Struct OtpValidator 

pub struct OtpValidator<S: OtpStore> { /* private fields */ }

Validates and consumes OTP tokens.

Performs timing-safe hash comparison against the store to prevent timing side-channel attacks (RHELBU-3536 R8).

Implementations

impl<S: OtpStore> OtpValidator<S>

pub fn new(store: S) -> Self

Create a validator backed by the given store.

pub async fn validate( &self, plaintext_token: &str, ) -> OtpResult<ValidationResult>

Validate a plaintext OTP token.

Checks, in order:

1. Token exists in the store (by SHA-256 hash lookup)
2. Token is not revoked
3. Token has not expired
4. Token has not exceeded its max-use count

On success, increments the usage counter and returns entity metadata for authorization. Single-use tokens are consumed (marked with current_uses == max_uses) on first successful validation.

Timing Safety (RHELBU-3536 R8)

The store lookup is by hash, not by iterating and comparing plaintext values. The SHA-256 pre-image resistance ensures that even if an attacker observes lookup timing, they cannot infer the token value.

pub async fn revoke(&self, id: &Uuid) -> OtpResult<()>

Revoke an OTP by its record ID.

pub fn store(&self) -> &S

Reference to the underlying store.