diff --git a/app/application/security/twofactor.py b/app/application/security/twofactor.py index 06e39863e..286ba88f2 100644 --- a/app/application/security/twofactor.py +++ b/app/application/security/twofactor.py @@ -11,17 +11,17 @@ from app.runtime.log import logger class TwoFactorAuth: """解析已有验证码或根据共享密钥生成 TOTP 验证码。""" - def __init__(self, code_or_secret: str): + def __init__(self, code_or_secret: str | None) -> None: """按长度区分用户验证码和 TOTP 共享密钥。""" if code_or_secret and len(code_or_secret) >= 16: - self.code = None - self.secret = code_or_secret + self.code: str | None = None + self.secret: str | None = code_or_secret else: self.code = code_or_secret self.secret = None @staticmethod - def __calc(secret_key: str) -> str: + def __calc(secret_key: str | None) -> str: """按 30 秒时间窗计算六位 TOTP 验证码。""" if not secret_key: return "" @@ -29,16 +29,16 @@ class TwoFactorAuth: input_time = int(time.time()) // 30 key = base64.b32decode(secret_key) msg = struct.pack(">Q", input_time) - google_code = hmac.new(key, msg, hashlib.sha1).digest() + digest = hmac.new(key, msg, hashlib.sha1).digest() o = ( - google_code[19] & 15 + digest[19] & 15 if sys.version_info > (2, 7) - else ord(str(google_code[19])) & 15 + else ord(str(digest[19])) & 15 ) google_code = str( - (struct.unpack(">I", google_code[o: o + 4])[0] & 0x7FFFFFFF) % 1000000 + (struct.unpack(">I", digest[o: o + 4])[0] & 0x7FFFFFFF) % 1000000 ) - return f"0{google_code}" if len(google_code) == 5 else google_code + return google_code.zfill(6) except Exception as e: logger.error(f"计算动态验证码失败：{str(e)}") return "" diff --git a/docs/code-quality.md b/docs/code-quality.md index dfd209808..643e41be8 100644 --- a/docs/code-quality.md +++ b/docs/code-quality.md @@ -75,7 +75,7 @@ uv run --locked --no-sync python scripts/architecture/complexity.py 回调和返回值类型；全仓错误计数为零并不保证单独纳入 strict frontier 后也为零。 2026-10-16 开始逐文件清理类型债务，`app/domain/title.py` 通过局部可空类型声明保留 -既有搜索解析行为，并纳入严格清单；当前清单共 96 个文件（95 个生产文件和 1 个脚本）。 +既有搜索解析行为，并纳入严格清单；当前清单共 97 个文件（96 个生产文件和 1 个脚本）。 每个治理提交聚焦一个生产文件及其必要测试、门禁配置、真实下降基线和指标文档。 验收同时检查完整严格清单与全宿主 Linux 分析，避免 `follow_imports = skip` 隐藏依赖 签名冲突；不通过忽略诊断或放宽类型合同接受回退。最新文件清单以 `mypy.ini` 为准， diff --git a/docs/refactor/optimization-checklist.md b/docs/refactor/optimization-checklist.md index a8b5ab938..ea588692f 100644 --- a/docs/refactor/optimization-checklist.md +++ b/docs/refactor/optimization-checklist.md @@ -108,7 +108,7 @@ ARCH-201 至 ARCH-204 均达到实现、验证、提交、推送和远端门禁 | Event Contract | 53 | 均已有 payload model，但当前全部是 diagnostic enforcement | | Python 源码量 | 372,299 行 | 本次重新扫描物理行数，排除 `app/plugins/**`；74 个文件超过 1,000 行，12 个超过 2,000 行；源码尺寸仅作观察 | | 长方法 | 309 个超过 80 行 | 本次 AST 扫描排除 `app/plugins/**`；61 个超过 150 行，17 个超过 250 行；新增函数仍受 C901/嵌套深度门禁约束 | -| 全量 mypy 历史债务 | 8,837 / 458 文件 | 通知排版补齐 Slack 消息块类型，历史债务减少 2 项；工作流资源过滤改用领域对象调用过滤链，恢复的节点输出在消费前归一化，并收紧可空资源列表的类型低水位；消息媒体交互类型债务已清零，canonical Facade 与 endpoint 类型边界已补齐，低水位只允许继续下降；微信 ClawBot 入站 item_list 媒体解析改为按子项键名分派后，类型错误减少 4 项；站点解析器分享率改用浮点初值，类型错误减少 20 项；本次下载与文件安全修复再减少 3 项；Transmission 进度回退值归一化再减少 