Merge pull request #4 from immz4/2fa-import-google-auth

Add Google Authenticator 2FA import

Author: immz4

.reuse/dep5

@@ -298,3 +298,9 @@ Copyright:
     2017 The Tokio Authors
     2025 Foundation Devices, Inc. <hello@foundation.xyz>
 License: MIT OR Apache-2.0
+
+Files:
+  apps/gui-app-authenticator/proto/*
+Copyright:
+    2026 Foundation Devices, Inc. <hello@foundation.xyz>
+License: MIT OR Apache-2.0

Cargo.lock

@@ -7,17 +7,23 @@ version = "0.1.0"
 edition = "2021"
 
 [dependencies]
+base32 = "0.4"
+base64 = "0.22.1"
 fs = { workspace = true }
 fuzzy-filter = "0.1.0"
 i18n = { path = "../../i18n" }
 log = "0.4.14"
 log-server = { package = "xous-api-log", path = "../../xous/api/log" }
 ordered-table = { path = "../../utils/ordered-table" }
+prost = "0.14.3"
+regex = "1"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 slint-keyos-platform = { path = "../../slint-keyos-platform/runtime" }
 thiserror = "1.0"
 totp-rs = { version = "5.6.0", features = ["otpauth", "serde_support"] }
+url = "2.5.8"
+urlencoding = "2.1.3"
 
 [build-dependencies]
 slint-keyos-platform-build = { path = "../../slint-keyos-platform/build" }

apps/gui-app-authenticator/Cargo.toml

@@ -0,0 +1,30 @@
+syntax = "proto3";
+package google_auth_migration;
+
+message MigrationPayload {
+  enum Algorithm {
+    ALGORITHM_UNSPECIFIED = 0;
+    ALGORITHM_SHA1 = 1;
+    ALGORITHM_SHA256 = 2;
+    ALGORITHM_SHA512 = 3;
+  }
+  enum OtpType {
+    OTP_TYPE_UNSPECIFIED = 0;
+    OTP_TYPE_HOTP = 1;
+    OTP_TYPE_TOTP = 2;
+  }
+  repeated OtpParameters otp_parameters = 1;
+  int32 version = 2;
+  int32 batch_size = 3;
+  int32 batch_index = 4;
+  int32 batch_id = 5;
+}
+message OtpParameters {
+  bytes secret = 1;
+  string name = 2;
+  string issuer = 3;
+  MigrationPayload.Algorithm algorithm = 4;
+  int64 digits = 5;
+  MigrationPayload.OtpType type = 6;
+  int64 counter = 7;
+}

apps/gui-app-authenticator/proto/google_auth_migration.proto

@@ -0,0 +1,97 @@
+// This file is @generated by prost-build.
+#[derive(Clone, PartialEq, ::prost::Message)]
+pub struct MigrationPayload {
+    #[prost(message, repeated, tag = "1")]
+    pub otp_parameters: ::prost::alloc::vec::Vec<OtpParameters>,
+    #[prost(int32, tag = "2")]
+    pub version: i32,
+    #[prost(int32, tag = "3")]
+    pub batch_size: i32,
+    #[prost(int32, tag = "4")]
+    pub batch_index: i32,
+    #[prost(int32, tag = "5")]
+    pub batch_id: i32,
+}
+/// Nested message and enum types in `MigrationPayload`.
+pub mod migration_payload {
+    #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
+    #[repr(i32)]
+    pub enum Algorithm {
+        Unspecified = 0,
+        Sha1 = 1,
+        Sha256 = 2,
+        Sha512 = 3,
+    }
+    impl Algorithm {
+        /// String value of the enum field names used in the ProtoBuf definition.
+        ///
+        /// The values are not transformed in any way and thus are considered stable
+        /// (if the ProtoBuf definition does not change) and safe for programmatic use.
+        pub fn as_str_name(&self) -> &'static str {
+            match self {
+                Self::Unspecified => "ALGORITHM_UNSPECIFIED",
+                Self::Sha1 => "ALGORITHM_SHA1",
+                Self::Sha256 => "ALGORITHM_SHA256",
+                Self::Sha512 => "ALGORITHM_SHA512",
+            }
+        }
+
+        /// Creates an enum from field names used in the ProtoBuf definition.
+        pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
+            match value {
+                "ALGORITHM_UNSPECIFIED" => Some(Self::Unspecified),
+                "ALGORITHM_SHA1" => Some(Self::Sha1),
+                "ALGORITHM_SHA256" => Some(Self::Sha256),
+                "ALGORITHM_SHA512" => Some(Self::Sha512),
+                _ => None,
+            }
+        }
+    }
+    #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
+    #[repr(i32)]
+    pub enum OtpType {
+        Unspecified = 0,
+        Hotp = 1,
+        Totp = 2,
+    }
+    impl OtpType {
+        /// String value of the enum field names used in the ProtoBuf definition.
+        ///
+        /// The values are not transformed in any way and thus are considered stable
+        /// (if the ProtoBuf definition does not change) and safe for programmatic use.
+        pub fn as_str_name(&self) -> &'static str {
+            match self {
+                Self::Unspecified => "OTP_TYPE_UNSPECIFIED",
+                Self::Hotp => "OTP_TYPE_HOTP",
+                Self::Totp => "OTP_TYPE_TOTP",
+            }
+        }
+
+        /// Creates an enum from field names used in the ProtoBuf definition.
+        pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
+            match value {
+                "OTP_TYPE_UNSPECIFIED" => Some(Self::Unspecified),
+                "OTP_TYPE_HOTP" => Some(Self::Hotp),
+                "OTP_TYPE_TOTP" => Some(Self::Totp),
+                _ => None,
+            }
+        }
+    }
+}
+#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
+pub struct OtpParameters {
+    #[prost(bytes = "vec", tag = "1")]
+    pub secret: ::prost::alloc::vec::Vec<u8>,
+    #[prost(string, tag = "2")]
+    pub name: ::prost::alloc::string::String,
+    #[prost(string, tag = "3")]
+    pub issuer: ::prost::alloc::string::String,
+    #[prost(enumeration = "migration_payload::Algorithm", tag = "4")]
+    pub algorithm: i32,
+    #[prost(int64, tag = "5")]
+    pub digits: i64,
+    #[prost(enumeration = "migration_payload::OtpType", tag = "6")]
+    pub r#type: i32,
+    #[prost(int64, tag = "7")]
+    pub counter: i64,
+}

