Keep server data in an encrypted database, and harden every part

Storage. The server keeps its data in SQLite (a file in the data
directory, the default) or PostgreSQL (database, KEEPORG_DATABASE_URL or
-database). Every row, the KDBX versions included, is sealed with
AES-256-GCM under a key derived from the master key and named by an HMAC.
The master key is required to start and a different one is refused. A data
directory from 0.10 or earlier is imported on first start. Several servers
may share one PostgreSQL database. Go goes to 1.26 for the pure-Go
drivers (modernc.org/sqlite, jackc/pgx).

Hardening, after an audit of the server, both clients and the deployment:
- Single sign-on approves a device only after an explicit Approve in the
  browser that started it, bound by a cookie and PKCE; identities are never
  linked by username, by verified email only when allowed, never to admins.
- Sign-in attempts are limited per address and per account, passwords are
  checked outside the store lock with uniform timing, one-time codes work
  once, and starting two-factor needs the password.
- Merge vaults bound KDF parameters, payload size and XML shape, check
  pushes before storing them, and run at most two merges at once. A version
  is written in the same transaction as its metadata.
- Tokens in URLs only on the event stream, which ends on revocation; CSP,
  frame-ancestors, no-store and HSTS; sign-in CSRF; 404 for databases
  without access; new trusted_proxies.
- Clients open only the server's approval page, keep case-variant and
  retired file names apart, never overwrite a save made during a pull,
  require https except locally, send the stream token in a header, bound
  their reads and escape notifications and terminal output.
- The .deb creates the master key, systemd is sandboxed further, nginx sets
  modern TLS and HSTS, and CI deploys from main only.

Server 0.12.0, desktop 0.6.0, Android 0.4.0 (versionCode 4).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/account_test.go

@@ -13,6 +13,34 @@ import (
 	"cc.tiredsysadmin.keeporg/internal/totp"
 )
 
+// codeAt is the one-time code d steps from now. Each code is good once, so
+// a test that needs several uses inside one 30-second step takes them at
+// -1, 0 and +1, all within the accepted skew.
+func codeAt(t *testing.T, sec string, d int) string {
+	t.Helper()
+	c, err := totp.Code(sec, time.Now().Add(time.Duration(d)*30*time.Second))
+	if err != nil {
+		t.Fatal(err)
+	}
+	return c
+}
+
+// enrollTOTP turns the second factor on for the token's account, spending
+// the code one step back, and returns the secret.
+func (h *harness) enrollTOTP(t *testing.T, tok, password string) string {
+	t.Helper()
+	status, body := h.call("POST", "/api/v1/auth/totp/enroll", tok, map[string]string{"password": password})
+	if status != http.StatusOK {
+		t.Fatalf("enroll: %d %v", status, body)
+	}
+	sec := body["secret"].(string)
+	if status, body := h.call("POST", "/api/v1/auth/totp/confirm", tok,
+		map[string]string{"code": codeAt(t, sec, -1)}); status != http.StatusOK {
+		t.Fatalf("confirm: %d %v", status, body)
+	}
+	return sec
+}
+
 func sessionList(t *testing.T, h *harness, token string) []map[string]any {
 	t.Helper()
 	status, body := h.call("GET", "/api/v1/auth/sessions", token, nil)
@@ -75,16 +103,13 @@ func TestReplacingOrRemovingTheSecondFactorNeedsThePassword(t *testing.T) {
 	h := newHarness(t)
 	tok, _, _ := h.login("admin", adminPassword, "")
 
-	// Turning it on needs nothing beyond the session: it only adds a check.
-	status, body := h.call("POST", "/api/v1/auth/totp/enroll", tok, nil)
-	if status != http.StatusOK {
-		t.Fatalf("enroll: %d %v", status, body)
-	}
-	sec := body["secret"].(string)
-	code, _ := totp.Code(sec, time.Now())
-	if status, _ := h.call("POST", "/api/v1/auth/totp/confirm", tok, map[string]string{"code": code}); status != http.StatusOK {
-		t.Fatalf("confirm: %d", status)
+	// Even turning it on needs the password: on a stolen session it would
+	// lock the owner out.
+	if status, body := h.call("POST", "/api/v1/auth/totp/enroll", tok, nil); status != http.StatusForbidden {
+		t.Fatalf("enroll without the password: %d %v", status, body)
 	}
+	sec := h.enrollTOTP(t, tok, adminPassword)
+	code := codeAt(t, sec, 0)
 
