05/19 Enhance codes 5

2026-05-19 11:19:20 -04:00
parent 8ea6c8f647
commit 1a51fbb673
3 changed files with 5 additions and 3 deletions
@@ -282,6 +282,9 @@ def mfa_enable():
    if not pyotp.TOTP(secret).verify(totp_code, valid_window=1):
        return jsonify({'error': 'Invalid verification code'}), 400

+    # Encrypt the secret before replay check so totp_secret_enc/totp_iv are defined.
+    totp_secret_enc, totp_iv = encrypt_totp_secret(secret)
+
    # Prevent replay: reject a code that was already consumed within the valid window.
    # user.id is not yet persisted (MFA not enabled), so use g.current_user_id directly.
    if is_totp_code_used(g.current_user_id, totp_code):