QR Code Login Polling (user/scanlogin_poll.go)

Manages short-lived polling secrets for QR code authentication flows using Redis with secure constant-time comparison. Reuse for passwordless login implementations.

// Source: https://github.com/Mininglamp-OSS/octo-server | License: Apache-2.0 | Copyright You must retain, in the Source form of any Derivative Works
// Provided via justclaw.it.com; keep this notice with the code.
package user

import (
	"crypto/sha256"
	"crypto/subtle"
	"encoding/hex"
	"fmt"
	"time"

	"github.com/Mininglamp-OSS/octo-lib/common"
	"github.com/Mininglamp-OSS/octo-lib/pkg/util"
	"go.uber.org/zap"
)

// scanLoginPollSecretPrefix 是扫码登录轮询密钥的 Redis 前缀。
//
// 该前缀在 octo-server 本地定义（而非 octo-lib common.*CachePrefix）：octo-lib 是
// 外部模块，加常量需要先发版；本 key 的生命周期完全由 modules/user 掌握。
const (
	scanLoginPollSecretPrefix = "scanlogin:poll:"
	scanLoginStatusDisabled   = "disabled"
)

// scanLoginPollSecretQuery 是轮询方出示密钥的 query 参数名。
//
// 曾经改成自定义请求头 X-Scan-Poll-Secret，想让明文不进 access log —— 后来退回来了

... (truncated -- full source via MCP)