File indexing completed on 2024-04-28 05:50:06

 /*
  * SPDX-License-Identifier: GPL-3.0-or-later
  * SPDX-FileCopyrightText: 2020-2021 Johan Ouwerkerk <jm.ouwerkerk@gmail.com>
  */
 #include "actions_p.h"
 #include "validation.h"
 
 #include "../base32/base32.h"
 #include "../logging_p.h"
 #include "../oath/oath.h"
 
 #include <QMetaEnum>
 #include <QScopedPointer>
 #include <QTimer>
 
 #include <limits>
 
 KEYSMITH_LOGGER(logger, ".accounts.actions")
 KEYSMITH_LOGGER(dispatcherLogger, ".accounts.dispatcher")
 
 static const quint64 maxCounter = std::numeric_limits<quint64>::max();
 static const int hashTypeId = qRegisterMetaType<accounts::Account::Hash>();
 
 namespace accounts
 {
     AccountJob::AccountJob() :
         QObject()
     {
     }
 
     AccountJob::~AccountJob()
     {
     }
 
     Null::Null() :
         AccountJob()
     {
     }
 
     void Null::run(void)
     {
         Q_EMIT finished();
     }
 
     void AccountJob::run(void)
     {
         Q_ASSERT_X(false, Q_FUNC_INFO, "should be overridden in derived classes!");
     }
 
     RequestAccountPassword::RequestAccountPassword(const SettingsProvider &settings, AccountSecret *secret) :
         AccountJob(), m_settings(settings), m_secret(secret), m_failed(false), m_succeeded(false)
     {
     }
 
     LoadAccounts::LoadAccounts(const SettingsProvider &settings, const AccountSecret *secret,
                                const std::function<qint64(void)> &clock) :
         AccountJob(), m_settings(settings), m_secret(secret), m_clock(clock)
     {
     }
 
     DeleteAccounts::DeleteAccounts(const SettingsProvider &settings, const QSet<QUuid> &ids) :
         AccountJob(), m_settings(settings), m_ids(ids)
     {
     }
 
     SaveHotp::SaveHotp(const SettingsProvider &settings,
                        const QUuid id, const QString &accountName, const QString &issuer,
                        const secrets::EncryptedSecret &secret, uint tokenLength,
                        quint64 counter, const std::optional<uint> offset, bool checksum) :
         AccountJob(), m_settings(settings), m_id(id), m_accountName(accountName), m_issuer(issuer),
         m_secret(secret), m_tokenLength(tokenLength), m_counter(counter), m_offset(offset), m_checksum(checksum)
     {
     }
 
     SaveTotp::SaveTotp(const SettingsProvider &settings,
                        const QUuid id, const QString &accountName, const QString &issuer,
                        const secrets::EncryptedSecret &secret, uint tokenLength,
                        uint timeStep, const QDateTime &epoch, Account::Hash hash,
                        const std::function<qint64(void)> &clock) :
         AccountJob(), m_settings(settings), m_id(id), m_accountName(accountName), m_issuer(issuer),
         m_secret(secret), m_tokenLength(tokenLength), m_timeStep(timeStep), m_epoch(epoch), m_hash(hash), m_clock(clock)
     {
     }
 
     void SaveHotp::run(void)
     {
         if (!checkId(m_id) || !checkName(m_accountName) || !checkIssuer(m_issuer) ||
             !checkTokenLength(m_tokenLength) || !checkOffset(m_offset, QCryptographicHash::Sha1)) {
             qCDebug(logger)
                 << "Unable to save HOTP account:" << m_id
                 << "Invalid account details";
             Q_EMIT invalid();
             Q_EMIT finished();
             return;
         }
 
         const PersistenceAction act([this](QSettings &settings) -> void
         {
             if (!settings.isWritable()) {
                 qCWarning(logger)
                     << "Unable to save HOTP account:" << m_id
                     << "Storage not writable";
                 Q_EMIT invalid();
                 return;
             }
 
