Use Redis GETDEL when reading a one time password

A get followed by delete left a race where two clients could both retrieve the same secret. GETDEL fetches and removes the key in one step.

Author: Hashim1999164

snappass/main.py

@@ -174,8 +174,9 @@ def get_password(token):
     If not, the password is simply returned as is.
     """
     storage_key, decryption_key = parse_token(token)
-    password = redis_client.get(storage_key)
-    redis_client.delete(storage_key)
+    # Atomically get and delete so two clients cannot both read the secret
+    # (requires Redis 6.2+ / redis-py getdel).
+    password = redis_client.getdel(storage_key)
 
     if password is not None: