Make the TOTP face use the filesystem for secret storage (#95)

* TOTP using filesystem

* Filesystem: ability to read files line by line

8 files changed, 626 insertions, 2 deletions

diff --git a/movement/filesystem.c b/movement/filesystem.c
index d122a7fa..2b345eda 100644
--- a/movement/filesystem.c
+++ b/movement/filesystem.c
@@ -166,6 +166,29 @@ bool filesystem_read_file(char *filename, char *buf, int32_t length) {
     return false;
 }
 
+bool filesystem_read_line(char *filename, char *buf, int32_t *offset, int32_t length) {
+    memset(buf, 0, length + 1);
+    int32_t file_size = filesystem_get_file_size(filename);
+    if (file_size > 0) {
+        int err = lfs_file_open(&lfs, &file, filename, LFS_O_RDONLY);
+        if (err < 0) return false;
+        err = lfs_file_seek(&lfs, &file, *offset, LFS_SEEK_SET);
+        if (err < 0) return false;
+        err = lfs_file_read(&lfs, &file, buf, min(length - 1, file_size - *offset));
+        if (err < 0) return false;
+        for(int i = 0; i < length; i++) {
+            (*offset)++;
+            if (buf[i] == '\n') {
+                buf[i] = 0;
+                break;
+            }
+        }
+        return lfs_file_close(&lfs, &file) == LFS_ERR_OK;
+    }
+
+    return false;
+}
+
 static void filesystem_cat(char *filename) {
     info.type = 0;
     lfs_stat(&lfs, filename, &info);
@@ -191,6 +214,14 @@ bool filesystem_write_file(char *filename, char *text, int32_t length) {
     return lfs_file_close(&lfs, &file) == LFS_ERR_OK;
 }
 
+bool filesystem_append_file(char *filename, char *text, int32_t length) {
+    int err = lfs_file_open(&lfs, &file, filename, LFS_O_WRONLY | LFS_O_CREAT | LFS_O_APPEND);
+    if (err < 0) return false;
+    err = lfs_file_write(&lfs, &file, text, length);
+    if (err < 0) return false;
+    return lfs_file_close(&lfs, &file) == LFS_ERR_OK;
+}
+
 void filesystem_process_command(char *line) {
     printf("$ %s", line);
     char *command = strtok(line, " \n");
@@ -223,7 +254,7 @@ void filesystem_process_command(char *line) {
         memset(text, 0, 248);
         size_t pos = 0;
         char *word = strtok(NULL, " \n");
-        while (strcmp(word, ">")) {
+        while (strcmp(word, ">") && strcmp(word, ">>")) {
             sprintf(text + pos, "%s ", word);
             pos += strlen(word) + 1;
             word = strtok(NULL, " \n");
@@ -235,8 +266,12 @@ void filesystem_process_command(char *line) {
             printf("usage: echo text > file\n");
         } else if (strchr(filename, '/') || strchr(filename, '\\')) {
             printf("subdirectories are not supported\n");
-        } else {
+        } else if (!strcmp(word, ">")) {
             filesystem_write_file(filename, text, strlen(text));
+            filesystem_append_file(filename, "\n", 1);
+        } else if (!strcmp(word, ">>")) {
+            filesystem_append_file(filename, text, strlen(text));
+            filesystem_append_file(filename, "\n", 1);
         }
         free(text);
     } else {
diff --git a/movement/filesystem.h b/movement/filesystem.h
index b0fb7f58..3cd3d092 100644
--- a/movement/filesystem.h
+++ b/movement/filesystem.h
@@ -69,6 +69,17 @@ int32_t filesystem_get_file_size(char *filename);
   */
 bool filesystem_read_file(char *filename, char *buf, int32_t length);
 
+/** @brief Reads a line from a file into a buffer
+  * @param filename the file you wish to read
+  * @param buf A buffer of at least length + 1 bytes; the file will be read into this buffer,
+  *            and the last byte (buf[length]) will be set to 0 as a null terminator.
+  * @param offset Pointer to an int representing the offset into the file. This will be updated
+  *               to reflect the offset of the next line.
