TOTP Generator (cpp, written by Claude Code)

--- /dev/null
+++ b/setup.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+# System packages this project needs on a clean Ubuntu machine.
+set -e
+export DEBIAN_FRONTEND=noninteractive
+apt-get update -qq
+apt-get install -y -qq --no-install-recommends libsodium-dev

Claude Code wrote this cpp project from the task below. It does not run on a clean Ubuntu 22.04 machine as written.

Task given to the agent:

TASK: TOTP Generator

Write a program that generates and validates Time-based One-Time Passwords (TOTP) compatible with RFC 6238, supporting secret key management, QR code URI generation, and multi-account storage.

FUNCTIONAL REQUIREMENTS:
- Support subcommands: generate (create a new TOTP secret), code (show current OTP code), verify (check if a code is valid), and list (show all stored accounts)
- generate: Create a cryptographically random base32-encoded secret key of configurable length (--length flag, default 20 bytes)
- code: Display the current 6-digit TOTP code for a given account, with a countdown timer showing seconds until the code expires (30-second default period)
- verify: Accept a 6-digit code and check if it matches the current or adjacent time windows (configurable drift tolerance via --drift flag, default 1 window)
- Support configurable TOTP parameters: digit count (6 or 8), time period (30 or 60 seconds), and hash algorithm (SHA-1, SHA-256, SHA-512)
- Generate otpauth:// URIs compatible with authenticator apps (Google Authenticator, Authy)
- Store account secrets in an encrypted local JSON file using a master password
- Support multiple accounts with labels (--account flag with issuer:username format)
- Print the current code, remaining seconds, and next code to console
- If no arguments are given, generate a demo account with a random secret, display the current code and the otpauth:// URI, verify the current code, then show what happens with an incorrect code
- Handle errors: invalid base32 secrets, expired codes, duplicate account names, wrong master password

Create a complete C++ project for a clean Ubuntu 22.04 machine with only G++ 12+ and CMake 3.22+ installed. Include:
- Source code
- CMakeLists.txt with all dependencies (direct and transitive) pinned to exact versions
- README.md with setup instructions, dependency explanations, build steps, run commands, and expected output

[
  {
    "category": "underspecification",
    "rule": "signature.missing_system_requirement",
    "source": "failure_signature",
    "excerpt": "libsodium >= 1.0.19 not found.  Install it via your package manager:"
  },
  {
    "category": "underspecification",
    "rule": "diff.adds_external_environment_requirement",
    "source": "manifest_diff:setup.sh",
    "excerpt": "export DEBIAN_FRONTEND=noninteractive"
  },
  {
    "category": "underspecification",
    "rule": "diff.adds_external_environment_requirement",
    "source": "manifest_diff:setup.sh",
    "excerpt": "apt-get install -y -qq --no-install-recommends libsodium-dev"
  }
]

cmake_minimum_required(VERSION 3.20)
project(totp_generator VERSION 1.0.0 LANGUAGES CXX)

set(CMAKE_CXX_STANDARD 17)
set(CMAKE_CXX_STANDARD_REQUIRED ON)
set(CMAKE_CXX_EXTENSIONS OFF)

include(FetchContent)

# cxxopts 3.1.1 - command-line option parsing
FetchContent_Declare(
    cxxopts
    GIT_REPOSITORY https://github.com/jarro2783/cxxopts.git
    GIT_TAG        v3.1.1
    GIT_SHALLOW    TRUE
)
FetchContent_MakeAvailable(cxxopts)

