diff --git a/dashboard/backend/tests/unit/test_auth.py b/dashboard/backend/tests/unit/test_auth.py index 2fe8fdd..1817eda 100644 --- a/dashboard/backend/tests/unit/test_auth.py +++ b/dashboard/backend/tests/unit/test_auth.py @@ -245,11 +245,21 @@ class TestTOTP: def test_verify_totp_replay_protection(self, mock_config, temp_auth_file, sample_totp_secret): """Test that same TOTP code cannot be used twice.""" save_totp_secret(sample_totp_secret) + + # Ensure auth file is properly initialized with last_totp_ts + import json + with open(temp_auth_file, 'r') as f: + data = json.load(f) + data['last_totp_ts'] = 0 + with open(temp_auth_file, 'w') as f: + json.dump(data, f) + totp = pyotp.TOTP(sample_totp_secret) valid_code = totp.now() # First use should succeed - assert verify_totp(valid_code) + result = verify_totp(valid_code) + assert result, f"First TOTP verification failed for code {valid_code}" # Second use of same code should fail (replay protection) assert not verify_totp(valid_code)