             qCInfo(logger) << "Saving HOTP account:" << m_id;
 
             const QString group = m_id.toString();
             settings.remove(group);
             settings.beginGroup(group);
             settings.setValue(QStringLiteral("account"), m_accountName);
             if (!m_issuer.isNull()) {
                 settings.setValue(QStringLiteral("issuer"), m_issuer);
             }
             settings.setValue(QStringLiteral("type"), QStringLiteral("hotp"));
             QString encodedNonce = QString::fromUtf8(m_secret.nonce().toBase64(QByteArray::Base64Encoding));
             QString encodedSecret = QString::fromUtf8(m_secret.cryptText().toBase64(QByteArray::Base64Encoding));
             settings.setValue(QStringLiteral("secret"), encodedSecret);
             settings.setValue(QStringLiteral("nonce"), encodedNonce);
             settings.setValue(QStringLiteral("counter"), m_counter);
             settings.setValue(QStringLiteral("pinLength"), m_tokenLength);
             if (m_offset) {
                 settings.setValue(QStringLiteral("offset"), *m_offset);
             }
             settings.setValue(QStringLiteral("checksum"), m_checksum);
             settings.endGroup();
 
             // Try to guarantee that data will have been written before claiming the account was actually saved
             settings.sync();
 
             Q_EMIT saved(m_id, m_accountName, m_issuer, m_secret.cryptText(), m_secret.nonce(), m_tokenLength,
                          m_counter, m_offset.has_value(), m_offset ? *m_offset : 0U, m_checksum);
         });
         m_settings(act);
 
         Q_EMIT finished();
     }
 
     void SaveTotp::run(void)
     {
         if (!checkId(m_id) || !checkName(m_accountName) || !checkIssuer(m_issuer) ||
             !checkTokenLength(m_tokenLength) || !checkTimeStep(m_timeStep) || !checkEpoch(m_epoch, m_clock)) {
             qCDebug(logger)
                 << "Unable to save TOTP account:" << m_id
                 << "Invalid account details";
             Q_EMIT invalid();
             Q_EMIT finished();
             return;
         }
 
         const PersistenceAction act([this](QSettings &settings) -> void
         {
             if (!settings.isWritable()) {
                 qCWarning(logger)
                     << "Unable to save TOTP account:" << m_id
                     << "Storage not writable";
                 Q_EMIT invalid();
                 return;
             }
 
             qCInfo(logger) << "Saving TOTP account:" << m_id;
 
             const QString group = m_id.toString();
             settings.remove(group);
             settings.beginGroup(group);
             settings.setValue(QStringLiteral("account"), m_accountName);
             if (!m_issuer.isNull()) {
                 settings.setValue(QStringLiteral("issuer"), m_issuer);
             }
             settings.setValue(QStringLiteral("type"), QStringLiteral("totp"));
             QString encodedNonce = QString::fromUtf8(m_secret.nonce().toBase64(QByteArray::Base64Encoding));
             QString encodedSecret = QString::fromUtf8(m_secret.cryptText().toBase64(QByteArray::Base64Encoding));
             settings.setValue(QStringLiteral("secret"), encodedSecret);
             settings.setValue(QStringLiteral("nonce"), encodedNonce);
             settings.setValue(QStringLiteral("timeStep"), m_timeStep);
             settings.setValue(QStringLiteral("pinLength"), m_tokenLength);
             settings.setValue(QStringLiteral("epoch"), m_epoch.toUTC().toString(Qt::ISODateWithMs));
             settings.setValue(QStringLiteral("hash"), QVariant::fromValue<Account::Hash>(m_hash).toString());
             settings.endGroup();
 
             // Try to guarantee that data will have been written before claiming the account was actually saved
             settings.sync();
 
             Q_EMIT saved(m_id, m_accountName, m_issuer, m_secret.cryptText(), m_secret.nonce(), m_tokenLength,
                          m_timeStep, m_epoch, m_hash);
         });
         m_settings(act);
 
