Security: Add multi-factor authentication (MFA) for user accounts

[achildrenmile]

Problem

Single-factor authentication (username/password) is vulnerable to:

• Phishing
• Credential reuse
• Password leaks

For an application handling sensitive data such as working time records, this presents a security risk.

---

Goal

Introduce optional multi-factor authentication (MFA) to significantly increase account security while keeping usability manageable.

---

MFA Scope

• MFA is optional but strongly recommended
• MFA can be enabled per user
• MFA applies to:
  • Login
  • Sensitive account actions (optional, future)

---

Supported MFA Method (Initial)

Time-based One-Time Passwords (TOTP)

• Compatible with common authenticator apps:
  • Google Authenticator
  • Microsoft Authenticator
  • Authy
• RFC 6238 compliant
• No SMS-based MFA (security reasons)

---

Enrollment Flow

1. User enables MFA in account settings
2. System generates a secret
3. QR code is displayed
4. User confirms setup by entering a valid OTP
5. MFA is marked as active

---

Login Flow with MFA

1. User logs in with username/password
2. If MFA is enabled:
   • Prompt for one-time code
3. Access is granted only after successful verification

---

Security Requirements

• MFA secrets must be stored securely
• Secrets must never be logged or exposed
• Rate limiting on MFA attempts
• MFA verification must not bypass existing session validation
• MFA can be disabled only after successful authentication

---

Recovery & Fallback

• Provide recovery codes:
  • Generated during MFA setup
  • One-time use
• Recovery codes must be stored securely (hashed)
• Clear warning that losing recovery codes may lock the account

---

Acceptance Criteria

• Users can enable and disable MFA
• MFA enrollment uses TOTP
• Login enforces MFA when enabled
• Recovery codes are generated and usable
• MFA state is clearly visible to the user
• No regression for users without MFA enabled
• Works on desktop and mobile

---

Out of Scope

• SMS-based MFA
• Hardware keys (FIDO2)
• Mandatory MFA enforcement
• MFA for API access

---

Notes

This issue establishes a secure and extensible MFA foundation.
Additional MFA methods can be added later if required.