fix: totp security;

Author: kpirnie

internal/auth/auth.go

@@ -48,6 +48,7 @@ type LoginResult struct {
 	SessionID    string
 	TOTPRequired bool
 	UserID       int64
+	TOTPKey      []byte
 }
 
 // isSecure reports whether the request arrived over a secure connection,
@@ -106,10 +107,22 @@ func Login(database *sql.DB, uname, password string) (*LoginResult, error) {
 		return nil, ErrInvalidCredentials
 	}
 
+	// Derive the TOTP encryption key from the password while it is still in hand
+	salt := user.TOTPSalt
+	if salt == "" {
+		if s, sErr := GenerateTOTPSalt(); sErr == nil && db.SetTOTPSalt(database, user.ID, s) == nil {
+			salt = s
+		}
+	}
+	var totpKey []byte
+	if salt != "" {
+		totpKey = DeriveTOTPKey(password, salt)
+	}
+
 	// If TOTP is enabled, signal the caller to handle the second step
 	if user.TOTPEnabled {
 		logger.Debug("TOTP required for user: %s", uname)
-		return &LoginResult{TOTPRequired: true, UserID: user.ID}, nil
+		return &LoginResult{TOTPRequired: true, UserID: user.ID, TOTPKey: totpKey}, nil
 	}
 
 	// Generate a new session ID
@@ -142,6 +155,9 @@ func Login(database *sql.DB, uname, password string) (*LoginResult, error) {
 
 	logger.Debug("User logged in: %s", uname)
 
+	// Keep the derived key in memory for the session so enrollment can encrypt immediately
+	StashTOTPKey(sessionID, totpKey, SessionDuration)
+
 	// Return the session ID to be set in the cookie
 	return &LoginResult{SessionID: sessionID}, nil
 }

