pax_global_header00006660000000000000000000000064145227427640014527gustar00rootroot0000000000000052 comment=5f81836a7cd6428f91c471475ac1723683b16843 django-otp-1.3.0/000077500000000000000000000000001452274276400135725ustar00rootroot00000000000000django-otp-1.3.0/.bumpversion.cfg000066400000000000000000000006371452274276400167100ustar00rootroot00000000000000[bumpversion] current_version = 1.3.0 commit = true message = Version {new_version} tag = true [bumpversion:file:CHANGES.rst] search = Unreleased replace = v{new_version} - {now:%B %d, %Y} [bumpversion:file:pyproject.toml] search = version = "{current_version}" replace = version = "{new_version}" [bumpversion:file:docs/source/conf.py] search = release = '{current_version}' replace = release = '{new_version}' django-otp-1.3.0/.coveragerc000066400000000000000000000000641452274276400157130ustar00rootroot00000000000000[run] source = django_otp omit = */migrations/* django-otp-1.3.0/.devcontainer/000077500000000000000000000000001452274276400163315ustar00rootroot00000000000000django-otp-1.3.0/.devcontainer/Dockerfile000066400000000000000000000010471452274276400203250ustar00rootroot00000000000000FROM mcr.microsoft.com/devcontainers/python:1-3.11-bullseye ENV PYTHONUNBUFFERED 1 # [Optional] If your requirements rarely change, uncomment this section to add them to the image. # COPY requirements.txt /tmp/pip-tmp/ # RUN pip3 --disable-pip-version-check --no-cache-dir install -r /tmp/pip-tmp/requirements.txt \ # && rm -rf /tmp/pip-tmp # [Optional] Uncomment this section to install additional OS packages. RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \ && apt-get -y install --no-install-recommends postgresql-client django-otp-1.3.0/.devcontainer/devcontainer.json000066400000000000000000000017661452274276400217170ustar00rootroot00000000000000// For format details, see https://aka.ms/devcontainer.json. For config options, see the // README at: https://github.com/devcontainers/templates/tree/main/src/postgres { "name": "Python 3 & PostgreSQL", "dockerComposeFile": "docker-compose.yml", "service": "app", "workspaceFolder": "/workspaces/${localWorkspaceFolderBasename}", "features": { "ghcr.io/devcontainers-contrib/features/hatch:2": { "version": "latest" } }, // Use 'forwardPorts' to make a list of ports inside the container available locally. // This can be used to network with other containers or the host. "forwardPorts": [8000], "containerEnv": {"DJANGO_OTP_CONFIG": "test/config/github.toml"} // Use 'postCreateCommand' to run commands after the container is created. // "postCreateCommand": "pip install --user -r requirements.txt", // Configure tool-specific properties. // "customizations": {}, // Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root. // "remoteUser": "root" } django-otp-1.3.0/.devcontainer/docker-compose.yml000066400000000000000000000017631452274276400217750ustar00rootroot00000000000000version: '3.8' services: app: build: context: .. dockerfile: .devcontainer/Dockerfile volumes: - ../..:/workspaces:cached # Overrides default command so things don't shut down after the process ends. command: sleep infinity # Runs app on the same network as the database container, allows "forwardPorts" in devcontainer.json function. network_mode: service:db # Use "forwardPorts" in **devcontainer.json** to forward an app port locally. # (Adding the "ports" property to this file will not forward from a Codespace.) db: image: postgres:latest restart: unless-stopped volumes: - postgres-data:/var/lib/postgresql/data environment: POSTGRES_USER: postgres POSTGRES_DB: django-otp POSTGRES_PASSWORD: postgres # Add "forwardPorts": ["5432"] to **devcontainer.json** to forward PostgreSQL locally. # (Adding the "ports" property to this file will not forward from a Codespace.) volumes: postgres-data: django-otp-1.3.0/.flake8000066400000000000000000000002421452274276400147430ustar00rootroot00000000000000[flake8] ignore = # line break before binary operator W503 # line break after binary operator W504 # line too long E501 django-otp-1.3.0/.github/000077500000000000000000000000001452274276400151325ustar00rootroot00000000000000django-otp-1.3.0/.github/workflows/000077500000000000000000000000001452274276400171675ustar00rootroot00000000000000django-otp-1.3.0/.github/workflows/test.yaml000066400000000000000000000013601452274276400210320ustar00rootroot00000000000000name: Run tests on: pull_request: branches: [ master ] jobs: test: runs-on: ubuntu-latest services: postgres: image: postgres env: POSTGRES_PASSWORD: postgres options: >- --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5 ports: - 5432:5432 steps: - uses: actions/checkout@v3 - uses: actions/setup-python@v4 with: python-version: | 3.8 3.10 3.12 - name: Install hatch run: pipx install hatch - name: Run Tests run: hatch run test:run env: DJANGO_OTP_CONFIG: test/config/github.toml django-otp-1.3.0/.gitignore000066400000000000000000000002011452274276400155530ustar00rootroot00000000000000# Python __pycache__/ *.py[co] # builds /dist/ /docs/build/ # test *.sqlite3 /test/config/env-*.toml # Other tools /.coverage django-otp-1.3.0/.hgignore000066400000000000000000000003661452274276400154020ustar00rootroot00000000000000# Don't remove this file. # # When hatch builds an sdist, it includes any .gitignore and .hgignore it can # find here or in parent directories. To avoid information leakage, this file # masks any .hgignore one might have in their home directory. django-otp-1.3.0/.readthedocs.yaml000066400000000000000000000001741452274276400170230ustar00rootroot00000000000000version: 2 sphinx: configuration: docs/source/conf.py python: version: 3.8 install: - method: pip path: . django-otp-1.3.0/CHANGES.rst000066400000000000000000000424311452274276400154000ustar00rootroot00000000000000v1.3.0 - November 08, 2023 - Support cooldowns for token generation -------------------------------------------------------------------------------- - `#122`_: Added throttling to token generation. Devices that generate random tokens can take advantage of the new :class:`~django_otp.models.CooldownMixin` to enforce limits on how frequently new tokens can be generated (and presumably delivered). :class:`~django_otp.plugins.otp_email.models.EmailDevice` uses this and has a :setting:`default cooldown ` configured. Thanks to `Demetris Stavrou`_ for this feature. - Note: :class:`~django_otp.models.VerifyNotAllowed` is now an :class:`~enum.Enum`. This will break any code that inadvisably hard-coded the string value of the `N_FAILED_ATTEMPTS` property. .. _#122: https://github.com/django-otp/django-otp/pull/122 .. _Demetris Stavrou: https://github.com/demestav v1.2.4 - October 05, 2023 - Portuguese translation -------------------------------------------------------------------------------- - `#133`_: Add pt-PT translation. .. _#133: https://github.com/django-otp/django-otp/pull/133 v1.2.3 - September 17, 2023 - German translation fix -------------------------------------------------------------------------------- - `#131`_: Fix German translation .. _#131: https://github.com/django-otp/django-otp/pull/131 v1.2.2 - June 16, 2023 - otp_email html support -------------------------------------------------------------------------------- - `#125`_: Support email body_html templates .. _#125: https://github.com/django-otp/django-otp/pull/125 v1.2.1 - May 26, 2023 - pt-BR translations -------------------------------------------------------------------------------- - `#124`_: Add pt-BR translations. .. _#124: https://github.com/django-otp/django-otp/pull/124 v1.2.0 - May 11, 2023 - Tooling, TOTP images -------------------------------------------------------------------------------- - This