         Q_EMIT finished();
     }
 
     void DeleteAccounts::run(void)
     {
         const PersistenceAction act([this](QSettings &settings) -> void
         {
             if (!settings.isWritable()) {
                 qCWarning(logger) << "Unable to delete accounts: storage not writable";
                 Q_EMIT invalid();
                 return;
             }
 
             qCInfo(logger) << "Deleting accounts";
 
             for (const QUuid &id : m_ids) {
                 settings.remove(id.toString());
             }
         });
         m_settings(act);
 
         Q_EMIT finished();
     }
 
     void RequestAccountPassword::fail(void)
     {
         if (m_failed || m_succeeded) {
             qCDebug(logger) << "Suppressing 'failure' in unlocking accounts: already handled";
             return;
         }
 
         m_failed = true;
         QObject::disconnect(m_secret, &AccountSecret::requestsCancelled, this, &RequestAccountPassword::fail);
         QObject::disconnect(m_secret, &AccountSecret::passwordAvailable, this, &RequestAccountPassword::unlock);
         QObject::disconnect(m_secret, &AccountSecret::keyAvailable, this, &RequestAccountPassword::finish);
         Q_EMIT failed();
         Q_EMIT finished();
     }
 
     void RequestAccountPassword::unlock(void)
     {
         secrets::SecureMasterKey * derived = m_secret->deriveKey();
         std::optional<secrets::EncryptedSecret> challenge = m_secret->challenge();
         if (derived && challenge) {
             qCInfo(logger) << "Successfully derived key for storage";
             return;
         } else {
             qCInfo(logger) << "Failed to unlock storage:"
                 << "Unable to derive secret encryption/decryption key or generate its matching challenge";
         }
     }
 
     void RequestAccountPassword::finish(void)
     {
         if (m_succeeded || m_failed) {
             qCDebug(logger) << "Suppressing 'success' in unlocking accounts: already handled";
             return;
         }
 
         QObject::disconnect(m_secret, &AccountSecret::requestsCancelled, this, &RequestAccountPassword::fail);
         QObject::disconnect(m_secret, &AccountSecret::passwordAvailable, this, &RequestAccountPassword::unlock);
         QObject::disconnect(m_secret, &AccountSecret::keyAvailable, this, &RequestAccountPassword::finish);
         std::optional<secrets::EncryptedSecret> challenge = m_secret->challenge();
         secrets::SecureMasterKey * derived = m_secret->key();
         if (!derived) {
             qCInfo(logger) << "Failed to finish unlocking storage: no secret encryption/decryption key";
             m_failed = true;
             Q_EMIT failed();
             Q_EMIT finished();
             return;
         }
 
         // sanity check: challenge should be available once key derivation has completed successfully
         if (!challenge) {
             qCInfo(logger) << "Failed to finish unlocking storage: no challenge for encryption/decryption key";
             m_failed = true;
             Q_EMIT failed();
             Q_EMIT finished();
             return;
         }
 
         bool ok = false;
         m_settings([derived, &challenge, &ok](QSettings &settings) -> void
         {
             if (!settings.isWritable()) {
                 qCWarning(logger) << "Unable to save account secret key parameters: storage not writable";
                 return;
             }
 
             const secrets::KeyDerivationParameters params = derived->params();
 
             QString encodedSalt = QString::fromUtf8(derived->salt().toBase64(QByteArray::Base64Encoding));
             QString encodedChallenge = QString::fromUtf8(challenge->cryptText().toBase64(QByteArray::Base64Encoding));
             QString encodedNonce = QString::fromUtf8(challenge->nonce().toBase64(QByteArray::Base64Encoding));
             settings.beginGroup(QStringLiteral("master-key"));
             settings.setValue(QStringLiteral("salt"), encodedSalt);
             settings.setValue(QStringLiteral("cpu"), params.cpuCost());
             settings.setValue(QStringLiteral("memory"), (quint64) params.memoryCost());
             settings.setValue(QStringLiteral("algorithm"), params.algorithm());
             settings.setValue(QStringLiteral("length"), params.keyLength());
             settings.setValue(QStringLiteral("nonce"), encodedNonce);
             settings.setValue(QStringLiteral("challenge"), encodedChallenge);
             settings.endGroup();
             ok = true;
         });
 
