Function EncryptTOTPSecret

internal/crypto/totp.go:28–37

EncryptTOTPSecret encrypts the TOTP shared secret with AES-256-GCM (using the existing EncryptAES helper, which derives the key via HKDF) and prepends TOTPCipherPrefix so it is recognisable as ciphertext. TOTP secrets are long-lived — they are enrolled once per user and used forever — so a reversib

(plain, key string)

// forever — so a reversible primitive is required (we need the original
// secret on every Validate call to compute the expected code).
func EncryptTOTPSecret(plain, key string) (string, error) {
	if plain == "" {
		return "", nil
	}
	ct, err := EncryptAES(key, plain)
	if err != nil {
		return "", err
	}
	return TOTPCipherPrefix + ct, nil
}

// DecryptTOTPSecret decrypts a value previously written by
// EncryptTOTPSecret. It is strict: the stored value MUST carry the