Two-Factor Authentication (2FA)

import pyotp
import time

def gen_key():
    """Generate a secret key for the user"""
    return pyotp.random_base32()

def gen_url(key, username):
    """Generate provisioning URI for QR code"""
    return pyotp.totp.TOTP(key).provisioning_uri(
        name=username,
        issuer_name='Normo Unsecure PWA'
    )

def generate_code(key: str):
    """Generate current TOTP code"""
    totp = pyotp.TOTP(key)
    return totp.now()

def verify_code(key: str, code: str):
    """Verify user-provided code"""
    totp = pyotp.TOTP(key)
    return totp.verify(code)

# Example usage
key = gen_key()  # Store this in database for each user
print(f"Secret Key: {key}")

uri = gen_url(key, "[email protected]")
print(f"QR Code URI: {uri}")

code = generate_code(key)
print(f"Current Code: {code}")

# Verify the code
user_input = input("Enter code from authenticator app: ")
if verify_code(key, user_input):
    print("✓ Code verified!")
else:
    print("✗ Invalid code")

import os
from dotenv import load_dotenv
from flask import Flask, request, render_template, redirect, session, url_for
from twilio.rest import Client

load_dotenv()
app = Flask(__name__)
app.secret_key = os.environ.get('SECRET_KEY')

TWILIO_ACCOUNT_SID = os.environ.get('TWILIO_ACCOUNT_SID')
TWILIO_AUTH_TOKEN = os.environ.get('TWILIO_AUTH_TOKEN')
TWILIO_VERIFY_SERVICE = os.environ.get('TWILIO_VERIFY_SERVICE')

client = Client(TWILIO_ACCOUNT_SID, TWILIO_AUTH_TOKEN)

@app.route('/', methods=['GET', 'POST'])
def login():
    if request.method == 'POST':
        # First, verify username/password
        username = request.form['username']
        password = request.form['password']
        
        # Assume login is successful
        # Get user's email from database
        to_email = "[email protected]"  # From database
        
        session['username'] = username
        session['to_email'] = to_email
        
        # Send verification code
        send_verification(to_email)
        
        return redirect(url_for('verify_page'))
    
    return render_template('index.html')

def send_verification(to_email):
    """Send verification code via email"""
    verification = client.verify \
        .services(TWILIO_VERIFY_SERVICE) \
        .verifications \
        .create(to=to_email, channel='email')
    print(f"Verification sent: {verification.sid}")

@app.route("/verify", methods=['GET', 'POST'])
def verify_page():
    to_email = session.get('to_email')
    error = None
    
    if request.method == 'POST':
        verification_code = request.form['verificationcode']
        
        if check_verification_token(to_email, verification_code):
            session['logged_in'] = True
            return render_template('success.html', 
                email=to_email
            )
        else:
            error = "Invalid verification code. Please try again."
            return render_template('verify.html', error=error)
    
    return render_template('verify.html', email=to_email)

def check_verification_token(email, token):
    """Verify the code entered by user"""
    check = client.verify \
        .services(TWILIO_VERIFY_SERVICE) \
        .verification_checks \
        .create(to=email, code=token)
    return check.status == 'approved'

import unittest
import pyotp

class Test2FA(unittest.TestCase):
    def test_totp_generation(self):
        secret = pyotp.random_base32()
        totp = pyotp.TOTP(secret)
        code = totp.now()
        
        # Code should be 6 digits
        self.assertEqual(len(code), 6)
        self.assertTrue(code.isdigit())
    
    def test_totp_verification(self):
        secret = pyotp.random_base32()
        totp = pyotp.TOTP(secret)
        code = totp.now()
        
        # Valid code should verify
        self.assertTrue(totp.verify(code))
        
        # Invalid code should fail
        self.assertFalse(totp.verify('000000'))
    
    def test_time_window(self):
        secret = pyotp.random_base32()
        totp = pyotp.TOTP(secret)
        
        # Code should remain valid for ~30 seconds
        code = totp.now()
        time.sleep(1)
        self.assertTrue(totp.verify(code))