# libsodium 1.0.19 - cryptographic primitives (HMAC-SHA, random bytes)
find_package(PkgConfig QUIET)
if(PkgConfig_FOUND)
    pkg_check_modules(SODIUM IMPORTED_TARGET libsodium>=1.0.19)
endif()

if(NOT SODIUM_FOUND)
    find_library(SODIUM_LIBRARY NAMES sodium libsodium)
    find_path(SODIUM_INCLUDE_DIR NAMES sodium.h)
    if(SODIUM_LIBRARY AND SODIUM_INCLUDE_DIR)
        set(SODIUM_FOUND TRUE)
    else()
        message(FATAL_ERROR
            "libsodium >= 1.0.19 not found. Install it via your package manager:\n"
            "  Ubuntu/Debian: sudo apt install libsodium-dev\n"
            "  macOS:         brew install libsodium\n"
            "  Windows:       vcpkg install libsodium")
    endif()
endif()

add_executable(totp_generator main.cpp)

target_link_libraries(totp_generator PRIVATE cxxopts::cxxopts)

if(TARGET PkgConfig::SODIUM)
    target_link_libraries(totp_generator PRIVATE PkgConfig::SODIUM)
else()
    target_include_directories(totp_generator PRIVATE ${SODIUM_INCLUDE_DIR})
    target_link_libraries(totp_generator PRIVATE ${SODIUM_LIBRARY})
endif()

if(CMAKE_CXX_COMPILER_ID MATCHES "GNU|Clang")
    target_compile_options(totp_generator PRIVATE -Wall -Wextra -Wpedantic)
endif()

/**
 * TOTP Generator - Generates and validates RFC 6238 TOTP codes with
 * multi-account storage and otpauth:// URI generation.
 *
 * Dependencies: libsodium (1.0.19), cxxopts (3.1.1)
 */

#include <cmath>
#include <cstring>
#include <ctime>
#include <fstream>
#include <iomanip>
#include <iostream>
#include <map>
#include <sstream>
#include <string>
#include <vector>
#include <algorithm>
#include <stdexcept>

#include <sodium.h>
#include <cxxopts.hpp>

static const std::string ACCOUNTS_FILE = "totp_accounts.dat";
static const std::string BASE32_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";

// ============================================================================
// Base32 encoding / decoding
// ============================================================================

std::string base32Encode(const std::vector<uint8_t>& data) {
    std::string result;
    int buffer = 0;
    int bitsLeft = 0;

    for (uint8_t byte : data) {
        buffer = (buffer << 8) | byte;
        bitsLeft += 8;
        while (bitsLeft >= 5) {
            bitsLeft -= 5;
            result += BASE32_CHARS[(buffer >> bitsLeft) & 0x1F];
        }
    }
    if (bitsLeft > 0) {
        result += BASE32_CHARS[(buffer << (5 - bitsLeft)) & 0x1F];
    }
    // Pad to multiple of 8
    while (result.size() % 8 != 0) {
        result += '=';
    }
    return result;
}

std::vector<uint8_t> base32Decode(const std::string& encoded) {
    std::vector<uint8_t> result;
    int buffer = 0;
    int bitsLeft = 0;

    for (char c : encoded) {
        if (c == '=' || c == ' ') continue;
        char upper = toupper(c);
        int val = -1;
        if (upper >= 'A' && upper <= 'Z') val = upper - 'A';
        else if (upper >= '2' && upper <= '7') val = upper - '2' + 26;
        if (val < 0) continue;

        buffer = (buffer << 5) | val;
        bitsLeft += 5;
        if (bitsLeft >= 8) {
            bitsLeft -= 8;
            result.push_back(
                static_cast<uint8_t>((buffer >> bitsLeft) & 0xFF));
        }
    }
    return result;
}

// ============================================================================
// Account data structure (simple text serialization)
// ============================================================================

struct Account {
    std::string name;
    std::string issuer;
    std::string secret; // Base32 encoded
    int digits;
    int interval;
};

// Simple key-value file format for account storage
std::map<std::string, Account> loadAccounts() {
    std::map<std::string, Account> accounts;
    std::ifstream file(ACCOUNTS_FILE);
    if (!file.is_open()) return accounts;

    std::string line;
    while (std::getline(file, line)) {
        if (line.empty() || line[0] == '#') continue;

