otp
===
TOTP/HOTP codes from the command line. `otp.py` is the stdlib crypto core;
`cli.py` and `tui.py` read named secrets from a file and behave like an
authenticator.


Secrets file
------------
Location is `$OTP_SECRETS`, default `~/.config/otp_secrets`. Keep it private:

    chmod 600 ~/.config/otp_secrets

The file must be regular, owned by the current user, and have no group or
other permissions. Unsafe files are rejected.

One entry per line, whitespace-delimited fields:

    name  secret  [period]  [digits]  [digest]

`name` and `secret` (base32, single token) are required. Names may contain
ASCII letters, digits, `.`, `_`, `@`, `+` and `-`. `period` must be 1-3600
seconds (default 30), `digits` must be 6-10 (default 6), and `digest` must be
sha1, sha256 or sha512 (default sha1). Blank lines and lines starting with `#`
are ignored. Duplicate names and extra fields are rejected. See
`otp_secrets.example`.


Encrypted secrets
-----------------
Optionally set `OTP_SECRETS_CMD` to any command that writes secrets-file
text to stdout; it is run with `sh -c` instead of reading `$OTP_SECRETS`,
so any secret store works:

    OTP_SECRETS_CMD='age -d ~/.config/otp_secrets.age' ./tui.py
    OTP_SECRETS_CMD='gpg -qd ~/.config/otp_secrets.gpg' ./cli.py
    OTP_SECRETS_CMD='pass show otp' ./cli.py github

Passphrase prompts and errors go to the terminal; a non-zero exit aborts
with the command's exit code. To encrypt an existing file with age:

    age -p -o ~/.config/otp_secrets.age ~/.config/otp_secrets


Usage
-----
List a code for every entry:

    ./cli.py

Print just one code (for scripting):

    ./cli.py github

Live full-screen view with countdown bars; `q` quits, `r` reloads:

    ./tui.py

Raw filter, no secrets file, reads base32 keys on stdin; optional positional
arguments are period, digits, digest:

    echo JBSWY3DPEHPK3PXP | ./otp.py
    echo JBSWY3DPEHPK3PXP | ./otp.py 60 8 sha256


Debug
-----
`test.py` asserts the RFC 4226 and RFC 6238 test vectors against the core, and
checks entry parsing, file permissions and the command path:

    ./test.py

A named code must equal the raw filter for the same secret in the same window:

    ./cli.py github
    echo JBSWY3DPEHPK3PXP | ./otp.py

Point at a private throwaway file to test without touching your real secrets:

    umask 077
    TMP=$(mktemp)
    printf 'demo JBSWY3DPEHPK3PXP\n' > "$TMP"
    OTP_SECRETS="$TMP" ./cli.py demo
    rm "$TMP"

Exercise the command path without any encryption:

    OTP_SECRETS_CMD='printf "demo JBSWY3DPEHPK3PXP\n"' ./cli.py demo