feat: release OTP and Passkey Tools 0.1.0

2026-08-19 12:19:35 +02:00
commit f1cb2d7151
67 changed files with 12802 additions and 0 deletions
@@ -0,0 +1,81 @@
+import { useEffect, useRef } from "react";
+
+export function HelpDialog({
+  open,
+  onClose,
+}: {
+  open: boolean;
+  onClose: () => void;
+}) {
+  const ref = useRef<HTMLDialogElement>(null);
+  useEffect(() => {
+    const dialog = ref.current;
+    if (!dialog) return;
+    if (open && !dialog.open) dialog.showModal();
+    if (!open && dialog.open) dialog.close();
+  }, [open]);
+  return (
+    <dialog ref={ref} className="tool-dialog" onClose={onClose}>
+      <div className="dialog-heading">
+        <div>
+          <p className="eyebrow">Local authentication laboratory</p>
+          <h2>OTP & Passkey Tools help</h2>
+        </div>
+        <button
+          className="icon-button"
+          type="button"
+          aria-label="Close help"
+          onClick={onClose}
+        >
+          ×
+        </button>
+      </div>
+      <div className="dialog-body prose">
+        <h3>Handle secrets deliberately</h3>
+        <p>
+          OTP seeds are equivalent to a second-factor credential. This app keeps
+          them in memory only, masks them by default and clears them on reload.
+          Exports are explicit and unencrypted; move them only through a secure
+          channel.
+        </p>
+        <h3>OTP clock and counters</h3>
+        <p>
+          TOTP is computed from this device’s clock. A rejected valid-looking
+          value commonly means clock drift, a different period, or the wrong
+          hash/digit profile. HOTP counters must remain synchronized.
+        </p>
+        <h3>Passkey inspection</h3>
+        <p>
+          Inspection is offline. Verification is layered: client-data
+          expectations, RP ID hash, authenticator flags, counter and
+          cryptographic signature are reported separately. Metadata is never
+          fetched silently.
+        </p>
+        <h3>Live ceremonies</h3>
+        <p>
+          WebAuthn credentials belong to an exact RP ID. Live tests are enabled
+          only on localhost or the dedicated authentication hostname. The shared
+          Toolbox origin remains inspect-only so unrelated apps do not share its
+          credential namespace.
+        </p>
+        <p>
+          No authentication material, file, telemetry or request leaves this
+          tab.
+        </p>
+      </div>
+      <div className="dialog-actions">
+        <a
+          className="secondary-button"
+          href="https://git.add-ideas.de/lotobo/auth-tools"
+          target="_blank"
+          rel="noreferrer"
+        >
+          Source and issues
+        </a>
+        <button className="primary-button" type="button" onClick={onClose}>
+          Done
+        </button>
+      </div>
+    </dialog>
+  );
+}