project is now managed with `hatch`_, which replaces setuptools, pipenv, and tox. Users of the package should not be impacted. Developers can refer to the readme for details. If you're packaging this project from source, I suggest relying on pip's isolated builds rather than using hatch directly. - `#123`_: Add support for passing an image parameter in the otpauth URL. See :setting:`OTP_TOTP_IMAGE`. .. _hatch: https://hatch.pypa.io/ .. _#123: https://github.com/django-otp/django-otp/pull/123 v1.1.6 - March 07, 2023 - German translation -------------------------------------------------------------------------------- - `#116`_: Add German translation .. _#116: https://github.com/django-otp/django-otp/pull/116 v1.1.5 - March 06, 2023 - Bugfix release -------------------------------------------------------------------------------- - `#115`_: Force OTP_EMAIL_SUBJECT to be a string .. _#115: https://github.com/django-otp/django-otp/pull/115 v1.1.4 - November 10, 2022 - Spanish translation -------------------------------------------------------------------------------- - `#106`_: Add Spanish translation .. _#106: https://github.com/django-otp/django-otp/pull/106 v1.1.3 - November 30, 2021 - Admin template fix -------------------------------------------------------------------------------- - `#89`_: Use the standard `username` context variable for compatibility. .. _#89: https://github.com/django-otp/django-otp/pull/89 v1.1.2 - November 29, 2021 - Forward compatibility -------------------------------------------------------------------------------- - `#93`_: Default to AutoField to avoid spurious migrations. .. _#93: https://github.com/django-otp/django-otp/issues/93 v1.1.1 - September 14, 2021 - Throttling message fix -------------------------------------------------------------------------------- - `#87`_: Fix ``locked_until`` key in throttling reason map. .. _#87: https://github.com/django-otp/django-otp/issues/87 v1.1.0 - September 13, 2021 - Concurrent verification -------------------------------------------------------------------------------- Where possible, all APIs now verify tokens atomically. This prevents race conditions that could result in a token being verified twice as well as closing gaps in throttling enforcement. Low-level integrators may still need to :ref:`manage their own transactions `. v1.0.6 - May 28, 2021 - Email customization -------------------------------------------------------------------------------- - `#82`_: Add ability to pass extra context when rendering :class:`~django_otp.plugins.otp_email.models.EmailDevice` templates. .. _#82: https://github.com/django-otp/django-otp/issues/82 v1.0.5 - May 08, 2021 - config_url fix -------------------------------------------------------------------------------- - `#77`_: Force username to a string in `config_url`. Note that this might not produce a very human-friendly result, but it shouldn't throw an exception. .. _#77: https://github.com/django-otp/django-otp/issues/77 v1.0.4 - April 28, 2021 - Dark mode fix -------------------------------------------------------------------------------- - `#76`_: Django 3.2 supports the prefers-color-scheme media query, so we need to force a white background for QR codes. .. _#76: https://github.com/django-otp/django-otp/issues/76 v1.0.3 - April 03, 2021 - Email body template path setting -------------------------------------------------------------------------------- - `#71`_: Provide time at which throttling lock expires. .. _#71: https://github.com/django-otp/django-otp/issues/71 v1.0.2 - October 23, 2020 - Email body template path setting -------------------------------------------------------------------------------- - Added a setting to load the email body template from a template file. v1.0.1 - October 06, 2020 - Add French translations -------------------------------------------------------------------------------- - Added contributed French string translations. v1.0.0 - August 13, 2020 - Update supported Django verisons. -------------------------------------------------------------------------------- - Dropped support for Django < 2.2. v0.9.4 - August 05, 2020 - Django 3.1 support -------------------------------------------------------------------------------- - `#49`_: Hide the navigation sidebar on the login page. .. _#49: https://github.com/django-otp/django-otp/issues/49 v0.9.3 - June 23, 2020 - June 18, 2020 - Admin fix -------------------------------------------------------------------------------- - Stricter authorization checks for qrcodes in the admin interface. v0.9.1 - May 08, 2020 - Admin fix -------------------------------------------------------------------------------- - `#38`_: Update admin fields for :class:`~django_otp.plugins.otp_email.models.EmailDevice`. .. _#38: https://github.com/django-otp/django-otp/pull/38 v0.9.0 - April 17, 2020 - Improved email device -------------------------------------------------------------------------------- :class:`~django_otp.models.SideChannelDevice` is a new abstract device class to simplify writing devices that deliver tokens to the user by other channels (email, SMS, etc.). - `#33`_, `#34`_ (`arjan-s`_): Implement :class:`~django_otp.models.SideChannelDevice`, reimplement :class:`~django_otp.plugins.otp_email.models.EmailDevice` on top of it, and add a few settings for customization. - Add rate limiting to :class:`~django_otp.plugins.otp_email.models.EmailDevice` and :class:`~django_otp.plugins.otp_static.models.StaticDevice`. .. _#33: https://github.com/django-otp/django-otp/pull/33 .. _#34: https://github.com/django-otp/django-otp/pull/34 .. _arjan-s: https://github.com/arjan-s v0.8.1 - February 08, 2020 - Admin fix -------------------------------------------------------------------------------- - `#26`_: Display OTP Token field on the login page even when user has not yet authenticated. .. _#26: https://github.com/django-otp/django-otp/issues/26 v0.8.0 - February 06, 2020 - Drop Python 2 support -------------------------------------------------------------------------------- - `#17`_: Drop Python 2 support. - `#18`_: Back to a single login template for now. - `#23`_: Allow :setting:`OTP_HOTP_ISSUER` and :setting:`OTP_TOTP_ISSUER` to be callable. .. _#17: https://github.com/django-otp/django-otp/pull/17 .. _#18: https://github.com/django-otp/django-otp/pull/18 .. _#23: https://github.com/django-otp/django-otp/pull/23 v0.7.5 - December 27, 2019 - Django 3.0 support -------------------------------------------------------------------------------- - `#15`_: Add admin template for Django 3.0. .. _#15: https://github.com/django-otp/django-otp/issues/15 v0.7.4 - November 21, 2019 - Cleanup -------------------------------------------------------------------------------- - `#10`_: Remove old admin login templates that are confusing some unrelated tools. .. _#10: https://github.com/django-otp/django-otp/issues/10 v0.7.3 - October 22, 2019 - Minor improvements ---------------------------------------------- - Built-in forms have autocomplete disabled for token widgets. - Fixed miscellaneous typos. v0.7.2 - September 17, 2019 - LoginView fix ------------------------------------------- - `#2`_: Fix LoginView for already-authenticated users, with multiple auth backends configured. .. _#2: https://github.com/django-otp/django-otp/issues/2 v0.7.1 - September 12, 2019 - Preliminary Django 3.0 support ------------------------------------------------------------ Removed dependencies on Python 2 compatibility shims in Django < 3.0. v0.7.0 - August 26, 2019 - Housekeeping --------------------------------------- Removed obsolete compatibility shims. The testing