mfasec

Documentation

Index

• func DecryptSecret(encoded, jwtSecret string) (string, error)
• func EncryptSecret(plaintext, jwtSecret string) (string, error)
• func FormatExpiry(t time.Time) string
• func GenerateTOTPCode(secret string, t time.Time) (string, error)
• func GenerateTOTPSecret() (string, error)
• func OTPAuthURL(issuer, account, secret string) string
• func ParseExpiry(raw string) (time.Time, error)
• func SignPendingLogin(jwtSecret string, claims PendingLoginClaims, ttl time.Duration) (string, time.Time, error)
• func ValidateTOTP(passcode, secret string) bool
• type PendingLoginClaims
  • func VerifyPendingLogin(jwtSecret, token string) (PendingLoginClaims, error)

Functions

func DecryptSecret

func DecryptSecret(encoded, jwtSecret string) (string, error)

DecryptSecret decrypts a stored TOTP secret.

func EncryptSecret

func EncryptSecret(plaintext, jwtSecret string) (string, error)

EncryptSecret encrypts a TOTP secret for storage at rest.

func FormatExpiry

func FormatExpiry(t time.Time) string

FormatExpiry returns RFC3339 for API responses.

func GenerateTOTPCode

func GenerateTOTPCode(secret string, t time.Time) (string, error)

GenerateTOTPCode returns the current TOTP code for tests.

func GenerateTOTPSecret

func GenerateTOTPSecret() (string, error)

GenerateTOTPSecret returns a base32-encoded TOTP secret.

func OTPAuthURL

func OTPAuthURL(issuer, account, secret string) string

OTPAuthURL builds an otpauth URI for authenticator apps.

func ParseExpiry

func ParseExpiry(raw string) (time.Time, error)

ParseExpiry parses RFC3339 expiry strings in tests.

func SignPendingLogin

func SignPendingLogin(jwtSecret string, claims PendingLoginClaims, ttl time.Duration) (string, time.Time, error)

SignPendingLogin creates a short-lived pending login token.

func ValidateTOTP

func ValidateTOTP(passcode, secret string) bool

ValidateTOTP checks a six-digit code with ±1 step skew.

Types

type PendingLoginClaims

type PendingLoginClaims struct {
	CustomerID      string `json:"customer_id"`
	TokenGeneration int64  `json:"token_generation"`
	ExpiresAt       int64  `json:"expires_at"`
}

PendingLoginClaims identifies an authenticated password step awaiting MFA.

func VerifyPendingLogin

func VerifyPendingLogin(jwtSecret, token string) (PendingLoginClaims, error)

VerifyPendingLogin validates and parses a pending login token.