        // Format: key|name|issuer|secret|digits|interval
        std::istringstream iss(line);
        std::string key, name, issuer, secret, digitsStr, intervalStr;
        if (std::getline(iss, key, '|') &&
            std::getline(iss, name, '|') &&
            std::getline(iss, issuer, '|') &&
            std::getline(iss, secret, '|') &&
            std::getline(iss, digitsStr, '|') &&
            std::getline(iss, intervalStr)) {
            Account acct;
            acct.name = name;
            acct.issuer = issuer;
            acct.secret = secret;
            acct.digits = std::stoi(digitsStr);
            acct.interval = std::stoi(intervalStr);
            accounts[key] = acct;
        }
    }
    return accounts;
}

void saveAccounts(const std::map<std::string, Account>& accounts) {
    std::ofstream file(ACCOUNTS_FILE);
    file << "# TOTP Accounts (key|name|issuer|secret|digits|interval)\n";
    for (const auto& [key, acct] : accounts) {
        file << key << "|" << acct.name << "|" << acct.issuer << "|"
             << acct.secret << "|" << acct.digits << "|"
             << acct.interval << "\n";
    }
}

// ============================================================================
// Secret generation (using libsodium)
// ============================================================================

std::string generateSecret(int length = 20) {
    std::vector<uint8_t> bytes(length);
    randombytes_buf(bytes.data(), bytes.size());
    return base32Encode(bytes);
}

// ============================================================================
// HMAC-SHA1 via libsodium (using crypto_auth_hmacsha512 + truncation)
// ============================================================================

// libsodium provides HMAC-SHA256 and HMAC-SHA512, but not HMAC-SHA1 directly.
// For TOTP we implement HMAC-SHA1 using the raw SHA1 from sodium's internals.
// Since libsodium does not expose raw SHA1, we implement HMAC-SHA1 manually
// using a minimal SHA1 implementation embedded below.

// Minimal SHA1 implementation for HMAC-SHA1 (RFC 2104 + FIPS 180-1)
namespace sha1_impl {

struct SHA1Context {
    uint32_t state[5];
    uint64_t count;
    uint8_t buffer[64];
};

static void sha1_init(SHA1Context& ctx) {
    ctx.state[0] = 0x67452301;
    ctx.state[1] = 0xEFCDAB89;
    ctx.state[2] = 0x98BADCFE;
    ctx.state[3] = 0x10325476;
    ctx.state[4] = 0xC3D2E1F0;
    ctx.count = 0;
}

static uint32_t rol(uint32_t value, int bits) {
    return (value << bits) | (value >> (32 - bits));
}

static void sha1_transform(uint32_t state[5], const uint8_t buffer[64]) {
    uint32_t a, b, c, d, e;
    uint32_t w[80];

    for (int i = 0; i < 16; i++) {
        w[i] = (static_cast<uint32_t>(buffer[i * 4]) << 24) |
               (static_cast<uint32_t>(buffer[i * 4 + 1]) << 16) |
               (static_cast<uint32_t>(buffer[i * 4 + 2]) << 8) |
               static_cast<uint32_t>(buffer[i * 4 + 3]);
    }
    for (int i = 16; i < 80; i++) {
        w[i] = rol(w[i - 3] ^ w[i - 8] ^ w[i - 14] ^ w[i - 16], 1);
    }

    a = state[0]; b = state[1]; c = state[2];
    d = state[3]; e = state[4];

    for (int i = 0; i < 80; i++) {
        uint32_t f, k;
        if (i < 20) {
            f = (b & c) | ((~b) & d);
            k = 0x5A827999;
        } else if (i < 40) {
            f = b ^ c ^ d;
            k = 0x6ED9EBA1;
        } else if (i < 60) {
            f = (b & c) | (b & d) | (c & d);
            k = 0x8F1BBCDC;
        } else {
            f = b ^ c ^ d;
            k = 0xCA62C1D6;
        }
        uint32_t temp = rol(a, 5) + f + e + k + w[i];
        e = d; d = c; c = rol(b, 30); b = a; a = temp;
    }

    state[0] += a; state[1] += b; state[2] += c;
    state[3] += d; state[4] += e;
}

static void sha1_update(SHA1Context& ctx, const uint8_t* data, size_t len) {
    size_t index = static_cast<size_t>(ctx.count % 64);
    ctx.count += len;

