decrypt_key(CIPHER2)[0], KEY1_RAW) # different sized key, password, and cost CIPHER3 = dict(v=1, c=8, s='FCCTARTIJWE7CPQHUDKA', k='D2DRS32YESGHHINWFFCELKN7Z6NAHM4M', t='2') self.assertEqual(wallet.decrypt_key(CIPHER3)[0], KEY2_RAW) # wrong password should silently result in wrong key temp = CIPHER1.copy() temp.update(t='2') self.assertEqual(wallet.decrypt_key(temp)[0], b'\xafD6.F7\xeb\x19\x05Q') # missing tag should throw error temp = CIPHER1.copy() temp.update(t='3') self.assertRaises(KeyError, wallet.decrypt_key, temp) # unknown version should throw error temp = CIPHER1.copy() temp.update(v=999) self.assertRaises(ValueError, wallet.decrypt_key, temp) def test_decrypt_key_needs_recrypt(self): """.decrypt_key() -- needs_recrypt flag""" self.require_aes_support() wallet = AppWallet({"1": PASS1, "2": PASS2}, encrypt_cost=13) # ref should be accepted ref = dict(v=1, c=13, s='AAAA', k='AAAA', t='2') self.assertFalse(wallet.decrypt_key(ref)[1]) # wrong cost temp = ref.copy() temp.update(c=8) self.assertTrue(wallet.decrypt_key(temp)[1]) # wrong tag temp = ref.copy() temp.update(t="1") self.assertTrue(wallet.decrypt_key(temp)[1]) # XXX: should this check salt_size? def assertSaneResult(self, result, wallet, key, tag="1", needs_recrypt=False): """check encrypt_key() result has expected format""" self.assertEqual(set(result), set(["v", "t", "c", "s", "k"])) self.assertEqual(result['v'], 1) self.assertEqual(result['t'], tag) self.assertEqual(result['c'], wallet.encrypt_cost) self.assertEqual(len(result['s']), to_b32_size(wallet.salt_size)) self.assertEqual(len(result['k']), to_b32_size(len(key))) result_key, result_needs_recrypt = wallet.decrypt_key(result) self.assertEqual(result_key, key) self.assertEqual(result_needs_recrypt, needs_recrypt) def test_encrypt_key(self): """.encrypt_key()""" # check for support wallet = AppWallet({"1": PASS1}, encrypt_cost=5) self.require_aes_support(canary=partial(wallet.encrypt_key, KEY1_RAW)) # basic behavior result = wallet.encrypt_key(KEY1_RAW) self.assertSaneResult(result, wallet, KEY1_RAW) # creates new salt each time other = wallet.encrypt_key(KEY1_RAW) self.assertSaneResult(result, wallet, KEY1_RAW) self.assertNotEqual(other['s'], result['s']) self.assertNotEqual(other['k'], result['k']) # honors custom cost wallet2 = AppWallet({"1": PASS1}, encrypt_cost=6) result = wallet2.encrypt_key(KEY1_RAW) self.assertSaneResult(result, wallet2, KEY1_RAW) # honors default tag wallet2 = AppWallet({"1": PASS1, "2": PASS2}) result = wallet2.encrypt_key(KEY1_RAW) self.assertSaneResult(result, wallet2, KEY1_RAW, tag="2") # honor salt size wallet2 = AppWallet({"1": PASS1}) wallet2.salt_size = 64 result = wallet2.encrypt_key(KEY1_RAW) self.assertSaneResult(result, wallet2, KEY1_RAW) # larger key result = wallet.encrypt_key(KEY2_RAW) self.assertSaneResult(result, wallet, KEY2_RAW) # border case: empty key # XXX: might want to allow this, but documenting behavior for now self.assertRaises(ValueError, wallet.encrypt_key, b"") def test_encrypt_cost_timing(self): """verify cost parameter via timing""" self.require_aes_support() # time default cost wallet = AppWallet({"1": "aaa"}) wallet.encrypt_cost -= 2 delta, _ = time_call(partial(wallet.encrypt_key, KEY1_RAW), maxtime=0) # this should take (2**3=8) times as long wallet.encrypt_cost += 3 delta2, _ = time_call(partial(wallet.encrypt_key, KEY1_RAW), maxtime=0) self.assertAlmostEqual(delta2, delta*8, delta=(delta*8)*0.5) #============================================================================= # eoc #============================================================================= #============================================================================= # common OTP code #============================================================================= #: used as base value for RFC test vector keys RFC_KEY_BYTES_20 = "12345678901234567890".encode("ascii") RFC_KEY_BYTES_32 = (RFC_KEY_BYTES_20*2)[:32] RFC_KEY_BYTES_64 = (RFC_KEY_BYTES_20*4)[:64] # TODO: this class is separate from TotpTest due to historical issue, # when there was a base class, and a separate HOTP class. # these test case classes should probably be combined. class TotpTest(TestCase): """ common code shared by TotpTest & HotpTest """ #============================================================================= # class attrs #============================================================================= descriptionPrefix = "passlib.totp.TOTP" #============================================================================= # setup #============================================================================= def setUp(self): super(TotpTest, self).setUp() # clear norm_hash_name() cache so 'unknown hash' warnings get emitted each time from passlib.crypto.digest import lookup_hash lookup_hash.clear_cache() # monkeypatch module's rng to be deterministic self.patchAttr(totp_module, "rng", self.getRandom()) #============================================================================= # general helpers #============================================================================= def randtime(self): """ helper to generate random epoch time :returns float: epoch time """ return self.getRandom().random() * max_time_t def randotp(self, cls=None, **kwds): """ helper which generates a random TOTP instance. """ rng = self.getRandom() if "key" not in kwds: kwds['new'] = True kwds.setdefault("digits", rng.randint(6, 10)) kwds.setdefault("alg", rng.choice(["sha1", "sha256", "sha512"])) kwds.setdefault("period", rng.randint(10, 120)) return (cls or TOTP)(**kwds) def test_randotp(self): """ internal test -- randotp() """ otp1 = self.randotp() otp2 = self.randotp() self.assertNotEqual(otp1.key, otp2.key, "key not