From 9f42a49bcae14100a28f0518c88356fca3701a03 Mon Sep 17 00:00:00 2001
From: Brian Obot <brianobot@gmail.com>
Date: Wed, 15 Jul 2026 11:24:06 +0100
Subject: [PATCH] Ensure the OTP Codes used across the app has central setting
 definition

---
 .coverage            | Bin 53248 -> 53248 bytes
 app/services/auth.py |   7 ++++---
 app/settings.py      |   3 +++
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/.coverage b/.coverage
index a77b9d15c9ffd261458cfbc6f0aaab0cb8c4c1f2..f14a43d40e4da76d12e201182acf83ff844c66d4 100644
GIT binary patch
delta 521
zcmV+k0`~oYpaX!Q1CU|@mB_JVnJ)u0E-<n%1yD^5vH%bG5AP4=57!UQ55f<$51S8&
z4}cGK4{Hx&4_OaO4?_<t4<HX14-F3E4%-gP4#N()4zUhu4q^@}4jT>=4gn4G4c!gS
z4aE(zvk?$r4M7nl1PKWy?tK(`$;lZr%+GT_4+kU!0SOQz@_Y>=1OW*gBI;!N>8GFY
z+Y}-M0SPK0S}H%EeOdp<YnRkDU;YS_{D>%j4ITsm2^<Axv}qE6<`Dum9RvXhZXNFZ
za?UxqTrOYvyqA2<uYBe+&nNRU@v`}3zqN09lgs6k?##>O<-OcEyd+<F<t#S_90UOg
z4jchR8wCLgfeH=o-*1b>%*;&ql;F$bgCtMf^W@G?^4-r&NuPcFb~2ME^9g31U((JO
zFX7yr{p7xP^CK{P1b?Ty$vlqRkKi1WK8qqbF%cz%AOyG%1{MSX2@VPpC=~<&2~rvM
zT(bGw+Z*}Z%+0*%)91Ucz3k2Jxy{?llJ}Bt7KzUj@ROR09W9NK77+vi2`&`+zBmWu
zAO|_fA%}Yz=8&@x1`q@R2@Vqh3=aeW2^tAjezLTa&Ws)b29xcK9W5-~vb;|)%FM?X
z2m}EMFcJ2DADo^M$nz6F9(dfzKm5ae3<m@O2^tS}`+o$J%#Iij4Fm)M2^<4@pA*k_
LxBqst=8qac=UdOh

delta 672
zcmZozz}&Eac|sCX)`g8JGxeE`^-MMyum<?DwJ`Ai;D68mjPD8GZNBq-2YH2g8F+s1
zyybb!bDQTP&tab3+&j6~aWCVZ&0WZy!5zUJ!0pCu$7RE1!fC{*!YRYa#qo#zANzau
zXKXE-1qF=QM4RGOSvfgd9p2T7RGmC2X?*5<u|5C9iH6J^Ogs}O$}@IMoH&7_fq{XM
zfn$Ng#EEgn4o(T|DlCkg0?MCic$I++8KqY#zg{k%|KWCHwGt~MXLFfil$QPc+Q|RM
zv!`D%jsM3naiSd~-^7Ul%q~HUK#B!q+~m)_8Xi1yK>bpzX}8t>X2>Zv*2{vl*U7&7
zTXfEHcZ^>A&pp#?&aSU{W_&*Vv+?ImKXdkP&99t%`sw6%XHLI;y7!L79-a8gr#j{n
zCwj9pG60Qbvj;Mn6o3v@3kJHEO$KN_pA2JTy)@Wl-go!&yIs$m@%b_3!Rg1%D(CNh
zesj+M+uid%k@IW+mf3xN{<$)3ZhY7|{r7j~{C%>o{Ijw_4Nv{@-6w7OZudWwnK*Gf
zGtk({8~c>3?2Vt!dH!Z6Kf4$xFt|Q3Yls3FL6YBMHvPPPTl)8%GiUd_y!?Fky1j4C
zzTbKF_UTREC*_OnJpcLoWS)Lm8Quwv^@3nWiTv7UQU650{^x1^{nbC8P2Vg&abh-x
zcf>&65de8dn30DcNK0{s)$Q9pIjmn!pPiE%C?LX7cI-YI8y83o8<!v_kX8}hb@Tk2
zyPNj=8~i$RyjhzAXklB}<c0mh6DL}OqGScgI}<0a<|*J|2bsxV_PhSi<o*2;f{pbo
bVAnBM%`ZM*zWsmM#EI`fiZ?&&mvR6A9bgD$

diff --git a/app/services/auth.py b/app/services/auth.py
index 6f0d287..c8d38e8 100644
--- a/app/services/auth.py
+++ b/app/services/auth.py
@@ -36,6 +36,7 @@
 # Signup responds identically whether or not the email is already registered,
 # so an attacker can't enumerate accounts through the signup endpoint.
 GENERIC_SIGNUP_MESSAGE = "Please check your email to activate your account."
+VERIFICATION_CODE_LENGTH = settings.VERIFICATION_CODE_LENGTH
 
 
 # --- Redis key builders (single source of truth for key formats) ------------
@@ -150,7 +151,7 @@ async def initiate_password_reset(
     if not user or await email_cooldown_active("reset", email):
         return {"detail": "Password Reset Code Sent"}
 
-    code = generate_random_code(6)
+    code = generate_random_code(VERIFICATION_CODE_LENGTH)
     await redis_manager.cache_json_item(
         reset_code_key(email), {"code": code}, ttl=60 * 30
     )
@@ -287,7 +288,7 @@ async def signup_user(
 
     user = await create_user(data, session)
 
-    code = generate_random_code(6)
+    code = generate_random_code(VERIFICATION_CODE_LENGTH)
     await redis_manager.cache_json_item(
         activation_code_key(data.email), {"code": code}, ttl=60 * 30
     )
@@ -310,7 +311,7 @@ async def resend_activation_code(
     if not user or await email_cooldown_active("activation", email):
         return {"detail": "Activation Code Sent"}
 
-    code = generate_random_code(6)
+    code = generate_random_code(VERIFICATION_CODE_LENGTH)
     await redis_manager.cache_json_item(
         activation_code_key(email), {"code": code}, ttl=60 * 30
     )
diff --git a/app/settings.py b/app/settings.py
index 83a8e54..5e1c218 100644
--- a/app/settings.py
+++ b/app/settings.py
@@ -14,6 +14,9 @@ class Settings(BaseSettings):
     JWT_SECRET: str = ""  # REQUIRED in production (DEBUG=False); see validator below
     JWT_ALGORITHM: str = "HS256"  # optional environement variable with default value
 
+    # ensures the length of the otp codes used across the app is consistent
+    VERIFICATION_CODE_LENGTH: int = 6
+
     REDIS_HOST: str = "localhost"
     REDIS_PORT: int = 6379