Documentation
¶
Overview ¶
Package totp implements TOTP (RFC 6238) validation using only the standard library: HMAC-SHA1 with a 30-second step, 6-digit output, and ±1 step clock skew. It has no dependencies on the rest of Culvert (first internal/ leaf extracted under ADR-0002).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func VerifyTOTPReturnCounter ¶
func VerifyTOTPReturnCounter(secret, code string, nowUnix, lastCounter int64) (ok bool, counter int64)
VerifyTOTPReturnCounter validates a TOTP code and returns (ok, counter) where counter is the matched time-step. Callers MUST track the last-matched counter per user and reject codes whose matched counter is <= lastCounter to close the replay window (RFC 6238 §5.2). Passing lastCounter = 0 disables replay protection (legacy call sites).
A nowUnix parameter is taken instead of calling time.Now() so tests can exercise the function deterministically without clock monkey-patching.
Types ¶
This section is empty.
Source Files