06/04 Optimize app

app/routes/auth.py

@@ -75,7 +75,7 @@ def logout():
 # ── TOTP: second-factor verification ─────────────────────────────────────────
 
 @auth_bp.route('/totp/verify', methods=['GET', 'POST'])
-@limiter.limit('10 per minute')
+@limiter.limit('10 per minute; 30 per hour')
 def totp_verify():
     pending_id = session.get('_totp_pending_id')
     if not pending_id:
@@ -102,8 +102,17 @@ def totp_verify():
             audit('login_success_2fa', f'user={user.username}')
             log.info('[auth] TOTP verified for user %s', user.username)
             return redirect(next_url)
+
         log.warning('[auth] invalid TOTP code for user %s ip=%s',
                     user.username, request.remote_addr)
+        attempts = session.get('_totp_attempts', 0) + 1
+        session['_totp_attempts'] = attempts
+        if attempts >= 5:
+            session.pop('_totp_pending_id', None)
+            session.pop('_totp_attempts', None)
+            audit('login_failed_2fa', f'user={user.username} — max attempts reached')
+            flash('Too many failed attempts. Please log in again.', 'danger')
+            return redirect(url_for('auth.login'))
         error = 'Invalid code — please try again.'
 
     return render_template('auth/totp_verify.html', error=error)
@@ -113,6 +122,7 @@ def totp_verify():
 
 @auth_bp.route('/totp/setup', methods=['GET', 'POST'])
 @login_required
+@limiter.limit('10 per minute')
 def totp_setup():
     user = current_user
 

app/routes/schwab.py

@@ -149,7 +149,7 @@ def map_accounts():
         for sa in schwab_accounts:
             val = request.form.get(f'pfm_account_{sa.id}', '')
             if val == 'new':
-                pfm_type = ACCOUNT_TYPE_MAP.get(sa.account_type, 'investment')
+                pfm_type = ACCOUNT_TYPE_MAP.get(sa.account_type, 'other')
                 new_acct = Account(
                     name=sa.account_name,
                     account_type=pfm_type,