Block sending loop commands with same TOTP code by codebymini · Pull Request #450 · loopandlearn/LoopFollow

Block Sending Loop Commands with Same TOTP Code

Overview

This commit implements a security enhancement to prevent the reuse of Time-based One-Time Password (TOTP) codes when sending Loop commands via APNS (Apple Push Notification Service). The change ensures that each TOTP code can only be used once within its 30-second validity period.

Key Changes

  1. New Storage Properties (Storage.swift)
    Added loopAPNSTOTPUsed: Boolean flag to track if a TOTP code has been used
    Added loopAPNSTOTPLastUsed: Timestamp tracking when the TOTP was last used
  2. Enhanced TOTP Validation Logic
    Bolus View (LoopAPNSBolusView.swift): Added isTOTPBlocked computed property
    Carbs View (LoopAPNSCarbsView.swift): Added identical isTOTPBlocked computed property
    Both views now check TOTP usage status before allowing command submission
  3. UI Enhancements
    Warning Display: Added visual warning section when TOTP is blocked, showing:
    Orange warning icon with "TOTP Code Already Used" message
    Explanatory text about waiting for the next code
    Button State Management: Send buttons are disabled when TOTP is blocked
  4. Automatic TOTP Reset Logic
    Timer-based Reset: Automatically resets TOTP usage flag when a new 30-second period begins
    Safety Checks: Multiple validation points ensure TOTP blocking is properly managed:
    When moving to a new TOTP period
    At the start of each new period (≥29 seconds remaining)
    Fallback check for 30+ seconds elapsed since last use
  5. Command Success Tracking
    TOTP usage is marked with timestamp when commands are successfully sent
    Prevents immediate reuse of the same TOTP code