TOTP: introduce new interface that prevents code reuse

[glaubinix]

Target branch: 11.4.x
Resolves issue #226

• It is a Bug fix
• It is a New feature
• Breaks BC
• Includes Deprecations

We did run into the same issue that was previously mentioned here where users can submit the same TOTP code multiple times.

To prevent this, a new interface was introduced with a new verifyWithPreviousTimestamp method that accepts an additional parameter, the timestamp of the last used code. Passing the parameter will prevent the code matching the timestamp, and in case leeway is used, the previous code, from being reused again. To make it possible to store the timestamp for the submitted code, the timestamp needs to be returned by the verifyWithPreviousTimestamp method. Happy to adjust this to return a result object, in case that is preferred.

[Spomky]

Hi,

Many thanks for this PR.
I like the interface, but I would prefer another class that extends the TOTP class with the new interface.

[glaubinix]

Thank you for the feedback! The TOTP class is marked as final and should probably stay that way. Do you have a preference on introducing an AbstractTOTP class that implement the basic logic for both classes, or do you prefer adding a new TOTPWithPreviousTimestamp class that extends the two interface and then extract the verify logic into an internal TOTPVerifier class?

[glaubinix]

Hi, still happy to make those changes you requested. Any chance you could let me know your preference how I should proceed?