Keep server data in an encrypted database, and harden every part

Storage. The server keeps its data in SQLite (a file in the data
directory, the default) or PostgreSQL (database, KEEPORG_DATABASE_URL or
-database). Every row, the KDBX versions included, is sealed with
AES-256-GCM under a key derived from the master key and named by an HMAC.
The master key is required to start and a different one is refused. A data
directory from 0.10 or earlier is imported on first start. Several servers
may share one PostgreSQL database. Go goes to 1.26 for the pure-Go
drivers (modernc.org/sqlite, jackc/pgx).

Hardening, after an audit of the server, both clients and the deployment:
- Single sign-on approves a device only after an explicit Approve in the
  browser that started it, bound by a cookie and PKCE; identities are never
  linked by username, by verified email only when allowed, never to admins.
- Sign-in attempts are limited per address and per account, passwords are
  checked outside the store lock with uniform timing, one-time codes work
  once, and starting two-factor needs the password.
- Merge vaults bound KDF parameters, payload size and XML shape, check
  pushes before storing them, and run at most two merges at once. A version
  is written in the same transaction as its metadata.
- Tokens in URLs only on the event stream, which ends on revocation; CSP,
  frame-ancestors, no-store and HSTS; sign-in CSRF; 404 for databases
  without access; new trusted_proxies.
- Clients open only the server's approval page, keep case-variant and
  retired file names apart, never overwrite a save made during a pull,
  require https except locally, send the stream token in a header, bound
  their reads and escape notifications and terminal output.
- The .deb creates the master key, systemd is sandboxed further, nginx sets
  modern TLS and HSTS, and CI deploys from main only.

Server 0.12.0, desktop 0.6.0, Android 0.4.0 (versionCode 4).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/account.go

@@ -27,8 +27,8 @@ var (
 	// is no password to change.
 	errNoPassword = errors.New("this account signs in through single sign-on and has no password here")
 	// errReauth asks for the password and, once enrolled, the one-time code,
-	// before a change that would weaken how the account signs in. A live
-	// session is what an unlocked laptop leaves lying around.
+	// before a change to how the account signs in. A live session is what
+	// an unlocked laptop leaves lying around.
 	errReauth = errors.New("confirm with your password and one-time code")
 )
 
@@ -104,24 +104,12 @@ func revokeOtherSessions(st *store.State, userID, keep string) int {
 	return n
 }
 
-// reauth checks the caller's password, and their one-time code when one is
-// enrolled, for a change that weakens or replaces how the account signs in.
-func reauth(st *store.State, u *store.User, password, code string) error {
-	if u.PassHash == "" {
-		return errNoPassword
-	}
-	if password == "" {
-		return errReauth
-	}
-	_, err := checkPassword(st, u.Username, password, code)
-	return err
-}
-
 // beginTOTP starts enrolling a second factor and returns its secret. Until
-// confirmTOTP sees a code from it, the account signs in as before. Replacing
-// a factor that is already active needs the password and the current code,
-// because a new secret disarms the old one.
-func beginTOTP(st *store.State, userID, password, code string) (string, error) {
+// confirmTOTP sees a code from it, the account signs in as before. The
+// caller has re-proved the password (and any current code): turning a
+// factor on from a stolen session would lock the owner out, and replacing
+// one disarms the old.
+func beginTOTP(st *store.State, userID string) (string, error) {
 	u := st.Users[userID]
 	if u == nil {
 		return "", errNoSuchSession
@@ -129,16 +117,12 @@ func beginTOTP(st *store.State, userID, password, code string) (string, error) {
 	if u.PassHash == "" {
 		return "", errNoPassword
 	}
-	if u.TOTPConfirmed {
-		if err := reauth(st, u, password, code); err != nil {
-			return "", err
-		}
-	}
-	u.TOTPSecret, u.TOTPConfirmed = totp.NewSecret(), false
+	u.TOTPSecret, u.TOTPConfirmed, u.TOTPLastStep = totp.NewSecret(), false, 0
 	return u.TOTPSecret, nil
 }
 