and support matrix is unchanged from 0.6.0, so there should be no impact. v0.6.0 - April 22, 2019 - Failure throttling -------------------------------------------- - Built-in :ref:`HOTP ` and :ref:`TOTP ` devices are now rate-limited, enforcing exponentially increasing delays between successive failures. See the device documentation for information on presenting more useful error messages when this happens, as well as for tuning (or disabling) this behavior. Thanks to Luke Plant for the idea and implementation. v0.5.2 - February 11 - 2019 - Fix URL encoding ---------------------------------------------- - Fix encoding of otpauth:// URL parameters. v0.5.1 - October 24, 2018 - Customizable error messages ------------------------------------------------------- - Error messages in :class:`~django_otp.forms.OTPAuthenticationForm` and :class:`~django_otp.forms.OTPTokenForm` can be customized. v0.5.0 - August 14, 2018 - Django 2.1 support --------------------------------------------- - Remove dependencies on old non-class login views. - Drop support for Django < 1.11. v0.4.3 - March 8, 2018 - Minor static token fix ----------------------------------------------- - Fix return type of :meth:`~django_otp.plugins.otp_static.models.StaticToken.random_token`. v0.4.2 - December 15, 2017 - addstatictoken fix ----------------------------------------------- - Fix addstatictoken string handling under Python 3. v0.4.1 - August 29, 2017 - Misc fixes ------------------------------------- - Improved handling of device persistent identifiers. - Make sure default keys are unicode values. v0.4.0 - July 19, 2017 - Update support matrix ---------------------------------------------- - Fix addstatictoken on Django 1.10+. - Drop support for versions of Django that are past EOL. v0.3.14 - May 30, 2017 - addstatictoken fix ------------------------------------------- - Update addstatictoken command for current Django versions. v0.3.13 - April 11, 2017 - Pickle compatibility ----------------------------------------------- - Allow verified users to be pickled. v0.3.12 - April 2, 2017 - Forward compatibility ----------------------------------------------- - Minor fixes for Django 1.11 and 2.0. v0.3.11 - March 8, 2017 - Built-in QR Code support -------------------------------------------------- - Generate HOTP and TOTP otpauth URLs and corresponding QR Codes. To enable this feature, install ``django-otp[qrcode]`` or just install the `qrcode`_ package. - Support for Python 2.6 and Django 1.4 were dropped in this version (long overdue). .. _qrcode: https://pypi.python.org/pypi/qrcode/ v0.3.8 - November 27, 2016 - Forward compatbility for Django 2.0 ---------------------------------------------------------------- - Treat :attr:`~django.contrib.auth.models.User.is_authenticated` and :attr:`~django.contrib.auth.models.User.is_anonymous` as properties in Django 1.10 and later. - Add explict on_delete behavior for all foreign keys. v0.3.7 - September 24, 2016 - Convenience API --------------------------------------------- - Added a convenience API for verifying TOTP tokens: :meth:`django_otp.oath.TOTP.verify`. v0.3.6 - September 4, 2016 - Django 1.10 ---------------------------------------- - Don't break the laziness of ``request.user``. - Improved error message for invalid tokens. - Support the new middleware API in Django 1.10. v0.3.5 - April 13, 2016 - Fix default TOTP key ---------------------------------------------- - The default (random) key for a new TOTP device is now forced to a unicode string. v0.3.4 - January 10, 2016 - Python 3 cleanup -------------------------------------------- - All modules include all four Python 3 __future__ imports for consistency. - Migrations no longer have byte strings in them. v0.3.3 - October 15, 2015 - Django 1.9 -------------------------------------- - Fix the addstatictoken management command under Django 1.9. v0.3.2 - October 11, 2015 - Django 1.8 -------------------------------------- - Stop importing models into the root of the package. - Use ModelAdmin.raw_id_fields for foreign keys to users. - General cleanup and compatibility with Django 1.9a1. v0.3.1 - April 3, 2015 - Django 1.8 ----------------------------------- - Add support for the new app registry, when available. - Add Django 1.8 to the test matrix and fix a few test bugs. v0.3.0 - February 7, 2015 - Support Django migrations ----------------------------------------------------- - All plugins now have both Django and South migrations. Please see the `upgrade notes`_ for details on upgrading from previous versions. .. _upgrade notes: https://pythonhosted.org/django-otp/overview.html#upgrading v0.2.7 - April 26, 2014 - Fix for Custom user models with South --------------------------------------------------------------- - Updated the otp_totp South migrations to support custom user models. Thanks to https://bitbucket.org/robirichter. v0.2.6 - April 18, 2014 - Fix for Python 3.2 with South ------------------------------------------------------- - Removed South-generated unicode string literals. v0.2.4 - April 15, 2014 - TOTP plugin fix (migration warning) ------------------------------------------------------------- - Per the RFC, :class:`~django_otp.plugins.otp_totp.models.TOTPDevice` will no longer verify the same token twice. - Cosmetic fixes to the admin login form on Django 1.6. .. warning:: This includes a model change in TOTPDevice. If you are upgrading and your project uses South, you should first convert it to South with ``manage migrate otp_totp 0001 --fake``. If you're not using South, you will need to generate and run the appropriate SQL manually. v0.2.3 - March 3, 2014 - Fix pickling ------------------------------------- - OTPMiddleware no longer interferes with pickling request.user. v0.2.2 - December 31, 2013 - Require Django 1.4.2 ------------------------------------------------- - Update Django requirement to 1.4.2, the first version with django.utils.six. v0.2.1 - November 19, 2013 - Bug fix ------------------------------------ - Fix unicode representation of devices in some exotic scenarios. v0.2.0 - November 10, 2013 - Django 1.6 --------------------------------------- - Now supports Django 1.4 to 1.6 on Python 2.6, 2.7, 3.2, and 3.3. This is the first release for Python 3. v0.1.8 - August 20, 2013 - user_has_device API ----------------------------------------------- - Add :func:`django_otp.user_has_device` to detect whether a user has any devices configured. This change supports a fix in django-otp-agents 0.1.4. v0.1.7 - July 3, 2013 - Decorator improvement ----------------------------------------------- - Add if_configured argument to :func:`~django_otp.decorators.otp_required`. v0.1.6 - May 9, 2013 - Unit test improvements --------------------------------------------- - Major unit test cleanup. Tests should pass or be skipped under all supported versions of Django, with or without custom users and timzeone support. v0.1.5 - May 8, 2013 - OTPAdminSite improvement ----------------------------------------------- - OTPAdminSite now selects an apporpriate login template automatically, based on the current Django version. Django versions 1.3 to 1.5 are currently supported. - Unit test cleanup. v0.1.3 - March 10, 2013 - Django 1.5 compatibility -------------------------------------------------- - Add support for custom user models in Django 1.5. - Stop using ``Device.objects``: Django doesn't allow access to an abstract model's manager any more. v0.1.2 - October 8, 2012 - Bug fix ---------------------------------- - Fix an exception when an empty login form is submitted. v0.1.0 - August 20, 2012 - Initial Release ------------------------------------------ Initial release. django-otp-1.3.0/CONTRIBUTING.rst000066400000000000000000000037121452274276400162360ustar00rootroot00000000000000.. vim: tw=80 lbr Contributing ------------ As mentioned in the README, this project is stable and mature. It's not receiving significant ongoing investment, but well-formed fixes and improvements are welcome. "Well-formed" in this context primarily means that it is fully backward-compatible and includes documentation and test coverage. Improvements that can just as well exist as external plugins should be implemented as such. Before checking in, always run ``hatch run check`` to run linters and the test suite. The CI configuration will actually run ``hatch run test:run``, which will test across multiple Python/Django versions for completeness. If you get linter errors, you may be able to fix them with ``hatch run fix``. An important thing to remember is that this is a framework that supports a wide range of plugins. There's only one rule for a plugin: it must inherit from `django_otp.models.Device` and implement one key method. The project provides a collection of mixins and other abstract model classes to help with common functionality, but they are all optional. The key takeaway here is that when considering backward-compatibility, you can assume virtually nothing. In particular, note that adding a new model field to an abstract model class is a breaking change and should be avoided at almost all costs. Updating an existing abstract model in django-otp will trigger the need for migrations in all projects that rely on it, leading to a special kind of dependency hell. New standard functionality options can be added by defining additional mixins if necessary. Stub methods may be added to the root Device class to define common interfaces for such features. As always, remember that writing the code is often the least part of making a change. Understanding the problem and alternative approaches, writing good documentation, making a testing strategy, and demonstrating backward compatibility collectively tend to dwarf actually typing out the implementation. django-otp-1.3.0/LICENSE000066400000000000000000000022741452274276400146040ustar00rootroot00000000000000This is free and unencumbered software released into the public domain. Anyone is free to copy, modify, publish, use, compile, sell, or distribute this software, either in source code form or as a compiled binary, for any purpose, commercial or non-commercial, and by any means. In jurisdictions that recognize copyright laws, the author or authors of this software dedicate any and all copyright interest in the software to the public domain. We make this dedication for the benefit of the public at large and to the detriment of our heirs and successors. We intend this dedication to be an overt act of relinquishment in perpetuity of all present and future rights to this software under copyright law. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. For more information, please refer to django-otp-1.3.0/README.rst000066400000000000000000000146041452274276400152660ustar00rootroot00000000000000.. vim: tw=80 lbr django-otp ========== .. image:: https://img.shields.io/pypi/v/django-otp?color=blue :target: https://pypi.org/project/django-otp/ :alt: PyPI .. image:: https://img.shields.io/readthedocs/django-otp-official :target: https://django-otp-official.readthedocs.io/ :alt: Documentation .. image:: https://img.shields.io/badge/github-django--otp-green :target: https://github.com/django-otp/django-otp :alt: Source This project makes it easy to add support for `one-time passwords `_ (OTPs) to Django. It can be integrated at various levels, depending on how much customization is required. It integrates with ``django.contrib.auth``, although it is not a Django authentication backend. The primary target is developers wishing to incorporate OTPs into their Django projects as a form of `two-factor authentication `_. Several simple OTP plugins are included and more are available separately. This package also includes an implementation of OATH `HOTP `_ and `TOTP `_ for convenience, as these are standard OTP algorithms used by multiple plugins. If you're looking for a higher-level or more opinionated solution, you might be interested in `django-two-factor-auth `_. Status ------ This project is stable and maintained, but is no longer actively used by the author and is not seeing much ongoing investment. Well-formed issues and pull requests are welcome, but please see CONTRIBUTING.rst first. General questions and ideas should be directed to the Discussions section; issues should be reserved for confirmed bugs. .. end-of-doc-intro Development ----------- This project is built and managed with `hatch`_. If you don't have hatch, I recommend installing it with `pipx`_: ``pipx install hatch``. ``pyproject.toml`` defines several useful scripts for development and testing. The default environment includes all dev and test dependencies for quickly running tests. The ``test`` environment defines the test matrix for running the full validation suite. Everything is executed in the context of the Django project in test/test\_project. As a quick primer, hatch scripts can be run with ``hatch run [:] {% endblock %} django-otp-1.3.0/src/django_otp/tests.py000066400000000000000000000475161452274276400202360ustar00rootroot00000000000000from datetime import timedelta from doctest import DocTestSuite from io import StringIO import pickle from threading import Thread import unittest from freezegun import freeze_time from django.contrib.auth import get_user_model from django.contrib.auth.models import AnonymousUser from django.core.management import call_command from django.core.management.base import CommandError from django.db import IntegrityError, connection from django.test import RequestFactory from django.test import TestCase as DjangoTestCase from django.test import TransactionTestCase as DjangoTransactionTestCase from django.test import skipUnlessDBFeature from django.test.utils import override_settings from django.urls import reverse from django.utils import timezone from django_otp import ( DEVICE_ID_SESSION_KEY, match_token, oath, user_has_device, util, verify_token, ) from django_otp.forms import OTPTokenForm from django_otp.middleware import OTPMiddleware from django_otp.models import GenerateNotAllowed, VerifyNotAllowed from django_otp.plugins.otp_static.models import StaticDevice, StaticToken def load_tests(loader, tests, pattern): suite = unittest.TestSuite() suite.addTests(tests) suite.addTest(DocTestSuite(util)) suite.addTest(DocTestSuite(oath)) return suite class TestThread(Thread): "Django testing quirk: threads have to close their DB connections." def run(self): super().run() connection.close() class OTPTestCaseMixin: """ Utilities for dealing with custom user models. """ @classmethod def setUpClass(cls): super().setUpClass() cls.User = get_user_model() cls.USERNAME_FIELD = cls.User.USERNAME_FIELD def create_user(self, username, password, **kwargs): """ Try to create a user, honoring the custom user model, if any. This may raise an exception if the user model is too exotic for our purposes. """ return self.User.objects.create_user(username, password=password, **kwargs) class TestCase(OTPTestCaseMixin, DjangoTestCase): pass class TransactionTestCase(OTPTestCaseMixin, DjangoTransactionTestCase): pass class ThrottlingTestMixin: """ Generic tests for throttled devices. Any concrete device implementation that uses throttling should define a TestCase subclass that includes this as a base class. This will help verify a correct integration of