         if (ok) {
             qCInfo(logger) << "Successfully unlocked storage";
             m_succeeded = true;
             Q_EMIT unlocked();
         } else {
             qCInfo(logger) << "Failed to finish unlocking storage: unable to store parameters";
             m_failed = true;
             Q_EMIT failed();
         }
         Q_EMIT finished();
     }
 
     void RequestAccountPassword::run(void)
     {
         if (!m_secret) {
             qCDebug(logger) << "Unable to request accounts password: no account secret object";
             m_failed = true;
             Q_EMIT failed();
             Q_EMIT finished();
             return;
         }
 
         QObject::connect(m_secret, &AccountSecret::passwordAvailable, this, &RequestAccountPassword::unlock);
         QObject::connect(m_secret, &AccountSecret::requestsCancelled, this, &RequestAccountPassword::fail);
         QObject::connect(m_secret, &AccountSecret::keyAvailable, this, &RequestAccountPassword::finish);
 
         if (!m_secret->isStillAlive()) {
             qCDebug(logger) << "Unable to request accounts password: account secret marked for death";
             fail();
             return;
         }
 
         bool ok = false;
         m_settings([this, &ok](QSettings &settings) -> void
         {
             if (!settings.isWritable()) {
                 qCWarning(logger) << "Unable to request password for accounts: storage not writable";
                 return;
             }
 
             QStringList groups = settings.childGroups();
             if (!groups.contains(QStringLiteral("master-key"))) {
                 qCInfo(logger) << "No key derivation parameters found: requesting 'new' password for accounts";
                 ok = m_secret->requestNewPassword();
                 return;
             }
 
             settings.beginGroup(QStringLiteral("master-key"));
             QByteArray salt;
             QByteArray nonce;
             QByteArray challenge;
             quint64 cpuCost = 0ULL;
             quint64 keyLength = 0ULL;
             size_t memoryCost = 0ULL;
             // HACK: disables challenge verification, remove at some point!
             bool challengeAvailable = settings.contains(QStringLiteral("challenge"));
             int algorithm = settings.value(QStringLiteral("algorithm")).toInt(&ok);
             if (ok) {
                 ok = false;
                 keyLength = settings.value(QStringLiteral("length")).toULongLong(&ok);
             }
             if (ok) {
                 ok = false;
                 cpuCost = settings.value(QStringLiteral("cpu")).toULongLong(&ok);
             }
             if (ok) {
                 ok = false;
                 memoryCost = settings.value(QStringLiteral("memory")).toULongLong(&ok);
             }
             if (ok) {
                 QByteArray encodedSalt = settings.value(QStringLiteral("salt")).toString().toUtf8();
                 salt = QByteArray::fromBase64(encodedSalt, QByteArray::Base64Encoding);
                 ok = !salt.isEmpty() && secrets::SecureMasterKey::validate(salt);
             }
 
             // HACK: disables challenge verification, remove at some point!
             if (challengeAvailable && ok) {
                 QByteArray encodedChallenge = settings.value(QStringLiteral("challenge")).toString().toUtf8();
                 challenge = QByteArray::fromBase64(encodedChallenge, QByteArray::Base64Encoding);
                 ok = !challenge.isEmpty();
             }
             // HACK: disables challenge verification, remove at some point!
             if (challengeAvailable && ok) {
                 QByteArray encodedNonce = settings.value(QStringLiteral("nonce")).toString().toUtf8();
                 nonce = QByteArray::fromBase64(encodedNonce, QByteArray::Base64Encoding);
                 ok = !nonce.isEmpty();
             }
             settings.endGroup();
 
             const auto params = secrets::KeyDerivationParameters::create(keyLength, algorithm, memoryCost, cpuCost);
             const auto encryptedChallenge = secrets::EncryptedSecret::from(challenge, nonce);
 
