25 lines
769 B
Markdown
25 lines
769 B
Markdown
# TODO: 2FA (TOTP) Integration
|
|
|
|
Goal: Add optional TOTP-based 2FA for users (admin-managed, later self-managed).
|
|
|
|
Proposed library:
|
|
- Start with a lightweight TOTP library (e.g. remotemerge/totp-php) or a more established one (e.g. spomky-labs/otphp).
|
|
|
|
Data model:
|
|
- users: totp_secret (encrypted), totp_enabled (tinyint), totp_verified_at (nullable)
|
|
- user_backup_codes: user_id, code_hash, created_at, used_at (nullable)
|
|
|
|
Admin user edit flow:
|
|
- Enable 2FA: generate secret + show QR (otpauth URI).
|
|
- Verify code to activate.
|
|
- Generate backup codes (show once).
|
|
|
|
Login flow:
|
|
- After password: prompt TOTP if totp_enabled.
|
|
- Rate-limit attempts.
|
|
|
|
Security notes:
|
|
- Encrypt secret at rest.
|
|
- Accept small time drift (+/- 1 step).
|
|
- Default to SHA-1 for compatibility.
|