terrible no good massive refactor commit (oh yeah and built generic sessions for admin panel)

controller/totp.go

@@ -17,7 +17,7 @@ import (
 	"github.com/jmoiron/sqlx"
 )
 
-const TOTP_SECRET_LENGTH = 32
+const TOTP_SECRET_LENGTH = 64
 const TIME_STEP int64 = 30
 const CODE_LENGTH = 6
 
@@ -89,6 +89,24 @@ func GetTOTPsForAccount(db *sqlx.DB, accountID string) ([]model.TOTP, error) {
     return totps, nil
 }
 
+func CheckTOTPForAccount(db *sqlx.DB, accountID string, totp string) (*model.TOTP, error) {
+    totps, err := GetTOTPsForAccount(db, accountID)
+    if err != nil {
+        // user has no TOTP methods
+        return nil, err
+    }
+    for _, method := range totps {
+        check := GenerateTOTP(method.Secret, 0)
+        if check == totp {
+            // return the whole TOTP method as it may be useful for logging
+            return &method, nil
+        }
+    }
+    // user failed all TOTP checks
+    // note: this state will still occur even if the account has no TOTP methods.
+    return nil, nil
+}
+
 func GetTOTP(db *sqlx.DB, accountID string, name string) (*model.TOTP, error) {
     totp := model.TOTP{}