forked from thijooree/android
67 lines
2.1 KiB
Markdown
67 lines
2.1 KiB
Markdown
# OTP Screen
|
|
|
|
Displays the current TOTP (Time-based One-Time Password) code for each enrolled bank authenticator. Used when confirming transfers, QR payments, or other 2FA-protected operations.
|
|
|
|
---
|
|
|
|
## Fragment — `OtpFragment`
|
|
|
|
Hosts one card per enrolled bank authenticator. Banks with no stored TOTP seed are not shown.
|
|
|
|
---
|
|
|
|
## TOTP Display
|
|
|
|
Each card shows:
|
|
- Bank logo and name
|
|
- The current 6-digit TOTP code (large text)
|
|
- A circular countdown ring showing time remaining in the current 30-second window
|
|
- The code refreshes automatically when the window expires — no user interaction needed
|
|
|
|
### Algorithm
|
|
|
|
Standard RFC 6238 TOTP:
|
|
- Hash: SHA-1
|
|
- Window: 30 seconds
|
|
- Digits: 6
|
|
- Seed: stored per-bank in `CredentialStore` (encrypted)
|
|
|
|
---
|
|
|
|
## Supported Banks
|
|
|
|
One card is rendered for every MIB and every BML login that has a stored OTP seed (`OtpFragment.kt:93-98`). Seeds are per-`loginId` in `CredentialStore`.
|
|
|
|
| Bank | Seed source | Card label |
|
|
|---|---|---|
|
|
| MIB | `loadMibCredentials(loginId).otpSeed` (entered at login) | `"MIB · {fullName}"` |
|
|
| BML | `loadBmlCredentials(loginId).otpSeed` (entered at login) | `"BML · {fullName}"` |
|
|
|
|
If no full name has been cached the label falls back to plain `"MIB"` / `"BML"` and a background `MibProfileClient.fetchPersonalProfile()` / `BmlAccountClient.fetchUserInfo()` call refreshes it.
|
|
|
|
---
|
|
|
|
## Background Name Refresh
|
|
|
|
When the screen opens, the fragment may fire a background API call to refresh the account holder name associated with each seed. This is a best-effort call — failure does not affect OTP display.
|
|
|
|
---
|
|
|
|
## Usage
|
|
|
|
The OTP screen is informational — the user copies the displayed code manually and enters it wherever required (e.g., in `TransferFragment`'s OTP dialog, or in an external portal). The code is never submitted automatically from this screen.
|
|
|
|
---
|
|
|
|
## Security
|
|
|
|
The TOTP seeds are stored encrypted in `CredentialStore`. They are never logged or included in error reports.
|
|
|
|
---
|
|
|
|
|
|
|
|
---
|
|
|
|
[← Activities](09-activities.md) **Next →** [PayMV QR Screen](11-paymv-qr-screen.md)
|