randomized:") # NOTE: has (1/5)**10 odds of failure for _ in range(10): if otp1.digits != otp2.digits: break otp2 = self.randotp() else: self.fail("digits not randomized") # NOTE: has (1/3)**10 odds of failure for _ in range(10): if otp1.alg != otp2.alg: break otp2 = self.randotp() else: self.fail("alg not randomized") #============================================================================= # reference vector helpers #============================================================================= #: default options used by test vectors (unless otherwise stated) vector_defaults = dict(format="base32", alg="sha1", period=30, digits=8) #: various TOTP test vectors, #: each element in list has format [options, (time, token <, int(expires)>), ...] vectors = [ #------------------------------------------------------------------------- # passlib test vectors #------------------------------------------------------------------------- # 10 byte key, 6 digits [dict(key="ACDEFGHJKL234567", digits=6), # test fencepost to make sure we're rounding right (1412873399, '221105'), # == 29 mod 30 (1412873400, '178491'), # == 0 mod 30 (1412873401, '178491'), # == 1 mod 30 (1412873429, '178491'), # == 29 mod 30 (1412873430, '915114'), # == 0 mod 30 ], # 10 byte key, 8 digits [dict(key="ACDEFGHJKL234567", digits=8), # should be same as 6 digits (above), but w/ 2 more digits on left side of token. (1412873399, '20221105'), # == 29 mod 30 (1412873400, '86178491'), # == 0 mod 30 (1412873401, '86178491'), # == 1 mod 30 (1412873429, '86178491'), # == 29 mod 30 (1412873430, '03915114'), # == 0 mod 30 ], # sanity check on key used in docstrings [dict(key="S3JD-VB7Q-D2R7-JPXX", digits=6), (1419622709, '000492'), (1419622739, '897212'), ], #------------------------------------------------------------------------- # reference vectors taken from http://tools.ietf.org/html/rfc6238, appendix B # NOTE: while appendix B states same key used for all tests, the reference # code in the appendix repeats the key up to the alg's block size, # and uses *that* as the secret... so that's what we're doing here. #------------------------------------------------------------------------- # sha1 test vectors [dict(key=RFC_KEY_BYTES_20, format="raw", alg="sha1"), (59, '94287082'), (1111111109, '07081804'), (1111111111, '14050471'), (1234567890, '89005924'), (2000000000, '69279037'), (20000000000, '65353130'), ], # sha256 test vectors [dict(key=RFC_KEY_BYTES_32, format="raw", alg="sha256"), (59, '46119246'), (1111111109, '68084774'), (1111111111, '67062674'), (1234567890, '91819424'), (2000000000, '90698825'), (20000000000, '77737706'), ], # sha512 test vectors [dict(key=RFC_KEY_BYTES_64, format="raw", alg="sha512"), (59, '90693936'), (1111111109, '25091201'), (1111111111, '99943326'), (1234567890, '93441116'), (2000000000, '38618901'), (20000000000, '47863826'), ], #------------------------------------------------------------------------- # other test vectors #------------------------------------------------------------------------- # generated at http://blog.tinisles.com/2011/10/google-authenticator-one-time-password-algorithm-in-javascript [dict(key="JBSWY3DPEHPK3PXP", digits=6), (1409192430, '727248'), (1419890990, '122419')], [dict(key="JBSWY3DPEHPK3PXP", digits=9, period=41), (1419891152, '662331049')], # found in https://github.com/eloquent/otis/blob/develop/test/suite/Totp/Value/TotpValueGeneratorTest.php, line 45 [dict(key=RFC_KEY_BYTES_20, format="raw", period=60), (1111111111, '19360094')], [dict(key=RFC_KEY_BYTES_32, format="raw", alg="sha256", period=60), (1111111111, '40857319')], [dict(key=RFC_KEY_BYTES_64, format="raw", alg="sha512", period=60), (1111111111, '37023009')], ] def iter_test_vectors(self): """ helper to iterate over test vectors. yields ``(totp, time, token, expires, prefix)`` tuples. """ from passlib.totp import TOTP for row in self.vectors: kwds = self.vector_defaults.copy() kwds.update(row[0]) for entry in row[1:]: if len(entry) == 3: time, token, expires = entry else: time, token = entry expires = None # NOTE: not re-using otp between calls so that stateful methods # (like .match) don't have problems. log.debug("test vector: %r time=%r token=%r expires=%r", kwds, time, token, expires) otp = TOTP(**kwds) prefix = "alg=%r time=%r token=%r: " % (otp.alg, time, token) yield otp, time, token, expires, prefix #============================================================================= # constructor tests #============================================================================= def test_ctor_w_new(self): """constructor -- 'new' parameter""" # exactly one of 'key' or 'new' is required self.assertRaises(TypeError, TOTP) self.assertRaises(TypeError, TOTP, key='4aoggdbbqsyhntuz', new=True) # generates new key otp = TOTP(new=True) otp2 = TOTP(new=True) self.assertNotEqual(otp.key, otp2.key) def test_ctor_w_size(self): """constructor -- 'size' parameter""" # should default to digest size, per RFC self.assertEqual(len(TOTP(new=True, alg="sha1").key), 20) self.assertEqual(len(TOTP(new=True, alg="sha256").key), 32) self.assertEqual(len(TOTP(new=True, alg="sha512").key), 64) # explicit key size self.assertEqual(len(TOTP(new=True, size=10).key), 10) self.assertEqual(len(TOTP(new=True, size=16).key), 16) # for new=True, maximum size enforced (based on alg) self.assertRaises(ValueError, TOTP, new=True, size=21, alg="sha1") # for new=True, minimum size enforced self.assertRaises(ValueError, TOTP, new=True, size=9) # for existing key, minimum size is only warned about with self.assertWarningList([ dict(category=exc.PasslibSecurityWarning, message_re=".*for security purposes, secret key must be.