81 lines
2.9 KiB
Python
81 lines
2.9 KiB
Python
# Copyright 2026 Google LLC
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
from datetime import datetime, timedelta, timezone
|
|
import logging
|
|
import secrets
|
|
from app.config import settings
|
|
|
|
logger = logging.getLogger("artemis.otp")
|
|
|
|
|
|
class OTPService:
|
|
"""Manages generation, storage, dispatch, and verification of One-Time Passwords."""
|
|
|
|
def __init__(self):
|
|
# In-memory storage: identifier -> {"code": str, "expires_at": datetime}
|
|
self._store: dict[str, dict] = {}
|
|
|
|
def generate_otp(self, identifier: str) -> str:
|
|
"""Generate a secure 6-digit OTP code and record its expiration."""
|
|
# Clean identifier
|
|
ident = identifier.strip().lower()
|
|
|
|
# If DEV_MOCK_OTP is configured, use it for local/test environments
|
|
if settings.DEV_MOCK_OTP:
|
|
code = settings.DEV_MOCK_OTP
|
|
else:
|
|
code = f"{secrets.randbelow(900000) + 100000}"
|
|
|
|
expires_at = datetime.now(timezone.utc) + timedelta(seconds=settings.OTP_EXPIRE_SECONDS)
|
|
self._store[ident] = {
|
|
"code": code,
|
|
"expires_at": expires_at,
|
|
}
|
|
|
|
# Dispatch via SMS / Email provider (mocked logger in template)
|
|
logger.info(f"[OTP Service] Generated OTP for {ident}: [{code}] (Expires at: {expires_at.isoformat()})")
|
|
return code
|
|
|
|
def verify_otp(self, identifier: str, code: str) -> bool:
|
|
"""Verify an OTP code against stored records and consume it."""
|
|
ident = identifier.strip().lower()
|
|
record = self._store.get(ident)
|
|
|
|
# Allow fallback mock code for local testing
|
|
if settings.DEV_MOCK_OTP and code == settings.DEV_MOCK_OTP:
|
|
logger.info(f"[OTP Service] Development mock OTP accepted for {ident}")
|
|
self._store.pop(ident, None)
|
|
return True
|
|
|
|
if not record:
|
|
logger.warning(f"[OTP Service] No active OTP found for {ident}")
|
|
return False
|
|
|
|
if datetime.now(timezone.utc) > record["expires_at"]:
|
|
logger.warning(f"[OTP Service] OTP for {ident} has expired")
|
|
self._store.pop(ident, None)
|
|
return False
|
|
|
|
if secrets.compare_digest(record["code"], code.strip()):
|
|
logger.info(f"[OTP Service] OTP successfully verified for {ident}")
|
|
self._store.pop(ident, None) # Consume code
|
|
return True
|
|
|
|
logger.warning(f"[OTP Service] Invalid OTP attempt for {ident}")
|
|
return False
|
|
|
|
|
|
otp_service = OTPService()
|