05/02/2026 updated code for security 5

app/__init__.py

@@ -201,4 +201,32 @@ def create_app(config_name: str = 'development') -> Flask:
                 'in your production .env to enforce global rate limits.'
             )
 
+    # ── Critical config validation — all environments ──────────────────────────
+    # TOTP_ENCRYPTION_KEY is required whenever MFA is in use. Validate it at
+    # startup so a misconfiguration produces a clear error immediately rather
+    # than a cryptic RuntimeError inside a request handler hours later.
+    import logging as _startup_log
+    _slog = _startup_log.getLogger(__name__)
+    totp_key = app.config.get('TOTP_ENCRYPTION_KEY', '')
+    if not totp_key:
+        _slog.warning(
+            '[PassKeeper] TOTP_ENCRYPTION_KEY is not set. MFA setup and verification '
+            'will fail. Generate a key with: '
+            'python -c "import secrets; print(secrets.token_hex(32))" '
+            'and add it to your .env file.'
+        )
+    elif len(totp_key) != 64:
+        _slog.error(
+            '[PassKeeper] TOTP_ENCRYPTION_KEY must be exactly 64 hex characters (32 bytes). '
+            f'Current value has {len(totp_key)} characters. MFA will not function correctly.'
+        )
+    else:
+        try:
+            bytes.fromhex(totp_key)
+        except ValueError:
+            _slog.error(
+                '[PassKeeper] TOTP_ENCRYPTION_KEY contains non-hex characters. '
+                'MFA will not function correctly.'
+            )
+
     return app