*") ]): _ = TOTP('0A'*9, 'hex') def test_ctor_w_key_and_format(self): """constructor -- 'key' and 'format' parameters""" # handle base32 encoding (the default) self.assertEqual(TOTP(KEY1).key, KEY1_RAW) # .. w/ lower case self.assertEqual(TOTP(KEY1.lower()).key, KEY1_RAW) # .. w/ spaces (e.g. user-entered data) self.assertEqual(TOTP(' 4aog gdbb qsyh ntuz ').key, KEY1_RAW) # .. w/ invalid char self.assertRaises(Base32DecodeError, TOTP, 'ao!ggdbbqsyhntuz') # handle hex encoding self.assertEqual(TOTP('e01c630c2184b076ce99', 'hex').key, KEY1_RAW) # .. w/ invalid char self.assertRaises(Base16DecodeError, TOTP, 'X01c630c2184b076ce99', 'hex') # handle raw bytes self.assertEqual(TOTP(KEY1_RAW, "raw").key, KEY1_RAW) def test_ctor_w_alg(self): """constructor -- 'alg' parameter""" # normalize hash names self.assertEqual(TOTP(KEY1, alg="SHA-256").alg, "sha256") self.assertEqual(TOTP(KEY1, alg="SHA256").alg, "sha256") # invalid alg self.assertRaises(ValueError, TOTP, KEY1, alg="SHA-333") def test_ctor_w_digits(self): """constructor -- 'digits' parameter""" self.assertRaises(ValueError, TOTP, KEY1, digits=5) self.assertEqual(TOTP(KEY1, digits=6).digits, 6) # min value self.assertEqual(TOTP(KEY1, digits=10).digits, 10) # max value self.assertRaises(ValueError, TOTP, KEY1, digits=11) def test_ctor_w_period(self): """constructor -- 'period' parameter""" # default self.assertEqual(TOTP(KEY1).period, 30) # explicit value self.assertEqual(TOTP(KEY1, period=63).period, 63) # reject wrong type self.assertRaises(TypeError, TOTP, KEY1, period=1.5) self.assertRaises(TypeError, TOTP, KEY1, period='abc') # reject non-positive values self.assertRaises(ValueError, TOTP, KEY1, period=0) self.assertRaises(ValueError, TOTP, KEY1, period=-1) def test_ctor_w_label(self): """constructor -- 'label' parameter""" self.assertEqual(TOTP(KEY1).label, None) self.assertEqual(TOTP(KEY1, label="foo@bar").label, "foo@bar") self.assertRaises(ValueError, TOTP, KEY1, label="foo:bar") def test_ctor_w_issuer(self): """constructor -- 'issuer' parameter""" self.assertEqual(TOTP(KEY1).issuer, None) self.assertEqual(TOTP(KEY1, issuer="foo.com").issuer, "foo.com") self.assertRaises(ValueError, TOTP, KEY1, issuer="foo.com:bar") #============================================================================= # using() tests #============================================================================= # TODO: test using() w/ 'digits', 'alg', 'issue', 'wallet', **wallet_kwds def test_using_w_period(self): """using() -- 'period' parameter""" # default self.assertEqual(TOTP(KEY1).period, 30) # explicit value self.assertEqual(TOTP.using(period=63)(KEY1).period, 63) # reject wrong type self.assertRaises(TypeError, TOTP.using, period=1.5) self.assertRaises(TypeError, TOTP.using, period='abc') # reject non-positive values self.assertRaises(ValueError, TOTP.using, period=0) self.assertRaises(ValueError, TOTP.using, period=-1) def test_using_w_now(self): """using -- 'now' parameter""" # NOTE: reading time w/ normalize_time() to make sure custom .now actually has effect. # default -- time.time otp = self.randotp() self.assertIs(otp.now, _time.time) self.assertAlmostEqual(otp.normalize_time(None), int(_time.time())) # custom function counter = [123.12] def now(): counter[0] += 1 return counter[0] otp = self.randotp(cls=TOTP.using(now=now)) # NOTE: TOTP() constructor invokes this as part of test, using up counter values 124 & 125 self.assertEqual(otp.normalize_time(None), 126) self.assertEqual(otp.normalize_time(None), 127) # require callable self.assertRaises(TypeError, TOTP.using, now=123) # require returns int/float msg_re = r"now\(\) function must return non-negative" self.assertRaisesRegex(AssertionError, msg_re, TOTP.using, now=lambda: 'abc') # require returns non-negative value self.assertRaisesRegex(AssertionError, msg_re, TOTP.using, now=lambda: -1) #============================================================================= # internal method tests #============================================================================= def test_normalize_token_instance(self, otp=None): """normalize_token() -- instance method""" if otp is None: otp = self.randotp(digits=7) # unicode & bytes self.assertEqual(otp.normalize_token(u('1234567')), '1234567') self.assertEqual(otp.normalize_token(b'1234567'), '1234567') # int self.assertEqual(otp.normalize_token(1234567), '1234567') # int which needs 0 padding self.assertEqual(otp.normalize_token(234567), '0234567') # reject wrong types (float, None) self.assertRaises(TypeError, otp.normalize_token, 1234567.0) self.assertRaises(TypeError, otp.normalize_token, None) # too few digits self.assertRaises(exc.MalformedTokenError, otp.normalize_token, '123456') # too many digits self.assertRaises(exc.MalformedTokenError, otp.normalize_token, '01234567') self.assertRaises(exc.MalformedTokenError, otp.normalize_token, 12345678) def test_normalize_token_class(self): """normalize_token() -- class method""" self.test_normalize_token_instance(otp=TOTP.using(digits=7)) def test_normalize_time(self): """normalize_time()""" TotpFactory = TOTP.using() otp = self.randotp(TotpFactory) for _ in range(10): time = self.randtime() tint = int(time) self.assertEqual(otp.normalize_time(time), tint) self.assertEqual(otp.normalize_time(tint + 0.5), tint) self.assertEqual(otp.normalize_time(tint), tint) dt = datetime.datetime.utcfromtimestamp(time) self.assertEqual(otp.normalize_time(dt), tint) orig = TotpFactory.now try: TotpFactory.now = staticmethod(lambda: time) self.assertEqual(otp.normalize_time(None), tint) finally: TotpFactory.now = orig self.assertRaises(TypeError, otp.normalize_time, '1234') #============================================================================= # key attr tests #============================================================================= def