Read TOTP seeds split across lines, as vm-service now does

#1573's vm-service drops CR and LF from a seed with its spaces and hyphens
before the length check (its base32 decoder skips them), so a seed pasted
across lines is valid. The clients refused it; they now drop them too. A raw
line break inside an otpauth URI is still refused, as Go's url.Parse does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019dbwbLvQGyzwkxNetvqf3v

Author: AHarmlessPyro

README.md

@@ -213,7 +213,7 @@ Things to know:
   metadata member sent replaces the stored one and `None` removes it.
 - Secret types are `secret` (the default), `totp` and `op_token`, fixed at
   creation; `client.secrets.list({"type": "totp"})` filters by type. TOTP
-  values are checked locally before upload: a base32 seed (spaces, hyphens,
+  values are checked locally before upload: a base32 seed (spaces, hyphens, line breaks,
   lowercase and trailing `=` are fine) or an `otpauth://totp/` URI with
   `algorithm` SHA1/SHA256/SHA512, `digits` 6 or 8 and `period` 1-300. Seeds
   shorter than 10 bytes (16 characters) are accepted but weak. The platform

hyperbrowser/secrets_common.py

@@ -122,12 +122,13 @@ def _invalid_totp(reason: str) -> HyperbrowserError:
 
 
 def _check_totp_base32(seed: str) -> None:
-    # Spaces, hyphens, lowercase and trailing "=" padding are accepted, as
-    # sites show seeds in all of these forms. Characters are uppercased one
+    # Spaces, hyphens, line breaks, lowercase and trailing "=" padding are
+    # accepted, as sites show seeds in all of these forms and the platform
+    # skips them too. Characters are uppercased one
     # at a time, as Go does, so "ß" can't turn into "SS".
     normalized = "".join(
         upper if len(upper) == 1 else char
-        for char in seed.replace(" ", "").replace("-", "")
+        for char in re.sub(r"[ \r\n-]", "", seed)
         for upper in [char.upper()]
     ).rstrip("=")
     if not normalized:

tests/test_credentials.py

@@ -198,6 +198,10 @@ def test_totp_secrets_seal_the_seed_under_the_returned_context(private_key):
     f"otpauth://totp/x?secret={SEED}&digits=6%zz",
     "\ufeff\u3000" + SEED + "\u00a0\u0085",
     "\u0131" + SEED[1:],
+    # The platform skips line breaks, as Go's base32 decoder does.
+    SEED[:13] + "\n" + SEED[13:],
+    SEED[:16] + "\r\n" + SEED[16:],
+    f"otpauth://totp/x?secret={SEED[:16]}%0A{SEED[16:]}",
 ]
 BAD_SEEDS = [
     ("", "empty"),
@@ -236,7 +240,6 @@ def test_totp_secrets_seal_the_seed_under_the_returned_context(private_key):
     ("\x1c" + SEED, "not base32"),
     (SEED[:-1] + "\u00df", "not base32"),
     ("\ufb00AAAAAA", "not base32"),
-    ("JBSWY3DP\nEHPK3PXP", "not base32"),
 ]