fix(auth): encrypt secrets with AES-256-GCM and an Argon2id-derived key - #39540

Draft

bircni wants to merge 8 commits into

go-gitea:mainfrom

bircni:fix/totp-secret-pbkdf2-salt

Commits on Oct 1, 2026

fix(auth): encrypt TOTP secrets with PBKDF2 and per-user salt
bircni
committed
140b267
fix(auth): store TOTP PBKDF2 salt in Secret without a migration
bircni
committed
ef08e78

Commits on Oct 2, 2026

fix(auth): derive SECRET_KEY encryption key with Argon2id
silverwind
committed
5292ba8
refactor(auth): keep legacy TOTP decryption in the migration only
silverwind
committed
0557575
refactor(auth): move secret re-encryption migration to v29
silverwind
committed
84d0327
fix(auth): encrypt v2 secrets with AES-256-GCM
silverwind
committed
b92095a
fix(auth): keep reading legacy md5 TOTP secrets at runtime
silverwind
committed
703651d
Merge branch 'main' into fix/totp-secret-pbkdf2-salt
silverwind
authored
00eba29