The target asks for a second factor

The situation. Sign-in works, then the target asks for a six-digit code. Where that code comes from decides the route.

The code is generated from a seed you hold

Standard TOTP, the kind an authenticator app produces. If the base32 seed is stored in the credential file under totp_cle, Dinoer computes the current code itself:

{"type": "remplir", "selecteur": "input[name=\"otp\"]",
 "valeur": "depuis_secrets_totp"}

Nobody has to type anything or watch the clock. The seed stays in the encrypted directory, and the code is computed by Dinoer, not by the page.

Use this route whenever it is available.

The code is sent to you

By SMS, by email, in an app: Dinoer cannot generate it. attendre_mfa_ntfy posts a waiting notice on your ntfy topic (the ntfy_topic key of the credential file), waits for you to send the code on that topic, then types it into the field. It does not submit: add the click that follows.

[
  {"type": "cliquer", "selecteur": "#send-code"},
  {"type": "attendre_mfa_ntfy", "selecteur": "input[name=\"otp\"]", "timeout": 120},
  {"type": "cliquer", "selecteur": "#confirm"}
]

timeout is the wait in seconds, 120 by default. Only a message of 4 to 8 digits is taken as a code; anything else on the topic is ignored.

A code written in the scenario is refused

{"type": "remplir", "selecteur": "input[name=\"otp\"]", "valeur": "123456"}

Dinoer refuses this scenario before the browser starts: a selector that contains otp, totp, mfa or 2fa is treated as a sensitive field, and its value must come from depuis_secrets or depuis_secrets_totp. If a person has to read the code, the route above is the one to use: that person sends it on the topic.

The case neither covers

Enrolment: the very first code, at the moment the seed is created.

When you turn on two-factor authentication, the server generates the seed and shows it once. At that moment it is nowhere else: not in your credential file, not on a topic. depuis_secrets_totp has nothing to read.

Dinoer has no action for this step. Do the enrolment by hand, store the seed under totp_cle in the credential file, and let Dinoer use it from then on.

If you compute a code inside the page

The browser’s crypto.subtle API exists only in a secure context, HTTPS or localhost. On a plain HTTP target it is undefined, and a script that relies on it fails with Cannot read properties of undefined. depuis_secrets_totp does not depend on it, since Dinoer computes the code outside the page.

In short

• Seed in the credential file: depuis_secrets_totp. Prefer this.
• Code sent to you: attendre_mfa_ntfy, then a click to submit.
• A code written in the scenario is refused on a field that looks like one for a code.
• Enrolment is done by hand, once; store the seed afterwards.