+  * @param length The maximum number of bytes to read
+  * @return true if the read was successful; false otherwise
+  */
+bool filesystem_read_line(char *filename, char *buf, int32_t *offset, int32_t length);
+
 /** @brief Writes file to the filesystem
   * @param filename the file you wish to write
   * @param text The contents of the file
@@ -77,6 +88,14 @@ bool filesystem_read_file(char *filename, char *buf, int32_t length);
   */
 bool filesystem_write_file(char *filename, char *text, int32_t length);
 
+/** @brief Appends text to file on the filesystem
+  * @param filename the file you wish to write
+  * @param text The contents to write
+  * @param length The number of bytes to write
+  * @return true if the write was successful; false otherwise
+  */
+bool filesystem_append_file(char *filename, char *text, int32_t length);
+
 /** @brief Handles the interactive file browser when Movement is plugged in to USB.
   * @param line The command that the user typed into the serial console.
   */
diff --git a/movement/lib/base32/base32.c b/movement/lib/base32/base32.c
new file mode 100644
index 00000000..548f9a4a
--- /dev/null
+++ b/movement/lib/base32/base32.c
@@ -0,0 +1,221 @@
+/**
+ * base32 (de)coder implementation as specified by RFC4648.
+ *
+ * Copyright (c) 2010 Adrien Kunysz
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ **/
+
+#include <assert.h>  // assert()
+#include <limits.h>  // CHAR_BIT
+
+#include "base32.h"
+
+/**
+ * Let this be a sequence of plain data before encoding:
+ *
+ *  01234567 01234567 01234567 01234567 01234567
+ * +--------+--------+--------+--------+--------+
+ * |< 0 >< 1| >< 2 ><|.3 >< 4.|>< 5 ><.|6 >< 7 >|
+ * +--------+--------+--------+--------+--------+
+ *
+ * There are 5 octets of 8 bits each in each sequence.
+ * There are 8 blocks of 5 bits each in each sequence.
+ *
+ * You probably want to refer to that graph when reading the algorithms in this
+ * file. We use "octet" instead of "byte" intentionnaly as we really work with
+ * 8 bits quantities. This implementation will probably not work properly on
+ * systems that don't have exactly 8 bits per (unsigned) char.
+ **/
+
+static size_t min(size_t x, size_t y)
+{
+	return x < y ? x : y;
+}
+
+static const unsigned char PADDING_CHAR = '=';
+
+/**
+ * Pad the given buffer with len padding characters.
+ */
+static void pad(unsigned char *buf, int len)
+{
+	for (int i = 0; i < len; i++)
+		buf[i] = PADDING_CHAR;
+}
+
+/**
+ * This convert a 5 bits value into a base32 character.
+ * Only the 5 least significant bits are used.
+ */
+static unsigned char encode_char(unsigned char c)
+{
+	static unsigned char base32[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+	return base32[c & 0x1F];  // 0001 1111
+}
+
+/**
+ * Decode given character into a 5 bits value. 
+ * Returns -1 iff the argument given was an invalid base32 character
+ * or a padding character.
+ */
+static int decode_char(unsigned char c)
+{
+	int retval = -1;
+
+	if (c >= 'A' && c <= 'Z')
+		retval = c - 'A';
+	if (c >= '2' && c <= '7')
+		retval = c - '2' + 26;
+
+	assert(retval == -1 || ((retval & 0x1F) == retval));
+
+	return  retval;
+}
+
+/**
+ * Given a block id between 0 and 7 inclusive, this will return the index of
+ * the octet in which this block starts. For example, given 3 it will return 1
+ * because block 3 starts in octet 1:
+ *
+ * +--------+--------+
+ * | ......<|.3 >....|
+ * +--------+--------+
+ *  octet 1 | octet 2
+ */
+static int get_octet(int block)
+{
+	assert(block >= 0 && block < 8);
+	return (block*5) / 8;
+}
+
+/**
+ * Given a block id between 0 and 7 inclusive, this will return how many bits
+ * we can drop at the end of the octet in which this block starts. 
+ * For example, given block 0 it will return 3 because there are 3 bits
+ * we don't care about at the end:
+ *
+ *  +--------+-
+ *  |< 0 >...|
+ *  +--------+-
+ *
+ * Given block 1, it will return -2 because there
+ * are actually two bits missing to have a complete block:
+ *
+ *  +--------+-
+ *  |.....< 1|..
+ *  +--------+-
+ **/
+static int get_offset(int block)
+{
+	assert(block >= 0 && block < 8);
+	return (8 - 5 - (5*block) % 8);
+}
+
+/**
+ * Like "b >> offset" but it will do the right thing with negative offset.
+ * We need this as bitwise shifting by a negative offset is undefined
+ * behavior.