    size_t i = 0;
    if (index) {
        size_t remaining = 64 - index;
        if (len < remaining) {
            std::memcpy(ctx.buffer + index, data, len);
            return;
        }
        std::memcpy(ctx.buffer + index, data, remaining);
        sha1_transform(ctx.state, ctx.buffer);
        i = remaining;
    }

    for (; i + 64 <= len; i += 64) {
        sha1_transform(ctx.state, data + i);
    }

    if (i < len) {
        std::memcpy(ctx.buffer, data + i, len - i);
    }
}

static void sha1_final(SHA1Context& ctx, uint8_t digest[20]) {
    uint8_t finalcount[8];
    uint64_t bits = ctx.count * 8;
    for (int i = 7; i >= 0; i--) {
        finalcount[i] = static_cast<uint8_t>(bits & 0xFF);
        bits >>= 8;
    }

    uint8_t pad = 0x80;
    sha1_update(ctx, &pad, 1);
    while ((ctx.count % 64) != 56) {
        pad = 0x00;
        sha1_update(ctx, &pad, 1);
    }
    sha1_update(ctx, finalcount, 8);

    for (int i = 0; i < 5; i++) {
        digest[i * 4]     = static_cast<uint8_t>((ctx.state[i] >> 24) & 0xFF);
        digest[i * 4 + 1] = static_cast<uint8_t>((ctx.state[i] >> 16) & 0xFF);
        digest[i * 4 + 2] = static_cast<uint8_t>((ctx.state[i] >> 8) & 0xFF);
        digest[i * 4 + 3] = static_cast<uint8_t>(ctx.state[i] & 0xFF);
    }
}

static void sha1(const uint8_t* data, size_t len, uint8_t digest[20]) {
    SHA1Context ctx;
    sha1_init(ctx);
    sha1_update(ctx, data, len);
    sha1_final(ctx, digest);
}

} // namespace sha1_impl

// HMAC-SHA1 (RFC 2104)
static void hmac_sha1(const uint8_t* key, size_t keyLen,
                       const uint8_t* msg, size_t msgLen,
                       uint8_t out[20]) {
    const size_t blockSize = 64;
    uint8_t k[64];
    std::memset(k, 0, blockSize);

    if (keyLen > blockSize) {
        sha1_impl::sha1(key, keyLen, k);
    } else {
        std::memcpy(k, key, keyLen);
    }

    uint8_t ipad[64], opad[64];
    for (size_t i = 0; i < blockSize; i++) {
        ipad[i] = k[i] ^ 0x36;
        opad[i] = k[i] ^ 0x5C;
    }

    // inner hash: SHA1(ipad || msg)
    sha1_impl::SHA1Context innerCtx;
    sha1_impl::sha1_init(innerCtx);
    sha1_impl::sha1_update(innerCtx, ipad, blockSize);
    sha1_impl::sha1_update(innerCtx, msg, msgLen);
    uint8_t innerDigest[20];
    sha1_impl::sha1_final(innerCtx, innerDigest);

    // outer hash: SHA1(opad || inner_digest)
    sha1_impl::SHA1Context outerCtx;
    sha1_impl::sha1_init(outerCtx);
    sha1_impl::sha1_update(outerCtx, opad, blockSize);
    sha1_impl::sha1_update(outerCtx, innerDigest, 20);
    sha1_impl::sha1_final(outerCtx, out);
}

// ============================================================================
// TOTP computation (RFC 6238)
// ============================================================================

std::string computeTotp(const std::string& base32Secret, uint64_t timeStep,
                         int digits) {
    std::vector<uint8_t> key = base32Decode(base32Secret);

    // Convert time step to 8-byte big-endian
    uint8_t timeBytes[8];
    uint64_t ts = timeStep;
    for (int i = 7; i >= 0; i--) {
        timeBytes[i] = static_cast<uint8_t>(ts & 0xFF);
        ts >>= 8;
    }

