Introduce 'otp-setup', to set TOTP up.

2 files changed, 44 insertions, 0 deletions

diff --git a/okupy/accounts/urls.py b/okupy/accounts/urls.py
index 764be4a..1823c41 100644
--- a/okupy/accounts/urls.py
+++ b/okupy/accounts/urls.py
@@ -13,6 +13,7 @@ accounts_urlpatterns = patterns('',
     url(r'^foundation-members/$', v.DevListsView.as_view(template_name='foundation-members.html')),
     url(r'^signup/$', v.signup),
     url(r'^activate/(?P<token>[a-zA-Z0-9]+)/$', v.activate),
+    url(r'^otp-setup/$', v.otp_setup),
     url(r'^endpoint/$', v.openid_endpoint),
     url(r'^id/(.*)/$', v.user_page),
     url(r'^auth-site/$', v.openid_auth_site),
diff --git a/okupy/accounts/views.py b/okupy/accounts/views.py
index de1c0d3..9b21a2d 100644
--- a/okupy/accounts/views.py
+++ b/okupy/accounts/views.py
@@ -32,6 +32,7 @@ from ..common.ldap_helpers import get_ldap_connection
 from ..common.exceptions import OkupyError
 from ..common.log import log_extra_data
 from ..otp import init_otp
+from ..otp.totp.models import TOTPDevice
 
 # the following two are for exceptions
 import openid.yadis.discover
@@ -367,6 +368,48 @@ def activate(request, token):
     return redirect(login)
 
 
+@otp_required
+def otp_setup(request):
+    dev = TOTPDevice.objects.get(user=request.user)
+    secret = None
+    conf_form = None
+
+    if request.method == 'POST':
+        if 'disable' in request.POST:
+            dev.disable()
+        elif 'confirm' in request.POST and 'otp_secret' in request.session:
+            secret = request.session['otp_secret']
+            conf_form = OTPForm(request.POST)
+            try:
+                if not conf_form.is_valid():
+                    raise OkupyError()
+                token = conf_form.cleaned_data['otp_token']
+                if not dev.verify_token(token, secret):
+                    raise OkupyError()
+            except OkupyError:
+                messages.error(request, 'Token verification failed.')
+                conf_form = OTPForm()
+            else:
+                dev.enable(secret)
+                secret = None
+                conf_form = None
+        elif 'enable' in request.POST:
+            secret = dev.gen_secret()
+            request.session['otp_secret'] = secret
+            conf_form = OTPForm()
+
+    if secret:
+        # into groups of four characters
+        secret = ' '.join([secret[i:i+4]
+                           for i in range(0, len(secret), 4)])
+
+    return render(request, 'otp-setup.html', {
+        'otp_enabled': dev.is_enabled(),
+        'secret': secret,
+        'conf_form': conf_form,
+    })
+
+
 # OpenID-specific