test_key_attrs(self): """pretty_key() and .key attributes""" rng = self.getRandom() # test key attrs otp = TOTP(KEY1_RAW, "raw") self.assertEqual(otp.key, KEY1_RAW) self.assertEqual(otp.hex_key, 'e01c630c2184b076ce99') self.assertEqual(otp.base32_key, KEY1) # test pretty_key() self.assertEqual(otp.pretty_key(), '4AOG-GDBB-QSYH-NTUZ') self.assertEqual(otp.pretty_key(sep=" "), '4AOG GDBB QSYH NTUZ') self.assertEqual(otp.pretty_key(sep=False), KEY1) self.assertEqual(otp.pretty_key(format="hex"), 'e01c-630c-2184-b076-ce99') # quick fuzz test: make attr access works for random key & random size otp = TOTP(new=True, size=rng.randint(10, 20)) _ = otp.hex_key _ = otp.base32_key _ = otp.pretty_key() #============================================================================= # generate() tests #============================================================================= def test_totp_token(self): """generate() -- TotpToken() class""" from passlib.totp import TOTP, TotpToken # test known set of values otp = TOTP('s3jdvb7qd2r7jpxx') result = otp.generate(1419622739) self.assertIsInstance(result, TotpToken) self.assertEqual(result.token, '897212') self.assertEqual(result.counter, 47320757) ##self.assertEqual(result.start_time, 1419622710) self.assertEqual(result.expire_time, 1419622740) self.assertEqual(result, ('897212', 1419622740)) self.assertEqual(len(result), 2) self.assertEqual(result[0], '897212') self.assertEqual(result[1], 1419622740) self.assertRaises(IndexError, result.__getitem__, -3) self.assertRaises(IndexError, result.__getitem__, 2) self.assertTrue(result) # time dependant bits... otp.now = lambda : 1419622739.5 self.assertEqual(result.remaining, 0.5) self.assertTrue(result.valid) otp.now = lambda : 1419622741 self.assertEqual(result.remaining, 0) self.assertFalse(result.valid) # same time -- shouldn't return same object, but should be equal result2 = otp.generate(1419622739) self.assertIsNot(result2, result) self.assertEqual(result2, result) # diff time in period -- shouldn't return same object, but should be equal result3 = otp.generate(1419622711) self.assertIsNot(result3, result) self.assertEqual(result3, result) # shouldn't be equal result4 = otp.generate(1419622999) self.assertNotEqual(result4, result) def test_generate(self): """generate()""" from passlib.totp import TOTP # generate token otp = TOTP(new=True) time = self.randtime() result = otp.generate(time) token = result.token self.assertIsInstance(token, unicode) start_time = result.counter * 30 # should generate same token for next 29s self.assertEqual(otp.generate(start_time + 29).token, token) # and new one at 30s self.assertNotEqual(otp.generate(start_time + 30).token, token) # verify round-trip conversion of datetime dt = datetime.datetime.utcfromtimestamp(time) self.assertEqual(int(otp.normalize_time(dt)), int(time)) # handle datetime object self.assertEqual(otp.generate(dt).token, token) # omitting value should use current time otp2 = TOTP.using(now=lambda: time)(key=otp.base32_key) self.assertEqual(otp2.generate().token, token) # reject invalid time self.assertRaises(ValueError, otp.generate, -1) def test_generate_w_reference_vectors(self): """generate() -- reference vectors""" for otp, time, token, expires, prefix in self.iter_test_vectors(): # should output correct token for specified time result = otp.generate(time) self.assertEqual(result.token, token, msg=prefix) self.assertEqual(result.counter, time // otp.period, msg=prefix) if expires: self.assertEqual(result.expire_time, expires) #============================================================================= # TotpMatch() tests #============================================================================= def assertTotpMatch(self, match, time, skipped=0, period=30, window=30, msg=''): from passlib.totp import TotpMatch # test type self.assertIsInstance(match, TotpMatch) # totp sanity check self.assertIsInstance(match.totp, TOTP) self.assertEqual(match.totp.period, period) # test attrs self.assertEqual(match.time, time, msg=msg + " matched time:") expected = time // period counter = expected + skipped self.assertEqual(match.counter, counter, msg=msg + " matched counter:") self.assertEqual(match.expected_counter, expected, msg=msg + " expected counter:") self.assertEqual(match.skipped, skipped, msg=msg + " skipped:") self.assertEqual(match.cache_seconds, period + window) expire_time = (counter + 1) * period self.assertEqual(match.expire_time, expire_time) self.assertEqual(match.cache_time, expire_time + window) # test tuple self.assertEqual(len(match), 2) self.assertEqual(match, (counter, time)) self.assertRaises(IndexError, match.__getitem__, -3) self.assertEqual(match[0], counter) self.assertEqual(match[1], time) self.assertRaises(IndexError, match.__getitem__, 2) # test bool self.assertTrue(match) def test_totp_match_w_valid_token(self): """match() -- valid TotpMatch object""" time = 141230981 token = '781501' otp = TOTP.using(now=lambda: time + 24 * 3600)(KEY3) result = otp.match(token, time) self.assertTotpMatch(result, time=time, skipped=0) def test_totp_match_w_older_token(self): """match() -- valid TotpMatch object with future token""" from passlib.totp import TotpMatch time = 141230981 token = '781501' otp = TOTP.using(now=lambda: time + 24 * 3600)(KEY3) result = otp.match(token, time - 30) self.assertTotpMatch(result, time=time - 30, skipped=1) def test_totp_match_w_new_token(self): """match() -- valid TotpMatch object with past token""" time = 141230981 token = '781501' otp = TOTP.using(now=lambda: time + 24 * 3600)(KEY3) result = otp.match(token, time + 30) self.assertTotpMatch(result, time=time + 30, skipped=-1) def test_totp_match_w_invalid_token(self): """match() -- invalid