internal/auth/totpcrypt.go

@@ -0,0 +1,141 @@
+// PodNest - Self-hosted site management platform
+// Copyright (c) 2026 Kevin Pirnie <iam@kevinpirnie.com>
+// Licensed under the MIT License. See LICENSE file in the project root for full license text.
+
+package auth
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"encoding/base64"
+	"errors"
+	"strings"
+	"sync"
+	"time"
+
+	"golang.org/x/crypto/argon2"
+)
+
+// totpEncPrefix marks a TOTP secret encrypted with a password-derived key
+const totpEncPrefix = "enc:pw1:"
+
+// ErrTOTPKeyUnavailable is returned when an encrypted secret cannot be decrypted
+// because the password-derived key is not in the keystore (e.g. after a restart)
+var ErrTOTPKeyUnavailable = errors.New("totp key unavailable")
+
+// totpKeyEntry holds a derived key and its expiry in the in-memory keystore
+type totpKeyEntry struct {
+	key []byte
+	exp time.Time
+}
+
+// totpKeys holds password-derived keys in memory only, keyed by pending token
+// or session ID — never persisted, so a DB read alone cannot recover secrets
+var (
+	totpKeysMu sync.Mutex
+	totpKeys   = map[string]totpKeyEntry{}
+)
+
+// StashTOTPKey stores a derived key under the given ID for the given TTL
+func StashTOTPKey(id string, key []byte, ttl time.Duration) {
+	if id == "" || key == nil {
+		return
+	}
+	totpKeysMu.Lock()
+	defer totpKeysMu.Unlock()
+
+	// prune anything expired while we hold the lock — keeps the map tiny
+	now := time.Now()
+	for k, e := range totpKeys {
+		if now.After(e.exp) {
+			delete(totpKeys, k)
+		}
+	}
+	totpKeys[id] = totpKeyEntry{key: key, exp: now.Add(ttl)}
+}
+
+// GetTOTPKey returns the derived key stashed under the given ID, or nil
+func GetTOTPKey(id string) []byte {
+	totpKeysMu.Lock()
+	defer totpKeysMu.Unlock()
+	e, ok := totpKeys[id]
+	if !ok || time.Now().After(e.exp) {
+		return nil
+	}
+	return e.key
+}
+
+// DropTOTPKey removes the derived key stashed under the given ID
+func DropTOTPKey(id string) {
+	totpKeysMu.Lock()
+	defer totpKeysMu.Unlock()
+	delete(totpKeys, id)
+}
+
+// GenerateTOTPSalt returns a random base64 salt for key derivation
+func GenerateTOTPSalt() (string, error) {
+	b := make([]byte, 16)
+	if _, err := rand.Read(b); err != nil {
+		return "", err
+	}
+	return base64.StdEncoding.EncodeToString(b), nil
+}
+
+// DeriveTOTPKey derives a 32-byte AES key from the user's password and salt
+func DeriveTOTPKey(password, salt string) []byte {
+	return argon2.IDKey([]byte(password), []byte(salt), 1, 64*1024, 4, 32)
+}
+
+// IsEncryptedTOTPSecret reports whether a stored secret is encrypted at rest
+func IsEncryptedTOTPSecret(s string) bool {
+	return strings.HasPrefix(s, totpEncPrefix)
+}
+
+// EncryptTOTPSecret encrypts a plaintext secret with the derived key using AES-256-GCM
+func EncryptTOTPSecret(key []byte, secret string) (string, error) {
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return "", err
+	}
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return "", err
+	}
+	nonce := make([]byte, gcm.NonceSize())
+	if _, err := rand.Read(nonce); err != nil {
+		return "", err
+	}
+	ct := gcm.Seal(nonce, nonce, []byte(secret), nil)
+	return totpEncPrefix + base64.StdEncoding.EncodeToString(ct), nil
+}
+
+// DecryptTOTPSecret returns the plaintext secret; unencrypted values pass through
+func DecryptTOTPSecret(key []byte, stored string) (string, error) {
+	if !IsEncryptedTOTPSecret(stored) {
+		return stored, nil
+	}
+	if key == nil {
+		return "", ErrTOTPKeyUnavailable
+	}
+	raw, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(stored, totpEncPrefix))
+	if err != nil {
+		return "", err
+	}
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return "", err
+	}
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return "", err
+	}
+	if len(raw) < gcm.NonceSize() {
+		return "", errors.New("invalid encrypted totp secret")
+	}
+	pt, err := gcm.Open(nil, raw[:gcm.NonceSize()], raw[gcm.NonceSize():], nil)
+	if err != nil {
+		return "", err
+	}
+	return string(pt), nil
+}

internal/db/db.go

@@ -90,6 +90,8 @@ func migrateColumns(db *sql.DB) error {
 		// TOTP support
 		`ALTER TABLE kppn_users ADD COLUMN totp_secret TEXT NOT NULL DEFAULT ''`,
 		`ALTER TABLE kppn_users ADD COLUMN totp_enabled INTEGER NOT NULL DEFAULT 0`,
+		// per-user salt for password-derived totp secret encryption
+		`ALTER TABLE kppn_users ADD COLUMN totp_salt TEXT NOT NULL DEFAULT ''`,
 		// Notifiy support
 		`ALTER TABLE kppn_users ADD COLUMN notify_email INTEGER NOT NULL DEFAULT 0`,
 		`ALTER TABLE kppn_users ADD COLUMN notify_sms INTEGER NOT NULL DEFAULT 0`,

internal/db/users.go

@@ -57,11 +57,11 @@ func GetUserByUsername(db *sql.DB, uname string) (*models.User, error) {
 
