Extract secret from otpauth uri

Author: samueltardieu

lib/nimble_totp.ex

@@ -30,6 +30,7 @@ defmodule NimbleTOTP do
 
     * Generate secrets composed of random bytes.
     * Generate URIs to be encoded in a QR Code.
+    * Decode otpauth://totp/ URIs and extract the secret, label and issuer.
     * Generate Time-Based One-Time Passwords (TOTPs) based on a secret.
 
   ### Generating the secret
@@ -188,6 +189,52 @@ defmodule NimbleTOTP do
     otpauth_uri(issuer, account, secret, [])
   end
 
+  @doc """
+  Extract the secret and label from an otpauth URI, as well as the extra properties.
+
+  The issuer will be extracted either from a label prefix or from an extra URI parameter.
+  If both are present, they have to be equal or an error will be returned.
+
+  ## Examples
+
+      iex> NimbleTOTP.decompose_otpauth_uri("otpauth://totp/Acme:alice?secret=MFRGGZA&issuer=Acme")
+      {:ok, "abcd", "alice", %{"issuer" => "Acme"}}
+
+      iex> NimbleTOTP.decompose_otpauth_uri("otpauth://totp/Acme:alice?secret=INVALID!&issuer=Acme")
+      :error
+
+  """
+  @spec decompose_otpauth_uri(String.t()) ::
+          {:ok, <<>>, String.t(), map()} | {:error, :invalid_uri}
+  def decompose_otpauth_uri(uri) when is_binary(uri) do
+    with true <- uri =~ ~r"^otpauth://totp/",
+         {:ok, uri} <- URI.new(uri),
+         ["", label] <- String.split(uri.path, "/"),
+         # Reject empty prefix issuer or empty labels (with or without prefix issuer)
+         false <- label =~ ~r/^(:|$|.*:$)/,
+         query = URI.decode_query(uri.query, %{}, :rfc3986),
+         {secret, query} <- Map.pop(query, "secret"),
+         {:ok, secret} <- Base.decode32(secret, padding: false),
+         param_issuer <- Map.get(query, "issuer"),
+         false <- (param_issuer || "") =~ ":" do
+      case String.split(label, ":") do
+        [label] when param_issuer != "" ->
+          {:ok, secret, label, query}
+
+        [^param_issuer, label] ->
+          {:ok, secret, label, query}
+
+        [issuer, label] when is_nil(param_issuer) ->
+          {:ok, secret, label, Map.put(query, "issuer", issuer)}
+
+        _ ->
+          :error
+      end
+    else
+      _ -> :error
+    end
+  end
+
   @doc """
   Generate a binary composed of random bytes.
 
@@ -217,7 +264,12 @@ defmodule NimbleTOTP do
 
   ## Examples
 
-      secret = Base.decode32!("PTEPUGZ7DUWTBGMW4WLKB6U63MGKKMCA")
+      secret = Base.decode32!("PTEPUGZ7DUWTBGMW4WLKB6U63MGKKMCA", padding: false)
+      NimbleTOTP.verification_code(secret)
+      #=> "569777"
+
+      uri = "otpauth://Acme:alice?secret=PTEPUGZ7DUWTBGMW4WLKB6U63MGKKMCA"
+      {:ok, secret, _label, _uri_params} = decompose_otpauth_uri(uri)
       NimbleTOTP.verification_code(secret)
       #=> "569777"
 

test/nimble_totp_test.exs

@@ -171,6 +171,89 @@ defmodule NimbleTOTPTest do
     end
   end
 
+  describe "decompose_otpauth_uri" do
+    test "supports the absence of issuer" do
+      uri = "otpauth://totp/alice?secret=MFRGGZA"
+      assert {:ok, "abcd", "alice", %{}} == NimbleTOTP.decompose_otpauth_uri(uri)
+    end
+
+    test "extracts the issuer from the prefix" do
+      uri = "otpauth://totp/Acme:alice?secret=MFRGGZA"
+
+      assert {:ok, "abcd", "alice", %{"issuer" => "Acme"}} ==
+               NimbleTOTP.decompose_otpauth_uri(uri)
+    end
+
+    test "extracts the issuer from the URI params" do
+      uri = "otpauth://totp/alice?secret=MFRGGZA&issuer=Acme"
+
+      assert {:ok, "abcd", "alice", %{"issuer" => "Acme"}} ==
+               NimbleTOTP.decompose_otpauth_uri(uri)
+    end
+
+    test "accepts identical issuers in prefix and URI params" do
+      uri = "otpauth://totp/Acme:alice?secret=MFRGGZA&issuer=Acme"
+
+      assert {:ok, "abcd", "alice", %{"issuer" => "Acme"}} ==
+               NimbleTOTP.decompose_otpauth_uri(uri)
+    end
+
+    test "preserves extra URI params" do
+      uri = "otpauth://totp/Acme:alice?secret=MFRGGZA&issuer=Acme&extra=1"
+
+      {:ok, "abcd", "alice", params} = NimbleTOTP.decompose_otpauth_uri(uri)
+      assert [{"extra", "1"}, {"issuer", "Acme"}] == Enum.sort(params)
+    end
+
+    test "rejects an empty label with no prefix issuer" do
+      uri = "otpauth://totp/?secret=MFRGGZA"
+
+      assert :error == NimbleTOTP.decompose_otpauth_uri(uri)
+    end
+
+    test "rejects an empty label with a prefix issuer" do
+      uri = "otpauth://totp/Acme:?secret=MFRGGZA"
+
+      assert :error == NimbleTOTP.decompose_otpauth_uri(uri)
+    end
+
+    test "rejects an empty prefix issuer" do
+      uri = "otpauth://totp/:alice?secret=MFRGGZA"
+
+      assert :error == NimbleTOTP.decompose_otpauth_uri(uri)
+    end
+
+    test "rejects an empty issuer from URI params" do
+      uri = "otpauth://totp/alice?secret=MFRGGZA&issuer="
+
+      assert :error == NimbleTOTP.decompose_otpauth_uri(uri)
+    end
+
+    test "rejects different issuers in prefix and URI params" do
+      uri = "otpauth://totp/Acme:alice?secret=MFRGGZA&issuer=Corp"
+
+      assert :error == NimbleTOTP.decompose_otpauth_uri(uri)
+    end
+
+    test "rejects URI with wrong scheme or host" do
+      uri = "otpauth://hotp/Acme:alice?secret=MFRGGZA&issuer=Corp"
+
+      assert :error == NimbleTOTP.decompose_otpauth_uri(uri)
+    end
+
+    test "rejects URI if issuer contains ':'" do
+      uri = "otpauth://hotp/alice?secret=MFRGGZA&issuer=Acme:Corp"
+
+      assert :error == NimbleTOTP.decompose_otpauth_uri(uri)
+    end
+
+    test "rejects URI if label contains ':'" do
+      uri = "otpauth://hotp/Acme:Corp:alice?secret=MFRGGZA"
+
+      assert :error == NimbleTOTP.decompose_otpauth_uri(uri)
+    end
+  end
+
   defp to_unix(naive_datetime),
     do: naive_datetime |> DateTime.from_naive!("Etc/UTC") |> DateTime.to_unix()
 end