The target asks for a second factor

The situation. Login works, and the target then asks for a six-digit code. Where that code comes from decides which of three routes you take.

The code is generated from a seed you hold

Standard TOTP — the kind an authenticator app produces. If you have stored the base32 seed in the encrypted directory under totp_cle, Diwall generates the current code itself:

{"type": "remplir_som", "id": 6, "valeur": "depuis_secrets_totp"}

No human, no clipboard, nothing to time. The seed stays in the encrypted directory and the code is computed inside the browser process, like any other credential.

This is the route to prefer whenever it is available.

The code arrives by SMS or email

You cannot generate it — it is sent to you. attendre_mfa_ntfy waits for the code to be pushed through a notification channel, fills the field and submits:

[
  {"type": "cliquer_som", "id": 5},
  {"type": "attendre_mfa_ntfy", "id_som": 6, "timeout": 120}
]

id_som is the numbered OTP input; timeout is the wait in seconds, 120 by default. This route needs the notification integration configured beforehand — it does not read the directory, because the code does not exist until it is sent.

Neither applies — a human types it

[
  {"type": "remplir_som", "id": 6, "valeur": "123456"},
  {"type": "cliquer_som", "id": 7}
]

Honest fallback: someone reads the code and edits the scenario before running it. It works, and it does not scale — worth knowing it exists, not worth building on.

The case none of these covers

Enrolment. The very first code, at the moment the secret is created.

When you activate 2FA, the server generates the seed and shows it once. At that instant it exists nowhere else — not in your encrypted directory, not in a notification. depuis_secrets_totp has nothing to read, and attendre_mfa_ntfy has nothing to wait for.

There is no tooling for this. What works is to do the whole enrolment in a single scenario — read the seed from the page, compute the first code, submit it, and only then store the seed — so that nothing has to persist between two calls. It is possible, it has been done, and it is genuinely awkward.

Stated here rather than discovered mid-enrolment, with a page that will not let you go back.

One trap worth knowing

Computing a TOTP yourself inside evaluer requires the browser’s crypto API, which only exists in a secure context — HTTPS or localhost. On a plain HTTP target it is simply absent, and you get Cannot read properties of undefined rather than a helpful message.

If you are on HTTP by choice — a test machine, a local appliance — that route is closed. Use the encrypted directory.

In short

• Seed in the encrypted directory → depuis_secrets_totp. Prefer this.
• Code pushed to you → attendre_mfa_ntfy with the numbered field.
• Neither → a human types it, and that is fine for a one-off.
• Enrolment is a separate problem: one scenario, no persistence between calls.
• No browser crypto on a plain HTTP target.