Two-Factor Authentication (2FA) via SMS

import os
import secrets
import time

from telnyx import Telnyx

client = Telnyx(api_key=os.environ.get("TELNYX_API_KEY"))

# In production, use a database (Redis, PostgreSQL, etc.)
otp_store = {}

OTP_LENGTH = 6
OTP_EXPIRY_SECONDS = 300  # 5 minutes


def generate_otp() -> str:
    """Generate a cryptographically secure numeric OTP."""
    # Use secrets module for secure random generation
    return "".join(secrets.choice("0123456789") for _ in range(OTP_LENGTH))


def send_otp(phone_number: str) -> dict:
    """Generate and send an OTP to the given phone number."""
    otp = generate_otp()

    # Store OTP with expiry and attempt counter
    otp_store[phone_number] = {
        "otp": otp,
        "expires_at": time.time() + OTP_EXPIRY_SECONDS,
        "attempts": 0,
        "max_attempts": 3,
    }

    # Send via Telnyx
    response = client.messages.send(
        from_=os.environ.get("TELNYX_FROM_NUMBER"),
        to=phone_number,
        text=f"Your verification code is: {otp}. It expires in 5 minutes.",
    )

    return {"message_id": response.data.id, "expires_in": OTP_EXPIRY_SECONDS}


def verify_otp(phone_number: str, submitted_otp: str) -> bool:
    """Verify the submitted OTP. Returns True if valid."""
    record = otp_store.get(phone_number)
    if not record:
        return False

    # Check expiry
    if time.time() > record["expires_at"]:
        del otp_store[phone_number]
        return False

    # Check attempts
    record["attempts"] += 1
    if record["attempts"] > record["max_attempts"]:
        del otp_store[phone_number]
        return False

    # Constant-time comparison to prevent timing attacks
    if secrets.compare_digest(record["otp"], submitted_otp):
        del otp_store[phone_number]  # One-time use
        return True

    return False


# Example usage
result = send_otp("+15559876543")
print(f"OTP sent, message ID: {result['message_id']}")

# Later, when user submits the code:
# is_valid = verify_otp("+15559876543", "123456")