From 48b71d49e306635384af199528af2398e652dbcc Mon Sep 17 00:00:00 2001 From: saubyk <39208279+saubyk@users.noreply.github.com> Date: Sun, 19 Jul 2026 18:55:19 -0700 Subject: [PATCH] Address review: soften parity comment, guard async verify double-click Two non-blocking review points on #1644: - createHmacKey's comment claimed "exact parity" with otplib, but otplib's totpPadSecret under-repeats to 18 bytes for 1- and 9-byte secrets where this service pads to 20. Unreachable in RTL (secrets are always 10 bytes from generateSecret, field is read-only), and replicating the otplib bug has negative value - so the comment is corrected to state parity holds for the 10-byte secrets used here rather than universally. - onVerifyToken's token check is now async, so two fast clicks on Verify could dispatch updateApplicationSettings twice (was synchronous before). Payload is idempotent so it was harmless, but guarded with an in-flight flag to restore the single-dispatch behavior. Frontend/backend artifacts rebuilt; TOTP spec and lint pass. --- frontend/index.html | 2 +- frontend/main.2342107661e2489f.js | 1 - frontend/main.483124dd4b12e339.js | 1 + .../two-factor-auth/two-factor-auth.component.ts | 6 +++++- src/app/shared/services/totp.service.ts | 7 ++++--- 5 files changed, 11 insertions(+), 6 deletions(-) delete mode 100644 frontend/main.2342107661e2489f.js create mode 100644 frontend/main.483124dd4b12e339.js diff --git a/frontend/index.html b/frontend/index.html index 2e7c6d36..7222bb90 100644 --- a/frontend/index.html +++ b/frontend/index.html @@ -15,5 +15,5 @@