 // confirmTOTP turns the second factor on, once a code from it checks out.
+// That code is spent: it cannot also sign in.
 func confirmTOTP(st *store.State, userID, code string) error {
 	u := st.Users[userID]
 	if u == nil || u.TOTPSecret == "" {
@@ -147,10 +131,11 @@ func confirmTOTP(st *store.State, userID, code string) error {
 	if u.TOTPConfirmed {
 		return errors.New("the second factor is already on")
 	}
-	if !totp.Check(u.TOTPSecret, code, time.Now()) {
+	step, ok := totp.Match(u.TOTPSecret, code, time.Now())
+	if !ok {
 		return errTOTPInvalid
 	}
-	u.TOTPConfirmed = true
+	u.TOTPConfirmed, u.TOTPLastStep = true, step
 	return nil
 }
 
@@ -161,9 +146,9 @@ func cancelTOTP(st *store.State, userID string) {
 	}
 }
 
-// disableTOTP turns the second factor off, behind the password and a
-// current code.
-func disableTOTP(st *store.State, userID, password, code string) error {
+// disableTOTP turns the second factor off. The caller has re-proved the
+// password and a current code.
+func disableTOTP(st *store.State, userID string) error {
 	u := st.Users[userID]
 	if u == nil {
 		return errNoSuchSession
@@ -171,10 +156,7 @@ func disableTOTP(st *store.State, userID, password, code string) error {
 	if !u.TOTPConfirmed {
 		return errors.New("no second factor is on")
 	}
-	if err := reauth(st, u, password, code); err != nil {
-		return err
-	}
-	u.TOTPSecret, u.TOTPConfirmed = "", false
+	u.TOTPSecret, u.TOTPConfirmed, u.TOTPLastStep = "", false, 0
 	return nil
 }
 
@@ -182,6 +164,9 @@ func disableTOTP(st *store.State, userID, password, code string) error {
 // failures are 403, not 401: a client that drops its token on 401 must not
 // sign itself out over a mistyped password.
 func failAccount(w http.ResponseWriter, err error) {
+	if writeThrottled(w, err) {
+		return
+	}
 	switch {
 	case errors.Is(err, errNoSuchSession):
 		fail(w, http.StatusNotFound, "not_found", err.Error())
@@ -190,7 +175,7 @@ func failAccount(w http.ResponseWriter, err error) {
 	case errors.Is(err, errTOTPInvalid):
 		fail(w, http.StatusForbidden, "totp_invalid", "the one-time code was rejected")
 	case errors.Is(err, errBadCredentials):
-		fail(w, http.StatusForbidden, "bad_credentials", "the password is wrong")
+		fail(w, http.StatusForbidden, "bad_credentials", "the password or one-time code is wrong")
 	case errors.Is(err, errNoPassword):
 		fail(w, http.StatusConflict, "no_password", err.Error())
 	default:
@@ -228,8 +213,7 @@ func (s *Server) handleRevokeOtherSessions(w http.ResponseWriter, r *http.Reques
 	writeJSON(w, http.StatusOK, map[string]int{"revoked": n})
 }
 
-// reauthRequest is the body of a change that may need re-authentication.
-// It is optional where nothing is enrolled yet.
+// reauthRequest is the body of a change that needs re-authentication.
 type reauthRequest struct {
 	Password string `json:"password"`
 	TOTP     string `json:"totp"`
@@ -241,9 +225,9 @@ func (s *Server) handleTOTPEnroll(w http.ResponseWriter, r *http.Request, u *sto
 		return
 	}
 	var sec string
-	if err := s.st.Update(func(st *store.State) error {
+	if err := s.reconfirm(r, u, req.Password, req.TOTP, func(st *store.State, u *store.User) error {
 		var err error
-		sec, err = beginTOTP(st, u.ID, req.Password, req.TOTP)
+		sec, err = beginTOTP(st, u.ID)
 		return err
 	}); err != nil {
 		failAccount(w, err)
@@ -280,8 +264,8 @@ func (s *Server) handleTOTPDisable(w http.ResponseWriter, r *http.Request, u *st
 	if !readJSON(w, r, &req) {
 		return
 	}
-	if err := s.st.Update(func(st *store.State) error {
-		return disableTOTP(st, u.ID, req.Password, req.TOTP)
+	if err := s.reconfirm(r, u, req.Password, req.TOTP, func(st *store.State, u *store.User) error {
+		return disableTOTP(st, u.ID)
 	}); err != nil {
 		failAccount(w, err)
 		return