ThrottlingMixin. Subclasses are responsible for populating self.device with a device to test as well as implementing methods to generate tokens to test with. """ def setUp(self): self.device = None def valid_token(self): """Returns a valid token to pass to our device under test.""" raise NotImplementedError() def invalid_token(self): """Returns an invalid token to pass to our device under test.""" raise NotImplementedError() # # Tests # def test_delay_imposed_after_fail(self): verified1 = self.device.verify_token(self.invalid_token()) self.assertFalse(verified1) verified2 = self.device.verify_token(self.valid_token()) self.assertFalse(verified2) def test_delay_after_fail_expires(self): verified1 = self.device.verify_token(self.invalid_token()) self.assertFalse(verified1) with freeze_time() as frozen_time: # With default settings initial delay is 1 second frozen_time.tick(delta=timedelta(seconds=1.1)) verified2 = self.device.verify_token(self.valid_token()) self.assertTrue(verified2) def test_throttling_failure_count(self): self.assertEqual(self.device.throttling_failure_count, 0) for i in range(0, 5): self.device.verify_token(self.invalid_token()) # Only the first attempt will increase throttling_failure_count, # the others will all be within 1 second of first # and therefore not count as attempts. self.assertEqual(self.device.throttling_failure_count, 1) def test_verify_is_allowed(self): # Initially should be allowed verify_is_allowed1, data1 = self.device.verify_is_allowed() self.assertEqual(verify_is_allowed1, True) self.assertEqual(data1, None) # After failure, verify is not allowed with freeze_time(): self.device.verify_token(self.invalid_token()) verify_is_allowed2, data2 = self.device.verify_is_allowed() self.assertEqual(verify_is_allowed2, False) self.assertEqual( data2, { 'reason': VerifyNotAllowed.N_FAILED_ATTEMPTS, 'failure_count': 1, 'locked_until': timezone.now() + timezone.timedelta(seconds=1), }, ) # After a successful attempt, should be allowed again with freeze_time() as frozen_time: frozen_time.tick(delta=timedelta(seconds=1.1)) self.device.verify_token(self.valid_token()) verify_is_allowed3, data3 = self.device.verify_is_allowed() self.assertEqual(verify_is_allowed3, True) self.assertEqual(data3, None) class CooldownTestMixin: def setUp(self): self.device = None def valid_token(self): """Returns a valid token to pass to our device under test.""" raise NotImplementedError() def invalid_token(self): """Returns an invalid token to pass to our device under test.""" raise NotImplementedError() # # Tests # def test_generate_is_allowed_on_first_try(self): """Token generation should be allowed on first try.""" allowed, _ = self.device.generate_is_allowed() self.assertTrue(allowed) def test_cooldown_imposed_after_successful_generation(self): """ Token generation before cooldown should not be allowed and the relevant reason should be returned. """ with freeze_time(): self.device.generate_challenge() self.device.refresh_from_db() allowed, details = self.device.generate_is_allowed() self.assertFalse(allowed) self.assertEqual( details['reason'], GenerateNotAllowed.COOLDOWN_DURATION_PENDING ) def test_cooldown_expire_time(self): """ When token generation is not allowed, the cooldown expire time should be returned. """ with freeze_time(): self.device.generate_challenge() self.device.refresh_from_db() _, details = self.device.generate_is_allowed() self.assertEqual( details['next_generation_at'], timezone.now() + timedelta(seconds=10) ) def test_cooldown_reset(self): """Cooldown can be reset and allow token generation again before the initial period expires.""" with freeze_time(): self.device.generate_is_allowed() self.device.refresh_from_db() self.device.cooldown_reset() self.device.refresh_from_db() allowed, _ = self.device.generate_is_allowed() self.assertTrue(allowed) def test_valid_token_verification_resets_cooldown(self): """When the token is verified, the cooldown period is reset.""" with freeze_time(): self.device.generate_challenge() self.device.refresh_from_db() verified = self.device.verify_token(self.valid_token()) self.assertTrue(verified) self.device.refresh_from_db() allowed, _ = self.device.generate_is_allowed() self.assertTrue(allowed) def test_invalid_token_verification_does_not_reset_cooldown(self): """When the token is not verified, the cooldown period is not reset.""" with freeze_time(): self.device.generate_challenge() self.device.refresh_from_db() verified = self.device.verify_token(self.invalid_token()) self.assertFalse(verified) self.device.refresh_from_db() allowed, _ = self.device.generate_is_allowed() self.assertFalse(allowed) @override_settings(OTP_STATIC_THROTTLE_FACTOR=0) class APITestCase(TestCase): def setUp(self): try: self.alice = self.create_user('alice', 'password') self.bob = self.create_user('bob', 'password') except IntegrityError: self.skipTest("Unable to create a test user.") else: device = self.alice.staticdevice_set.create() device.token_set.create(token='alice') def test_user_has_device(self): with self.subTest(user='anonymous'): self.assertFalse(user_has_device(AnonymousUser())) with self.subTest(user='alice'): self.assertTrue(user_has_device(self.alice)) with self.subTest(user='bob'): self.assertFalse(user_has_device(self.bob)) def test_verify_token(self): device = self.alice.staticdevice_set.first() verified = verify_token(self.alice, device.persistent_id, 'bogus') self.assertIsNone(verified) verified = verify_token(self.alice, device.persistent_id, 'alice') self.assertIsNotNone(verified) def test_match_token(self): verified = match_token(self.alice, 'bogus') self.assertIsNone(verified) verified = match_token(self.alice, 'alice') self.assertEqual(verified, self.alice.staticdevice_set.first()) class OTPMiddlewareTestCase(TestCase): def setUp(self): self.factory = RequestFactory() try: self.alice = self.create_user('alice', 'password') self.bob = self.create_user('bob', 'password') except IntegrityError: self.skipTest("Unable to create a test user.") else: for user in [self.alice, self.bob]: device = user.staticdevice_set.create() device.token_set.create(token=user.get_username()) self.middleware = OTPMiddleware(lambda r: None) def test_verified(self): request = self.factory.get('/') request.user = self.alice device = self.alice.staticdevice_set.get() request.session = {DEVICE_ID_SESSION_KEY: device.persistent_id} self.middleware(request) self.assertTrue(request.user.is_verified()) def test_verified_legacy_device_id(self): request = self.factory.get('/') request.user = self.alice device = self.alice.staticdevice_set.get() request.session = { DEVICE_ID_SESSION_KEY: '{}.{}/{}'.format( device.__module__, device.__class__.