Documentation
¶
Overview ¶
Package totp is a thin platform seam over github.com/pquerna/otp (RFC 6238 TOTP), mirroring the qrcode and crypto packages: it isolates the third-party dependency behind a small, stateless surface so the caller's application layer depends on its own minimal interface rather than the library directly, keeping that layer's tests hermetic and the library swappable.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Provider ¶
type Provider struct{}
Provider generates and validates RFC 6238 TOTP secrets using the standard Google-Authenticator-compatible parameters (30-second period, 6 digits, SHA1, ±1 period clock-skew tolerance) via pquerna/otp's defaults. It holds no state, so the zero value is ready to use.
func NewProvider ¶
func NewProvider() *Provider
NewProvider constructs a Provider. It takes no dependencies; the constructor exists for symmetry with this codebase's other platform seams (e.g. crypto.NewCipher, qrcode's package functions) and so composition roots inject it the same way as every other dependency.
func (Provider) GenerateSecret ¶
GenerateSecret creates a new random TOTP secret for accountName under issuer, returning the base32-encoded secret (for manual entry) and its otpauth:// provisioning URI (for QR code rendering). The secret is never logged or returned to any caller other than the one enrolling.
func (Provider) MatchStep ¶
MatchStep reports whether code is valid for secret at any RFC 6238 step (the counter, floor(unix/period)) within the ±1-period skew window of now — the SAME tolerance Validate applies — and, when it is, which step matched. Unlike Validate's plain bool, the matched step lets a caller enforce a durable replay guard across steps (the same code must never be accepted twice, even across the skew window, which requires knowing WHICH of the up to three candidate steps a submitted code actually corresponds to).
When more than one candidate step matches — an astronomically unlikely coincidence for a 6-digit code, but not provably impossible — the HIGHEST step is returned, so a caller's replay guard stays maximally restrictive rather than accidentally permissive.
Source Files