feature: users can be enrolled for TOTP one-time passwords.

debian-package/src/usr/lib/vpn-router/web

@@ -11,8 +11,8 @@ Pages:
   /config  the configuration without its secrets, and what the router resolved and
            runs, as JSON
   /users   the users in the router's directory, whether or not a P2S system is enabled: list,
-           add, change, set the password, disable, enable, remove, and the OpenVPN client
-           profile (see users())
+           add, change, set the password, disable, enable, remove, the OpenVPN client
+           profile, and TOTP enrolment (see users())
   /groups  the groups of the router's directory: list, add, rename or describe, remove, and
            add and take out members (see groups())
 
@@ -422,6 +422,9 @@ def users(state, method, path, body):
       POST   /users/<name>/enable     let the user in again
       DELETE /users/<name>            remove the user and revoke the certificate
       GET    /users/<name>/profile    the OpenVPN client profile
+      POST   /users/<name>/otp        a new TOTP secret and its otpauth URI; nothing is stored
+      PUT    /users/<name>/otp        store a TOTP secret: {"secret", "code"}, code a code of the secret
+      DELETE /users/<name>/otp        remove the TOTP token
     """
     if body == 'invalid' or (body is not None and not isinstance(body, dict)):
         return 400, {'error': 'the body must be a JSON object'}
@@ -438,6 +441,9 @@ def users(state, method, path, body):
         ('POST', 3, 'enable'): lambda connection: vpnrouter_users.enable(connection, name),
         ('DELETE', 2, None): lambda connection: vpnrouter_users.remove(connection, name),
         ('GET', 3, 'profile'): lambda connection: vpnrouter_users.profile(connection, name),
+        ('POST', 3, 'otp'): lambda connection: vpnrouter_users.otp_new(connection, name),
+        ('PUT', 3, 'otp'): lambda connection: vpnrouter_users.otp_enrol(connection, name, body.get('secret'), body.get('code')),
+        ('DELETE', 3, 'otp'): lambda connection: vpnrouter_users.otp_remove(connection, name),
     }
     if route not in actions:
         return 404, {'error': f'no route {method} {path}'}