06/04 Optimize app

app/routes/auth.py

@@ -75,7 +75,7 @@ def logout():
 # ── TOTP: second-factor verification ─────────────────────────────────────────
 
 @auth_bp.route('/totp/verify', methods=['GET', 'POST'])
-@limiter.limit('10 per minute')
+@limiter.limit('10 per minute; 30 per hour')
 def totp_verify():
     pending_id = session.get('_totp_pending_id')
     if not pending_id:
@@ -102,8 +102,17 @@ def totp_verify():
             audit('login_success_2fa', f'user={user.username}')
             log.info('[auth] TOTP verified for user %s', user.username)
             return redirect(next_url)
+
         log.warning('[auth] invalid TOTP code for user %s ip=%s',
                     user.username, request.remote_addr)
+        attempts = session.get('_totp_attempts', 0) + 1
+        session['_totp_attempts'] = attempts
+        if attempts >= 5:
+            session.pop('_totp_pending_id', None)
+            session.pop('_totp_attempts', None)
+            audit('login_failed_2fa', f'user={user.username} — max attempts reached')
+            flash('Too many failed attempts. Please log in again.', 'danger')
+            return redirect(url_for('auth.login'))
         error = 'Invalid code — please try again.'
 
     return render_template('auth/totp_verify.html', error=error)
@@ -113,6 +122,7 @@ def totp_verify():
 
 @auth_bp.route('/totp/setup', methods=['GET', 'POST'])
 @login_required
+@limiter.limit('10 per minute')
 def totp_setup():
     user = current_user