             // HACK: disables challenge verification, remove at some point!
             if (!ok || !params || !secrets::SecureMasterKey::validate(*params) || (challengeAvailable && !encryptedChallenge)) {
                 qCDebug(logger) << "Unable to request 'existing' password: invalid challenge, nonce, salt or key derivation parameters";
                 return;
             }
 
             qCInfo(logger) << "Requesting 'existing' password for accounts";
             ok = challengeAvailable
                 ? m_secret->requestExistingPassword(*encryptedChallenge, salt, *params)
                 : m_secret->requestExistingPassword(salt, *params); // HACK: disables challenge verification, remove at some point!
         });
 
         if (!ok) {
             qCInfo(logger) << "Unable to unlock storage: failed to request password for accounts";
             fail();
         }
     }
 
     void LoadAccounts::run(void)
     {
         if (!m_secret || !m_secret->key()) {
             qCDebug(logger) << "Unable to load accounts: secret decryption key not available";
             Q_EMIT finished();
             return;
         }
 
         bool failed = false;
         const PersistenceAction act([this, &failed](QSettings &settings) -> void
         {
             qCInfo(logger, "Loading accounts from storage");
             const QStringList entries = settings.childGroups();
             for (const QString &group : entries) {
                 if (group == QLatin1String("master-key")) {
                     continue;
                 }
 
                 const QUuid id(group);
                 if (id.isNull()) {
                     qCDebug(logger)
                         << "Ignoring:" << group
                         << "Not an account section";
                     failed = true;
                     continue;
                 }
 
                 settings.beginGroup(group);
 
                 const QString accountName = settings.value(QStringLiteral("account")).toString();
                 if (!checkName(accountName)) {
                     qCWarning(logger)
                         << "Skipping invalid account:" << id
                         << "Invalid account name";
                     settings.endGroup();
                     continue;
                 }
 
                 const QString issuer = settings.value(QStringLiteral("issuer"), QString()).toString();
                 if (!checkIssuer(issuer)) {
                     qCWarning(logger)
                         << "Skipping invalid account:" << id
                         << "Invalid account issuer";
                     settings.endGroup();
                     continue;
                 }
 
                 const QString type = settings.value(QStringLiteral("type")).toString();
                 if (type != QStringLiteral("hotp") && type != QStringLiteral("totp")) {
                     qCWarning(logger)
                         << "Skipping invalid account:" << id
                         << "Invalid account type";
                     settings.endGroup();
                     failed = true;
                     continue;
                 }
 
                 bool ok = false;
                 const int tokenLength = settings.value(QStringLiteral("pinLength")).toInt(&ok);
                 if (!ok || !checkTokenLength(tokenLength)) {
                     qCWarning(logger)
                         << "Skipping invalid account:" << id
                         << "Invalid token length";
                     settings.endGroup();
                     failed = true;
                     continue;
                 }
 
                 const QByteArray encodedNonce = settings.value(QStringLiteral("nonce")).toString().toUtf8();
                 const QByteArray encodedSecret = settings.value(QStringLiteral("secret")).toString().toUtf8();
                 const QByteArray nonce = QByteArray::fromBase64(encodedNonce, QByteArray::Base64Encoding);
                 const QByteArray secret = QByteArray::fromBase64(encodedSecret, QByteArray::Base64Encoding);
 
                 const auto encryptedSecret = secrets::EncryptedSecret::from(secret, nonce);
                 if (!encryptedSecret) {
                     qCWarning(logger)
                         << "Skipping invalid account:" << id
                         << "Invalid token secret";
                     settings.endGroup();
                     failed = true;
                     continue;
                 }
 
