From d7d8ff8afd4ec94b7367e76bc4190f80fb1496c1 Mon Sep 17 00:00:00 2001
From: Flaminel <flm.marius@gmail.com>
Date: Sat, 22 Aug 2026 12:00:16 +0300
Subject: [PATCH] Fix 2FA code rejected when it has spaces (#743)

---
 .../Contracts/Requests/VerifyTotpRequest.cs   |  2 +-
 .../Features/Auth/TotpServiceTests.cs         | 18 +++++++++++++++
 .../Features/Auth/TotpService.cs              | 13 ++++++++---
 .../features/auth/login/login.component.html  |  4 ++--
 .../auth/login/login.component.spec.ts        | 18 +++++++++++++++
 .../features/auth/login/login.component.ts    |  4 ++--
 .../features/auth/setup/setup.component.html  |  2 +-
 .../auth/setup/setup.component.spec.ts        | 18 +++++++++++++++
 .../features/auth/setup/setup.component.ts    |  2 +-
 .../account/two-factor-card.component.html    |  2 +-
 .../account/two-factor-card.component.spec.ts | 14 +++++++++++
 .../account/two-factor-card.component.ts      |  2 +-
 e2e/tests/auth/two-factor.api.spec.ts         | 23 +++++++++++++++++++
 13 files changed, 110 insertions(+), 12 deletions(-)

diff --git a/code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/VerifyTotpRequest.cs b/code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/VerifyTotpRequest.cs
index 590c3cd8..1047bccc 100644
--- a/code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/VerifyTotpRequest.cs
+++ b/code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/VerifyTotpRequest.cs
@@ -5,6 +5,6 @@ namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
 public sealed record VerifyTotpRequest
 {
     [Required]
-    [StringLength(6, MinimumLength = 6)]
+    [StringLength(32)]
     public required string Code { get; init; }
 }
diff --git a/code/backend/Cleanuparr.Infrastructure.Tests/Features/Auth/TotpServiceTests.cs b/code/backend/Cleanuparr.Infrastructure.Tests/Features/Auth/TotpServiceTests.cs
index ffc77908..75fc39e1 100644
--- a/code/backend/Cleanuparr.Infrastructure.Tests/Features/Auth/TotpServiceTests.cs
+++ b/code/backend/Cleanuparr.Infrastructure.Tests/Features/Auth/TotpServiceTests.cs
@@ -68,6 +68,24 @@ public sealed class TotpServiceTests
         _sut.VerifySecondFactor(user, codes[0].Replace("-", string.Empty).ToLowerInvariant()).ShouldBeTrue();
     }
 
+    [Fact]
+    public void VerifySecondFactor_WithPaddedTotpCode_ReturnsTrue()
+    {
+        string secret = _sut.GenerateSecret();
+        User user = CreateUser(secret);
+
+        _sut.VerifySecondFactor(user, $" {ComputeTotp(secret)} ").ShouldBeTrue();
+    }
+
+    [Fact]
+    public void VerifySecondFactor_WithPaddedRecoveryCode_ReturnsTrue()
+    {
+        List<string> codes = _sut.GenerateRecoveryCodes();
+        User user = CreateUser(_sut.GenerateSecret(), codes);
+
+        _sut.VerifySecondFactor(user, $" {codes[0]}\n").ShouldBeTrue();
+    }
+
     private User CreateUser(string secret, List<string>? recoveryCodes = null)
     {
         return new User
diff --git a/code/backend/Cleanuparr.Infrastructure/Features/Auth/TotpService.cs b/code/backend/Cleanuparr.Infrastructure/Features/Auth/TotpService.cs
index ff86512a..58b18fbd 100644
--- a/code/backend/Cleanuparr.Infrastructure/Features/Auth/TotpService.cs
+++ b/code/backend/Cleanuparr.Infrastructure/Features/Auth/TotpService.cs
@@ -24,7 +24,14 @@ public sealed class TotpService : ITotpService
     /// <inheritdoc/>
     public bool ValidateCode(string secret, string code)
     {
-        if (string.IsNullOrWhiteSpace(code) || code.Length != 6)
+        if (string.IsNullOrWhiteSpace(code))
+        {
+            return false;
+        }
+
+        string trimmedCode = code.Trim();
+
+        if (trimmedCode.Length != 6)
         {
             return false;
         }
@@ -33,7 +40,7 @@ public sealed class TotpService : ITotpService
         {
             var keyBytes = Base32Encoding.ToBytes(secret);
             var totp = new Totp(keyBytes);
-            return totp.VerifyTotp(code, out _, new VerificationWindow(previous: 1, future: 1));
+            return totp.VerifyTotp(trimmedCode, out _, new VerificationWindow(previous: 1, future: 1));
         }
         catch
         {
@@ -72,7 +79,7 @@ public sealed class TotpService : ITotpService
     {
         try
         {
-            var normalized = code.Replace("-", "").ToUpperInvariant();
+            string normalized = code.Trim().Replace("-", "").ToUpperInvariant();
             return BCrypt.Net.BCrypt.Verify(normalized, hash);
         }
         catch
diff --git a/code/frontend/src/app/features/auth/login/login.component.html b/code/frontend/src/app/features/auth/login/login.component.html
index 01cd7553..5679918e 100644
--- a/code/frontend/src/app/features/auth/login/login.component.html
+++ b/code/frontend/src/app/features/auth/login/login.component.html
@@ -102,7 +102,7 @@
       <app-button
         variant="primary"
         class="login-submit"
-        [disabled]="totpCode().length !== 6 || loading()"
+        [disabled]="totpCode().trim().length !== 6 || loading()"
         type="submit"
       >
         @if (loading()) {
@@ -135,7 +135,7 @@
       <app-button
         variant="primary"
         class="login-submit"
-        [disabled]="!recoveryCode() || loading()"
+        [disabled]="!recoveryCode().trim() || loading()"
         type="submit"
       >
         @if (loading()) {
diff --git a/code/frontend/src/app/features/auth/login/login.component.spec.ts b/code/frontend/src/app/features/auth/login/login.component.spec.ts
index 2d97e77b..789f4add 100644
--- a/code/frontend/src/app/features/auth/login/login.component.spec.ts
+++ b/code/frontend/src/app/features/auth/login/login.component.spec.ts
@@ -185,6 +185,24 @@ describe('LoginComponent', () => {
     expect(navigations).toEqual([['/dashboard']]);
   });
 