__name__, device.id ) } self.middleware(request) self.assertTrue(request.user.is_verified()) def test_unverified(self): request = self.factory.get('/') request.user = self.alice request.session = {} self.middleware(request) self.assertFalse(request.user.is_verified()) def test_no_device(self): request = self.factory.get('/') request.user = self.alice request.session = { DEVICE_ID_SESSION_KEY: 'otp_static.staticdevice/0', } self.middleware(request) self.assertFalse(request.user.is_verified()) def test_no_model(self): request = self.factory.get('/') request.user = self.alice request.session = { DEVICE_ID_SESSION_KEY: 'otp_bogus.bogusdevice/0', } self.middleware(request) self.assertFalse(request.user.is_verified()) def test_wrong_user(self): request = self.factory.get('/') request.user = self.alice device = self.bob.staticdevice_set.get() request.session = {DEVICE_ID_SESSION_KEY: device.persistent_id} self.middleware(request) self.assertFalse(request.user.is_verified()) def test_pickling(self): request = self.factory.get('/') request.user = self.alice device = self.alice.staticdevice_set.get() request.session = {DEVICE_ID_SESSION_KEY: device.persistent_id} self.middleware(request) # Should not raise an exception. pickle.dumps(request.user) class LoginViewTestCase(TestCase): def setUp(self): try: self.alice = self.create_user('alice', 'password') self.bob = self.create_user('bob', 'password', is_staff=True) except IntegrityError: self.skipTest("Unable to create a test user.") else: for user in [self.alice, self.bob]: device = user.staticdevice_set.create() device.token_set.create(token=user.get_username()) def test_admin_login_template(self): response = self.client.get(reverse('otpadmin:login')) self.assertContains(response, 'Username:') self.assertContains(response, 'Password:') self.assertNotContains(response, 'OTP Device:') self.assertContains(response, 'OTP Token:') response = self.client.post( reverse('otpadmin:login'), data={ 'username': self.bob.get_username(), 'password': 'password', }, ) self.assertContains(response, 'Username:') self.assertContains(response, 'Password:') self.assertContains(response, 'OTP Device:') self.assertContains(response, 'OTP Token:') device = self.bob.staticdevice_set.get() token = device.token_set.get() response = self.client.post( reverse('otpadmin:login'), data={ 'username': self.bob.get_username(), 'password': 'password', 'otp_device': device.persistent_id, 'otp_token': token.token, 'next': '/', }, ) self.assertRedirects(response, '/') def test_authenticate(self): device = self.alice.staticdevice_set.get() token = device.token_set.get() params = { 'username': self.alice.get_username(), 'password': 'password', 'otp_device': device.persistent_id, 'otp_token': token.token, 'next': '/', } response = self.client.post(reverse('login'), params) self.assertRedirects(response, '/') response = self.client.get('/') self.assertInHTML( f'{self.alice.get_username()}', response.content.decode(response.charset), ) def test_verify(self): device = self.alice.staticdevice_set.get() token = device.token_set.get() params = { 'otp_device': device.persistent_id, 'otp_token': token.token, 'next': '/', } self.client.login(username=self.alice.get_username(), password='password') response = self.client.post(reverse('login-otp'), params) self.assertRedirects(response, '/') response = self.client.get('/') self.assertInHTML( f'{self.alice.get_username()}', response.content.decode(response.charset), ) @skipUnlessDBFeature('has_select_for_update') @override_settings(OTP_STATIC_THROTTLE_FACTOR=0) class ConcurrencyTestCase(TransactionTestCase): def setUp(self): try: self.alice = self.create_user('alice', 'password') self.bob = self.create_user('bob', 'password') except IntegrityError: self.skipTest("Unable to create a test user.") else: for user in [self.alice, self.bob]: device = user.staticdevice_set.create() device.token_set.create(token='valid') def test_verify_token(self): class VerifyThread(Thread): def __init__(self, user, device_id, token): super().__init__() self.user = user self.device_id = device_id self.token = token self.verified = None def run(self): self.verified = verify_token(self.user, self.device_id, self.token) connection.close() device = self.alice.staticdevice_set.get() threads = [ VerifyThread(device.user, device.persistent_id, 'valid') for _ in range(10) ] for thread in threads: thread.start() for thread in threads: thread.join() self.assertEqual(sum(1 for t in threads if t.verified is not None), 1) def test_match_token(self): class VerifyThread(Thread): def __init__(self, user, token): super().__init__() self.user = user self.token = token self.verified = None def run(self): self.verified = match_token(self.user, self.token) connection.close() threads = [VerifyThread(self.alice, 'valid') for _ in range(10)] for thread in threads: thread.start() for thread in threads: thread.join() self.assertEqual(sum(1 for t in threads if t.verified is not None), 1) def test_concurrent_throttle_count(self): self._test_throttling_concurrency(thread_count=10, expected_failures=10) @override_settings(OTP_STATIC_THROTTLE_FACTOR=1) def test_serialized_throttling(self): # After the first failure, verification will be skipped and the count # will not be incremented. self._test_throttling_concurrency(thread_count=10, expected_failures=1) def _test_throttling_concurrency(self, thread_count, expected_failures): forms = ( OTPTokenForm( device.user, None, {'otp_device': device.persistent_id, 'otp_token': 'bogus'}, ) for _ in range(thread_count) for device in StaticDevice.objects.all() ) threads = [TestThread(target=form.is_valid) for form in forms] for thread in threads: thread.start() for thread in threads: thread.join() for device in StaticDevice.objects.all(): with self.subTest(user=device.user.get_username()): self.assertEqual(device.throttling_failure_count, expected_failures) class AddStaticTokenTestCase(TestCase): def setUp(self): try: self.alice = self.create_user('alice', 'password') self.bob = self.create_user('bob', 'password', is_staff=True) except IntegrityError: self.skipTest("Unable to create a test user.") def test_no_user(self): with self.assertRaises(CommandError): call_command('addstatictoken', 'bogus') def test_new_device(self): out = StringIO() call_command('addstatictoken', 'alice', stdout=out) token = out.getvalue().strip() static_token = StaticToken.objects.select_related('device__user').get( token=token ) self.assertEqual(static_token.device.user, self.alice) def test_existing_device(self): device = self.alice.staticdevice_set.create() out = StringIO() call_command('addstatictoken', 'alice', stdout=out) token = out.getvalue().strip() static_token = StaticToken.objects.select_related('device__user').get( token=token ) self.assertEqual(static_token.device, device) def test_explicit_token(self): device = self.alice.staticdevice_set.create() out = StringIO() call_command('addstatictoken', 'alice', '-t', 'secret-token', stdout=out) token = out.getvalue().strip() static_token = StaticToken.objects.select_related('device__user').get( token=token ) self.assertEqual(token, 'secret-token') self.assertEqual(static_token.device, device) django-otp-1.3.0/src/django_otp/util.py000066400000000000000000000046241452274276400200420ustar00rootroot00000000000000from binascii import unhexlify from os import urandom import random import string from django.core.exceptions import ValidationError def hex_validator(length=0): """ Returns a function to be used as a model validator for a hex-encoded CharField. This is useful for secret keys of all kinds:: def key_validator(value): return hex_validator(20)(value) key = models.CharField(max_length=40, validators=[key_validator], help_text='A hex-encoded 20-byte secret key') :param int length: If greater than 0, validation will fail unless the decoded value is exactly this number of bytes. :rtype: function >>> hex_validator()('0123456789abcdef') >>> hex_validator(8)(b'0123456789abcdef') >>> hex_validator()('phlebotinum') # doctest: +IGNORE_EXCEPTION_DETAIL Traceback (most recent call last): ... ValidationError: ['phlebotinum is not valid hex-encoded data.'] >>> hex_validator(9)('0123456789abcdef') # doctest: +IGNORE_EXCEPTION_DETAIL Traceback (most recent call last): ... ValidationError: ['0123456789abcdef does not represent exactly 9 bytes.'] """ def _validator(value): try: if isinstance(value, str): value = value.encode() unhexlify(value) except Exception: raise ValidationError('{0} is not valid hex-encoded data.'.format(value)) if (length > 0) and (len(value) != length * 2): raise ValidationError( '{0} does not represent exactly {1} bytes.'