 	// A session alone can no longer swap the secret or turn it off.
 	if status, body := h.call("POST", "/api/v1/auth/totp/enroll", tok, nil); status != http.StatusForbidden || body["code"] != "reauth_required" {
@@ -98,6 +123,11 @@ func TestReplacingOrRemovingTheSecondFactorNeedsThePassword(t *testing.T) {
 		map[string]string{"password": "wrong-password", "totp": code}); status != http.StatusForbidden || body["code"] != "bad_credentials" {
 		t.Fatalf("disable with a wrong password: %d %v", status, body)
 	}
+	// A wrong code reads the same as a wrong password.
+	if status, body := h.call("DELETE", "/api/v1/auth/totp", tok,
+		map[string]string{"password": adminPassword, "totp": "000000"}); status != http.StatusForbidden || body["code"] != "bad_credentials" {
+		t.Fatalf("disable with a wrong code: %d %v", status, body)
+	}
 	var on bool
 	h.srv.Store().Read(func(st *store.State) { on = st.Users["admin"].TOTPConfirmed })
 	if !on {
@@ -171,6 +201,11 @@ func TestAccountPageSetsUpTheSecondFactor(t *testing.T) {
 	csrf := b.signIn()
 
 	_, page := b.post("/web/account", url.Values{"csrf": {csrf}, "action": {"totp-begin"}})
+	if !strings.Contains(page, "Confirm with your password") {
+		t.Fatalf("set up without the password:\n%s", page)
+	}
+	_, page = b.post("/web/account", url.Values{"csrf": {csrf}, "action": {"totp-begin"},
+		"password": {adminPassword}})
 	if !strings.Contains(page, `href="otpauth://totp/`) {
 		t.Fatalf("no authenticator link:\n%s", page)
 	}
@@ -184,8 +219,7 @@ func TestAccountPageSetsUpTheSecondFactor(t *testing.T) {
 	if !strings.Contains(page, "rejected") {
 		t.Fatalf("a wrong code was not refused:\n%s", page)
 	}
-	code, _ := totp.Code(sec, time.Now())
-	_, page = b.post("/web/account", url.Values{"csrf": {csrf}, "action": {"totp-confirm"}, "code": {code}})
+	_, page = b.post("/web/account", url.Values{"csrf": {csrf}, "action": {"totp-confirm"}, "code": {codeAt(t, sec, -1)}})
 	if !strings.Contains(page, "Two-factor authentication is on") {
 		t.Fatalf("not turned on:\n%s", page)
 	}
@@ -199,7 +233,7 @@ func TestAccountPageSetsUpTheSecondFactor(t *testing.T) {
 		t.Fatalf("turned off without a code:\n%s", page)
 	}
 	_, page = b.post("/web/account", url.Values{"csrf": {csrf}, "action": {"totp-disable"},
-		"password": {adminPassword}, "totp": {code}})
+		"password": {adminPassword}, "totp": {codeAt(t, sec, 0)}})
 	if !strings.Contains(page, "Two-factor authentication is off") {
 		t.Fatalf("not turned off:\n%s", page)
 	}
@@ -257,6 +291,17 @@ func TestBrowserLabel(t *testing.T) {
 
 // makeUser adds a password account and returns a session token for it.
 func (h *harness) makeUser(name, password string) string {
+	h.t.Helper()
+	h.makeUserNoLogin(name, password)
+	tok, status, body := h.login(name, password, "")
+	if status != http.StatusOK {
+		h.t.Fatalf("login %s: %d %v", name, status, body)
+	}
+	return tok
+}
+
+// makeUserNoLogin adds a password account.
+func (h *harness) makeUserNoLogin(name, password string) {
 	h.t.Helper()
 	hash, err := secret.Hash(password)
 	if err != nil {
@@ -268,9 +313,4 @@ func (h *harness) makeUser(name, password string) string {
 	}); err != nil {
 		h.t.Fatal(err)
 	}
-	tok, status, body := h.login(name, password, "")
-	if status != http.StatusOK {
-		h.t.Fatalf("login %s: %d %v", name, status, body)
-	}
-	return tok
 }