July 4 - Implement TOTP 2FA

app/templates/auth/profile.html

@@ -157,6 +157,48 @@
             </div>
         </div>
 
+        {% if current_user.role in ['admin', 'director'] %}
+        <!-- Two-factor authentication (phase35) -->
+        <div class="card shadow-sm mb-4">
+            <div class="card-header bg-light d-flex justify-content-between align-items-center">
+                <h6 class="mb-0 fw-semibold"><i class="bi bi-shield-lock me-1"></i>Two-Factor Authentication</h6>
+                {% if current_user.mfa_enabled %}
+                <span class="badge bg-success">Enabled</span>
+                {% else %}
+                <span class="badge bg-secondary">Disabled</span>
+                {% endif %}
+            </div>
+            <div class="card-body">
+                {% if current_user.mfa_enabled %}
+                <p class="text-muted small mb-3">
+                    Your account is protected with an authenticator app. You'll be asked
+                    for a 6-digit code each time you sign in.
+                </p>
+                <form method="POST" action="{{ url_for('auth.mfa_disable') }}"
+                      onsubmit="return confirm('Disable two-factor authentication? Your account will be less secure.');">
+                    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
+                    <label class="form-label small">Enter a current code or your password to disable:</label>
+                    <div class="input-group">
+                        <input type="text" name="code" class="form-control" placeholder="6-digit code"
+                               inputmode="numeric" autocomplete="off">
+                        <input type="password" name="password" class="form-control" placeholder="…or password"
+                               autocomplete="off">
+                        <button type="submit" class="btn btn-outline-danger">Disable 2FA</button>
+                    </div>
+                </form>
+                {% else %}
+                <p class="text-muted small mb-3">
+                    Add a second layer of security. After entering your password you'll
+                    confirm a one-time code from an authenticator app.
+                </p>
+                <a href="{{ url_for('auth.mfa_setup') }}" class="btn btn-primary">
+                    <i class="bi bi-shield-plus me-1"></i>Enable Two-Factor
+                </a>
+                {% endif %}
+            </div>
+        </div>
+        {% endif %}
+
         <!-- Recent Inspections -->
         <div class="card shadow-sm">
             <div class="card-header bg-light d-flex justify-content-between align-items-center">