1 files changed, 16 insertions, 0 deletions
diff --git a/src/main/java/org/traccar/api/resource/UserResource.java b/src/main/java/org/traccar/api/resource/UserResource.java
index d73e8b6f5..99537f912 100644
--- a/src/main/java/org/traccar/api/resource/UserResource.java
+++ b/src/main/java/org/traccar/api/resource/UserResource.java
@@ -15,12 +15,14 @@
  */
 package org.traccar.api.resource;
 
+import com.warrenstrange.googleauth.GoogleAuthenticator;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.ws.rs.DELETE;
 import jakarta.ws.rs.PathParam;
 import jakarta.ws.rs.core.Context;
 import org.traccar.api.BaseObjectResource;
 import org.traccar.config.Config;
+import org.traccar.config.Keys;
 import org.traccar.helper.LogAction;
 import org.traccar.helper.model.UserUtil;
 import org.traccar.model.ManagedUser;
@@ -96,6 +98,10 @@ public class UserResource extends BaseObjectResource<User> {
                 if (!permissionsService.getServer().getRegistration()) {
                     throw new SecurityException("Registration disabled");
                 }
+                if (permissionsService.getServer().getBoolean(Keys.WEB_TOTP_FORCE.getKey())
+                        && entity.getTotpKey() == null) {
+                    throw new SecurityException("One-time password key is required");
+                }
                 UserUtil.setUserDefaults(entity, config);
             }
         }
@@ -128,4 +134,14 @@ public class UserResource extends BaseObjectResource<User> {
         return response;
     }
 
+    @Path("totp")
+    @PermitAll
+    @POST
+    public String generateTotpKey() throws StorageException {
+        if (!permissionsService.getServer().getBoolean(Keys.WEB_TOTP_ENABLE.getKey())) {
+            throw new SecurityException("One-time password is disabled");
+        }
+        return new GoogleAuthenticator().createCredentials().getKey();
+    }
+
 }