feat(cli): authforgectl totp enroll/status/revoke

cli/src/main.rs

@@ -56,6 +56,11 @@ enum Cmd {
         #[command(subcommand)]
         cmd: RecoveryCmd,
     },
+    /// Manage TOTP enrollments.
+    Totp {
+        #[command(subcommand)]
+        cmd: TotpCmd,
+    },
 }
 
 #[derive(Subcommand)]
@@ -99,6 +104,16 @@ enum RecoveryCmd {
     Revoke { user: String },
 }
 
+#[derive(Subcommand)]
+enum TotpCmd {
+    /// Generate a fresh TOTP secret for a user.
+    Enroll { user: String },
+    /// Show whether a user has a TOTP secret on file.
+    Status { user: String },
+    /// Remove a user's TOTP enrollment.
+    Revoke { user: String },
+}
+
 #[tokio::main]
 async fn main() -> Result<()> {
     let cli = Cli::parse();
@@ -197,4 +212,35 @@ mod tests {
             _ => panic!("wrong subcommand"),
         }
     }
+
+    #[test]
+    fn parse_totp_enroll() {
+        let c = Cli::try_parse_from(["authforgectl", "totp", "enroll", "alice"]).unwrap();
+        match c.cmd {
+            Cmd::Totp {
+                cmd: TotpCmd::Enroll { user },
+            } => assert_eq!(user, "alice"),
+            _ => panic!("wrong subcommand"),
+        }
+    }
+
+    #[test]
+    fn parse_totp_status_and_revoke() {
+        assert!(matches!(
+            Cli::try_parse_from(["authforgectl", "totp", "status", "alice"])
+                .unwrap()
+                .cmd,
+            Cmd::Totp {
+                cmd: TotpCmd::Status { .. }
+            }
+        ));
+        assert!(matches!(
+            Cli::try_parse_from(["authforgectl", "totp", "revoke", "alice"])
+                .unwrap()
+                .cmd,
+            Cmd::Totp {
+                cmd: TotpCmd::Revoke { .. }
+            }
+        ));
+    }
 }