From 62cabb10347342bab18032f056cbb23ca6a05290 Mon Sep 17 00:00:00 2001
From: Baoshuo <i@baoshuo.ren>
Date: Sat, 9 May 2026 21:04:55 +0800
Subject: [PATCH] core: migrate notp to otpauth (#1157)

---
 packages/hydrooj/package.json         | 4 +---
 packages/hydrooj/src/lib/verifyTFA.ts | 9 ++++-----
 2 files changed, 5 insertions(+), 8 deletions(-)

diff --git a/packages/hydrooj/package.json b/packages/hydrooj/package.json
index 5f434ec5d..c7a9b9910 100644
--- a/packages/hydrooj/package.json
+++ b/packages/hydrooj/package.json
@@ -44,7 +44,7 @@
         "mongodb-uri": "^0.9.7",
         "nanoid": "^5.1.11",
         "nodemailer": "^8.0.7",
-        "notp": "^2.0.3",
+        "otpauth": "^9.5.1",
         "p-queue": "^9.2.0",
         "sanitize-filename": "^1.6.4",
         "schemastery": "^3.18.0",
@@ -53,7 +53,6 @@
         "superagent": "^10.3.0",
         "superagent-proxy": "^3.0.0",
         "tar": "6.2.1",
-        "thirty-two": "^1.0.2",
         "ua-parser-js": "1.0.41"
     },
     "devDependencies": {
@@ -66,7 +65,6 @@
         "@types/mime-types": "^3.0.1",
         "@types/mongodb-uri": "^0.9.4",
         "@types/nodemailer": "^8.0.0",
-        "@types/notp": "^2.0.5",
         "@types/semver": "^7.7.1",
         "@types/superagent": "^8.1.9",
         "@types/superagent-proxy": "^3.0.4",
diff --git a/packages/hydrooj/src/lib/verifyTFA.ts b/packages/hydrooj/src/lib/verifyTFA.ts
index 4013cc94d..5780c3651 100644
--- a/packages/hydrooj/src/lib/verifyTFA.ts
+++ b/packages/hydrooj/src/lib/verifyTFA.ts
@@ -1,8 +1,7 @@
-import notp from 'notp';
-import b32 from 'thirty-two';
+import { Secret, TOTP } from 'otpauth';
 
 export function verifyTFA(secret: string, code?: string) {
-    if (!code || !code.length) return null;
-    const bin = b32.decode(secret);
-    return notp.totp.verify(code.replace(/\W+/g, ''), bin);
+    if (!code || !code.length) return false;
+    const totp = new TOTP({ secret: Secret.fromBase32(secret), algorithm: 'SHA1', digits: 6, period: 30 });
+    return totp.validate({ token: code.replace(/\W+/g, '') }) !== null;
 }