Add TOTP 2FA to Server Fleet Hub and limit verified telemetry stream to latest 50 events

tests/test_server.py

@@ -470,6 +470,46 @@ class TestServerComponent(unittest.TestCase):
         self.assertEqual(client_data["active_seats"], 0)
         self.assertEqual(len(client_data["clients"]), 1)
 
+    def test_two_factor_auth_and_totp_flow(self):
+        """Tests TOTP secret generation, token verification, URI generation, and enable/disable lifecycle."""
+        Server.init_db(self.test_db)
+        
+        # 1. Test TOTP helpers
+        secret = Server.generate_totp_secret()
+        self.assertTrue(len(secret) >= 16)
+        token = Server.get_totp_token(secret)
+        self.assertEqual(len(token), 6)
+        self.assertTrue(token.isdigit())
+        self.assertTrue(Server.verify_totp_code(secret, token))
+        self.assertFalse(Server.verify_totp_code(secret, "000000" if token != "000000" else "999999"))
+        self.assertFalse(Server.verify_totp_code(secret, "invalid"))
+
+        # 2. Test OTPAuth URI
+        uri = Server.get_totp_uri("admin", secret, issuer="LOGAR Fleet Hub")
+        self.assertTrue(uri.startswith("otpauth://totp/"))
+        self.assertIn("secret=" + secret, uri)
+        self.assertIn("LOGAR", uri)
+
+        # 3. Test initial user 2FA status
+        info = Server.get_user_totp_info("admin", db_path=self.test_db)
+        self.assertFalse(info["enabled"])
+        self.assertEqual(info["secret"], "")
+
+        # 4. Test enabling 2FA
+        enabled = Server.enable_user_totp("admin", secret, db_path=self.test_db)
+        self.assertTrue(enabled)
+
+        info_active = Server.get_user_totp_info("admin", db_path=self.test_db)
+        self.assertTrue(info_active["enabled"])
+        self.assertEqual(info_active["secret"], secret)
+
+        # 5. Test disabling 2FA
+        disabled = Server.disable_user_totp("admin", db_path=self.test_db)
+        self.assertTrue(disabled)
+
+        info_disabled = Server.get_user_totp_info("admin", db_path=self.test_db)
+        self.assertFalse(info_disabled["enabled"])
+
 
 if __name__ == "__main__":
     unittest.main()