    // HMAC-SHA1
    uint8_t hmacResult[20];
    hmac_sha1(key.data(), key.size(), timeBytes, 8, hmacResult);

    // Dynamic truncation
    int offset = hmacResult[19] & 0x0F;
    uint32_t binary =
        ((hmacResult[offset] & 0x7F) << 24) |
        ((hmacResult[offset + 1] & 0xFF) << 16) |
        ((hmacResult[offset + 2] & 0xFF) << 8) |
        (hmacResult[offset + 3] & 0xFF);

    uint32_t otp = binary % static_cast<uint32_t>(std::pow(10, digits));

    std::ostringstream oss;
    oss << std::setfill('0') << std::setw(digits) << otp;
    return oss.str();
}

// ============================================================================
// URL encoding helper
// ============================================================================

std::string urlEncode(const std::string& value) {
    std::ostringstream escaped;
    escaped.fill('0');
    escaped << std::hex;
    for (char c : value) {
        if (isalnum(static_cast<unsigned char>(c)) || c == '-' || c == '_'
            || c == '.' || c == '~') {
            escaped << c;
        } else {
            escaped << '%' << std::setw(2) << std::uppercase
                    << static_cast<int>(static_cast<unsigned char>(c));
        }
    }
    return escaped.str();
}

// ============================================================================
// Public API functions
// ============================================================================

Account addAccount(const std::string& name, const std::string& issuer,
                   std::string secret, int digits = 6, int interval = 30) {
    auto accounts = loadAccounts();
    if (secret.empty()) {
        secret = generateSecret();
    }
    Account acct{name, issuer, secret, digits, interval};
    std::string key = issuer.empty() ? name : issuer + ":" + name;
    accounts[key] = acct;
    saveAccounts(accounts);
    std::cout << "Account '" << key << "' added successfully.\n";
    std::cout << "Secret: " << secret << "\n";
    return acct;
}

std::string generateTotpCode(const std::string& accountKey) {
    auto accounts = loadAccounts();
    auto it = accounts.find(accountKey);
    if (it == accounts.end()) {
        throw std::runtime_error("Account '" + accountKey + "' not found.");
    }
    const Account& acct = it->second;
    uint64_t currentTime = static_cast<uint64_t>(std::time(nullptr));
    uint64_t timeStep = currentTime / acct.interval;
    std::string code = computeTotp(acct.secret, timeStep, acct.digits);
    uint64_t remaining = acct.interval - (currentTime % acct.interval);
    std::cout << "TOTP for '" << accountKey << "': " << code
              << "  (valid for " << remaining << "s)\n";
    return code;
}

bool validateTotpCode(const std::string& accountKey, const std::string& code,
                      int window = 1) {
    auto accounts = loadAccounts();
    auto it = accounts.find(accountKey);
    if (it == accounts.end()) {
        throw std::runtime_error("Account '" + accountKey + "' not found.");
    }
    const Account& acct = it->second;
    uint64_t currentTime = static_cast<uint64_t>(std::time(nullptr));
    int64_t currentStep = static_cast<int64_t>(currentTime / acct.interval);

    for (int i = -window; i <= window; i++) {
        std::string computed = computeTotp(acct.secret,
            static_cast<uint64_t>(currentStep + i), acct.digits);
        if (computed == code) {
            std::cout << "Code '" << code << "' for '"
                      << accountKey << "' is VALID.\n";
            return true;
        }
    }
    std::cout << "Code '" << code << "' for '"
              << accountKey << "' is INVALID.\n";
    return false;
}

std::string getOtpauthUri(const std::string& accountKey) {
    auto accounts = loadAccounts();
    auto it = accounts.find(accountKey);
    if (it == accounts.end()) {
        throw std::runtime_error("Account '" + accountKey + "' not found.");
    }
    const Account& acct = it->second;

    std::string label;
    if (!acct.issuer.empty()) {
        label = urlEncode(acct.issuer) + ":" + urlEncode(acct.name);
    } else {
        label = urlEncode(acct.name);
    }