TotpMatch object""" time = 141230981 token = '781501' otp = TOTP.using(now=lambda: time + 24 * 3600)(KEY3) self.assertRaises(exc.InvalidTokenError, otp.match, token, time + 60) #============================================================================= # match() tests #============================================================================= def assertVerifyMatches(self, expect_skipped, token, time, # * otp, gen_time=None, **kwds): """helper to test otp.match() output is correct""" # NOTE: TotpMatch return type tested more throughly above ^^^ msg = "key=%r alg=%r period=%r token=%r gen_time=%r time=%r:" % \ (otp.base32_key, otp.alg, otp.period, token, gen_time, time) result = otp.match(token, time, **kwds) self.assertTotpMatch(result, time=otp.normalize_time(time), period=otp.period, window=kwds.get("window", 30), skipped=expect_skipped, msg=msg) def assertVerifyRaises(self, exc_class, token, time, # * otp, gen_time=None, **kwds): """helper to test otp.match() throws correct error""" # NOTE: TotpMatch return type tested more throughly above ^^^ msg = "key=%r alg=%r period=%r token=%r gen_time=%r time=%r:" % \ (otp.base32_key, otp.alg, otp.period, token, gen_time, time) return self.assertRaises(exc_class, otp.match, token, time, __msg__=msg, **kwds) def test_match_w_window(self): """match() -- 'time' and 'window' parameters""" # init generator & helper otp = self.randotp() period = otp.period time = self.randtime() token = otp.generate(time).token common = dict(otp=otp, gen_time=time) assertMatches = partial(self.assertVerifyMatches, **common) assertRaises = partial(self.assertVerifyRaises, **common) #------------------------------- # basic validation, and 'window' parameter #------------------------------- # validate against previous counter (passes if window >= period) assertRaises(exc.InvalidTokenError, token, time - period, window=0) assertMatches(+1, token, time - period, window=period) assertMatches(+1, token, time - period, window=2 * period) # validate against current counter assertMatches(0, token, time, window=0) # validate against next counter (passes if window >= period) assertRaises(exc.InvalidTokenError, token, time + period, window=0) assertMatches(-1, token, time + period, window=period) assertMatches(-1, token, time + period, window=2 * period) # validate against two time steps later (should never pass) assertRaises(exc.InvalidTokenError, token, time + 2 * period, window=0) assertRaises(exc.InvalidTokenError, token, time + 2 * period, window=period) assertMatches(-2, token, time + 2 * period, window=2 * period) # TODO: test window values that aren't multiples of period # (esp ensure counter rounding works correctly) #------------------------------- # time normalization #------------------------------- # handle datetimes dt = datetime.datetime.utcfromtimestamp(time) assertMatches(0, token, dt, window=0) # reject invalid time assertRaises(ValueError, token, -1) def test_match_w_skew(self): """match() -- 'skew' parameters""" # init generator & helper otp = self.randotp() period = otp.period time = self.randtime() common = dict(otp=otp, gen_time=time) assertMatches = partial(self.assertVerifyMatches, **common) assertRaises = partial(self.assertVerifyRaises, **common) # assume client is running far behind server / has excessive transmission delay skew = 3 * period behind_token = otp.generate(time - skew).token assertRaises(exc.InvalidTokenError, behind_token, time, window=0) assertMatches(-3, behind_token, time, window=0, skew=-skew) # assume client is running far ahead of server ahead_token = otp.generate(time + skew).token assertRaises(exc.InvalidTokenError, ahead_token, time, window=0) assertMatches(+3, ahead_token, time, window=0, skew=skew) # TODO: test skew + larger window def test_match_w_reuse(self): """match() -- 'reuse' and 'last_counter' parameters""" # init generator & helper otp = self.randotp() period = otp.period time = self.randtime() tdata = otp.generate(time) token = tdata.token counter = tdata.counter expire_time = tdata.expire_time common = dict(otp=otp, gen_time=time) assertMatches = partial(self.assertVerifyMatches, **common) assertRaises = partial(self.assertVerifyRaises, **common) # last counter unset -- # previous period's token should count as valid assertMatches(-1, token, time + period, window=period) # last counter set 2 periods ago -- # previous period's token should count as valid assertMatches(-1, token, time + period, last_counter=counter-1, window=period) # last counter set 2 periods ago -- # 2 periods ago's token should NOT count as valid assertRaises(exc.InvalidTokenError, token, time + 2 * period, last_counter=counter, window=period) # last counter set 1 period ago -- # previous period's token should now be rejected as 'used' err = assertRaises(exc.UsedTokenError, token, time + period, last_counter=counter, window=period) self.assertEqual(err.expire_time, expire_time) # last counter set to current period -- # current period's token should be rejected err = assertRaises(exc.UsedTokenError, token, time, last_counter=counter, window=0) self.assertEqual(err.expire_time, expire_time) def test_match_w_token_normalization(self): """match() -- token normalization""" # setup test helper otp = TOTP('otxl2f5cctbprpzx') match = otp.match time = 1412889861 # separators / spaces should be stripped (orig token '332136') self.assertTrue(match(' 3 32-136 ', time)) # ascii bytes self.assertTrue(match(b'332136', time)) # too few digits self.assertRaises(exc.MalformedTokenError, match, '12345', time) # invalid char self.assertRaises(exc.MalformedTokenError, match, '12345X', time) # leading zeros count towards size self.assertRaises(exc.MalformedTokenError, match, '0123456', time) def