Implement pass-otp-compatible TOTP and HOTP behavior entirely in crates/storage and expose it through ironstorage otp.
Scope
Parse and validate otpauth://totp and otpauth://hotp URIs, including Base32 secret, issuer, account, algorithm, digits, period, and counter.
Implement otp code/show, default-to-code dispatch, insert/add, append, uri, validate, help and version behavior.
Support secret-derived URI creation with issuer/account defaults and path derivation from the URI label.
Find and replace or append the URI within multiline pass entries.
Generate SHA-1, SHA-256 and SHA-512 TOTP/HOTP codes; increment HOTP counters atomically and commit the updated entry.
Integrate clipboard and QR presentation without external OTP or QR tools.
Acceptance criteria
RFC 4226 and RFC 6238 vectors pass, including alternate algorithms, digits, periods and HOTP counters.
pass-otp fixtures round-trip through insert, append, code, URI and validate operations.
Malformed, ambiguous, duplicate and missing URI cases return typed errors without changing an entry or Git history.
Prerequisites
Insert/edit behavior; clipboard and QR presentation; embedded Git integration.
## Objective
Implement pass-otp-compatible TOTP and HOTP behavior entirely in `crates/storage` and expose it through `ironstorage otp`.
## Scope
- Parse and validate `otpauth://totp` and `otpauth://hotp` URIs, including Base32 secret, issuer, account, algorithm, digits, period, and counter.
- Implement `otp code/show`, default-to-code dispatch, `insert/add`, `append`, `uri`, `validate`, help and version behavior.
- Support secret-derived URI creation with issuer/account defaults and path derivation from the URI label.
- Find and replace or append the URI within multiline pass entries.
- Generate SHA-1, SHA-256 and SHA-512 TOTP/HOTP codes; increment HOTP counters atomically and commit the updated entry.
- Integrate clipboard and QR presentation without external OTP or QR tools.
## Acceptance criteria
- RFC 4226 and RFC 6238 vectors pass, including alternate algorithms, digits, periods and HOTP counters.
- pass-otp fixtures round-trip through insert, append, code, URI and validate operations.
- Malformed, ambiguous, duplicate and missing URI cases return typed errors without changing an entry or Git history.
## Prerequisites
Insert/edit behavior; clipboard and QR presentation; embedded Git integration.
hugo
added this to the 01 - Full Rust pass CLI parity milestone 2026-08-09 18:57:12 +00:00
Added storage-owned, pass-otp-compatible otpauth URI parsing and validation with exact URI preservation, Base32 decoding, issuer/account handling, SHA1/SHA256/SHA512, 6/8 digits, custom periods, and HOTP counters.
Added RFC-compatible TOTP/HOTP generation, atomic encrypted HOTP counter replacement, embedded Git commits, stale-write detection, and rollback on commit failure.
Added insert/replace/append/URI/code flows with multiline entry preservation, secret-derived URI/path defaults, typed redacted errors, hidden input, and no external OTP/pass/GPG/Git/QR helpers.
Wired terminal, clipboard, and QR presentation through the existing Rust presentation layer.
All checks passed. The implementation was reviewed against every acceptance criterion; malformed, ambiguous, duplicate, missing, declined, stale, and commit-failure cases leave entries and Git history unchanged.
Implemented in commit 4bd39b1 (pushed to main).
What changed:
- Added storage-owned, pass-otp-compatible otpauth URI parsing and validation with exact URI preservation, Base32 decoding, issuer/account handling, SHA1/SHA256/SHA512, 6/8 digits, custom periods, and HOTP counters.
- Added RFC-compatible TOTP/HOTP generation, atomic encrypted HOTP counter replacement, embedded Git commits, stale-write detection, and rollback on commit failure.
- Added insert/replace/append/URI/code flows with multiline entry preservation, secret-derived URI/path defaults, typed redacted errors, hidden input, and no external OTP/pass/GPG/Git/QR helpers.
- Wired terminal, clipboard, and QR presentation through the existing Rust presentation layer.
- Added pass-otp compatibility fixture tests, complete RFC 4226 and RFC 6238 vectors, parser/error/non-mutation tests, transactional HOTP tests, and CLI integration coverage.
- Documented the storage boundary and OTP compatibility behavior.
Verification completed:
- cargo fmt --all -- --check
- RUSTFLAGS="-D warnings" cargo check --workspace --all-targets
- cargo clippy --workspace --all-targets -- -D warnings
- cargo test --workspace
All checks passed. The implementation was reviewed against every acceptance criterion; malformed, ambiguous, duplicate, missing, declined, stale, and commit-failure cases leave entries and Git history unchanged.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Objective
Implement pass-otp-compatible TOTP and HOTP behavior entirely in
crates/storageand expose it throughironstorage otp.Scope
otpauth://totpandotpauth://hotpURIs, including Base32 secret, issuer, account, algorithm, digits, period, and counter.otp code/show, default-to-code dispatch,insert/add,append,uri,validate, help and version behavior.Acceptance criteria
Prerequisites
Insert/edit behavior; clipboard and QR presentation; embedded Git integration.
Implemented in commit
4bd39b1(pushed to main).What changed:
Verification completed:
All checks passed. The implementation was reviewed against every acceptance criterion; malformed, ambiguous, duplicate, missing, declined, stale, and commit-failure cases leave entries and Git history unchanged.