+ */
+static unsigned char shift_right(unsigned char byte, int offset)
+{
+	if (offset > 0)
+		return byte >>  offset;
+	else
+		return byte << -offset;
+}
+
+static unsigned char shift_left(unsigned char byte, int offset)
+{
+	return shift_right(byte, - offset);
+}
+
+/**
+ * Encode a sequence. A sequence is no longer than 5 octets by definition.
+ * Thus passing a length greater than 5 to this function is an error. Encoding
+ * sequences shorter than 5 octets is supported and padding will be added to the
+ * output as per the specification.
+ */
+static void encode_sequence(const unsigned char *plain, int len, unsigned char *coded)
+{
+	assert(CHAR_BIT == 8);  // not sure this would work otherwise
+	assert(len >= 0 && len <= 5);
+
+	for (int block = 0; block < 8; block++) {
+		int octet = get_octet(block);  // figure out which octet this block starts in
+		int junk = get_offset(block);  // how many bits do we drop from this octet?
+
+		if (octet >= len) { // we hit the end of the buffer
+			pad(&coded[block], 8 - block);
+			return;
+		}
+
+		unsigned char c = shift_right(plain[octet], junk);  // first part
+
+		if (junk < 0  // is there a second part?
+		&&  octet < len - 1)  // is there still something to read?
+		{
+			c |= shift_right(plain[octet+1], 8 + junk);
+		}
+		coded[block] = encode_char(c);
+	}
+}
+
+void base32_encode(const unsigned char *plain, size_t len, unsigned char *coded)
+{
+	// All the hard work is done in encode_sequence(),
+	// here we just need to feed it the data sequence by sequence.
+	for (size_t i = 0, j = 0; i < len; i += 5, j += 8) {
+		encode_sequence(&plain[i], min(len - i, 5), &coded[j]);
+	}
+}
+
+static int decode_sequence(const unsigned char *coded, unsigned char *plain)
+{
+	assert(CHAR_BIT == 8);
+	assert(coded && plain);
+
+	plain[0] = 0;
+	for (int block = 0; block < 8; block++) {
+		int offset = get_offset(block);
+		int octet = get_octet(block);
+
+		int c = decode_char(coded[block]);
+		if (c < 0)  // invalid char, stop here
+			return octet;
+
+		plain[octet] |= shift_left(c, offset);
+		if (offset < 0) {  // does this block overflows to next octet?
+			assert(octet < 4);
+			plain[octet+1] = shift_left(c, 8 + offset);
+		}
+	}
+	return 5;
+}
+
+size_t base32_decode(const unsigned char *coded, unsigned char *plain)
+{
+	size_t written = 0;
+	for (size_t i = 0, j = 0; ; i += 8, j += 5) {
+		int n = decode_sequence(&coded[i], &plain[j]);
+		written += n;
+		if (n < 5)
+			return written;
+	}
+}
diff --git a/movement/lib/base32/base32.h b/movement/lib/base32/base32.h
new file mode 100644
index 00000000..abf2d034
--- /dev/null
+++ b/movement/lib/base32/base32.h
@@ -0,0 +1,66 @@
+/**
+ * base32 (de)coder implementation as specified by RFC4648.
+ *
+ * Copyright (c) 2010 Adrien Kunysz
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ **/
+
+#ifndef __BASE32_H_
+#define __BASE32_H_
+
+#include <stddef.h>   // size_t
+
+/**
+ * Returns the length of the output buffer required to encode len bytes of
+ * data into base32. This is a macro to allow users to define buffer size at
+ * compilation time.
+ */
+#define BASE32_LEN(len)  (((len)/5)*8 + ((len) % 5 ? 8 : 0))
+
+/**
+ * Returns the length of the output buffer required to decode a base32 string
+ * of len characters. Please note that len must be a multiple of 8 as per
+ * definition of a base32 string. This is a macro to allow users to define
+ * buffer size at compilation time.
+ */
+#define UNBASE32_LEN(len)  (((len)/8)*5)
+
+/**
+ * Encode the data pointed to by plain into base32 and store the
+ * result at the address pointed to by coded. The "coded" argument
+ * must point to a location that has enough available space
+ * to store the whole coded string. The resulting string will only
+ * contain characters from the [A-Z2-7=] set. The "len" arguments
+ * define how many bytes will be read from the "plain" buffer.
+ **/
+void base32_encode(const unsigned char *plain, size_t len, unsigned char *coded);
+
+/**
+ * Decode the null terminated string pointed to by coded and write
+ * the decoded data into the location pointed to by plain. The
+ * "plain" argument must point to a location that has enough available
+ * space to store the whole decoded string.