test_match_w_reference_vectors(self): """match() -- reference vectors""" for otp, time, token, expires, msg in self.iter_test_vectors(): # create wrapper match = otp.match # token should match against time result = match(token, time) self.assertTrue(result) self.assertEqual(result.counter, time // otp.period, msg=msg) # should NOT match against another time self.assertRaises(exc.InvalidTokenError, match, token, time + 100, window=0) #============================================================================= # verify() tests #============================================================================= def test_verify(self): """verify()""" # NOTE: since this is thin wrapper around .from_source() and .match(), # just testing basic behavior here. from passlib.totp import TOTP time = 1412889861 TotpFactory = TOTP.using(now=lambda: time) # successful match source1 = dict(v=1, type="totp", key='otxl2f5cctbprpzx') match = TotpFactory.verify('332136', source1) self.assertTotpMatch(match, time=time) # failed match source1 = dict(v=1, type="totp", key='otxl2f5cctbprpzx') self.assertRaises(exc.InvalidTokenError, TotpFactory.verify, '332155', source1) # bad source source1 = dict(v=1, type="totp") self.assertRaises(ValueError, TotpFactory.verify, '332155', source1) # successful match -- json source source1json = '{"v": 1, "type": "totp", "key": "otxl2f5cctbprpzx"}' match = TotpFactory.verify('332136', source1json) self.assertTotpMatch(match, time=time) # successful match -- URI source1uri = 'otpauth://totp/Label?secret=otxl2f5cctbprpzx' match = TotpFactory.verify('332136', source1uri) self.assertTotpMatch(match, time=time) #============================================================================= # serialization frontend tests #============================================================================= def test_from_source(self): """from_source()""" from passlib.totp import TOTP from_source = TOTP.from_source # uri (unicode) otp = from_source(u("otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&" "issuer=Example")) self.assertEqual(otp.key, KEY4_RAW) # uri (bytes) otp = from_source(b"otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&" b"issuer=Example") self.assertEqual(otp.key, KEY4_RAW) # dict otp = from_source(dict(v=1, type="totp", key=KEY4)) self.assertEqual(otp.key, KEY4_RAW) # json (unicode) otp = from_source(u('{"v": 1, "type": "totp", "key": "JBSWY3DPEHPK3PXP"}')) self.assertEqual(otp.key, KEY4_RAW) # json (bytes) otp = from_source(b'{"v": 1, "type": "totp", "key": "JBSWY3DPEHPK3PXP"}') self.assertEqual(otp.key, KEY4_RAW) # TOTP object -- return unchanged self.assertIs(from_source(otp), otp) # TOTP object w/ different wallet -- return new one. wallet1 = AppWallet() otp1 = TOTP.using(wallet=wallet1).from_source(otp) self.assertIsNot(otp1, otp) self.assertEqual(otp1.to_dict(), otp.to_dict()) # TOTP object w/ same wallet -- return original otp2 = TOTP.using(wallet=wallet1).from_source(otp1) self.assertIs(otp2, otp1) # random string self.assertRaises(ValueError, from_source, u("foo")) self.assertRaises(ValueError, from_source, b"foo") #============================================================================= # uri serialization tests #============================================================================= def test_from_uri(self): """from_uri()""" from passlib.totp import TOTP from_uri = TOTP.from_uri # URIs from https://code.google.com/p/google-authenticator/wiki/KeyUriFormat #-------------------------------------------------------------------------------- # canonical uri #-------------------------------------------------------------------------------- otp = from_uri("otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&" "issuer=Example") self.assertIsInstance(otp, TOTP) self.assertEqual(otp.key, KEY4_RAW) self.assertEqual(otp.label, "alice@google.com") self.assertEqual(otp.issuer, "Example") self.assertEqual(otp.alg, "sha1") # default self.assertEqual(otp.period, 30) # default self.assertEqual(otp.digits, 6) # default #-------------------------------------------------------------------------------- # secret param #-------------------------------------------------------------------------------- # secret case insensitive otp = from_uri("otpauth://totp/Example:alice@google.com?secret=jbswy3dpehpk3pxp&" "issuer=Example") self.assertEqual(otp.key, KEY4_RAW) # missing secret self.assertRaises(ValueError, from_uri, "otpauth://totp/Example:alice@google.com?digits=6") # undecodable secret self.assertRaises(Base32DecodeError, from_uri, "otpauth://totp/Example:alice@google.com?" "secret=JBSWY3DPEHP@3PXP") #-------------------------------------------------------------------------------- # label param #-------------------------------------------------------------------------------- # w/ encoded space otp = from_uri("otpauth://totp/Provider1:Alice%20Smith?secret=JBSWY3DPEHPK3PXP&" "issuer=Provider1") self.assertEqual(otp.label, "Alice Smith") self.assertEqual(otp.issuer, "Provider1") # w/ encoded space and colon # (note url has leading space before 'alice') -- taken from KeyURI spec otp = from_uri("otpauth://totp/Big%20Corporation%3A%20alice@bigco.com?" "secret=JBSWY3DPEHPK3PXP") self.assertEqual(otp.label, "alice@bigco.com") self.assertEqual(otp.issuer, "Big Corporation") #-------------------------------------------------------------------------------- # issuer param / prefix #-------------------------------------------------------------------------------- # 'new style' issuer only otp = from_uri("otpauth://totp/alice@bigco.com?secret=JBSWY3DPEHPK3PXP&issuer=Big%20Corporation") self.assertEqual(otp.label, "alice@bigco.com") self.assertEqual(otp.issuer, "Big Corporation") # new-vs-old issuer mismatch