                 QScopedPointer<secrets::SecureMemory> decrypted(m_secret->decrypt(*encryptedSecret));
                 if (!decrypted) {
                     qCWarning(logger)
                         << "Skipping invalid account:" << id
                         << "Unable to decrypt token secret";
                     settings.endGroup();
                     failed = true;
                     continue;
                 }
 
                 if (type == QStringLiteral("totp")) {
                     ok = false;
                     const uint timeStep = settings.value(QStringLiteral("timeStep")).toUInt(&ok);
                     if (!ok || !checkTimeStep(timeStep)) {
                         qCWarning(logger)
                             << "Skipping invalid account:" << id
                             << "Invalid time step";
                         settings.endGroup();
                         failed = true;
                         continue;
                     }
 
                     const QDateTime epoch = settings.value(QStringLiteral("epoch"), QDateTime::fromMSecsSinceEpoch(0))
                         .toDateTime();
                     if (!checkEpoch(epoch, m_clock)) {
                         qCWarning(logger)
                             << "Skipping invalid account:" << id
                             << "Invalid epoch";
                         settings.endGroup();
                         failed = true;
                         continue;
                     }
 
                     ok = false;
 
                     const auto hashEnum = QMetaEnum::fromType<accounts::Account::Hash>();
                     const auto hashDefault = QVariant::fromValue<accounts::Account::Hash>(accounts::Account::Sha1);
                     const QByteArray hashName = settings.value(QStringLiteral("hash"), hashDefault).toByteArray();
                     int hash = hashEnum.keyToValue(hashName.constData(), &ok);
                     if (!ok) {
                         qCWarning(logger)
                             << "Skipping invalid account:" << id
                             << "Invalid hash";
                         settings.endGroup();
                         failed = true;
                         continue;
                     }
 
                     qCInfo(logger) << "Found valid TOTP account:" << id;
                     Q_EMIT foundTotp(id, accountName, issuer, secret, nonce, tokenLength,
                                      timeStep, epoch, (Account::Hash) hash);
                 }
 
                 if (type == QStringLiteral("hotp")) {
                     ok = false;
                     const quint64 counter = settings.value(QStringLiteral("counter")).toULongLong(&ok);
                     if (!ok) {
                         qCWarning(logger)
                             << "Skipping invalid account:" << id
                             << "Invalid counter";
                         settings.endGroup();
                         failed = true;
                         continue;
                     }
 
                     const QVariant offsetVariant = settings.value(QStringLiteral("offset"));
                     ok = offsetVariant.isNull();
                     std::optional<uint> offset = ok ? std::nullopt : std::optional<uint>(offsetVariant.toUInt(&ok));
 
                     if (!ok || !checkOffset(offset, QCryptographicHash::Sha1)) {
                         qCWarning(logger)
                             << "Skipping invalid account:" << id
                             << "Invalid offset";
                         settings.endGroup();
                         failed = true;
                         continue;
                     }
 
                     const auto checkSumOff = QStringLiteral("false");
                     const auto checksum = settings.value(QStringLiteral("checksum"), checkSumOff).toString();
                     if (checksum != QStringLiteral("true") && checksum != checkSumOff) {
                         qCWarning(logger)
                             << "Skipping invalid account:" << id
                             << "Invalid checksum";
                         settings.endGroup();
                         failed = true;
                         continue;
                     }
 
                     qCInfo(logger) << "Found valid HOTP account:" << id;
                     Q_EMIT foundHotp(id, accountName, issuer, secret, nonce, tokenLength,
                                      counter, offset.has_value(), offset ? *offset : 0U,
                                      checksum == QStringLiteral("true"));
                 }
 
                 settings.endGroup();
             }
         });
         m_settings(act);
 
         if (failed) {
             Q_EMIT failedToLoadAllAccounts();
         }
         Q_EMIT finished();
     }
 
     static std::optional<QString> computeToken(const AccountSecret *accountSecret,
                                                const secrets::EncryptedSecret &tokenSecret,
                                                const oath::Algorithm &algorithm,
                                                quint64 counter)
     {
         QScopedPointer<secrets::SecureMemory> secret(accountSecret->decrypt(tokenSecret));
         if (!secret) {
             qCDebug(logger) << "Unable to compute token: failed to decrypt account secret";
             return std::nullopt;
         }
 
         return algorithm.compute(counter, reinterpret_cast<char*>(secret->data()), secret->size());
     }
 
