TOTP (Time-based one-time passwords)

curl -X POST https://your-kratos-instance/self-service/settings?flow=<flow-id> \
  -H "Content-Type: application/json" \
  -H "Cookie: ory_kratos_session=<session-token>" \
  -d '{
    "method": "totp",
    "totp_unlink": true
  }'

func KeyToHTMLImage(key *otp.Key) (string, error) {
    var buf bytes.Buffer
    img, err := key.Image(256, 256)
    if err != nil {
        return "", errors.WithStack(err)
    }
    
    if err := png.Encode(&buf, img); err != nil {
        return "", errors.WithStack(err)
    }
    
    return "data:image/png;base64," + 
           base64.StdEncoding.EncodeToString(buf.Bytes()), nil
}

type SchemaExtension struct {
    AccountName string
    l           sync.Mutex
}

func (r *SchemaExtension) Run(
  _ jsonschema.ValidationContext, 
  s schema.ExtensionConfig, 
  value interface{},
) error {
    r.l.Lock()
    defer r.l.Unlock()
    if s.Credentials.TOTP.AccountName {
        r.AccountName = fmt.Sprintf("%s", value)
    }
    return nil
}

type Strategy struct{ d dependencies }

func NewStrategy(d dependencies) *Strategy { 
    return &Strategy{d: d} 
}

func (s *Strategy) CountActiveFirstFactorCredentials(
  _ context.Context, 
  _ map[identity.CredentialsType]identity.Credentials,
) (count int, err error) {
    return 0, nil  // TOTP is never a first factor
}

func (s *Strategy) CountActiveMultiFactorCredentials(
  _ context.Context, 
  cc map[identity.CredentialsType]identity.Credentials,
) (count int, err error) {
    for _, c := range cc {
        if c.Type == s.ID() && len(c.Config) > 0 {
            var conf identity.CredentialsTOTPConfig
            if err = json.Unmarshal(c.Config, &conf); err != nil {
                return 0, errors.WithStack(err)
            }
            
            _, err := otp.NewKeyFromURL(conf.TOTPURL)
            if len(conf.TOTPURL) > 0 && err == nil {
                count++
            }
        }
    }
    return
}