self.assertRaises(ValueError, TOTP.from_uri, "otpauth://totp/Provider1:alice?secret=JBSWY3DPEHPK3PXP&issuer=Provider2") #-------------------------------------------------------------------------------- # algorithm param #-------------------------------------------------------------------------------- # custom alg otp = from_uri("otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&algorithm=SHA256") self.assertEqual(otp.alg, "sha256") # unknown alg self.assertRaises(ValueError, from_uri, "otpauth://totp/Example:alice@google.com?" "secret=JBSWY3DPEHPK3PXP&algorithm=SHA333") #-------------------------------------------------------------------------------- # digit param #-------------------------------------------------------------------------------- # custom digits otp = from_uri("otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&digits=8") self.assertEqual(otp.digits, 8) # digits out of range / invalid self.assertRaises(ValueError, from_uri, "otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&digits=A") self.assertRaises(ValueError, from_uri, "otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&digits=%20") self.assertRaises(ValueError, from_uri, "otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&digits=15") #-------------------------------------------------------------------------------- # period param #-------------------------------------------------------------------------------- # custom period otp = from_uri("otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&period=63") self.assertEqual(otp.period, 63) # reject period < 1 self.assertRaises(ValueError, from_uri, "otpauth://totp/Example:alice@google.com?" "secret=JBSWY3DPEHPK3PXP&period=0") self.assertRaises(ValueError, from_uri, "otpauth://totp/Example:alice@google.com?" "secret=JBSWY3DPEHPK3PXP&period=-1") #-------------------------------------------------------------------------------- # unrecognized param #-------------------------------------------------------------------------------- # should issue warning, but otherwise ignore extra param with self.assertWarningList([ dict(category=exc.PasslibRuntimeWarning, message_re="unexpected parameters encountered") ]): otp = from_uri("otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&" "foo=bar&period=63") self.assertEqual(otp.base32_key, KEY4) self.assertEqual(otp.period, 63) def test_to_uri(self): """to_uri()""" #------------------------------------------------------------------------- # label & issuer parameters #------------------------------------------------------------------------- # with label & issuer otp = TOTP(KEY4, alg="sha1", digits=6, period=30) self.assertEqual(otp.to_uri("alice@google.com", "Example Org"), "otpauth://totp/alice@google.com?secret=JBSWY3DPEHPK3PXP&" "issuer=Example%20Org") # label is required self.assertRaises(ValueError, otp.to_uri, None, "Example Org") # with label only self.assertEqual(otp.to_uri("alice@google.com"), "otpauth://totp/alice@google.com?secret=JBSWY3DPEHPK3PXP") # with default label from constructor otp.label = "alice@google.com" self.assertEqual(otp.to_uri(), "otpauth://totp/alice@google.com?secret=JBSWY3DPEHPK3PXP") # with default label & default issuer from constructor otp.issuer = "Example Org" self.assertEqual(otp.to_uri(), "otpauth://totp/alice@google.com?secret=JBSWY3DPEHPK3PXP" "&issuer=Example%20Org") # reject invalid label self.assertRaises(ValueError, otp.to_uri, "label:with:semicolons") # reject invalid issue self.assertRaises(ValueError, otp.to_uri, "alice@google.com", "issuer:with:semicolons") #------------------------------------------------------------------------- # algorithm parameter #------------------------------------------------------------------------- self.assertEqual(TOTP(KEY4, alg="sha256").to_uri("alice@google.com"), "otpauth://totp/alice@google.com?secret=JBSWY3DPEHPK3PXP&" "algorithm=SHA256") #------------------------------------------------------------------------- # digits parameter #------------------------------------------------------------------------- self.assertEqual(TOTP(KEY4, digits=8).to_uri("alice@google.com"), "otpauth://totp/alice@google.com?secret=JBSWY3DPEHPK3PXP&" "digits=8") #------------------------------------------------------------------------- # period parameter #------------------------------------------------------------------------- self.assertEqual(TOTP(KEY4, period=63).to_uri("alice@google.com"), "otpauth://totp/alice@google.com?secret=JBSWY3DPEHPK3PXP&" "period=63") #============================================================================= # dict serialization tests #============================================================================= def test_from_dict(self): """from_dict()""" from passlib.totp import TOTP from_dict = TOTP.from_dict #-------------------------------------------------------------------------------- # canonical simple example #-------------------------------------------------------------------------------- otp = from_dict(dict(v=1, type="totp", key=KEY4, label="alice@google.com", issuer="Example")) self.assertIsInstance(otp, TOTP) self.assertEqual(otp.key, KEY4_RAW) self.assertEqual(otp.label, "alice@google.com") self.assertEqual(otp.issuer, "Example") self.assertEqual(otp.alg, "sha1") # default self.assertEqual(otp.period, 30) # default self.assertEqual(otp.digits, 6) # default #-------------------------------------------------------------------------------- # metadata #-------------------------------------------------------------------------------- # missing version self.assertRaises(ValueError, from_dict, dict(type="totp", key=KEY4)) # invalid version self.assertRaises(ValueError, from_dict, dict(v=0, type="totp", key=KEY4)) self.assertRaises(ValueError, from_dict, dict(v=999, type="totp", key=KEY4)) # missing