+  it('accepts a pasted code that carries surrounding whitespace', () => {
+    const { fixture, verify2faCalls } = setup({
+      login: of({ requiresTwoFactor: true, loginToken: 'login-token' }),
+    });
+    const component = fixture.componentInstance;
+
+    component.submitLogin();
+    component.totpCode.set(' 123456 ');
+    fixture.detectChanges();
+
+    expect(submitButton(fixture).disabled).toBe(false);
+
+    submitButton(fixture).click();
+    fixture.detectChanges();
+
+    expect(verify2faCalls).toEqual([['login-token', '123456', undefined]]);
+  });
+
   it('verifies a recovery code and reports a rejected one on the recovery view', () => {
     const { fixture, verify2faCalls, navigations } = setup({
       login: of({ requiresTwoFactor: true, loginToken: 'login-token' }),
diff --git a/code/frontend/src/app/features/auth/login/login.component.ts b/code/frontend/src/app/features/auth/login/login.component.ts
index 24666f0a..fcda385f 100644
--- a/code/frontend/src/app/features/auth/login/login.component.ts
+++ b/code/frontend/src/app/features/auth/login/login.component.ts
@@ -117,7 +117,7 @@ export class LoginComponent implements OnInit {
     this.loading.set(true);
     this.error.set('');
 
-    this.auth.verify2fa(this.loginToken(), this.totpCode()).subscribe({
+    this.auth.verify2fa(this.loginToken(), this.totpCode().trim()).subscribe({
       next: () => {
         this.router.navigate(['/dashboard']);
       },
@@ -137,7 +137,7 @@ export class LoginComponent implements OnInit {
     this.loading.set(true);
     this.error.set('');
 
-    this.auth.verify2fa(this.loginToken(), this.recoveryCode(), true).subscribe({
+    this.auth.verify2fa(this.loginToken(), this.recoveryCode().trim(), true).subscribe({
       next: () => {
         this.router.navigate(['/dashboard']);
       },
diff --git a/code/frontend/src/app/features/auth/setup/setup.component.html b/code/frontend/src/app/features/auth/setup/setup.component.html
index f81c303b..a9224959 100644
--- a/code/frontend/src/app/features/auth/setup/setup.component.html
+++ b/code/frontend/src/app/features/auth/setup/setup.component.html
@@ -153,7 +153,7 @@
           <app-button
             variant="primary"
             class="submit-btn"
-            [disabled]="verificationCode().length !== 6"
+            [disabled]="verificationCode().trim().length !== 6"
             type="submit"
           >
             Verify Code
diff --git a/code/frontend/src/app/features/auth/setup/setup.component.spec.ts b/code/frontend/src/app/features/auth/setup/setup.component.spec.ts
index 56d67ca9..d48f3df2 100644
--- a/code/frontend/src/app/features/auth/setup/setup.component.spec.ts
+++ b/code/frontend/src/app/features/auth/setup/setup.component.spec.ts
@@ -191,6 +191,24 @@ describe('SetupComponent', () => {
     expect(fixture.nativeElement.querySelector('.recovery-codes')).toBeNull();
   });
 
+  it('accepts a padded verification code and submits it trimmed', () => {
+    const { fixture, verifyTotpCalls } = setup();
+    const component = fixture.componentInstance;
+
+    fillAccount(fixture);
+    component.createAccount();
+    component.verificationCode.set('  123456  ');
+    fixture.detectChanges();
+
+    expect(submitButton(fixture).disabled).toBe(false);
+
+    submitButton(fixture).click();
+    fixture.detectChanges();
+
+    expect(verifyTotpCalls).toEqual(['123456']);
+    expect(component.totpVerified()).toBe(true);
+  });
+
   it('gates the step three advance behind the saved recovery codes checkbox', () => {
     const { fixture } = setup();
     const component = fixture.componentInstance;
diff --git a/code/frontend/src/app/features/auth/setup/setup.component.ts b/code/frontend/src/app/features/auth/setup/setup.component.ts
index 7cad40e3..137d2c65 100644
--- a/code/frontend/src/app/features/auth/setup/setup.component.ts
+++ b/code/frontend/src/app/features/auth/setup/setup.component.ts
@@ -143,7 +143,7 @@ export class SetupComponent {
     this.loading.set(true);
     this.error.set('');
 
