Struct TotpPlugin 

pub struct TotpPlugin {
    pub enforce: bool,
    pub protected_actions: Vec<String>,
    /* private fields */
}

TOTP 2FA plugin. Implements time-based one-time passwords (RFC 6238). Uses HMAC-SHA1 with 30-second time steps and 6-digit codes.

Fields

enforce: bool

If true, require 2FA verification on protected actions.

protected_actions: Vec<String>

Actions that require 2FA (empty = all actions when enforce is true).

Implementations

impl TotpPlugin

pub fn new() -> Self

pub fn enforced(protected_actions: Vec<String>) -> Self

pub fn enroll(&self, user_id: &str) -> String

Enroll a user in 2FA. Returns the secret (for QR code generation).

pub fn verify(&self, user_id: &str, code: &str) -> bool

Verify a TOTP code and mark enrollment as verified.

Constant-time compare prevents timing attacks on the 6-digit code. The verified code’s counter is recorded so the same code cannot be replayed within its 30-second window — a successful verify burns that counter for this user.

pub fn is_verified(&self, user_id: &str) -> bool

Check if a user has verified 2FA.

pub fn is_enrolled(&self, user_id: &str) -> bool

Check if a user is enrolled (whether verified or not).

pub fn current_code(&self, user_id: &str) -> Option<String>

Generate the current TOTP code for a user.

pub fn unenroll(&self, user_id: &str) -> bool

Remove 2FA enrollment for a user.

Trait Implementations

impl Plugin for TotpPlugin

fn name(&self) -> &str

Unique name for this plugin.

fn on_init(&self, _ctx: &PluginContext)

Called once when the plugin is registered.

fn routes(&self) -> Vec<PluginRoute>

Custom API routes this plugin handles.

fn before_insert( &self, _entity: &str, _data: &mut Value, _auth: &AuthContext, ) -> Result<(), PluginError>

Called before an entity insert. Return Err to reject.

fn after_insert( &self, _entity: &str, _id: &str, _data: &Value, _auth: &AuthContext, )

Called after a successful insert.

fn before_update( &self, _entity: &str, _id: &str, _data: &mut Value, _auth: &AuthContext, ) -> Result<(), PluginError>

Called before an entity update. Return Err to reject.

fn after_update( &self, _entity: &str, _id: &str, _data: &Value, _auth: &AuthContext, )

Called after a successful update.

fn before_delete( &self, _entity: &str, _id: &str, _auth: &AuthContext, ) -> Result<(), PluginError>

Called before an entity delete. Return Err to reject.

fn after_delete(&self, _entity: &str, _id: &str, _auth: &AuthContext)

Called after a successful delete.

fn on_request( &self, _method: &str, _path: &str, _auth: &AuthContext, ) -> Result<(), PluginError>

Called on every incoming request (middleware).

fn on_request_with_meta( &self, method: &str, path: &str, auth: &AuthContext, _meta: &RequestMeta<'_>, ) -> Result<(), PluginError>

Richer variant of [on_request] that also receives per-request metadata (peer IP today; more fields may be added later). The default implementation delegates to on_request so existing plugins keep working without changes. Plugins that care about IP — notably rate limiting — override this hook.

fn on_session_create(&self, _user_id: &str, _token: &str)

Called when a new session is created.

fn entities(&self) -> Vec<ManifestEntity>

Additional manifest entities this plugin contributes.