Documentation
¶
Overview ¶
Package twofactor implements RFC 6238 TOTP verification with the standard library only (HMAC-SHA1, 30-second steps, 6 digits — the parameters every authenticator app uses by default). It is a pure leaf: no I/O, no clock dependency beyond an injected "now", so verification is fully unit-testable.
siphon uses this to gate destructive operations for profile groups that set require_2fa: the group's base32 TOTP secret (a secret-ref, never plaintext) is shared with the operator's authenticator app, and the CLI prompts for the current 6-digit code before running the operation.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Generate ¶
Generate returns the current 6-digit TOTP code for secret at time now. It is the counterpart to Verify (useful for provisioning/round-trip checks).
func Verify ¶
Verify reports whether code is a valid TOTP for secret at time now. It accepts the code for the current 30s step and the immediately adjacent steps (±1), the standard skew tolerance for clock drift between the operator's device and this host. secret is base32 (the format authenticator apps display/scan).
Types ¶
This section is empty.
Source Files