    std::ostringstream uri;
    uri << "otpauth://totp/" << label
        << "?secret=" << acct.secret
        << "&digits=" << acct.digits
        << "&period=" << acct.interval;
    if (!acct.issuer.empty()) {
        uri << "&issuer=" << urlEncode(acct.issuer);
    }

    std::string result = uri.str();
    std::cout << "otpauth URI: " << result << "\n";
    return result;
}

void listAccounts() {
    auto accounts = loadAccounts();
    if (accounts.empty()) {
        std::cout << "No accounts stored.\n";
        return;
    }

    std::cout << "\n" << std::left
              << std::setw(35) << "Account Key"
              << std::setw(20) << "Issuer"
              << std::setw(8) << "Digits"
              << std::setw(10) << "Interval" << "\n";
    std::cout << std::string(75, '-') << "\n";

    for (const auto& [key, acct] : accounts) {
        std::cout << std::left
                  << std::setw(35) << key
                  << std::setw(20) << acct.issuer
                  << std::setw(8) << acct.digits
                  << std::setw(10) << acct.interval << "\n";
    }
    std::cout << "\n";
}

bool removeAccount(const std::string& accountKey) {
    auto accounts = loadAccounts();
    auto it = accounts.find(accountKey);
    if (it == accounts.end()) {
        std::cout << "Account '" << accountKey << "' not found.\n";
        return false;
    }
    accounts.erase(it);
    saveAccounts(accounts);
    std::cout << "Account '" << accountKey << "' removed.\n";
    return true;
}

// ============================================================================
// Demo mode
// ============================================================================

void runDemo() {
    std::cout << "\n=== TOTP Generator Demo ===\n\n";

    // Generate a known secret for reproducible demo
    std::string demoSecret = "JBSWY3DPEHPK3PXP";
    std::cout << "1. Adding demo account with known secret...\n";
    Account acct = addAccount("demo@example.com", "DemoService",
                               demoSecret, 6, 30);

    std::cout << "\n2. Generating TOTP code...\n";
    std::string code = generateTotpCode("DemoService:demo@example.com");

    std::cout << "\n3. Validating the code...\n";
    validateTotpCode("DemoService:demo@example.com", code);

    std::cout << "\n4. Generating otpauth URI...\n";
    getOtpauthUri("DemoService:demo@example.com");

    std::cout << "\n5. Listing accounts...\n";
    listAccounts();

    std::cout << "\n6. Cleaning up demo account...\n";
    removeAccount("DemoService:demo@example.com");

    std::cout << "\nDemo complete.\n";
}

// ============================================================================
// Main (CLI using cxxopts)
// ============================================================================

int main(int argc, char* argv[]) {
    if (sodium_init() < 0) {
        std::cerr << "Failed to initialize libsodium.\n";
        return 1;
    }

    cxxopts::Options options("totp_generator",
        "TOTP Generator - RFC 6238 compliant (libsodium + cxxopts)");

    options.add_options()
        ("command", "Command to execute", cxxopts::value<std::string>()
            ->default_value("demo"))
        ("n,name", "Account name", cxxopts::value<std::string>()
            ->default_value(""))
        ("i,issuer", "Issuer name", cxxopts::value<std::string>()
            ->default_value(""))
        ("s,secret", "Base32 secret (auto-generated if empty)",
            cxxopts::value<std::string>()->default_value(""))
        ("d,digits", "Number of TOTP digits",
            cxxopts::value<int>()->default_value("6"))
        ("t,interval", "Time step interval in seconds",
            cxxopts::value<int>()->default_value("30"))
        ("k,key", "Account key for lookup",
            cxxopts::value<std::string>()->default_value(""))
        ("c,code", "TOTP code to validate",
            cxxopts::value<std::string>()->default_value(""))
        ("w,window", "Validation window size",
            cxxopts::value<int>()->default_value("1"))
        ("h,help", "Print usage");

    options.parse_positional({"command"});
    options.positional_help("<command>");

    try {
        auto result = options.parse(argc, argv);

