tfa

type Digits int

type HashAlgorithm string

type Key struct{ *url.URL }

type OTP interface {
	// Interval returns sequential value to be used in HMAC.
	// If targted OTP is HOTP returns counter value,
	// Otherwise, return time-step (current UTC time / period)
	Interval() uint64
	// Secret return OTP shared secret.
	Secret() string
	// Algorithm return OTP hashing algorithm.
	Algorithm() HashAlgorithm
	// Digits return OTP digits.
	Digits() Digits
	// Verify increments its interval and then calculates the next OTP value.
	// If the received value matches the calculated value then the OTP value is valid.
	// Verify follow validation of OTP values as described in RFC 6238 section 4.1 and
	// And RFC 4226 section 7.2.
	// To enable throttling at the server and stop brute force attacks,
	// The Verify method lunch lockout mechanism based on a predefined configuration.
	// The lockout mechanism implement a delay scheme and failed OTP counter,
	// Each time OTP verification failed the delay scheme increased by delay*failed, number of seconds,
	// And client must wait for the delay window, Otherwise, an error returned  verfication process disabled.
	// Once the max attempts reached the verification process return error indicate account has been blocked.
	// Lockout mechanism disabled by default, See OTPConfig to learn more about lockout configuration.
	// Lockout follow Throttling at the Server as described in RFC 4226 section 7.3 .
	Verify(otp string) (bool, error)
}

type OTPConfig struct {
	// OTPType targted OTP (TOTP, HOTP)
	OTPType OTPType
	// LockOutStartAt define in what attempt number, lockout mechanism start work.
	// Default  0
	LockOutStartAt uint
	// EnableLockout enable or disable lockout mechanism
	EnableLockout bool
	// LockOutDelay define delay window o disable password verification process default 30
	// the formula is delay * failed Attempts as described in RFC 4226 section-7.3.
	LockOutDelay uint
	// MaxAttempts define max attempts of verification failures to lock the account default 3.
	MaxAttempts uint
	// Digits represents the length of OTP.
	Digits Digits
	// SecretSize represents the length of secret, default 20 bytes.
	SecretSize uint
	// Secret represents shared secret between client and server, if empty a new secret will be generated.
	Secret string
	// HashAlgorithm represents tha hash algorithm hmac use, default SHA1
	HashAlgorithm HashAlgorithm
	// Period represents time step in seconds used by TOTP, default 30 as descriped in  RFC 6238 section-4.1.
	Period uint64
	// Counter represents the incremental number used by HOTP.
	Counter uint64
	// Issuer represents  the provider or service.
	Issuer string
	// Label represents path in key uri
	Label string
	// contains filtered or unexported fields
}

type OTPType string