calculate.go

package ykoath

import (
	"encoding/binary"
	"fmt"
	"math"
)

const (
	errNoValuesFound   = "no values found in response (% x)"
	errUnknownName     = "no such name configued (%s)"
	errInvalidDigits   = "invalid digits (%d)"
	errMultipleMatches = "multiple matches found (%s)"
	errAuthentication  = "authentication failed"
	touchRequired      = "touch-required"
	hotpNoResponse     = "hotp-no-response"
)

//// Calculate is a high-level function that first identifies all TOTP credentials
//// that are configured and returns the matching one (if no touch is required) or
//// fires the callback and then fetches the name again while blocking during
//// the device awaiting touch
//func (o *OATH) Calculate(name string, touchRequiredCallback func(string) error) (string, error) {
//
//	res, err := o.CalculateAll()
//
//	if err != nil {
//		return "", nil
//	}
//
//	// support matching by name without issuer in the same way that ykman does
//	// https://github.com/Yubico/yubikey-manager/blob/f493008d78a0ad09016f23dabd1cb658929d9c0e/ykman/cli/oath.py#L543
//	var key, code string
//	var matches []string
//	for k, c := range res {
//		if strings.Contains(strings.ToLower(k), strings.ToLower(name)) {
//			key = k
//			code = c
//			matches = append(matches, k)
//		}
//	}
//	if len(matches) > 1 {
//		return "", fmt.Errorf(errMultipleMatches, strings.Join(matches, ","))
//	}
//
//	if key == "" {
//		return "", fmt.Errorf(errUnknownName, name)
//	}
//
//	if code == touchRequired {
//
//		if err := touchRequiredCallback(name); err != nil {
//			return "", err
//		}
//
//		return o.calculate(key)
//
//	}
//
//	return code, nil
//
//}

// Calculate implements the "CALCULATE" instruction to fetch a single
// truncated TOTP response
func (o *OATH) Calculate(name string, touchRequiredCallback func(string) error) (string, error) {

	var (
		buf       = make([]byte, 8)
		timestamp = o.Clock().Unix() / 30
	)

	binary.BigEndian.PutUint64(buf, uint64(timestamp))

	res, err := o.send(0x00, 0xa2, 0x00, 0x01,
		write(0x71, []byte(name)),
		write(0x74, buf),
	)

	if err != nil {
		return "", err
	}

	for _, tv := range res {

		switch tv.tag {

		case 0x76:
			return otp(tv.value), nil

		default:
			return "", fmt.Errorf(errUnknownTag, tv.tag)
		}

	}

	return "", fmt.Errorf(errNoValuesFound, res)

}

// CalculateAll implements the "CALCULATE ALL" instruction to fetch all TOTP
// tokens and their codes (or a constant indicating a touch requirement)
func (o *OATH) CalculateAll() (map[string]string, error) {

	var (
		buf       = make([]byte, 8)
		codes     []string
		names     []string
		timestamp = o.Clock().Unix() / 30
	)

	binary.BigEndian.PutUint64(buf, uint64(timestamp))

	res, err := o.send(0x00, 0xa4, 0x00, 0x01,
		write(0x74, buf),
	)

	if err != nil {
		return nil, err
	}

	for _, tv := range res {

		switch tv.tag {

		case 0x71:
			names = append(names, string(tv.value))

		case 0x7c:
			codes = append(codes, touchRequired)

		case 0x76:
			codes = append(codes, otp(tv.value))

		case 0x77:
			codes = append(codes, hotpNoResponse)

		default:
			return nil, fmt.Errorf(errUnknownTag, tv.tag)
		}

	}

	all := make(map[string]string, len(names))

	for idx, name := range names {
		all[name] = codes[idx]
	}

	return all, nil

}

// otp converts a value into a (6 or 8 digits) one-time password
func otp(value []byte) string {

	digits := value[0]
	if digits != 6 && digits != 8 {
		return fmt.Sprintf(errInvalidDigits, digits)
	}
	code := binary.BigEndian.Uint32(value[1:]) % uint32(math.Pow10(int(digits)))
	return fmt.Sprintf(fmt.Sprintf("%%0%dd", digits), code)

}