Single point of secret creation

phpstan.neon

@@ -5,6 +5,7 @@ parameters:
         - tests
     ignoreErrors:
         - '#Variable property access on \$this\(OTPHP\\OTP\)\.#'
+        - '#^Method OTPHP\\OTP::generateSecret\(\) should return non-empty-string but returns string\.$#'
 
 includes:
     - vendor/phpstan/phpstan-strict-rules/rules.neon

src/HOTP.php

@@ -6,7 +6,6 @@ namespace OTPHP;
 
 use InvalidArgumentException;
 use function is_int;
-use ParagonIE\ConstantTime\Base32;
 
 /**
  * @see \OTPHP\Test\HOTPTest
@@ -39,9 +38,7 @@ final class HOTP extends OTP implements HOTPInterface
 
     public static function generate(int $counter = 0, string $digest = 'sha1', int $digits = 6): self
     {
-        $secret = Base32::encodeUpper(random_bytes(64));
-
-        return new self($secret, $counter, $digest, $digits);
+        return new self(self::generateSecret(), $counter, $digest, $digits);
     }
 
     public function getCounter(): int

src/OTP.php

@@ -36,6 +36,14 @@ abstract class OTP implements OTPInterface
         return $this->generateOTP($input);
     }
 
+    /**
+     * @return non-empty-string
+     */
+    final protected static function generateSecret(): string
+    {
+        return Base32::encodeUpper(random_bytes(64));
+    }
+
     /**
      * The OTP at the specified input.
      */

src/TOTP.php

@@ -6,7 +6,6 @@ namespace OTPHP;
 
 use InvalidArgumentException;
 use function is_int;
-use ParagonIE\ConstantTime\Base32;
 
 /**
  * @see \OTPHP\Test\TOTPTest
@@ -46,9 +45,7 @@ final class TOTP extends OTP implements TOTPInterface
         int $digits = 6,
         int $epoch = 0
     ): self {
-        $secret = Base32::encodeUpper(random_bytes(64));
-
-        return new self($secret, $period, $digest, $digits, $epoch);
+        return new self(self::generateSecret(), $period, $digest, $digits, $epoch);
     }
 
     public function getPeriod(): int