+ * Returns the length of the decoded string. This may be less than
+ * expected due to padding. If an invalid base32 character is found
+ * in the coded string, decoding will stop at that point.
+ **/
+size_t base32_decode(const unsigned char *coded, unsigned char *plain);
+
+#endif
diff --git a/movement/make/Makefile b/movement/make/Makefile
index f0f26c3f..bf9351eb 100644
--- a/movement/make/Makefile
+++ b/movement/make/Makefile
@@ -18,6 +18,7 @@ INCLUDES += \
   -I../watch_faces/demo/ \
   -I../../littlefs/ \
   -I../lib/TOTP-MCU/ \
+  -I../lib/base32/ \
   -I../lib/sunriset/ \
   -I../lib/vsop87/ \
   -I../lib/astrolib/ \
@@ -31,6 +32,7 @@ INCLUDES += \
 SRCS += \
   ../lib/TOTP-MCU/sha1.c \
   ../lib/TOTP-MCU/TOTP.c \
+  ../lib/base32/base32.c \
   ../lib/sunriset/sunriset.c \
   ../lib/vsop87/vsop87a_milli.c \
   ../lib/astrolib/astrolib.c \
@@ -55,6 +57,7 @@ SRCS += \
   ../watch_faces/complication/day_one_face.c \
   ../watch_faces/complication/stopwatch_face.c \
   ../watch_faces/complication/totp_face.c \
+  ../watch_faces/complication/totp_face_lfs.c \
   ../watch_faces/complication/sunrise_sunset_face.c \
   ../watch_faces/complication/countdown_face.c \
   ../watch_faces/complication/counter_face.c \
diff --git a/movement/movement_faces.h b/movement/movement_faces.h
index 9aa5e6ca..282be0e6 100644
--- a/movement/movement_faces.h
+++ b/movement/movement_faces.h
@@ -39,6 +39,7 @@
 #include "voltage_face.h"
 #include "stopwatch_face.h"
 #include "totp_face.h"
+#include "totp_face_lfs.h"
 #include "lis2dw_logging_face.h"
 #include "demo_face.h"
 #include "hello_there_face.h"
diff --git a/movement/watch_faces/complication/totp_face_lfs.c b/movement/watch_faces/complication/totp_face_lfs.c
new file mode 100644
index 00000000..0b542653
--- /dev/null
+++ b/movement/watch_faces/complication/totp_face_lfs.c
@@ -0,0 +1,253 @@
+#include <stdlib.h>
+#include <string.h>
+#include <math.h>
+
+#include "TOTP.h"
+#include "base32.h"
+
+#include "watch.h"
+#include "watch_utility.h"
+#include "filesystem.h"
+
+#include "totp_face_lfs.h"
+
+/* Reads from a file totp_uris.txt where each line is what's in a QR code:
+ * e.g.
+ *   otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&issuer=Example
+ *   otpauth://totp/ACME%20Co:john.doe@email.com?secret=HXDMVJECJJWSRB3HWIZR4IFUGFTMXBOZ&issuer=ACME%20Co&algorithm=SHA1&digits=6&period=30
+ * This is also the same as what Aegis exports in plain-text format.
+ *
+ * Minimal sanitisation of input, however.
+ *
+ * At the moment, to get the records onto the filesystem, start a serial connection and do:
+ *   echo otpauth://totp/Example:alice@google.com?secret=JBSWY3DPEHPK3PXP&issuer=Example > totp_uris.txt
+ *   echo otpauth://totp/ACME%20Co:john.doe@email.com?secret=HXDMVJECJJWSRB3HWIZR4IFUGFTMXBOZ&issuer=ACME%20Co&algorithm=SHA1&digits=6&period=30 >> totp_uris.txt
+ * (note the double >> in the second one)
+ *
+ * You may want to customise the characters that appear to identify the 2FA code. These are just the first two characters of the issuer,
+ * and it's fine to modify the URI.
