Documentation
¶
Overview ¶
Package totpadapter implements the credbound.TOTPProvider port with RFC 6238 six-digit SHA-1 codes (the interoperable authenticator-app profile) on top of github.com/pquerna/otp.
Wire it into credbound.Config.TOTP:
totp, err := totpadapter.New(totpadapter.Config{Issuer: "Example"})
Credbound owns everything around the algorithm: secret storage, replay rejection by time step, recovery codes and step-up semantics.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
// Issuer is the display name embedded in otpauth:// URIs so
// authenticator apps can label the account. Required.
Issuer string
// Period is the time-step length in seconds. Zero defaults to 30;
// values outside 15 through 120 are rejected.
Period uint
// Skew is how many adjacent time steps are accepted around the current
// one to absorb clock drift. At most 2; larger windows widen the
// brute-force and replay surface.
Skew uint
}
Config parameterizes the TOTP algorithm. Only Issuer is required.
type Provider ¶
type Provider struct {
// contains filtered or unexported fields
}
Provider generates and validates TOTP codes. It is stateless and safe for concurrent use. It implements credbound.TOTPProvider.
func New ¶
New validates config and returns a Provider. A missing issuer or an unsafe period/skew combination is rejected.
func (*Provider) Generate ¶
Generate creates a fresh 160-bit shared secret for accountName and returns the base32 secret together with its otpauth:// provisioning URI. The secret must be treated as a credential; Credbound stores it encrypted and the URI should only ever be shown to the enrolling user.
func (*Provider) Validate ¶
Validate checks code against secret at the given time, accepting the configured skew. It returns the time step of the code that actually matched — not the wall-clock step — so the store's monotonic replay guard (last_used_step) rejects reuse of a code across every step in the skew window. Returning the wall-clock step would let a code accepted at an earlier step be replayed at each later step still inside the window. The reported step is meaningful only when the boolean is true; otherwise it is the current wall-clock step.
Source Files