TOTP

database.mjs

@@ -59,7 +59,7 @@ export function buildSeedOperations(state) {
   const nullable = value => value == null || value === '' ? null : value;
 
   add(
-    'UPDATE schema_metadata SET schema_version = 16, app_version = ?, self_registration_enabled = ?, created_at = ? WHERE id = 1',
+    'UPDATE schema_metadata SET schema_version = 17, app_version = ?, self_registration_enabled = ?, created_at = ? WHERE id = 1',
     Number(state.meta?.version || 1), state.settings?.selfRegistrationEnabled ? 1 : 0,
     state.meta?.createdAt || new Date().toISOString()
   );
@@ -471,6 +471,10 @@ function stateFromRows(rows) {
       classId: row.class_id || null,
       active: row.active == null ? true : Boolean(row.active),
       mustChangePassword: Boolean(row.must_change_password),
+      totpEnabled: Boolean(row.totp_enabled),
+      totpSecretEncrypted: row.totp_secret_encrypted || null,
+      totpRecoveryCodes: (() => { try { return JSON.parse(row.totp_recovery_codes || '[]'); } catch { return []; } })(),
+      totpLastUsedStep: row.totp_last_used_step == null ? null : Number(row.totp_last_used_step),
       archivedAt: row.archived_at || null,
       archivedBy: row.archived_by || null,
       displayName: row.display_name,
@@ -945,6 +949,17 @@ function createRepository({ client, location, read, transaction, close }) {
       if (log) operations.push(auditOperation(log));
       await transaction(operations);
     },
+    async updateTotpSecurity(user, log = null) {
+      const operations = [operation(
+        `UPDATE users SET
+          totp_enabled = ?, totp_secret_encrypted = ?, totp_recovery_codes = ?, totp_last_used_step = ?
+        WHERE id = ?`,
+        user.totpEnabled ? 1 : 0, optional(user.totpSecretEncrypted), JSON.stringify(user.totpRecoveryCodes || []),
+        optional(user.totpLastUsedStep), user.id
+      )];
+      if (log) operations.push(auditOperation(log));
+      await transaction(operations);
+    },
     async updateCandidateArchives(users, log) {
       const operations = users.map(user => operation(
         'UPDATE users SET archived_at = ?, archived_by = ? WHERE id = ?',