.format(value, length) ) return _validator def random_hex(length=20): """ Returns a string of random bytes encoded as hex. This uses :func:`os.urandom`, so it should be suitable for generating cryptographic keys. :param int length: The number of (decoded) bytes to return. :returns: A string of hex digits. :rtype: str """ return urandom(length).hex() def random_number_token(length=6): """ Returns a string of random digits encoded as string. :param int length: The number of digits to return. :returns: A string of decimal digits. :rtype: str """ rand = random.SystemRandom() if hasattr(rand, 'choices'): digits = rand.choices(string.digits, k=length) else: digits = (rand.choice(string.digits) for i in range(length)) return ''.join(digits) django-otp-1.3.0/src/django_otp/views.py000066400000000000000000000032401452274276400202130ustar00rootroot00000000000000from functools import partial from django.contrib.auth import BACKEND_SESSION_KEY from django.contrib.auth import views as auth_views from django.utils.functional import cached_property from django_otp.forms import OTPAuthenticationForm, OTPTokenForm class LoginView(auth_views.LoginView): """ This is a replacement for :class:`django.contrib.auth.views.LoginView` that requires two-factor authentication. It's slightly clever: if the user is already authenticated but not verified, it will only ask the user for their OTP token. If the user is anonymous or is already verified by an OTP device, it will use the full username/password/token form. In order to use this, you must supply a template that is compatible with both :class:`~django_otp.forms.OTPAuthenticationForm` and :class:`~django_otp.forms.OTPTokenForm`. This is a good view for :setting:`OTP_LOGIN_URL`. """ otp_authentication_form = OTPAuthenticationForm otp_token_form = OTPTokenForm @cached_property def authentication_form(self): user = self.request.user if user.is_anonymous or user.is_verified(): form = self.otp_authentication_form else: form = partial(self.otp_token_form, user) return form def form_valid(self, form): # OTPTokenForm does not call authenticate(), so we may need to populate # user.backend ourselves to keep login() happy. user = form.get_user() if not hasattr(user, 'backend'): user.backend = self.request.session[BACKEND_SESSION_KEY] return super().form_valid(form) # Backwards compatibility. login = LoginView.as_view() django-otp-1.3.0/test/000077500000000000000000000000001452274276400145515ustar00rootroot00000000000000django-otp-1.3.0/test/config/000077500000000000000000000000001452274276400160165ustar00rootroot00000000000000django-otp-1.3.0/test/config/github.toml000066400000000000000000000002741452274276400202000ustar00rootroot00000000000000# Configuration for our GitHub workflows and codespaces. [database] ENGINE = "django.db.backends.postgresql" HOST = "localhost" NAME = "django-otp" USER = "postgres" PASSWORD = "postgres" django-otp-1.3.0/test/config/sample.toml000066400000000000000000000010001452274276400201630ustar00rootroot00000000000000# A list of plugins to add to INSTALLED_APPS. You'll need to install relevant # packages into your environment manually. plugins = [] # Additional middleware to add between AuthenticationMiddleware and # OTPMiddleware. For more complex configs, you can override MIDDLEWARE entirely # under [settings]. middleware = [] # The value of DATABASES["default"]. [database] ENGINE = "django.db.backends.postgresql" NAME = "django-otp" USER = "postgres" # Any other settings to add. [settings] MY_SETTING = "my-value" django-otp-1.3.0/test/test_project/000077500000000000000000000000001452274276400172565ustar00rootroot00000000000000django-otp-1.3.0/test/test_project/__init__.py000066400000000000000000000000001452274276400213550ustar00rootroot00000000000000django-otp-1.3.0/test/test_project/backends.py000066400000000000000000000002031452274276400213750ustar00rootroot00000000000000class DummyBackend: def authenticate(self, request): return None def get_user(self, user_id): return None django-otp-1.3.0/test/test_project/config.py000066400000000000000000000013741452274276400211020ustar00rootroot00000000000000import os.path from django.core.exceptions import ImproperlyConfigured try: import tomllib except ModuleNotFoundError: import tomli as tomllib def _load_config(path: str, required) -> dict: if os.path.exists(path): with open(path, 'rb') as f: config = tomllib.load(f) elif required: raise ImproperlyConfigured(f"{path} does not exist.") else: config = {} return config def load() -> dict: path = os.getenv('DJANGO_OTP_CONFIG') env = os.getenv('HATCH_ENV_ACTIVE', '').split('.', 1)[0] if path: config = _load_config(path, required=True) elif env: config = _load_config(f'test/config/env-{env}.toml', required=False) else: config = {} return config django-otp-1.3.0/test/test_project/settings.py000066400000000000000000000045741452274276400215020ustar00rootroot00000000000000# django-otp test project from os.path import abspath, dirname, join from django.urls import reverse_lazy from . import config def project_path(path): return abspath(join(dirname(__file__), path)) cfg = config.load() DEBUG = True DATABASES = { 'default': cfg.get('database') or { 'ENGINE': 'django.db.backends.sqlite3', 'NAME': project_path('db.sqlite3'), } } INSTALLED_APPS = [ 'django.contrib.admin', 'django.contrib.auth', 'django.contrib.contenttypes', 'django.contrib.sessions', 'django.contrib.messages', 'django.contrib.staticfiles', 'django_otp', 'django_otp.plugins.otp_email', 'django_otp.plugins.otp_hotp', 'django_otp.plugins.otp_static', 'django_otp.plugins.otp_totp', ] INSTALLED_APPS.extend(cfg.get('plugins', [])) middleware_pre = [ 'django.middleware.security.SecurityMiddleware', 'django.contrib.sessions.middleware.SessionMiddleware', 'django.middleware.common.CommonMiddleware', 'django.middleware.csrf.CsrfViewMiddleware', 'django.contrib.auth.middleware.AuthenticationMiddleware', ] middleware_post = [ 'django_otp.middleware.OTPMiddleware', 'django.contrib.messages.middleware.MessageMiddleware', 'django.middleware.clickjacking.XFrameOptionsMiddleware', ] MIDDLEWARE = middleware_pre + cfg.get('middleware', []) + middleware_post AUTHENTICATION_BACKENDS = [ 'django.contrib.auth.backends.ModelBackend', 'test_project.backends.DummyBackend', ] TEMPLATES = [ { 'BACKEND': 'django.template.backends.django.DjangoTemplates', 'APP_DIRS': True, 'DIRS': [ project_path('templates'), ], 'OPTIONS': { 'context_processors': [ 'django.template.context_processors.debug', 'django.template.context_processors.request', 'django.contrib.auth.context_processors.auth', 'django.contrib.messages.context_processors.messages', ], }, }, ] EMAIL_BACKEND = 'django.core.mail.backends.console.EmailBackend' SECRET_KEY = 'test-key' ROOT_URLCONF = 'test_project.urls' STATIC_URL = '/static/' LOGIN_URL = reverse_lazy('login') LOGIN_REDIRECT_URL = reverse_lazy('home') LOGOUT_REDIRECT_URL = reverse_lazy('home') OTP_LOGIN_URL = reverse_lazy('login-otp') USE_TZ = True for k, v in cfg.get('settings', {}).items(): globals()[k] = v django-otp-1.3.0/test/test_project/templates/000077500000000000000000000000001452274276400212545ustar00rootroot00000000000000django-otp-1.3.0/test/test_project/templates/about.html000066400000000000000000000011061452274276400232520ustar00rootroot00000000000000{% extends "root.html" %} {% block main %}

About

This is a simple demo app for development and testing of django-otp. The home page just displays your current authentication status. The navbar contains links to views with different combinations of decorators to force authentication and/or verification. All views redirect to the home page, where you can see the result.