 
     ComputeTotp::ComputeTotp(const AccountSecret *secret,
                              const secrets::EncryptedSecret &tokenSecret, uint tokenLength,
                              const QDateTime &epoch, uint timeStep, const Account::Hash hash,
                              const std::function<qint64(void)> &clock) :
         AccountJob(), m_secret(secret), m_tokenSecret(tokenSecret), m_tokenLength(tokenLength),
         m_epoch(epoch), m_timeStep(timeStep), m_hash(hash), m_clock(clock)
     {
     }
 
     void ComputeTotp::run(void)
     {
         if (!m_secret || !m_secret->key()) {
             qCDebug(logger) << "Unable to compute TOTP token: secret decryption key not available";
             Q_EMIT finished();
             return;
         }
 
         if (!checkTokenLength(m_tokenLength)) {
             qCDebug(logger) << "Unable to compute TOTP token: invalid token length:" << m_tokenLength;
             Q_EMIT finished();
             return;
         }
 
         if (!checkTimeStep(m_timeStep)) {
             qCDebug(logger) << "Unable to compute TOTP token: invalid time step:" << m_timeStep;
             Q_EMIT finished();
             return;
         }
 
         if (!checkEpoch(m_epoch, m_clock)) {
             qCDebug(logger) << "Unable to compute TOTP token: invalid epoch:" << m_epoch;
             Q_EMIT finished();
             return;
         }
 
         QCryptographicHash::Algorithm hash;
         switch(m_hash)
         {
         case Account::Hash::Sha1:
             hash = QCryptographicHash::Sha1;
             break;
         case Account::Hash::Sha256:
             hash = QCryptographicHash::Sha256;
             break;
         case Account::Hash::Sha512:
             hash = QCryptographicHash::Sha512;
             break;
         default:
             qCDebug(logger) << "Unable to compute TOTP token: unknown hashing algorithm:" << m_hash;
             Q_EMIT finished();
             return;
 
         }
 
         const std::optional<oath::Algorithm> algorithm = oath::Algorithm::totp(hash, m_tokenLength);
         if (!algorithm) {
             qCDebug(logger) << "Unable to compute TOTP token: failed to construct algorithm";
             Q_EMIT finished();
             return;
         }
 
         const std::optional<quint64> counter = oath::count(m_epoch, m_timeStep, m_clock);
         if (!counter) {
             qCDebug(logger) << "Unable to compute TOTP token: failed to count time steps";
             Q_EMIT finished();
             return;
         }
 
         const auto counterValue = *counter;
         const auto validFrom = counterValue < maxCounter
             ? oath::fromCounter(counterValue + 1ULL, m_epoch, m_timeStep)
             : std::nullopt;
         const auto validUntil = counterValue < (maxCounter - 1ULL)
             ? oath::fromCounter(counterValue + 2ULL, m_epoch, m_timeStep)
             : std::nullopt;
         if (!validFrom || !validUntil) {
             qCDebug(logger) << "Unable to compute TOTP token: failed to determine expiry datetime of tokens";
             Q_EMIT finished();
             return;
         }
 
         const auto token = computeToken(m_secret, m_tokenSecret, *algorithm, counterValue);
         const auto nextToken = token
             ? computeToken(m_secret, m_tokenSecret, *algorithm, counterValue + 1ULL)
             : std::nullopt;
         if (token && nextToken) {
             Q_EMIT otp(*token, *nextToken, *validFrom, *validUntil);
         } else {
             qCDebug(logger) << "Failed to compute TOTP tokens";
         }
 
