Address review: soften parity comment, guard async verify double-click

Browse source

Two non-blocking review points on #1644:

- createHmacKey's comment claimed "exact parity" with otplib, but
  otplib's totpPadSecret under-repeats to 18 bytes for 1- and 9-byte
  secrets where this service pads to 20. Unreachable in RTL (secrets are
  always 10 bytes from generateSecret, field is read-only), and
  replicating the otplib bug has negative value - so the comment is
  corrected to state parity holds for the 10-byte secrets used here
  rather than universally.

- onVerifyToken's token check is now async, so two fast clicks on Verify
  could dispatch updateApplicationSettings twice (was synchronous
  before). Payload is idempotent so it was harmless, but guarded with an
  in-flight flag to restore the single-dispatch behavior.

Frontend/backend artifacts rebuilt; TOTP spec and lint pass.

...

This commit is contained in:

saubyk 2026-07-19 18:55:19 -07:00 • committed by Suheb

parent 3082d9a1af

commit 48b71d49e3

5 changed files with 11 additions and 6 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

2

frontend/index.html

View file

File diff suppressed because one or more lines are too long

1

frontend/main.2342107661e2489f.js

View file

File diff suppressed because one or more lines are too long

1

frontend/main.483124dd4b12e339.js Normal file

View file

File diff suppressed because one or more lines are too long