 	// query the database for a user matching the provided username and scan the result into the user struct
 	err := db.QueryRow(`
-		SELECT id, uname, pword, uhash, fname, lname, email, phone, role, totp_secret, totp_enabled, notify_email, notify_sms, created, updated
+		SELECT id, uname, pword, uhash, fname, lname, email, phone, role, totp_secret, totp_salt, totp_enabled, notify_email, notify_sms, created, updated
 		FROM kppn_users WHERE uname = ?`, uname,
 	).Scan(
 		&u.ID, &u.UName, &u.PWord, &u.UHash, &u.FName, &u.LName,
-		&u.Email, &u.Phone, &u.Role, &u.TOTPSecret, &u.TOTPEnabled,
+		&u.Email, &u.Phone, &u.Role, &u.TOTPSecret, &u.TOTPSalt, &u.TOTPEnabled,
 		&u.NotifyEmail, &u.NotifySMS, &u.Created, &u.Updated,
 	)
 	if err == sql.ErrNoRows {
@@ -84,11 +84,11 @@ func GetUserByID(db *sql.DB, id int64) (*models.User, error) {
 
 	// query the database for a user matching the provided ID and scan the result into the user struct
 	err := db.QueryRow(`
-		SELECT id, uname, pword, uhash, fname, lname, email, phone, role, totp_secret, totp_enabled, notify_email, notify_sms, created, updated
+		SELECT id, uname, pword, uhash, fname, lname, email, phone, role, totp_secret, totp_salt, totp_enabled, notify_email, notify_sms, created, updated
 		FROM kppn_users WHERE id = ?`, id,
 	).Scan(
 		&u.ID, &u.UName, &u.PWord, &u.UHash, &u.FName, &u.LName,
-		&u.Email, &u.Phone, &u.Role, &u.TOTPSecret, &u.TOTPEnabled,
+		&u.Email, &u.Phone, &u.Role, &u.TOTPSecret, &u.TOTPSalt, &u.TOTPEnabled,
 		&u.NotifyEmail, &u.NotifySMS, &u.Created, &u.Updated,
 	)
 	if err == sql.ErrNoRows {
@@ -202,6 +202,24 @@ func SetTOTPSecret(db *sql.DB, id int64, secret string) error {
 	return err
 }
 
+// SetTOTPSalt stores the per-user salt used for TOTP secret key derivation.
+func SetTOTPSalt(db *sql.DB, id int64, salt string) error {
+	_, err := db.Exec(`UPDATE kppn_users SET totp_salt=?, updated=datetime('now') WHERE id=?`, salt, id)
+	if err != nil {
+		logger.Error("SetTOTPSalt: failed for user %d: %v", id, err)
+	}
+	return err
+}
+
+// UpdateTOTPSecret replaces the stored TOTP secret without touching the enabled flag.
+func UpdateTOTPSecret(db *sql.DB, id int64, secret string) error {
+	_, err := db.Exec(`UPDATE kppn_users SET totp_secret=?, updated=datetime('now') WHERE id=?`, secret, id)
+	if err != nil {
+		logger.Error("UpdateTOTPSecret: failed for user %d: %v", id, err)
+	}
+	return err
+}
+
 // EnableTOTP activates TOTP for the user (secret must already be stored).
 func EnableTOTP(db *sql.DB, id int64) error {
 	_, err := db.Exec(`UPDATE kppn_users SET totp_enabled=1, updated=datetime('now') WHERE id=?`, id)

internal/handlers/users/handler.go

@@ -267,6 +267,12 @@ func (h *Handler) apiUpdateUser(w http.ResponseWriter, r *http.Request) {
 		}
 		logger.Debug("invalidating all sessions for user %d after password change", target.ID)
 		_ = db.DeleteUserSessions(h.DB, target.ID)
+
+		// the TOTP secret is encrypted with a key derived from the old password — force re-enrollment
+		if target.TOTPEnabled {
+			_ = db.DisableTOTP(h.DB, target.ID)
+			_ = db.DeleteBackupCodes(h.DB, target.ID)
+		}
 	}
 
