Present OTP, QR, and sensitive-output workflows #41

New Issue

hugo · 2026-08-09T19:30:18Z

hugo commented

2026-08-09 19:30:18 +00:00

Goal

Expose the complete pass-otp experience and sensitive-output controls in the desktop app.

Scope

Display current TOTP/HOTP values, remaining validity, and storage-provided OTP metadata after authentication.
Add OTP URI entry/import, QR scan/import where platform input is available, QR export/display, and OTP removal through typed storage commands.
Provide explicit copy actions for passwords, fields, and OTP codes with configured storage-owned clipboard clearing behavior and visible success/failure feedback.
Pause or mask sensitive presentation when locked; timer ticks must update display without extending authentication activity.
Never parse OTP URIs, generate codes, render QR payload semantics, or implement clipboard security policy in the GUI.
Expose OTP actions through menus/context actions and the command palette.

Acceptance criteria

RFC fixtures exposed by crates/storage drive deterministic TOTP/HOTP UI tests.
OTP countdown updates do not renew the authentication lease.
QR and clipboard operations use storage-provided payloads/policies and reveal no secret while locked.
Import, display, copy, increment, and removal errors are recoverable and do not corrupt the entry.

## Goal Expose the complete `pass-otp` experience and sensitive-output controls in the desktop app. ## Scope - Display current TOTP/HOTP values, remaining validity, and storage-provided OTP metadata after authentication. - Add OTP URI entry/import, QR scan/import where platform input is available, QR export/display, and OTP removal through typed storage commands. - Provide explicit copy actions for passwords, fields, and OTP codes with configured storage-owned clipboard clearing behavior and visible success/failure feedback. - Pause or mask sensitive presentation when locked; timer ticks must update display without extending authentication activity. - Never parse OTP URIs, generate codes, render QR payload semantics, or implement clipboard security policy in the GUI. - Expose OTP actions through menus/context actions and the command palette. ## Acceptance criteria - RFC fixtures exposed by `crates/storage` drive deterministic TOTP/HOTP UI tests. - OTP countdown updates do not renew the authentication lease. - QR and clipboard operations use storage-provided payloads/policies and reveal no secret while locked. - Import, display, copy, increment, and removal errors are recoverable and do not corrupt the entry.

hugo added this to the 03 - Cross-platform Iced desktop app milestone 2026-08-09 19:30:18 +00:00

hugo added the enhancement label 2026-08-09 19:30:18 +00:00

hugo commented

2026-08-10 18:23:31 +00:00

Implemented and pushed in commit 4a54bf7.

Implementation:

Added storage-owned desktop OTP operations for deterministic TOTP/HOTP codes, typed metadata and validity, explicit HOTP confirmation, URI/QR presentation, transactional URI or QR import, replacement, removal, refreshed documents, and tree state.
Added pure-Rust QR image decoding in crates/storage and an Iced canvas that draws only the storage-provided zeroizing QR matrix. Platform file pickers import PNG, JPEG, or GIF QR images without helper processes.
Added one shared desktop action registry for menus, field context actions, and the command palette, plus explicit code, URI, QR, import, copy, and removal workflows.
Added visible configured clipboard cleanup countdowns and retained storage clipboard restoration and race policy for fields, passwords, OTP codes, and URIs.
Lock, expiry, utility dismissal, and stale async completion clear or reject every OTP code, URI, QR matrix, import buffer, and clipboard presentation. Passive one-second countdown ticks do not touch authentication activity.
Corrected OTP-only pass entries so a first-line otpauth URI exposes typed OTP metadata instead of being classified as a password.

Acceptance verification:

RFC 6238 TOTP and RFC 4226 HOTP desktop regressions cover code display, metadata, countdown, explicit counter commit, and refreshed entry state.
QR image round-trip, invalid image, declined replacement, import, replacement, removal, clipboard cleanup, lock clearing, and authentication-expiry regressions are green.
Error paths preserve ciphertext or recoverable UI state and do not corrupt entries.

Required gates:

cargo fmt --all -- --check
RUSTFLAGS=-D warnings cargo check --workspace --all-targets
cargo clippy --workspace --all-targets -- -D warnings
cargo test --workspace

All gates passed.

Implemented and pushed in commit 4a54bf7. Implementation: - Added storage-owned desktop OTP operations for deterministic TOTP/HOTP codes, typed metadata and validity, explicit HOTP confirmation, URI/QR presentation, transactional URI or QR import, replacement, removal, refreshed documents, and tree state. - Added pure-Rust QR image decoding in crates/storage and an Iced canvas that draws only the storage-provided zeroizing QR matrix. Platform file pickers import PNG, JPEG, or GIF QR images without helper processes. - Added one shared desktop action registry for menus, field context actions, and the command palette, plus explicit code, URI, QR, import, copy, and removal workflows. - Added visible configured clipboard cleanup countdowns and retained storage clipboard restoration and race policy for fields, passwords, OTP codes, and URIs. - Lock, expiry, utility dismissal, and stale async completion clear or reject every OTP code, URI, QR matrix, import buffer, and clipboard presentation. Passive one-second countdown ticks do not touch authentication activity. - Corrected OTP-only pass entries so a first-line otpauth URI exposes typed OTP metadata instead of being classified as a password. Acceptance verification: - RFC 6238 TOTP and RFC 4226 HOTP desktop regressions cover code display, metadata, countdown, explicit counter commit, and refreshed entry state. - QR image round-trip, invalid image, declined replacement, import, replacement, removal, clipboard cleanup, lock clearing, and authentication-expiry regressions are green. - Error paths preserve ciphertext or recoverable UI state and do not corrupt entries. Required gates: - cargo fmt --all -- --check - RUSTFLAGS=-D warnings cargo check --workspace --all-targets - cargo clippy --workspace --all-targets -- -D warnings - cargo test --workspace All gates passed.

hugo closed this issue

2026-08-10 18:23:35 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: hugo/IronStorage#41