apps/gui-app-authenticator/proto/google_auth_migration.rs

@@ -0,0 +1,101 @@
+// SPDX-FileCopyrightText: 2026 Foundation Devices, Inc. <hello@foundation.xyz>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+use base64::engine::general_purpose::STANDARD as BASE64;
+use base64::Engine;
+use prost::Message;
+use regex::Regex;
+
+use crate::{get_timestamp_in_seconds, Auth, AuthValidationError};
+
+#[path = "../proto/google_auth_migration.rs"]
+mod proto;
+
+use proto::migration_payload::{Algorithm, OtpType};
+
+#[derive(Debug, thiserror::Error)]
+pub enum MigrationError {
+    #[error("Invalid migration URI format")]
+    InvalidUri,
+    #[error("Failed to decode base64 data: {0}")]
+    Base64DecodeError(#[from] base64::DecodeError),
+    #[error("Protobuf decode error: {0}")]
+    ProtobufDecodeError(String),
+    #[error("All accounts were HOTP (unsupported)")]
+    AllHotpSkipped,
+    #[error("Auth validation error: {0}")]
+    AuthValidationError(#[from] AuthValidationError),
+}
+
+#[derive(Debug, Clone)]
+pub struct MigrationEntry {
+    pub otpauth_url: String,
+    pub label: String,
+    pub account: String,
+    pub issuer: String,
+}
+
+pub fn is_migration_uri(uri: &str) -> bool { uri.starts_with("otpauth-migration://offline") }
+
+pub fn parse_migration_uri(uri: &str) -> Result<Vec<Auth>, MigrationError> {
+    let re = Regex::new(r"^otpauth-migration://offline\?(.*)$").unwrap();
+    let caps = re.captures(uri).ok_or(MigrationError::InvalidUri)?;
+
+    let query_string = &caps[1];
+    let data_param = extract_query_param(query_string, "data").ok_or(MigrationError::InvalidUri)?;
+
+    let decoded_data = urlencoding::decode(&data_param)
+        .map_err(|e| MigrationError::ProtobufDecodeError(e.to_string()))?
+        .into_owned();
+    let decoded = BASE64.decode(decoded_data)?;
+
+    let payload = proto::MigrationPayload::decode(decoded.as_slice())
+        .map_err(|e| MigrationError::ProtobufDecodeError(e.to_string()))?;
+
+    let mut entries = Vec::new();
+
+    for otp in &payload.otp_parameters {
+        // Skip HOTP entries (type 1), only import TOTP (type 2)
+        if otp.r#type != OtpType::Totp as i32 {
+            log::info!("Skipping HOTP entry: {}", otp.name);
+            continue;
+        }
+
+        let algo_str = match otp.algorithm {
+            x if x == Algorithm::Sha1 as i32 => "SHA1",
+            x if x == Algorithm::Sha256 as i32 => "SHA256",
+            x if x == Algorithm::Sha512 as i32 => "SHA512",
+            _ => "SHA1",
+        };
+
+        let secret = base32::encode(base32::Alphabet::RFC4648 { padding: false }, &otp.secret);
+
+        let label = if !otp.issuer.is_empty() { otp.issuer.clone() } else { otp.name.clone() };
+
+        let url = format!(
+            // 6 digits fow now are hardcoded since otp.digits contains nonsense data
+            // Example: it returns 1 for code with 6 digits
+            "otpauth://totp/{}:{}?secret={}&issuer={}&algorithm={}&digits=6&period=30",
+            urlencoding::encode(&label),
+            urlencoding::encode(&otp.name),
+            urlencoding::encode(&secret),
+            urlencoding::encode(&label),
+            urlencoding::encode(algo_str),
+        );
+
+        let auth = Auth::new(url, get_timestamp_in_seconds())?;
+        entries.push(auth);
+    }
+
+    if entries.is_empty() {
+        return Err(MigrationError::AllHotpSkipped);
+    }
+
+    Ok(entries)
+}
+
+fn extract_query_param(query: &str, key: &str) -> Option<String> {
+    let re = Regex::new(&format!(r"{}=([^&]*)", regex::escape(key))).ok()?;
+    let caps = re.captures(query)?;
+    Some(caps[1].to_string())
+}