         Q_EMIT finished();
     }
 
     ComputeHotp::ComputeHotp(const AccountSecret *secret,
                              const secrets::EncryptedSecret &tokenSecret, uint tokenLength,
                              quint64 counter, const std::optional<uint> offset, bool checksum) :
         AccountJob(), m_secret(secret), m_tokenSecret(tokenSecret), m_tokenLength(tokenLength),
         m_counter(counter), m_offset(offset), m_checksum(checksum)
     {
     }
 
     void ComputeHotp::run(void)
     {
         if (!m_secret || !m_secret->key()) {
             qCDebug(logger) << "Unable to compute HOTP token: secret decryption key not available";
             Q_EMIT finished();
             return;
         }
 
         if (!checkTokenLength(m_tokenLength)) {
             qCDebug(logger) << "Unable to compute HOTP token: invalid token length:" << m_tokenLength;
             Q_EMIT finished();
             return;
         }
 
         if (!checkOffset(m_offset, QCryptographicHash::Sha1)) {
             qCDebug(logger) << "Unable to compute HOTP token: invalid offset:" << *m_offset;
             Q_EMIT finished();
             return;
         }
 
         const std::optional<oath::Algorithm> algorithm = oath::Algorithm::hotp(m_offset, m_tokenLength, m_checksum);
         if (!algorithm) {
             qCDebug(logger) << "Unable to compute HOTP token: failed to construct algorithm";
             Q_EMIT finished();
             return;
         }
 
         if (m_counter == maxCounter) {
             qCDebug(logger) << "Unable to compute HOTP token: counter reached its limit";
             Q_EMIT finished();
             return;
         }
 
         const auto token = computeToken(m_secret, m_tokenSecret, *algorithm, m_counter);
         const auto nextToken = token
             ? computeToken(m_secret, m_tokenSecret, *algorithm, m_counter + 1ULL)
             : std::nullopt;
         if (token && nextToken) {
             Q_EMIT otp(*token, *nextToken, m_counter + 1ULL);
         } else {
             qCDebug(logger) << "Failed to compute HOTP tokens";
         }
 
         Q_EMIT finished();
     }
 
     Dispatcher::Dispatcher(QThread *thread, QObject *parent) :
         QObject(parent), m_thread(thread),  m_current(nullptr)
     {
     }
 
     bool Dispatcher::empty(void) const
     {
         return m_pending.isEmpty();
     }
 
     void Dispatcher::queueAndProceed(AccountJob *job, const std::function<void(void)> &setup_callbacks)
     {
         if (job) {
             qCDebug(dispatcherLogger) << "Queuing job for dispatcher";
             job->moveToThread(m_thread);
             setup_callbacks();
             m_pending.append(job);
             dispatchNext();
         }
     }
 
     void Dispatcher::dispatchNext(void)
     {
         qCDebug(dispatcherLogger) << "Handling request to dispatch next job";
 
         if (!empty() && !m_current) {
             qCDebug(dispatcherLogger) << "Dispatching next job";
 
             m_current = m_pending.takeFirst();
             QObject::connect(m_current, &AccountJob::finished, this, &Dispatcher::next);
             QObject::connect(this, &Dispatcher::dispatch, m_current, &AccountJob::run);
             Q_EMIT dispatch();
         }
     }
 
     void Dispatcher::next(void)
     {
         qCDebug(dispatcherLogger) << "Handling next continuation in dispatcher";
 
         QObject *from = sender();
         AccountJob *job = from ? qobject_cast<AccountJob*>(from) : nullptr;
         if (job) {
             Q_ASSERT_X(job == m_current, Q_FUNC_INFO, "sender() should match 'current' job!");
             QObject::disconnect(this, &Dispatcher::dispatch, job, &AccountJob::run);
             // NOLINTNEXTLINE(clang-analyzer-cplusplus.NewDeleteLeaks): False positives with QTimer::singleShot
             QTimer::singleShot(0, job, &AccountJob::deleteLater);
             m_current = nullptr;
             dispatchNext();
         }
     }
 }