Function DeriveClaimCode

internal/server/claim_codes.go:78–81

DeriveClaimCode produces the 6-digit code for the given (user, workspace) at the given wall-clock time. Exported so the Phase E "Connect project" modal handler can render the same code the claim path will verify. secret must be at least 16 bytes of cryptographically-strong material — production wir

(secret []byte, userID, workspaceID string, at time.Time)

// Returns "000000"–"999999" zero-padded so the wire format is uniform
// (avoids an agent stripping leading zeros when echoing the code back).
func DeriveClaimCode(secret []byte, userID, workspaceID string, at time.Time) string {
	bucket := at.UTC().Unix() / claimBucketSeconds
	return deriveClaimCodeForBucket(secret, userID, workspaceID, bucket)
}

// deriveClaimCodeForBucket is the inner derive — split out so
// VerifyClaimCode can derive both the current and previous bucket