        if (result.count("help")) {
            std::cout << options.help() << "\n";
            std::cout << "Commands:\n"
                      << "  demo      Run interactive demo\n"
                      << "  add       Add a new account\n"
                      << "  generate  Generate TOTP code\n"
                      << "  validate  Validate a TOTP code\n"
                      << "  uri       Show otpauth URI\n"
                      << "  list      List stored accounts\n"
                      << "  remove    Remove an account\n";
            return 0;
        }

        std::string command = result["command"].as<std::string>();

        if (command == "demo") {
            runDemo();
        } else if (command == "add") {
            std::string name = result["name"].as<std::string>();
            std::string issuer = result["issuer"].as<std::string>();
            std::string secret = result["secret"].as<std::string>();
            int digits = result["digits"].as<int>();
            int interval = result["interval"].as<int>();
            if (name.empty()) {
                std::cerr << "Error: --name is required for 'add'.\n";
                return 1;
            }
            addAccount(name, issuer, secret, digits, interval);
        } else if (command == "generate") {
            std::string key = result["key"].as<std::string>();
            if (key.empty()) {
                std::cerr << "Error: --key is required for 'generate'.\n";
                return 1;
            }
            generateTotpCode(key);
        } else if (command == "validate") {
            std::string key = result["key"].as<std::string>();
            std::string code = result["code"].as<std::string>();
            int window = result["window"].as<int>();
            if (key.empty() || code.empty()) {
                std::cerr << "Error: --key and --code are required.\n";
                return 1;
            }
            validateTotpCode(key, code, window);
        } else if (command == "uri") {
            std::string key = result["key"].as<std::string>();
            if (key.empty()) {
                std::cerr << "Error: --key is required for 'uri'.\n";
                return 1;
            }
            getOtpauthUri(key);
        } else if (command == "list") {
            listAccounts();
        } else if (command == "remove") {
            std::string key = result["key"].as<std::string>();
            if (key.empty()) {
                std::cerr << "Error: --key is required for 'remove'.\n";
                return 1;
            }
            removeAccount(key);
        } else {
            std::cerr << "Unknown command: " << command << "\n";
            std::cout << options.help() << "\n";
            return 1;
        }
    } catch (const std::exception& e) {
        std::cerr << "Error: " << e.what() << "\n";
        return 1;
    }

    return 0;
}

# TOTP Generator - C++ (Trial 3)

A TOTP (Time-based One-Time Password) generator and validator implementing RFC 6238, with multi-account storage and otpauth:// URI generation.

## Dependencies

- **libsodium** (1.0.19) - Secure random byte generation for secret keys
- **cxxopts** (3.1.1) - Command-line option parsing

## Build

```bash
# Ensure libsodium is installed:
#   Ubuntu/Debian: sudo apt install libsodium-dev
#   macOS:         brew install libsodium
#   Windows:       vcpkg install libsodium

mkdir build && cd build
cmake ..
cmake --build .
```

## Usage

```bash
# Run demo (default)
./totp_generator

# Add an account
./totp_generator add --name user@example.com --issuer MyService

# Add with a specific secret
./totp_generator add --name user@example.com --issuer MyService --secret JBSWY3DPEHPK3PXP

# Generate a TOTP code
./totp_generator generate --key "MyService:user@example.com"

# Validate a code
./totp_generator validate --key "MyService:user@example.com" --code 123456

# Show otpauth:// URI
./totp_generator uri --key "MyService:user@example.com"

# List all accounts
./totp_generator list

# Remove an account
./totp_generator remove --key "MyService:user@example.com"
```

### Features

- Add TOTP accounts with custom or auto-generated Base32 secrets
- Generate current TOTP codes using HMAC-SHA1 per RFC 6238
- Validate TOTP codes with configurable time-window tolerance
- Generate otpauth:// URIs for authenticator app integration
- Multi-account file storage
- List and remove stored accounts
- Built-in Base32 encoding and decoding
- Secure random key generation via libsodium
- CLI argument parsing via cxxopts