forked from thijooree/android
70 lines
2.5 KiB
Markdown
70 lines
2.5 KiB
Markdown
# OTP Screen
|
|
|
|
Displays the current TOTP (Time-based One-Time Password) code for each enrolled bank authenticator. Used when confirming transfers, QR payments, or other 2FA-protected operations.
|
|
|
|
---
|
|
|
|
## Fragment — `OtpFragment`
|
|
|
|
Hosts one card per enrolled bank authenticator. Banks with no stored TOTP seed are not shown.
|
|
|
|
---
|
|
|
|
## TOTP Display
|
|
|
|
Each card shows:
|
|
- Bank logo, bank name and account holder name
|
|
- A circular countdown ring with the seconds left in the current 30-second window; the ring and code turn red in the last 5 seconds
|
|
- The current 6-digit TOTP code (large text) with a copy button
|
|
- The next window's code (smaller, below a divider) with its own copy button — handy when the current code is about to expire
|
|
- The codes refresh automatically when the window expires — no user interaction needed
|
|
|
|
Tapping anywhere on the card also copies the current code. If no logins have a seed, an empty-state message is shown instead.
|
|
|
|
### Algorithm
|
|
|
|
Standard RFC 6238 TOTP:
|
|
- Hash: SHA-1
|
|
- Window: 30 seconds
|
|
- Digits: 6
|
|
- Seed: stored per-bank in `CredentialStore` (encrypted)
|
|
|
|
---
|
|
|
|
## Supported Banks
|
|
|
|
One card is rendered for every MIB and every BML login that has a stored OTP seed (`OtpFragment.kt`), sorted by the user's [login order](00-app-overview.md#login-order). Seeds are per-`loginId` in `CredentialStore`.
|
|
|
|
| Bank | Seed source | Card title / subtitle |
|
|
|---|---|---|
|
|
| MIB | `loadMibCredentials(loginId).otpSeed` (entered at login) | `MIB` / `{fullName}` |
|
|
| BML | `loadBmlCredentials(loginId).otpSeed` (entered at login) | `BML` / `{fullName}` |
|
|
|
|
If no full name has been cached the subtitle falls back to `"Authenticator"` and a background `MibProfileClient.fetchPersonalProfile()` / `BmlAccountClient.fetchUserInfo()` call refreshes it.
|
|
|
|
---
|
|
|
|
## Background Name Refresh
|
|
|
|
When the screen opens, the fragment may fire a background API call to refresh the account holder name associated with each seed. This is a best-effort call — failure does not affect OTP display.
|
|
|
|
---
|
|
|
|
## Usage
|
|
|
|
The OTP screen is informational — the user copies the displayed code manually and enters it wherever required (e.g., in `TransferFragment`'s OTP dialog, or in an external portal). The code is never submitted automatically from this screen.
|
|
|
|
---
|
|
|
|
## Security
|
|
|
|
The TOTP seeds are stored encrypted in `CredentialStore`. They are never logged or included in error reports.
|
|
|
|
---
|
|
|
|
|
|
|
|
---
|
|
|
|
[← Activities](09-activities.md) **Next →** [PayMV QR Screen](11-paymv-qr-screen.md)
|