05/18 Enhanced codes and functionalities

app/services/auth_service.py

@@ -177,7 +177,23 @@ def require_jwt(f):
     return decorated
 
 
-# ── Recovery proof helpers (HMAC-nonce) ──────────────────────────────────────
+# ── TOTP replay prevention ────────────────────────────────────────────────────
+
+def is_totp_code_used(user_id: int, code: str) -> bool:
+    """Return True if this TOTP code was already consumed for this user."""
+    from app.models.totp_used_code import TotpUsedCode
+    return TotpUsedCode.is_used(user_id, code)
+
+
+def mark_totp_code_used(user_id: int, code: str) -> None:
+    """
+    Record that this TOTP code was consumed so it cannot be replayed.
+    Caller must commit the session — the surrounding request handler does this.
+    """
+    from app.models.totp_used_code import TotpUsedCode
+    TotpUsedCode.mark_used(user_id, code)
+
+
 
 def generate_recovery_nonce() -> str:
     """