From 2f5a735c75fd1e58a6b926ea622c50c9921ad70b Mon Sep 17 00:00:00 2001
From: Nicolas <bircni@icloud.com>
Date: Mon, 15 Jun 2026 22:11:23 +0200
Subject: [PATCH] unexport

---
 models/auth/twofactor.go     | 11 ++++++-----
 routers/web/auth/password.go |  2 +-
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/models/auth/twofactor.go b/models/auth/twofactor.go
index 894b55f5d4..51f487aac1 100644
--- a/models/auth/twofactor.go
+++ b/models/auth/twofactor.go
@@ -105,15 +105,16 @@ func (t *TwoFactor) SetSecret(secretString string) error {
 	return nil
 }
 
-// ValidateTOTP validates the provided passcode.
-func (t *TwoFactor) ValidateTOTP(passcode string) (bool, error) {
+// validateTOTP validates the provided passcode. It does not consume the passcode; all login
+// surfaces must go through ValidateAndConsumeTOTP so that a passcode cannot be redeemed twice.
+func (t *TwoFactor) validateTOTP(passcode string) (bool, error) {
 	decodedStoredSecret, err := base64.StdEncoding.DecodeString(t.Secret)
 	if err != nil {
-		return false, fmt.Errorf("ValidateTOTP invalid base64: %w", err)
+		return false, fmt.Errorf("validateTOTP invalid base64: %w", err)
 	}
 	secretBytes, err := secret.AesDecrypt(t.getEncryptionKey(), decodedStoredSecret)
 	if err != nil {
-		return false, fmt.Errorf("ValidateTOTP unable to decrypt (maybe SECRET_KEY is wrong): %w", err)
+		return false, fmt.Errorf("validateTOTP unable to decrypt (maybe SECRET_KEY is wrong): %w", err)
 	}
 	secretStr := string(secretBytes)
 	return totp.Validate(passcode, secretStr), nil
@@ -124,7 +125,7 @@ func (t *TwoFactor) ValidateTOTP(passcode string) (bool, error) {
 // invalid passcode as well as for a replay, including the case where a concurrent request with
 // the same passcode won the race first. All TOTP login surfaces must go through this helper.
 func (t *TwoFactor) ValidateAndConsumeTOTP(ctx context.Context, passcode string) (bool, error) {
-	ok, err := t.ValidateTOTP(passcode)
+	ok, err := t.validateTOTP(passcode)
 	if err != nil || !ok {
 		return false, err
 	}
diff --git a/routers/web/auth/password.go b/routers/web/auth/password.go
index 880a4e2d80..ca3e37dad0 100644
--- a/routers/web/auth/password.go
+++ b/routers/web/auth/password.go
@@ -179,7 +179,7 @@ func ResetPasswdPost(ctx *context.Context) {
 			passcode := ctx.FormString("passcode")
 			ok, err := twofa.ValidateAndConsumeTOTP(ctx, passcode)
 			if err != nil {
-				ctx.HTTPError(http.StatusInternalServerError, "ValidateTOTP", err.Error())
+				ctx.HTTPError(http.StatusInternalServerError, "ValidateAndConsumeTOTP", err.Error())
 				return
 			}
 			if !ok {