+ */
+
+
+#define MAX_TOTP_RECORDS 20
+#define MAX_TOTP_SECRET_SIZE 48
+#define TOTP_FILE "totp_uris.txt"
+
+const char* TOTP_URI_START = "otpauth://totp/";
+
+struct totp_record {
+    uint8_t *secret;
+    size_t secret_size;
+    char label[2];
+    uint32_t period;
+};
+
+static struct totp_record totp_records[MAX_TOTP_RECORDS];
+static int num_totp_records = 0;
+
+static void init_totp_record(struct totp_record *totp_record) {
+    totp_record->secret_size = 0;
+    totp_record->label[0] = 'A';
+    totp_record->label[1] = 'A';
+    totp_record->period = 30;
+}
+
+static bool totp_face_lfs_read_param(struct totp_record *totp_record, char *param, char *value) {
+    if (!strcmp(param, "issuer")) {
+        if (value[0] == '\0' || value[1] == '\0') {
+            printf("TOTP issuer must be >= 2 chars, got '%s'\n", value);
+            return false;
+        }
+        totp_record->label[0] = value[0];
+        totp_record->label[1] = value[1];
+    } else if (!strcmp(param, "secret")) {
+        if (UNBASE32_LEN(strlen(value)) > MAX_TOTP_SECRET_SIZE) {
+            printf("TOTP secret too long: %s\n", value);
+            return false;
+        }
+        totp_record->secret = malloc(UNBASE32_LEN(strlen(value)));
+        totp_record->secret_size = base32_decode((unsigned char *)value, totp_record->secret);
+        if (totp_record->secret_size == 0) {
+            free(totp_record->secret);
+            printf("TOTP can't decode secret: %s\n", value);
+            return false;
+        }
+    } else if (!strcmp(param, "digits")) {
+        if (!strcmp(param, "6")) {
+            printf("TOTP got %s, not 6 digits\n", value);
+            return false;
+        }
+    } else if (!strcmp(param, "period")) {
+        totp_record->period = atoi(value);
+        if (totp_record->period == 0) {
+            printf("TOTP invalid period %s\n", value);
+            return false;
+        }
+    } else if (!strcmp(param, "algorithm")) {
+        if (!strcmp(param, "SHA1")) {
+            printf("TOTP ignored due to algorithm %s\n", value);
+            return false;
+        }
+    }
+
+    return true;
+}
+
+static void totp_face_lfs_read_file(char *filename) {
+    // For 'format' of file, see comment at top.
+    const size_t uri_start_len = strlen(TOTP_URI_START);
+
+    if (!filesystem_file_exists(filename)) {
+        printf("TOTP file error: %s\n", filename);
+        return;
+    }
+
+    char line[256];
+    int32_t offset = 0;
+    while (filesystem_read_line(filename, line, &offset, 255) && strlen(line)) {
+        if (num_totp_records == MAX_TOTP_RECORDS) {
+            printf("TOTP max records: %d\n", MAX_TOTP_RECORDS);
+            break;
+        }
+
+        // Check that it looks like a URI
+        if (strncmp(TOTP_URI_START, line, uri_start_len)) {
+            printf("TOTP invalid uri start: %s\n", line);
+            continue;
+        }
+
+        // Check that we can find a '?' (to start our parameters)
+        char *param;
+        char *param_saveptr = NULL;
+        char *params = strchr(line + uri_start_len, '?');
+        if (params == NULL) {
+            printf("TOTP no params: %s\n", line);
+            continue;
+        }
+
+        // Process the parameters and put them in the record
+        init_totp_record(&totp_records[num_totp_records]);
+        bool error = false;
+        param = strtok_r(params + 1, "&", &param_saveptr);
+        do {
+            char *param_middle = strchr(param, '=');
+            *param_middle = '\0';
+            error = error || !totp_face_lfs_read_param(&totp_records[num_totp_records], param, param_middle + 1);
+        } while ((param = strtok_r(NULL, "&", &param_saveptr)));
+
+        if (error) {
+            totp_records[num_totp_records].secret_size = 0;
+            continue;
+        }
+
+        // If we found a probably valid TOTP record, keep it. 
+        if (totp_records[num_totp_records].secret_size) {
+            num_totp_records += 1;
+        } else {
+            printf("TOTP missing secret: %s\n", line);
+        }
+    }
+}
+
+void totp_face_lfs_setup(movement_settings_t *settings, uint8_t watch_face_index, void ** context_ptr) {
+    (void) settings;
+    (void) watch_face_index;
+    if (*context_ptr == NULL) {
+        *context_ptr = malloc(sizeof(totp_lfs_state_t));
+    }
+
+#if !(__EMSCRIPTEN__)
+    if (num_totp_records == 0) {
+        totp_face_lfs_read_file(TOTP_FILE);
+    }
+#endif
+}
+
+static void totp_face_set_record(totp_lfs_state_t *totp_state, int i) {
+    if (num_totp_records == 0 && i >= num_totp_records) {
+        return;
+    }
+
+    totp_state->current_index = i;
+    TOTP(totp_records[i].secret, totp_records[i].secret_size, totp_records[i].period);
+    totp_state->current_code = getCodeFromTimestamp(totp_state->timestamp);
+    totp_state->steps = totp_state->timestamp / totp_records[i].period;
+}
+
+void totp_face_lfs_activate(movement_settings_t *settings, void *context) {
+    (void) settings;
+    memset(context, 0, sizeof(totp_lfs_state_t));
+    totp_lfs_state_t *totp_state = (totp_lfs_state_t *)context;
+
+#if __EMSCRIPTEN__
+    if (num_totp_records == 0) {
+        // Doing this here rather than in setup makes things a bit more pleasant in the simulator, since there's no easy way to trigger
+        // setup again after uploading the data.
