Allowing both config and override of allowed otp drift.

lib/two_factor_authentication.rb

@@ -10,6 +10,9 @@ require "rotp"
 module Devise
   mattr_accessor :max_login_attempts
   @@max_login_attempts = 3
+
+  mattr_accessor :allowed_otp_drift_seconds
+  @@allowed_otp_drift_seconds = 30
 end
 
 module TwoFactorAuthentication

lib/two_factor_authentication/models/two_factor_authenticatable.rb

@@ -20,17 +20,15 @@ module Devise
             end
           end
         end
-        ::Devise::Models.config(self, :max_login_attempts)
+        ::Devise::Models.config(self, :max_login_attempts, :allowed_otp_drift_seconds)
       end
 
       module InstanceMethodsOnActivation
         def authenticate_otp(code, options = {})
           totp = ROTP::TOTP.new(self.otp_column)
-          if drift = options[:drift]
+          drift = options[:drift] || self.class.allowed_otp_drift_seconds
-            totp.verify_with_drift(code, drift)
+
-          else
+          totp.verify_with_drift(code, drift)
-            totp.verify(code)
-          end
         end
 
         def otp_code(time = Time.now)