mirror of
https://github.com/DarkflameUniverse/DarkflameServer.git
synced 2026-10-02 02:43:44 +00:00
e213a7aeff
The NexusDashboard-parity dashboard (dDashboardServer) and everything built on it on the experimental branch: accounts, characters, properties and moderation tools, permissions shared with in-game slash commands, economy reports, World 3D and property 3D views with client scenery, scheduled events (features, vanity changes, live events, announcements, restarts), vanity files and events, the CDClient browser, the message inspector with saved captures, chat filter tools, community challenges, live ops, the AI moderator helper, and the server-side changes they need. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
50 lines
1.9 KiB
C++
50 lines
1.9 KiB
C++
#pragma once
|
|
|
|
#include <cstdint>
|
|
#include <optional>
|
|
#include <string>
|
|
#include <string_view>
|
|
#include <vector>
|
|
|
|
/**
|
|
* Time-based one-time passwords (RFC 6238, the codes authenticator apps show): 6 digits, 30 second steps,
|
|
* HMAC-SHA1, which is what every common authenticator app expects.
|
|
*/
|
|
namespace Totp {
|
|
constexpr int64_t STEP_SECONDS = 30;
|
|
constexpr int DIGITS = 6;
|
|
|
|
std::string Base32Encode(const std::vector<uint8_t>& data);
|
|
std::optional<std::vector<uint8_t>> Base32Decode(std::string_view text); // ignores spaces and case
|
|
|
|
// A new random 160-bit secret, base32 encoded
|
|
std::string GenerateSecret();
|
|
|
|
// The code for a time step (RFC 4226 HOTP with the step as counter)
|
|
std::string CodeAt(const std::vector<uint8_t>& secret, int64_t step);
|
|
|
|
/**
|
|
* Check a code against the current step and one step either side, for clock drift.
|
|
* @return the matching step, so the caller can refuse to accept the same step twice
|
|
*/
|
|
std::optional<int64_t> Verify(const std::string& base32Secret, std::string_view code, int64_t unixTime);
|
|
|
|
// otpauth:// link for authenticator apps (usually shown as a QR code)
|
|
std::string ProvisioningUri(const std::string& issuer, const std::string& account, const std::string& base32Secret);
|
|
|
|
// Single-use recovery codes like "k7qd-9xw2-mz4p", and the normalized form their hash is taken from
|
|
std::vector<std::string> GenerateRecoveryCodes(size_t count);
|
|
std::string NormalizeRecoveryCode(std::string_view code);
|
|
|
|
/**
|
|
* Secrets are stored encrypted (AES-256-GCM) so a database copy alone cannot generate codes.
|
|
* The key is `totp_key` from the dashboard config (64 hex characters), or a generated `dashboard_totp_key` file.
|
|
*/
|
|
bool LoadKey();
|
|
std::optional<std::string> EncryptSecret(const std::string& base32Secret);
|
|
std::optional<std::string> DecryptSecret(const std::string& stored);
|
|
|
|
// For tests: use this key instead of loading one
|
|
void SetKeyForTesting(const std::vector<uint8_t>& key);
|
|
}
|