CyberMind-FR 6f8a04fcad fix(users): stop leaking password hashes and TOTP secrets to any client ... GET /api/v1/users/users, /user/{username} and /export returned raw records from users.json, which holds the argon2id password hash, the TOTP *secret*, and the argon2id hashes of the TOTP backup codes. All three routes are gated by `require_jwt` — ANY authenticated account, not just an admin — so the lowest-privilege user could harvest every other account's credentials. The TOTP secret alone lets an attacker mint valid 6-digit codes forever: a complete MFA bypass. This is a privilege-escalation vector on a product whose own charter forbids secrets in clear. /export was the worst: its comment said "Remove sensitive data" while dropping only `provision_results`. A comment asserting a guarantee the code does not provide is worse than no comment — it stops reviewers from looking. Add redact_user() as the single place that decides what a client may see, and route all three through it. `totp` is kept but reduced to its non-secret metadata, and its PRESENCE is preserved: the webui shows the MFA badge on a truthiness test (`u.totp_enabled || u.totp || u.mfa_enabled`), so dropping the key would blank the badge and always emitting one would light it up for users who never enrolled. It lives in its own module rather than main.py because main.py reads the config at import, so importing it requires read access to /etc/secubox/secubox.conf — a security rule must stay testable without privileges. Verified live on gk2 across all three routes: no argon2 hash, no TOTP secret, no backup codes; totp_enabled still correct per account (admin true, gk2 and operator false). Mutation-checked: restoring the passthrough fails 5 of the 9 tests. Co-Authored-By: Gerald KERMA <devel@cybermind.fr>		2026-07-17 12:58:38 +02:00
..
__init__.py
engine.py
main.py	fix(users): stop leaking password hashes and TOTP secrets to any client	2026-07-17 12:58:38 +02:00
migrate_v1_to_v2.py
password_policy.py
redact.py	fix(users): stop leaking password hashes and TOTP secrets to any client	2026-07-17 12:58:38 +02:00
totp.py