lotobo/auth-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 5 Wiki Activity

feat: display scan-ready enrollment QR codes for OTP tokens

Browse Source
This commit is contained in:
zemion
2026-10-04 12:14:26 +02:00
parent 12696657a0
commit f309809eba
16 changed files with 334 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
public/CHANGELOG.md
+6
View File
@@ -4,6 +4,12 @@ All notable changes are documented here.
## Unreleased
## 0.3.2 - 2026-10-04
- Added an explicit Show QR code action for the current credential and each imported token, opening a large, camera-readable enrollment QR in a keyboard-accessible dialog.
- Kept enrollment QR codes black on white in both themes, with a quiet zone, token identity and parameters, local SVG download, and visible errors when a token exceeds the encoder capacity.
- Replaced the automatic credential QR preview with deliberate display and verified displayed TOTP/HOTP enrollment codes with the independent jsQR decoder.
## 0.3.1 - 2026-09-01
- Corrected the packaged corresponding-source identity to name this release and its immutable source tag.
public/README.md
+2 -1
View File
@@ -8,6 +8,7 @@ Authentication material stays in the active tab. The application has no backend,
- RFC 4226 HOTP and RFC 6238 TOTP generation and bounded diagnostic verification using SHA-1, SHA-256 or SHA-512, with exact 64-bit counters and preserved leading zeroes.
- Strict `otpauth://` parsing/serialization, random secret generation, masked values, interoperability findings, live period display and a project-owned QR encoder.
- **Show QR code** in the credential editor or beside any imported token displays a large enrollment QR for scanning with another device's authenticator. The dialog identifies the token and its parameters, supports SVG download, and closes with Escape. Displaying or downloading it reveals the token's secret; generation stays entirely in this tab.
- Auditable TOTP time travel using positive/negative period offsets or a frozen local date/time in an explicit IANA timezone, including DST-gap rejection and repeated-time disambiguation.
- Bounded clock-drift search, past/current/future OTP timelines, downloadable interoperability vectors and custom RFC 6238 T0 diagnostics.
- RFC 6287 OCRA-1 suite parsing and computation for counter, numeric/alphanumeric/hex challenge, PIN/password hash, session and timestamp inputs. Official RFC interoperability vectors cover SHA-1, SHA-256 and SHA-512 paths.
@@ -54,7 +55,7 @@ The Vite base is relative, so both `/` and nested paths work. `npm run toolbox:c
## Static deployment
Serve `dist/` or the contents of `release/auth-tools-0.3.1.zip` over HTTPS. Recommended response headers for the dedicated Auth Tools origin:
Serve `dist/` or the contents of `release/auth-tools-0.3.2.zip` over HTTPS. Recommended response headers for the dedicated Auth Tools origin:
```text
Content-Security-Policy: default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self'; worker-src 'self' blob:; manifest-src 'self'
public/SOURCE.md
+2 -2
View File
@@ -1,8 +1,8 @@
# Corresponding source and provenance
The corresponding source for OTP & Passkey Tools 0.3.1 is published at:
The corresponding source for OTP & Passkey Tools 0.3.2 is published at:
https://git.add-ideas.de/lotobo/auth-tools/src/tag/v0.3.1
https://git.add-ideas.de/lotobo/auth-tools/src/tag/v0.3.2
Build that tag with Node.js 22 and the exact `package-lock.json`:
public/toolbox-app.json
+1 -1
View File
@@ -3,7 +3,7 @@
"schemaVersion": 1,
"id": "de.add-ideas.auth-tools",
"name": "OTP & Passkey Tools",
"version": "0.3.1",
"version": "0.3.2",
"description": "Generate, inspect and verify OTP credentials and test WebAuthn/passkey ceremonies locally in the browser.",
"entry": "./",
"icon": "./favicon.svg",