04/18 Enhance app (security, performance)

app/routes/auth.py

@@ -13,6 +13,8 @@ from app.services.auth_service import (
     decode_token,
     blacklist_token,
     require_jwt,
+    encrypt_totp_secret,
+    decrypt_totp_secret,
 )
 
 auth_bp = Blueprint('auth', __name__)
@@ -75,6 +77,16 @@ def login():
 
     user = User.query.filter_by(email=email).first()
     if not user or not verify_auth_token(auth_hash, user.master_hash):
+        if user:
+            AuditLog.log(
+                user_id=user.id,
+                action='auth.login_failed',
+                resource_type='user',
+                resource_id=user.id,
+                detail='Failed login attempt — invalid password',
+                ip_address=_client_ip(),
+            )
+            db.session.commit()
         return jsonify({'error': 'Invalid email or password'}), 401
 
     from datetime import datetime
@@ -196,7 +208,9 @@ def mfa_enable():
     if not pyotp.TOTP(secret).verify(totp_code, valid_window=1):
         return jsonify({'error': 'Invalid verification code'}), 400
 
-    user.totp_secret = secret
+    totp_secret_enc, totp_iv = encrypt_totp_secret(secret)
+    user.totp_secret = totp_secret_enc
+    user.totp_iv = totp_iv
     user.totp_enabled = True
 
     AuditLog.log(
@@ -224,10 +238,12 @@ def mfa_disable():
     totp_code = (data.get('totp_code') or '').strip()
 
     import pyotp
-    if not pyotp.TOTP(user.totp_secret).verify(totp_code, valid_window=1):
+    plaintext_secret = decrypt_totp_secret(user.totp_secret, user.totp_iv)
+    if not pyotp.TOTP(plaintext_secret).verify(totp_code, valid_window=1):
         return jsonify({'error': 'Invalid verification code'}), 400
 
     user.totp_secret = None
+    user.totp_iv = None
     user.totp_enabled = False
 
     AuditLog.log(
@@ -264,7 +280,8 @@ def mfa_verify():
         return jsonify({'error': 'MFA not configured for this account'}), 400
 
     import pyotp
-    if not pyotp.TOTP(user.totp_secret).verify(totp_code, valid_window=1):
+    plaintext_secret = decrypt_totp_secret(user.totp_secret, user.totp_iv)
+    if not pyotp.TOTP(plaintext_secret).verify(totp_code, valid_window=1):
         return jsonify({'error': 'Invalid verification code'}), 400
 
     # One-time use: blacklist the mfa_token