From f248550a6bb5742bd951b9770ee29404b3804b8a Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@mcintire.me>
Date: Wed, 28 Jan 2026 16:31:10 -0600
Subject: [PATCH] totp debugging

---
 lib/towerops/accounts.ex | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/lib/towerops/accounts.ex b/lib/towerops/accounts.ex
index 35d69943..c86b91da 100644
--- a/lib/towerops/accounts.ex
+++ b/lib/towerops/accounts.ex
@@ -199,8 +199,31 @@ defmodule Towerops.Accounts do
   Allows for +/- 1 time step (30 seconds) to handle clock drift.
   """
   def verify_totp(secret, code) when is_binary(secret) and is_binary(code) do
+    current_time = System.system_time(:second)
+
     # NimbleTOTP.valid? by default checks current time +/- 1 time step (30s)
-    NimbleTOTP.valid?(secret, code)
+    result = NimbleTOTP.valid?(secret, code)
+
+    if !result do
+      require Logger
+      # Log detailed debugging info when TOTP fails
+      expected_code_current = NimbleTOTP.verification_code(secret, time: current_time)
+      expected_code_prev = NimbleTOTP.verification_code(secret, time: current_time - 30)
+      expected_code_next = NimbleTOTP.verification_code(secret, time: current_time + 30)
+
+      Logger.info("TOTP verification failed",
+        provided_code: code,
+        provided_code_length: String.length(code),
+        expected_code_current: expected_code_current,
+        expected_code_prev: expected_code_prev,
+        expected_code_next: expected_code_next,
+        current_unix_time: current_time,
+        current_datetime: DateTime.from_unix!(current_time),
+        secret_length: String.length(secret)
+      )
+    end
+
+    result
   end
 
   @doc """