There are also links to the admin site (with and without OTP required), plus links directly to the login page (with out without OTP required).

{% endblock %} django-otp-1.3.0/test/test_project/templates/bs5/000077500000000000000000000000001452274276400217455ustar00rootroot00000000000000django-otp-1.3.0/test/test_project/templates/bs5/input.html000066400000000000000000000007141452274276400237740ustar00rootroot00000000000000{# vim: set ft=htmldjango sw=2 sts=2 #} {% if field.help_text %}
{{ field.help_text }}
{% endif %} {% for error in field.errors %}
{{ error }}
{% endfor %} django-otp-1.3.0/test/test_project/templates/bs5/select.html000066400000000000000000000006541452274276400241170ustar00rootroot00000000000000{# vim: set ft=htmldjango sw=2 sts=2 #} {% if field.help_text %}
{{ field.help_text }}
{% endif %} {% for error in field.errors %}
{{ error }}
{% endfor %} django-otp-1.3.0/test/test_project/templates/home.html000066400000000000000000000012401452274276400230670ustar00rootroot00000000000000{% extends "root.html" %} {% block main %}

Status

Username {% if user.is_authenticated %} {{ user.get_username }} {% else %} anonymous {% endif %}
Verified by {% if user.otp_device %} {{ user.otp_device }}
{{ user.otp_device.persistent_id }} {% else %} none {% endif %}
{% endblock %} django-otp-1.3.0/test/test_project/templates/navbar.html000066400000000000000000000046021452274276400234150ustar00rootroot00000000000000{# vim: set ft=htmldjango sts=2 sw=2 #} django-otp-1.3.0/test/test_project/templates/otp/000077500000000000000000000000001452274276400220565ustar00rootroot00000000000000django-otp-1.3.0/test/test_project/templates/otp/email/000077500000000000000000000000001452274276400231455ustar00rootroot00000000000000django-otp-1.3.0/test/test_project/templates/otp/email/custom.txt000066400000000000000000000000331452274276400252140ustar00rootroot00000000000000Test template 3: {{token}} django-otp-1.3.0/test/test_project/templates/otp/email/custom_html.html000066400000000000000000000000221452274276400263630ustar00rootroot00000000000000

{{ token }}

django-otp-1.3.0/test/test_project/templates/otp/email/token.txt000066400000000000000000000000331452274276400250220ustar00rootroot00000000000000Test template 1: {{token}} django-otp-1.3.0/test/test_project/templates/registration/000077500000000000000000000000001452274276400237665ustar00rootroot00000000000000django-otp-1.3.0/test/test_project/templates/registration/logged_out.html000066400000000000000000000000001452274276400267720ustar00rootroot00000000000000django-otp-1.3.0/test/test_project/templates/registration/login.html000066400000000000000000000022131452274276400257620ustar00rootroot00000000000000{% extends "root.html" %} {% block main %} {% if form.username %}

Log in

{% elif form.otp_token %}

Verify

{% endif %} {% for error in form.non_field_errors %}
{{ error }}
{% endfor %}
{% csrf_token %} {% if form.username %}
{% include "bs5/input.html" with field=form.username %}
{% endif %} {% if form.password %}
{% include "bs5/input.html" with field=form.password type="password" %}
{% endif %} {% if form.otp_device and form.get_user %}
{% include "bs5/select.html" with field=form.otp_device %}
{% endif %} {% if form.otp_token %}
{% include "bs5/input.html" with field=form.otp_token %}
{% endif %}
{% if form.otp_token and form.get_user %}{% endif %}
{% endblock %} django-otp-1.3.0/test/test_project/templates/root.html000066400000000000000000000022251452274276400231260ustar00rootroot00000000000000{# vim: set ft=htmldjango sts=2 sw=2 #} django-otp demo {% include "navbar.html" %}
{% block main %}{% endblock %}
django-otp-1.3.0/test/test_project/urls.py000066400000000000000000000020251452274276400206140ustar00rootroot00000000000000from django.contrib import admin import django.contrib.auth.views from django.urls import path from django_otp.admin import OTPAdminSite import django_otp.views from . import views otp_admin_site = OTPAdminSite(OTPAdminSite.name) for model_cls, model_admin in admin.site._registry.items(): otp_admin_site.register(model_cls, model_admin.__class__) urlpatterns = [ path('', views.Home.as_view(), name='home'), path('about/', views.About.as_view(), name='about'), path('login/', django.contrib.auth.views.LoginView.as_view(), name='login'), path('logout/', django.contrib.auth.views.LogoutView.as_view(), name='logout'), path('login-otp/', django_otp.views.LoginView.as_view(), name='login-otp'), path('require-login/', views.require_login, name='require-login'), path('require-otp/', views.require_otp, name='require-otp'), path('require-login-then-otp/', views.require_login_then_otp, name='require-login-then-otp'), path('admin/', admin.site.urls), path('otpadmin/', otp_admin_site.urls), ] django-otp-1.3.0/test/test_project/views.py000066400000000000000000000012241452274276400207640ustar00rootroot00000000000000from django.contrib.auth.decorators import login_required from django.http import HttpResponseRedirect from django.urls import reverse from django.views.generic.base import TemplateView from django_otp.decorators import otp_required class Home(TemplateView): template_name = "home.html" class About(TemplateView): template_name = "about.html" @login_required def require_login(request): return HttpResponseRedirect(reverse('home')) @otp_required def require_otp(request): return HttpResponseRedirect(reverse('home')) @login_required @otp_required def require_login_then_otp(request): return HttpResponseRedirect(reverse('home'))