Function buildTotp

apps/api/src/api/auth/services/mfa.utils.ts:28–36

(secretBase32: string, label: string)

 * literal so tests with no env still produce a readable label.
 */
export const buildTotp = (secretBase32: string, label: string): TOTP =>
  new TOTP({
    issuer: env.APP_NAME === "" ? MFA_DEFAULT_ISSUER : env.APP_NAME,
    label,
    algorithm: "SHA1",
    digits: MFA_TOTP_DIGITS,
    period: MFA_TOTP_STEP_SECONDS,
    secret: Secret.fromBase32(secretBase32),
  });

/**
 * Generate a fresh batch of plaintext recovery codes. The caller is