-    this.auth.verifyTotpSetup(this.verificationCode()).subscribe({
+    this.auth.verifyTotpSetup(this.verificationCode().trim()).subscribe({
       next: () => {
         this.totpVerified.set(true);
         this.loading.set(false);
diff --git a/code/frontend/src/app/features/settings/account/two-factor-card.component.html b/code/frontend/src/app/features/settings/account/two-factor-card.component.html
index 89411704..8442336d 100644
--- a/code/frontend/src/app/features/settings/account/two-factor-card.component.html
+++ b/code/frontend/src/app/features/settings/account/two-factor-card.component.html
@@ -134,7 +134,7 @@
           <div class="form-actions">
             <app-button
               variant="primary"
-              [disabled]="enableVerificationCode().length !== 6 || enabling2fa()"
+              [disabled]="enableVerificationCode().trim().length !== 6 || enabling2fa()"
               (clicked)="verifyEnable2fa()"
             >
               @if (enabling2fa()) {
diff --git a/code/frontend/src/app/features/settings/account/two-factor-card.component.spec.ts b/code/frontend/src/app/features/settings/account/two-factor-card.component.spec.ts
index 68e35308..ec0747a2 100644
--- a/code/frontend/src/app/features/settings/account/two-factor-card.component.spec.ts
+++ b/code/frontend/src/app/features/settings/account/two-factor-card.component.spec.ts
@@ -207,6 +207,20 @@ describe('TwoFactorCardComponent', () => {
     expect(secret(fixture)).toBeNull();
   });
 
+  it('enables 2FA on a pasted code that carries surrounding whitespace', () => {
+    const { fixture, verifiedCodes } = setup();
+
+    type(fixture, 'Enter your password to enable 2FA', 'my-password');
+    click(fixture, 'Enable 2FA');
+    type(fixture, 'Enter 6-digit code from your app', ' 123456 ');
+
+    expect(button(fixture, 'Verify & Enable 2FA').disabled).toBe(false);
+
+    click(fixture, 'Verify & Enable 2FA');
+
+    expect(verifiedCodes).toEqual(['123456']);
+  });
+
   it('keeps the recovery codes on screen after enabling until they are dismissed', () => {
     const { fixture } = setup();
 
diff --git a/code/frontend/src/app/features/settings/account/two-factor-card.component.ts b/code/frontend/src/app/features/settings/account/two-factor-card.component.ts
index cb4bb147..7089497f 100644
--- a/code/frontend/src/app/features/settings/account/two-factor-card.component.ts
+++ b/code/frontend/src/app/features/settings/account/two-factor-card.component.ts
@@ -109,7 +109,7 @@ export class TwoFactorCardComponent {
 
   verifyEnable2fa(): void {
     this.enabling2fa.set(true);
-    this.api.verifyEnable2fa(this.enableVerificationCode()).subscribe({
+    this.api.verifyEnable2fa(this.enableVerificationCode().trim()).subscribe({
       next: () => {
         this.toast.success('Two-factor authentication enabled. Save your recovery codes before dismissing them!');
         this.enableSetup.set(false);
diff --git a/e2e/tests/auth/two-factor.api.spec.ts b/e2e/tests/auth/two-factor.api.spec.ts
index fb9ceecb..5686c03f 100644
--- a/e2e/tests/auth/two-factor.api.spec.ts
+++ b/e2e/tests/auth/two-factor.api.spec.ts
@@ -174,6 +174,29 @@ test.describe('Account — 2FA with recovery codes', () => {
     }
   });
 
+  test('codes pasted with surrounding whitespace are accepted', async ({ api, anonymousApi }) => {
+    const enable = await api.account.enable2fa(TEST_CONFIG.adminPassword);
+    expect(enable.ok).toBe(true);
+
+    const setup: TwoFactorSetup = await enable.json();
+    const verify = await api.account.enable2faVerify(` ${generateTotpCode(setup.secret)} `);
+    expect(verify.status).toBe(200);
+
+    try {
+      const recoveryApi = await loginWithRecoveryCode(anonymousApi, ` ${setup.recoveryCodes[0]}\n`);
+
+      const disable = await recoveryApi.account.disable2fa(
+        TEST_CONFIG.adminPassword,
+        ` ${generateTotpCode(setup.secret)} `,
+      );
+
+      expect(disable.status).toBe(200);
+      expect(await isTwoFactorEnabled(api)).toBe(false);
+    } finally {
+      await forceDisable(api, setup);
+    }
+  });
+
   test('repeated bad codes at the 2FA login step are rate limited', async ({ api, anonymousApi }) => {
     const setup = await enableTwoFactor(api);