type self.assertRaises(ValueError, from_dict, dict(v=1, key=KEY4)) #-------------------------------------------------------------------------------- # secret param #-------------------------------------------------------------------------------- # secret case insensitive otp = from_dict(dict(v=1, type="totp", key=KEY4.lower(), label="alice@google.com", issuer="Example")) self.assertEqual(otp.key, KEY4_RAW) # missing secret self.assertRaises(ValueError, from_dict, dict(v=1, type="totp")) # undecodable secret self.assertRaises(Base32DecodeError, from_dict, dict(v=1, type="totp", key="JBSWY3DPEHP@3PXP")) #-------------------------------------------------------------------------------- # label & issuer params #-------------------------------------------------------------------------------- otp = from_dict(dict(v=1, type="totp", key=KEY4, label="Alice Smith", issuer="Provider1")) self.assertEqual(otp.label, "Alice Smith") self.assertEqual(otp.issuer, "Provider1") #-------------------------------------------------------------------------------- # algorithm param #-------------------------------------------------------------------------------- # custom alg otp = from_dict(dict(v=1, type="totp", key=KEY4, alg="sha256")) self.assertEqual(otp.alg, "sha256") # unknown alg self.assertRaises(ValueError, from_dict, dict(v=1, type="totp", key=KEY4, alg="sha333")) #-------------------------------------------------------------------------------- # digit param #-------------------------------------------------------------------------------- # custom digits otp = from_dict(dict(v=1, type="totp", key=KEY4, digits=8)) self.assertEqual(otp.digits, 8) # digits out of range / invalid self.assertRaises(TypeError, from_dict, dict(v=1, type="totp", key=KEY4, digits="A")) self.assertRaises(ValueError, from_dict, dict(v=1, type="totp", key=KEY4, digits=15)) #-------------------------------------------------------------------------------- # period param #-------------------------------------------------------------------------------- # custom period otp = from_dict(dict(v=1, type="totp", key=KEY4, period=63)) self.assertEqual(otp.period, 63) # reject period < 1 self.assertRaises(ValueError, from_dict, dict(v=1, type="totp", key=KEY4, period=0)) self.assertRaises(ValueError, from_dict, dict(v=1, type="totp", key=KEY4, period=-1)) #-------------------------------------------------------------------------------- # unrecognized param #-------------------------------------------------------------------------------- self.assertRaises(TypeError, from_dict, dict(v=1, type="totp", key=KEY4, INVALID=123)) def test_to_dict(self): """to_dict()""" #------------------------------------------------------------------------- # label & issuer parameters #------------------------------------------------------------------------- # without label or issuer otp = TOTP(KEY4, alg="sha1", digits=6, period=30) self.assertEqual(otp.to_dict(), dict(v=1, type="totp", key=KEY4)) # with label & issuer from constructor otp = TOTP(KEY4, alg="sha1", digits=6, period=30, label="alice@google.com", issuer="Example Org") self.assertEqual(otp.to_dict(), dict(v=1, type="totp", key=KEY4, label="alice@google.com", issuer="Example Org")) # with label only otp = TOTP(KEY4, alg="sha1", digits=6, period=30, label="alice@google.com") self.assertEqual(otp.to_dict(), dict(v=1, type="totp", key=KEY4, label="alice@google.com")) # with issuer only otp = TOTP(KEY4, alg="sha1", digits=6, period=30, issuer="Example Org") self.assertEqual(otp.to_dict(), dict(v=1, type="totp", key=KEY4, issuer="Example Org")) # don't serialize default issuer TotpFactory = TOTP.using(issuer="Example Org") otp = TotpFactory(KEY4) self.assertEqual(otp.to_dict(), dict(v=1, type="totp", key=KEY4)) # don't serialize default issuer *even if explicitly set* otp = TotpFactory(KEY4, issuer="Example Org") self.assertEqual(otp.to_dict(), dict(v=1, type="totp", key=KEY4)) #------------------------------------------------------------------------- # algorithm parameter #------------------------------------------------------------------------- self.assertEqual(TOTP(KEY4, alg="sha256").to_dict(), dict(v=1, type="totp", key=KEY4, alg="sha256")) #------------------------------------------------------------------------- # digits parameter #------------------------------------------------------------------------- self.assertEqual(TOTP(KEY4, digits=8).to_dict(), dict(v=1, type="totp", key=KEY4, digits=8)) #------------------------------------------------------------------------- # period parameter #------------------------------------------------------------------------- self.assertEqual(TOTP(KEY4, period=63).to_dict(), dict(v=1, type="totp", key=KEY4, period=63)) # TODO: to_dict() # with encrypt=False # with encrypt="auto" + wallet + secrets # with encrypt="auto" + wallet + no secrets # with encrypt="auto" + no wallet # with encrypt=True + wallet + secrets # with encrypt=True + wallet + no secrets # with encrypt=True + no wallet # that 'changed' is set for old versions, and old encryption tags. #============================================================================= # json serialization tests #============================================================================= # TODO: from_json() / to_json(). # (skipped for right now cause just wrapper for from_dict/to_dict) #============================================================================= # eoc #============================================================================= #============================================================================= # eof #=============================================================================