GlcoinCore/RTL
1
0
Fork 0
mirror of https://github.com/Ride-The-Lightning/RTL.git synced 2026-08-13 12:33:07 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Address review: soften parity comment, guard async verify double-click

Browse source 
Two non-blocking review points on #1644:

- createHmacKey's comment claimed "exact parity" with otplib, but
  otplib's totpPadSecret under-repeats to 18 bytes for 1- and 9-byte
  secrets where this service pads to 20. Unreachable in RTL (secrets are
  always 10 bytes from generateSecret, field is read-only), and
  replicating the otplib bug has negative value - so the comment is
  corrected to state parity holds for the 10-byte secrets used here
  rather than universally.

- onVerifyToken's token check is now async, so two fast clicks on Verify
  could dispatch updateApplicationSettings twice (was synchronous
  before). Payload is idempotent so it was harmless, but guarded with an
  in-flight flag to restore the single-dispatch behavior.

Frontend/backend artifacts rebuilt; TOTP spec and lint pass.
This commit is contained in:
saubyk 2026-07-19 18:55:19 -07:00 • committed by Suheb
parent 3082d9a1af
commit 48b71d49e3
5 changed files with 11 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

2
frontend/index.html
View file

File diff suppressed because one or more lines are too long

1
frontend/main.2342107661e2489f.js
View file

File diff suppressed because one or more lines are too long

1
frontend/main.483124dd4b12e339.js Normal file
View file

File diff suppressed because one or more lines are too long

6
src/app/shared/components/data-modal/two-factor-auth/two-factor-auth.component.ts
View file

@ -30,6 +30,7 @@ export class TwoFactorAuthComponent implements OnInit, OnDestroy {
public faInfoCircle = faInfoCircle;
public flgValidated = false;
public isTokenValid = true;
private verifyingToken = false;
public otpauth = '';
public appConfig: RTLConfiguration | null = null;
public flgEditable = true;
@ -98,10 +99,13 @@ export class TwoFactorAuthComponent implements OnInit, OnDestroy {
this.generateSecret();
this.isTokenValid = true;
} else {
if (!this.tokenFormGroup.controls.token.value) {
if (!this.tokenFormGroup.controls.token.value || this.verifyingToken) {
return true;
}
// check() is async, so guard against a second click dispatching the update twice.
this.verifyingToken = true;
this.totpService.check(this.tokenFormGroup.controls.token.value, this.secretFormGroup.controls.secret.value).then((isTokenValid) => {
this.verifyingToken = false;
this.isTokenValid = isTokenValid;
if (!isTokenValid) {
this.tokenFormGroup.controls.token.setErrors({ notValid: true });

7
src/app/shared/services/totp.service.ts
View file

@ -44,9 +44,10 @@ export class TotpService {
return String(binary % (10 ** 6)).padStart(6, '0');
}
// Mirrors otplib's totpPadSecret for SHA1: secrets shorter than 10 bytes are
// repeated up to 20 bytes. Never triggers for the 10 byte secrets generated
// above; kept for exact parity with the backend's token derivation.
// Mirrors otplib's totpPadSecret for SHA1 (repeat to 20 bytes below 10 bytes).
// Never triggers for the 10 byte secrets generated above, which is the only
// case RTL produces; note otplib itself under-repeats to 18 bytes for 1- and
// 9-byte secrets, so parity is exact only for the secrets used here.
private createHmacKey(secretBytes: Uint8Array): Uint8Array {
if (secretBytes.length * 2 >= 20) { return secretBytes; }
const padded = new Uint8Array(20);