Claus Lohmar 93ec8b8131 fix(security): reject replayed TOTP codes ... REVIEW-001 (M0) L5s: a code valid for ±90s could be replayed. TOTP is a login fallback (D-005) and the only factor the bootstrap admin has (D-041), so a code observed once (shoulder-surfed, phished, in a log) must not work twice. Track the highest accepted counter per identity and refuse any counter that is not strictly newer. The search is newest-first and compares in constant time; a replay is reported as ErrInvalidCode — indistinguishable from a wrong code, so the response is not an oracle (A3). A fresh secret (re-enrollment) resets the counter.		2026-10-14 11:29:55 +00:00
..
totp.go	fix(security): reject replayed TOTP codes	2026-10-14 11:29:55 +00:00
totp_test.go	fix(security): reject replayed TOTP codes	2026-10-14 11:29:55 +00:00