From b13de895f75a1e2523913b4a4b00a251ff4a830e Mon Sep 17 00:00:00 2001 From: Graham McIntire Date: Wed, 28 Jan 2026 15:32:06 -0600 Subject: [PATCH] relax totp time --- lib/towerops/accounts.ex | 5 +++-- test/towerops/accounts_test.exs | 2 +- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/lib/towerops/accounts.ex b/lib/towerops/accounts.ex index 71897175..35d69943 100644 --- a/lib/towerops/accounts.ex +++ b/lib/towerops/accounts.ex @@ -196,10 +196,11 @@ defmodule Towerops.Accounts do Verifies a TOTP code against a secret. Returns true if the code is valid within the time window, false otherwise. + Allows for +/- 1 time step (30 seconds) to handle clock drift. """ def verify_totp(secret, code) when is_binary(secret) and is_binary(code) do - # Allow 30 second window for time drift - NimbleTOTP.valid?(secret, code, since: System.system_time(:second) - 30) + # NimbleTOTP.valid? by default checks current time +/- 1 time step (30s) + NimbleTOTP.valid?(secret, code) end @doc """ diff --git a/test/towerops/accounts_test.exs b/test/towerops/accounts_test.exs index 7cb67a8f..8d3b7f2a 100644 --- a/test/towerops/accounts_test.exs +++ b/test/towerops/accounts_test.exs @@ -441,7 +441,7 @@ defmodule Towerops.AccountsTest do # Generate code for current time (should always be valid) code = NimbleTOTP.verification_code(secret) - # Verify it works with the time window check (since: -30) + # Verify it works (checks current time +/- 1 step) assert Accounts.verify_totp(secret, code) end