2 项，逐文件逐错误码无增长 | +| 全量 mypy 历史债务 | 8,831 / 457 文件 | 通知排版补齐 Slack 消息块类型，历史债务减少 2 项；工作流资源过滤改用领域对象调用过滤链，恢复的节点输出在消费前归一化，并收紧可空资源列表的类型低水位；消息媒体交互类型债务已清零，canonical Facade 与 endpoint 类型边界已补齐，低水位只允许继续下降；微信 ClawBot 入站 item_list 媒体解析改为按子项键名分派后，类型错误减少 4 项；站点解析器分享率改用浮点初值，类型错误减少 20 项；本次下载与文件安全修复再减少 3 项；Transmission 进度回退值归一化再减少 2 项，逐文件逐错误码无增长 | | Ruff 历史诊断 | 98 | 低水位门禁通过，但规则集只覆盖 `E4/E7/E9/F/I` | | 覆盖率固定基线 | Application 80.00%，Domain 80.00% | Chain、Runtime、Agent、Adapter、Startup 未进入包级覆盖率门禁 | diff --git a/mypy.ini b/mypy.ini index 49b4480b0..8a483b85f 100644 --- a/mypy.ini +++ b/mypy.ini @@ -70,6 +70,7 @@ files = app/application/notification.py, app/application/mediaserver.py, app/application/music/catalog.py, + app/application/security/twofactor.py, app/application/outbox.py, app/application/torrent/cache.py, app/application/configuration.py, diff --git a/tests/fixtures/architecture/mypy-baseline.json b/tests/fixtures/architecture/mypy-baseline.json index 4d9eb3818..fb086112a 100644 --- a/tests/fixtures/architecture/mypy-baseline.json +++ b/tests/fixtures/architecture/mypy-baseline.json @@ -674,7 +674,6 @@ "no-untyped-def": 1 }, "app/application/security/cookie.py": { - "arg-type": 2, "assignment": 2, "no-any-return": 1, "type-arg": 3 @@ -686,11 +685,6 @@ "no-any-return": 3, "operator": 1 }, - "app/application/security/twofactor.py": { - "assignment": 2, - "return-value": 1, - "str-bytes-safe": 1 - }, "app/application/security/url.py": { "attr-defined": 2, "has-type": 2, diff --git a/tests/test_twofactor_auth.py b/tests/test_twofactor_auth.py new file mode 100644 index 000000000..b4f5374ef --- /dev/null +++ b/tests/test_twofactor_auth.py @@ -0,0 +1,42 @@ +"""自动生成的 TOTP 必须保留前导零，手工验证码仍按原值使用。""" + +import pyotp +import pytest + +from app.application.security import twofactor + +# 公开测试密钥，不连接真实账户或认证服务。 +TEST_SECRET = "JBSWY3DPEHPK3PXP" + + +@pytest.mark.parametrize("timestamp", [0, 30, 4020, 4830, 7680]) +def test_generated_totp_preserves_all_six_digits(monkeypatch, timestamp): + """与独立 TOTP 实现对照普通码及含多个前导零的码。""" + monkeypatch.setattr(twofactor.time, "time", lambda: timestamp) + + code = twofactor.TwoFactorAuth(TEST_SECRET).get_code() + + assert code == pyotp.TOTP(TEST_SECRET).at(timestamp) + assert len(code) == 6 + assert code.isdecimal() + + +@pytest.mark.parametrize("code", ["123456", "000001", "8210"]) +def test_explicit_code_is_returned_unchanged(code): + """补零只作用于自动生成的码，不改写用户直接提供的验证码。""" + assert twofactor.TwoFactorAuth(code).get_code() == code + + +@pytest.mark.parametrize("code", [None, ""]) +def test_empty_code_or_secret_preserves_empty_result(code): + """缺少手工验证码和共享密钥时继续返回空字符串。""" + assert twofactor.TwoFactorAuth(code).get_code() == "" + + +def test_invalid_secret_preserves_error_log_and_empty_result(monkeypatch): + """非法密钥仍记录错误并返回空值，不向调用方抛出认证异常。""" + messages = [] + monkeypatch.setattr(twofactor.logger, "error", messages.append) + + assert twofactor.TwoFactorAuth("not-a-valid-secret!").get_code() == "" + assert any("计算动态验证码失败" in message for message in messages)