| 37 | } |
| 38 | |
| 39 | export function verifyTotpCode(secret: string, code: string): boolean { |
| 40 | // Strip any non-digits — some authenticators emit codes like "123 456" or |
| 41 | // "123-456"; paste-from-clipboard can also carry whitespace. |
| 42 | const normalized = code.replace(/\D/g, ''); |
| 43 | if (normalized.length !== DIGITS) { |
| 44 | return false; |
| 45 | } |
| 46 | const key = decodeBase32IgnorePadding(secret); |
| 47 | return verifyTOTPWithGracePeriod( |
| 48 | key, |
| 49 | PERIOD_SECONDS, |
| 50 | DIGITS, |
| 51 | normalized, |
| 52 | GRACE_PERIOD_SECONDS, |
| 53 | ); |
| 54 | } |
| 55 | |
| 56 | // Human-friendly 10-char code split with a dash: `ABCDE-FGHIJ`. |
| 57 | // ~51 bits of entropy; argon2-hashed for storage. |