Collaborative development · Authentication & testing

Poké-Hub

A Pokémon model and dataset repository where I implemented two-factor authentication and account-recovery mechanisms.

Period: Nov–Dec 2025
Team: 12 people · two teams of 6
Context: Academic extension of UVLHub for a Pokémon model and dataset repository.
My role: Two-factor authentication: logic, interfaces and testing

My contribution

I implemented the two-factor authentication flow, from its screens and encrypted authentication secret to recovery codes and tests.

Poké-Hub: a repository of Pokémon models and datasets.

End-to-end 2FA
Two teams of 6

Extending an existing application

Poké-Hub builds on UVLHub and adapts its catalogue to Pokémon models and datasets, following reuse and open-science principles. Two teams of six worked in a shared repository.

Within my team, I took responsibility for two-factor authentication: adding protection while keeping setup, login and recovery understandable.

Poké-Hub security settings — Two-factor authentication enabled for a test account.

From setup to sign-in

TOTP setup using a QR code or manual secret entry, confirmed with a six-digit code.
Fernet encryption of the authentication secret before storage.
Additional sign-in verification and password-protected deactivation.
Jinja screens for setup, verification and account recovery.

Original Poké-Hub two-factor verification screen — Two-factor verification for sign-in.

Recovery and testing

I implemented single-use recovery codes, stored as hashes and consumed when used, to allow access if the authentication device is lost.

I added unit, integration and Selenium browser tests, alongside a Locust load scenario and changes to the continuous-integration environment.

Original Poké-Hub recovery-code screen — Recovery codes for a test account.

Source code and documentation available.

Code on GitHub