Expose the complete pass-otp experience and sensitive-output controls in the desktop app.
Scope
Display current TOTP/HOTP values, remaining validity, and storage-provided OTP metadata after authentication.
Add OTP URI entry/import, QR scan/import where platform input is available, QR export/display, and OTP removal through typed storage commands.
Provide explicit copy actions for passwords, fields, and OTP codes with configured storage-owned clipboard clearing behavior and visible success/failure feedback.
Pause or mask sensitive presentation when locked; timer ticks must update display without extending authentication activity.
Never parse OTP URIs, generate codes, render QR payload semantics, or implement clipboard security policy in the GUI.
Expose OTP actions through menus/context actions and the command palette.
Acceptance criteria
RFC fixtures exposed by crates/storage drive deterministic TOTP/HOTP UI tests.
OTP countdown updates do not renew the authentication lease.
QR and clipboard operations use storage-provided payloads/policies and reveal no secret while locked.
Import, display, copy, increment, and removal errors are recoverable and do not corrupt the entry.
## Goal
Expose the complete `pass-otp` experience and sensitive-output controls in the desktop app.
## Scope
- Display current TOTP/HOTP values, remaining validity, and storage-provided OTP metadata after authentication.
- Add OTP URI entry/import, QR scan/import where platform input is available, QR export/display, and OTP removal through typed storage commands.
- Provide explicit copy actions for passwords, fields, and OTP codes with configured storage-owned clipboard clearing behavior and visible success/failure feedback.
- Pause or mask sensitive presentation when locked; timer ticks must update display without extending authentication activity.
- Never parse OTP URIs, generate codes, render QR payload semantics, or implement clipboard security policy in the GUI.
- Expose OTP actions through menus/context actions and the command palette.
## Acceptance criteria
- RFC fixtures exposed by `crates/storage` drive deterministic TOTP/HOTP UI tests.
- OTP countdown updates do not renew the authentication lease.
- QR and clipboard operations use storage-provided payloads/policies and reveal no secret while locked.
- Import, display, copy, increment, and removal errors are recoverable and do not corrupt the entry.
hugo
added this to the 03 - Cross-platform Iced desktop app milestone 2026-08-09 19:30:18 +00:00
Added storage-owned desktop OTP operations for deterministic TOTP/HOTP codes, typed metadata and validity, explicit HOTP confirmation, URI/QR presentation, transactional URI or QR import, replacement, removal, refreshed documents, and tree state.
Added pure-Rust QR image decoding in crates/storage and an Iced canvas that draws only the storage-provided zeroizing QR matrix. Platform file pickers import PNG, JPEG, or GIF QR images without helper processes.
Added one shared desktop action registry for menus, field context actions, and the command palette, plus explicit code, URI, QR, import, copy, and removal workflows.
Added visible configured clipboard cleanup countdowns and retained storage clipboard restoration and race policy for fields, passwords, OTP codes, and URIs.
Lock, expiry, utility dismissal, and stale async completion clear or reject every OTP code, URI, QR matrix, import buffer, and clipboard presentation. Passive one-second countdown ticks do not touch authentication activity.
Corrected OTP-only pass entries so a first-line otpauth URI exposes typed OTP metadata instead of being classified as a password.
Implemented and pushed in commit 4a54bf7.
Implementation:
- Added storage-owned desktop OTP operations for deterministic TOTP/HOTP codes, typed metadata and validity, explicit HOTP confirmation, URI/QR presentation, transactional URI or QR import, replacement, removal, refreshed documents, and tree state.
- Added pure-Rust QR image decoding in crates/storage and an Iced canvas that draws only the storage-provided zeroizing QR matrix. Platform file pickers import PNG, JPEG, or GIF QR images without helper processes.
- Added one shared desktop action registry for menus, field context actions, and the command palette, plus explicit code, URI, QR, import, copy, and removal workflows.
- Added visible configured clipboard cleanup countdowns and retained storage clipboard restoration and race policy for fields, passwords, OTP codes, and URIs.
- Lock, expiry, utility dismissal, and stale async completion clear or reject every OTP code, URI, QR matrix, import buffer, and clipboard presentation. Passive one-second countdown ticks do not touch authentication activity.
- Corrected OTP-only pass entries so a first-line otpauth URI exposes typed OTP metadata instead of being classified as a password.
Acceptance verification:
- RFC 6238 TOTP and RFC 4226 HOTP desktop regressions cover code display, metadata, countdown, explicit counter commit, and refreshed entry state.
- QR image round-trip, invalid image, declined replacement, import, replacement, removal, clipboard cleanup, lock clearing, and authentication-expiry regressions are green.
- Error paths preserve ciphertext or recoverable UI state and do not corrupt entries.
Required gates:
- cargo fmt --all -- --check
- RUSTFLAGS=-D warnings cargo check --workspace --all-targets
- cargo clippy --workspace --all-targets -- -D warnings
- cargo test --workspace
All gates passed.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Goal
Expose the complete
pass-otpexperience and sensitive-output controls in the desktop app.Scope
Acceptance criteria
crates/storagedrive deterministic TOTP/HOTP UI tests.Implemented and pushed in commit
4a54bf7.Implementation:
Acceptance verification:
Required gates:
All gates passed.