OTP security hardened

backend/tests/test_user_config.py

@@ -89,6 +89,8 @@ def test_user_can_enable_and_use_otp():
     assert setup.status_code == 200
     secret = setup.json()['secret']
     assert setup.json()['otpauth_url'].startswith('otpauth://totp/')
+    recovery_codes = setup.json()['recovery_codes']
+    assert len(recovery_codes) == 10
 
     enabled = client.post('/api/user/otp', headers=headers, json={
         'action': 'enable', 'code': current_code(secret),
@@ -103,12 +105,36 @@ def test_user_can_enable_and_use_otp():
     assert otp_login.status_code == 200
 
     disabled = client.post('/api/user/otp', headers=headers, json={
-        'action': 'disable', 'code': current_code(secret),
+        'action': 'disable', 'code': current_code(secret), 'current_password': 'secret123',
     })
     assert disabled.status_code == 200
     assert disabled.json()['enabled'] is False
 
 
+def test_otp_recovery_code_requires_password_and_is_single_use():
+    login = client.post('/api/auth/login', json={'email': 'alice@example.com', 'password': 'secret123'}).json()
+    headers = {'Authorization': f"Bearer {login['access_token']}"}
+    setup = client.post('/api/user/otp/setup', headers=headers)
+    secret = setup.json()['secret']
+    recovery_code = setup.json()['recovery_codes'][0]
+    assert client.post('/api/user/otp', headers=headers, json={
+        'action': 'enable', 'code': current_code(secret),
+    }).status_code == 200
+
+    rejected = client.post('/api/user/otp/recover', headers=headers, json={
+        'current_password': 'wrong-password', 'recovery_code': recovery_code,
+    })
+    assert rejected.status_code == 400
+    recovered = client.post('/api/user/otp/recover', headers=headers, json={
+        'current_password': 'secret123', 'recovery_code': recovery_code,
+    })
+    assert recovered.status_code == 200
+    reused = client.post('/api/user/otp/recover', headers=headers, json={
+        'current_password': 'secret123', 'recovery_code': recovery_code,
+    })
+    assert reused.status_code == 400
+
+
 def test_verified_alternative_can_become_primary():
     login = client.post('/api/auth/login', json={'email': 'alice@example.com', 'password': 'secret123'}).json()
     headers = {'Authorization': f"Bearer {login['access_token']}"}