Addressed SA-3 by encrypting the sqlite content with a .env secret

backend/app/api/auth.py

@@ -15,6 +15,7 @@ from backend.app.services.email_verification import verify_email
 from backend.app.services.password_reset import create_reset_token, reset_password
 from backend.app.services.token_service import issue_token, revoke_token, validate_token
 from backend.app.services.otp_service import verify_code
+from backend.app.services.secret_store import decrypt_secret
 from backend.app.services.email_addresses import verify_user_email_address
 
 router = APIRouter()
@@ -48,7 +49,7 @@ def login(payload: LoginRequest):
         raise HTTPException(status_code=401, detail='Invalid username or password')
     if not user['email_verified']:
         raise HTTPException(status_code=403, detail='Email address is not verified')
-    if user['otp_enabled'] and not verify_code(user['otp_secret'], payload.otp):
+    if user['otp_enabled'] and not verify_code(decrypt_secret(user['otp_secret']), payload.otp):
         raise HTTPException(status_code=401, detail='One-time password required or invalid')
 
     token_data = issue_token(user['id'], user['username'])