【安全加密】操作二次验证：短信验证码的时限校验

---验证码的签发：6 位随机与频控
function OTP.send(actor, phone)
    local player = class(actor)
    if not player then return false end
    -- 发送频控：同一账号 60 秒内只发一次
    local last = tonumber(getplayvar(actor, 2, "OTPLast")) or 0
    if os.time() - last < 60 then
        sendmsg(actor, 1, "发送过于频繁，请稍候")
        return false
    end
    local code = tostring(math.random(100000, 999999))
    setplayvar(actor, "HUMAN", "OTPCode", code, 0)
    setplayvar(actor, "HUMAN", "OTPLast", os.time(), 0)
    setplayvar(actor, "HUMAN", "OTPExpire", os.time() + 300, 0)
    Sms.send(phone, "您的验证码是 " .. code ..
        "，5 分钟内有效，请勿泄露")
    return true
end

---验证码的校验：时限、次数与销毁
function OTP.verify(actor, input)
    local player = class(actor)
    if not player then return false end
    local expire = tonumber(getplayvar(actor, 2, "OTPExpire")) or 0
    if os.time() > expire then
        sendmsg(actor, 1, "验证码已过期，请重新获取")
        return false
    end
    local fails = tonumber(getplayvar(actor, 2, "OTPFails")) or 0
    if fails >= 5 then
        sendmsg(actor, 1, "错误次数过多，请 30 分钟后再试")
        return false
    end
    local code = getplayvar(actor, 2, "OTPCode") or ""
    if input ~= code then
        setplayvar(actor, "HUMAN", "OTPFails", fails + 1, 0)
        sendmsg(actor, 1, "验证码错误，剩余 " .. (4 - fails) .. " 次")
        return false
    end
    -- 验证通过：码立即销毁，一次一用
    setplayvar(actor, "HUMAN", "OTPCode", "", 0)
    setplayvar(actor, "HUMAN", "OTPExpire", 0, 0)
    setplayvar(actor, "HUMAN", "OTPFails", 0, 0)
    return true
end