Kyle Isom
37afc68287
- Profile page TOTP section with enrollment flow: password re-auth → QR code + manual entry → 6-digit confirm - Server-side QR code generation (go-qrcode, data: URI PNG) - Admin "Remove TOTP" button on account detail page - Enrollment nonces: sync.Map with 5-minute TTL, single-use - Template fragments: totp_section.html, totp_enroll_qr.html - Handler: handlers_totp.go (enroll start, confirm, admin remove) Security: Password re-auth before secret generation (SEC-01). Lockout checked before Argon2. CSRF on all endpoints. Single-use enrollment nonces with expiry. TOTP counter replay prevention (CRIT-01). Self-removal not permitted (admin only). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
39 lines
1.4 KiB
Modula-2
39 lines
1.4 KiB
Modula-2
module git.wntrmute.dev/kyle/mcias
|
|
|
|
go 1.26.0
|
|
|
|
require (
|
|
github.com/golang-jwt/jwt/v5 v5.3.1
|
|
github.com/golang-migrate/migrate/v4 v4.19.1
|
|
github.com/google/uuid v1.6.0
|
|
github.com/pelletier/go-toml/v2 v2.2.4
|
|
golang.org/x/crypto v0.49.0
|
|
golang.org/x/term v0.41.0
|
|
google.golang.org/grpc v1.74.2
|
|
google.golang.org/protobuf v1.36.7
|
|
modernc.org/sqlite v1.46.1
|
|
)
|
|
|
|
require (
|
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
|
github.com/fxamacker/cbor/v2 v2.9.0 // indirect
|
|
github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
|
|
github.com/go-webauthn/webauthn v0.16.1 // indirect
|
|
github.com/go-webauthn/x v0.2.2 // indirect
|
|
github.com/google/go-tpm v0.9.8 // indirect
|
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
|
github.com/ncruces/go-strftime v1.0.0 // indirect
|
|
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
|
|
github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e // indirect
|
|
github.com/stretchr/testify v1.11.1 // indirect
|
|
github.com/x448/float16 v0.8.4 // indirect
|
|
golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 // indirect
|
|
golang.org/x/net v0.51.0 // indirect
|
|
golang.org/x/sys v0.42.0 // indirect
|
|
golang.org/x/text v0.35.0 // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20250818200422-3122310a409c // indirect
|
|
modernc.org/libc v1.67.6 // indirect
|
|
modernc.org/mathutil v1.7.1 // indirect
|
|
modernc.org/memory v1.11.0 // indirect
|
|
)
|