04/18 Enhance app (security, performance)

2026-04-18 13:20:04 -04:00
parent b51468661e
commit 4d3f9844f0
14 changed files with 529 additions and 7 deletions
@@ -22,7 +22,11 @@ class User(db.Model, UserMixin):
    created_at = db.Column(db.DateTime, default=datetime.utcnow, nullable=False)
    last_login = db.Column(db.DateTime, nullable=True)
    # TOTP / MFA
-    totp_secret = db.Column(db.String(64), nullable=True)
+    # totp_secret: AES-256-GCM ciphertext of the base32 TOTP secret, base64-encoded.
+    # Encrypted server-side with the TOTP_ENCRYPTION_KEY from config.
+    # totp_iv: base64-encoded 12-byte GCM nonce for the above.
+    totp_secret = db.Column(db.String(255), nullable=True)
+    totp_iv = db.Column(db.String(64), nullable=True)
    totp_enabled = db.Column(db.Boolean, default=False, nullable=False)
    # ECDH P-256 sharing keypair
    # Public key: raw uncompressed point (65 bytes), base64-encoded (~88 chars), stored plaintext