Remove mastodon posts on delete and OTP

backend/app/api/user_config.py

@@ -10,6 +10,7 @@ from pydantic import BaseModel
 from backend.app.api.dependencies import get_current_user
 from backend.app.database import AVATARS_DIR, get_connection, hash_password
 from backend.app.services.link_service import create_label, delete_label, list_user_labels, update_label
+from backend.app.services.otp_service import create_secret, provisioning_uri, verify_code
 
 router = APIRouter()
 
@@ -24,6 +25,11 @@ class PasswordUpdate(BaseModel):
     new_password: str
 
 
+class OtpUpdate(BaseModel):
+    action: str
+    code: str | None = None
+
+
 class UserPluginConfigUpdate(BaseModel):
     instance: str | None = None
     access_token: str | None = None
@@ -44,7 +50,10 @@ def get_current_user_profile(user: dict = Depends(get_current_user)):
         ).fetchone()
     if row is None:
         raise HTTPException(status_code=404, detail='User not found')
-    return dict(row)
+    profile = dict(row)
+    profile.pop('otp_secret', None)
+    profile.pop('password_hash', None)
+    return profile
 
 
 @router.put('/me')
@@ -89,6 +98,37 @@ def update_password(payload: PasswordUpdate, user: dict = Depends(get_current_us
     return {'status': 'password_updated'}
 
 
+@router.get('/otp')
+def get_otp(user: dict = Depends(get_current_user)):
+    return {'enabled': bool(user['otp_enabled'])}
+
+
+@router.post('/otp/setup')
+def setup_otp(user: dict = Depends(get_current_user)):
+    if user['otp_enabled']:
+        raise HTTPException(status_code=409, detail='One-time password is already enabled')
+    secret = create_secret()
+    with get_connection() as conn:
+        conn.execute('UPDATE users SET otp_secret = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?', (secret, user['id']))
+        conn.commit()
+    return {'secret': secret, 'otpauth_url': provisioning_uri(secret, user['username'])}
+
+
+@router.post('/otp')
+def update_otp(payload: OtpUpdate, user: dict = Depends(get_current_user)):
+    if payload.action not in {'enable', 'disable'}:
+        raise HTTPException(status_code=422, detail='OTP action must be enable or disable')
+    if not verify_code(user['otp_secret'], payload.code):
+        raise HTTPException(status_code=400, detail='Invalid one-time password')
+    with get_connection() as conn:
+        if payload.action == 'enable':
+            conn.execute('UPDATE users SET otp_enabled = 1, updated_at = CURRENT_TIMESTAMP WHERE id = ?', (user['id'],))
+        else:
+            conn.execute('UPDATE users SET otp_enabled = 0, otp_secret = NULL, updated_at = CURRENT_TIMESTAMP WHERE id = ?', (user['id'],))
+        conn.commit()
+    return {'status': 'updated', 'enabled': payload.action == 'enable'}
+
+
 @router.get('/labels')
 def get_labels(user: dict = Depends(get_current_user)):
     return list_user_labels(user['id'])