 	logger.Debug("updated user %d: %s", target.ID, target.UName)
@@ -356,11 +362,26 @@ func (h *Handler) apiTOTPConfirm(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if !auth.VerifyTOTP(fresh.TOTPSecret, req.Code) {
+	// decrypt with the caller's password-derived key; pending secrets are stored plaintext
+	totpKey := auth.GetTOTPKey(auth.SessionFromRequest(r))
+	secret, decErr := auth.DecryptTOTPSecret(totpKey, fresh.TOTPSecret)
+	if decErr != nil {
+		apiutil.ErrorMsg(w, http.StatusBadRequest, "please log out and back in, then retry TOTP setup")
+		return
+	}
+
+	if !auth.VerifyTOTP(secret, req.Code) {
 		apiutil.ErrorMsg(w, http.StatusUnprocessableEntity, "invalid TOTP code")
 		return
 	}
 
+	// encrypt the confirmed secret with the owner's key — only when confirming our own
+	if caller.ID == target.ID && totpKey != nil && !auth.IsEncryptedTOTPSecret(fresh.TOTPSecret) {
+		if enc, encErr := auth.EncryptTOTPSecret(totpKey, fresh.TOTPSecret); encErr == nil {
+			_ = db.UpdateTOTPSecret(h.DB, target.ID, enc)
+		}
+	}
+
 	if err := db.EnableTOTP(h.DB, target.ID); err != nil {
 		logger.Error("apiTOTPConfirm: failed to enable TOTP for user %d: %v", target.ID, err)
 		apiutil.Error(w, http.StatusInternalServerError, err)

internal/models/models.go

@@ -138,6 +138,7 @@ type User struct {
 	Phone       string
 	Role        int
 	TOTPSecret  string
+	TOTPSalt    string
 	TOTPEnabled bool
 	NotifyEmail bool
 	NotifySMS   bool

internal/server/handler_ui.go

@@ -236,7 +236,17 @@ func (s *Server) handleLoginTOTP(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 
-		if !auth.VerifyTOTP(user.TOTPSecret, code) {
+		// decrypt the stored secret with the password-derived key from the login step
+		totpKey := auth.GetTOTPKey(pendingToken)
+		secret, decErr := auth.DecryptTOTPSecret(totpKey, user.TOTPSecret)
+		if decErr != nil {
+			logger.Warn("unable to decrypt TOTP secret for user %d: %v", user.ID, decErr)
+			auth.ClearTOTPPendingCookie(w)
+			http.Redirect(w, r, "/login", http.StatusSeeOther)
+			return
+		}
+
+		if !auth.VerifyTOTP(secret, code) {
 
 			// fall back to backup codes
 			used, _ := db.UseBackupCode(s.cfg.DB, user.ID, code)
@@ -271,13 +281,24 @@ func (s *Server) handleLoginTOTP(w http.ResponseWriter, r *http.Request) {
 		auth.ClearTOTPPendingCookie(w)
 		auth.RecordSuccessfulLogin(ip)
 
+		// lazily encrypt a plaintext secret now that the password-derived key is in hand
+		if totpKey != nil && !auth.IsEncryptedTOTPSecret(user.TOTPSecret) {
+			if enc, encErr := auth.EncryptTOTPSecret(totpKey, user.TOTPSecret); encErr == nil {
+				_ = db.UpdateTOTPSecret(s.cfg.DB, user.ID, enc)
+			}
+		}
+
 		sessionID, _, err := auth.CreateSession(s.cfg.DB, user.ID)
 		if err != nil {
 			logger.Error("failed to create session after TOTP for user %d: %v", user.ID, err)
 			http.Error(w, "internal error", http.StatusInternalServerError)
 			return
 		}
 
+		// hand the derived key from the pending token to the new session
+		auth.DropTOTPKey(pendingToken)
+		auth.StashTOTPKey(sessionID, totpKey, auth.SessionDuration)
+
 		logger.Debug("user '%s' completed TOTP login", user.UName)
 		// record successful TOTP login
 		audit.Record(models.AuditEntry{