Struct TotpService 

pub struct TotpService<S> { /* private fields */ }

TOTP service — handles setup, verification, and backup codes.

Secrets are stored as CredentialKind::Passkey entries (reusing the credential row with kind "passkey" to avoid schema changes). The secret is stored as a base32-encoded string in credential_hash.

Backup codes are SHA-256 hashed and stored in metadata as a JSON array.

Implementations

impl<S> TotpService<S>

where S: UserRepository + CredentialRepository + Clone + Send + Sync + 'static,

pub fn new(storage: S, app_name: impl Into<Arc<str>>) -> Self

pub async fn begin_setup(&self, user_id: Uuid) -> Result<TotpSetup>

Generate a new TOTP secret and backup codes for a user. Call confirm_setup with the first code before persisting.

pub async fn confirm_setup( &self, user_id: Uuid, setup: &TotpSetup, code: &str, ) -> Result<()>

Confirm the user can produce a valid code, then persist the secret.

pub async fn verify(&self, req: TotpVerifyRequest) -> Result<()>

Verify a TOTP code (or a backup code) during sign-in.

pub async fn disable(&self, user_id: Uuid) -> Result<()>

Remove TOTP from a user account.

pub async fn is_enabled(&self, user_id: Uuid) -> Result<bool>

Returns true if the user has TOTP enabled.