+        totp_face_lfs_read_file(TOTP_FILE);
+    }
+#endif
+
+    totp_state->timestamp = watch_utility_date_time_to_unix_time(watch_rtc_get_date_time(), movement_timezone_offsets[settings->bit.time_zone] * 60);
+    totp_face_set_record(totp_state, 0);
+}
+
+static void totp_face_display(totp_lfs_state_t *totp_state) {
+    uint8_t index = totp_state->current_index;
+    char buf[14];
+
+    if (num_totp_records == 0) {
+        watch_display_string("No2F Codes", 0);
+        return;
+    }
+
+    div_t result = div(totp_state->timestamp, totp_records[index].period);
+    if (result.quot != totp_state->steps) {
+        totp_state->current_code = getCodeFromTimestamp(totp_state->timestamp);
+        totp_state->steps = result.quot;
+    }
+    uint8_t valid_for = totp_records[index].period - result.rem;
+
+    sprintf(buf, "%c%c%2d%06lu", totp_records[index].label[0], totp_records[index].label[1], valid_for, totp_state->current_code);
+
+    watch_display_string(buf, 0);
+}
+
+bool totp_face_lfs_loop(movement_event_t event, movement_settings_t *settings, void *context) {
+    (void) settings;
+
+    totp_lfs_state_t *totp_state = (totp_lfs_state_t *)context;
+
+    switch (event.event_type) {
+        case EVENT_TICK:
+            totp_state->timestamp++;
+            totp_face_display(totp_state);
+            break;
+        case EVENT_ACTIVATE:
+            totp_face_display(totp_state);
+            break;
+        case EVENT_MODE_BUTTON_UP:
+            movement_move_to_next_face();
+            break;
+        case EVENT_LIGHT_BUTTON_DOWN:
+            movement_illuminate_led();
+            break;
+        case EVENT_TIMEOUT:
+            movement_move_to_face(0);
+            break;
+        case EVENT_ALARM_BUTTON_UP:
+            totp_face_set_record(totp_state, (totp_state->current_index + 1) % num_totp_records);
+            totp_face_display(totp_state);
+            break;
+        case EVENT_ALARM_BUTTON_DOWN:
+        case EVENT_ALARM_LONG_PRESS:
+        default:
+            break;
+    }
+
+    return true;
+}
+
+void totp_face_lfs_resign(movement_settings_t *settings, void *context) {
+    (void) settings;
+    (void) context;
+}
diff --git a/movement/watch_faces/complication/totp_face_lfs.h b/movement/watch_faces/complication/totp_face_lfs.h
new file mode 100644
index 00000000..0f388bc3
--- /dev/null
+++ b/movement/watch_faces/complication/totp_face_lfs.h
@@ -0,0 +1,26 @@
+#ifndef TOTP_FACE_LFS_H_
+#define TOTP_FACE_LFS_H_
+
+#include "movement.h"
+
+typedef struct {
+    uint32_t timestamp;
+    uint8_t steps;
+    uint32_t current_code;
+    uint8_t current_index;
+} totp_lfs_state_t;
+
+void totp_face_lfs_setup(movement_settings_t *settings, uint8_t watch_face_index, void ** context_ptr);
+void totp_face_lfs_activate(movement_settings_t *settings, void *context);
+bool totp_face_lfs_loop(movement_event_t event, movement_settings_t *settings, void *context);
+void totp_face_lfs_resign(movement_settings_t *settings, void *context);
+
+#define totp_face_lfs ((const watch_face_t){ \
+    totp_face_lfs_setup, \
+    totp_face_lfs_activate, \
+    totp_face_lfs_loop, \
+    totp_face_lfs_resign, \
+    NULL, \
+})
+
+#endif // TOTP_FACE_LFS_H_