fix(ywh): accept otpauth:// URI as 2FA secret; quiet ipatool entrypoint; ulimit before useradd

- YWH 2FA: users paste the whole otpauth:// URI (or a secret=… query) from the QR
  code instead of the bare base32 seed, so TOTP generation failed with 'Non-base32
  digit found' and the account stayed INVALID. extractTOTPSecret now pulls the
  secret= value out of a URI/query before decoding. Verified live: the stored
  0x88 URI now generates a valid code and /account/totp returns a JWT. Existing
  accounts work without re-entry. UI label + test updated.
- entrypoint: stop printing 'IPATOOL_KEYCHAIN_PASSPHRASE is NOT set - iOS downloads
  will fail!' as an error when ipatool is simply unused (optional). One quiet line
  when unconfigured; only warns if partially configured.
- Dockerfile: 'ulimit -n 1024' before useradd so its file-descriptor close-loop
  can't busy-spin for minutes when the build container's nofile limit is huge.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: h0tak88r

Dockerfile

@@ -97,8 +97,12 @@ RUN mkdir -p /app/new-results /app/nuclei_templates || true
 RUN chmod +x /usr/local/bin/autoar-entrypoint \
     && echo "All modules are now Go-based - pure Go implementation" || true
 
-# Add a non-root user
-RUN useradd -m -u 10001 autoar && \
+# Add a non-root user.
+# `ulimit -n 1024` first: some libc/useradd versions loop over every possible file
+# descriptor up to the (build container's) nofile limit, which can busy-spin for
+# minutes when that limit is huge. Capping it keeps this step fast.
+RUN ulimit -n 1024 2>/dev/null || true; \
+    useradd -m -u 10001 autoar && \
     chown -R autoar:autoar /app && \
     chown autoar:autoar /usr/local/bin/autoar-entrypoint
 USER autoar

internal/api/programs_ywh_auth.go

@@ -9,6 +9,7 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"net/url"
 	"strings"
 	"sync"
 	"time"
@@ -20,8 +21,26 @@ import (
 // setting up 2FA, NOT a one-time code.
 func generateTOTP(secret string) (string, error) { return totpAt(secret, time.Now()) }
 
+// extractTOTPSecret returns the bare base32 seed from whatever the user pasted.
+// Users often paste the whole otpauth:// URI (or a "…secret=XXXX&…" query) from
+// the 2FA QR code instead of just the seed — pull the secret= value out of it.
+func extractTOTPSecret(raw string) string {
+	s := strings.TrimSpace(raw)
+	if i := strings.Index(strings.ToLower(s), "secret="); i >= 0 {
+		v := s[i+len("secret="):]
+		if j := strings.IndexAny(v, "&?#\r\n\t "); j >= 0 {
+			v = v[:j]
+		}
+		if dec, err := url.QueryUnescape(v); err == nil {
+			v = dec
+		}
+		return v
+	}
+	return s
+}
+
 func totpAt(secret string, t time.Time) (string, error) {
-	s := strings.ToUpper(strings.ReplaceAll(strings.TrimSpace(secret), " ", ""))
+	s := strings.ToUpper(strings.ReplaceAll(strings.TrimSpace(extractTOTPSecret(secret)), " ", ""))
 	if s == "" {
 		return "", fmt.Errorf("empty TOTP secret")
 	}

internal/api/programs_ywh_auth_test.go

@@ -33,3 +33,22 @@ func TestTOTPRFC6238(t *testing.T) {
 		t.Errorf("spaced/lowercase secret should parse: %v", err)
 	}
 }
+
+// TestExtractTOTPSecret covers the common mistake of pasting the whole otpauth://
+// URI (or a secret= query) instead of just the base32 seed.
+func TestExtractTOTPSecret(t *testing.T) {
+	cases := map[string]string{
+		"GEZDGNBVGY3TQOJQ": "GEZDGNBVGY3TQOJQ", // bare seed → unchanged
+		"otpauth://totp/YesWeHack:me@x.com?secret=GEZDGNBVGY3TQOJQ&issuer=YesWeHack&digits=6": "GEZDGNBVGY3TQOJQ",
+		"secret=GEZDGNBVGY3TQOJQ&period=30": "GEZDGNBVGY3TQOJQ",
+	}
+	for in, want := range cases {
+		if got := extractTOTPSecret(in); got != want {
+			t.Errorf("extractTOTPSecret(%q) = %q, want %q", in, got, want)
+		}
+	}
+	// An otpauth URI must now produce a valid code (RFC vector secret embedded).
+	if code, err := totpAt("otpauth://totp/x?secret=GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ", time.Unix(59, 0)); err != nil || code != "287082" {
+		t.Errorf("otpauth URI TOTP = %q, err=%v; want 287082", code, err)
+	}
+}

internal/api/ui/pages/settings.js

@@ -290,7 +290,7 @@
   // Friendly placeholders for account fields (esp. the YWH 2FA seed).
   const ACCT_FIELD_LABELS = {
     username: 'Username', token: 'Token', email: 'Email', password: 'Password',
-    totp_secret: '2FA secret (base32) — optional',
+    totp_secret: '2FA secret or otpauth:// URI — optional',
   };
 
   async function loadSettingsAccounts() {

internal/scanner/entrypoint/entrypoint.go

@@ -24,26 +24,16 @@ func main() {
 	os.Setenv("AUTOAR_ENV", "docker")
 	fmt.Println("[entrypoint] Configuration loaded successfully")
 
-	fmt.Println("[entrypoint] Checking IPATOOL environment variables...")
-	if val := os.Getenv("IPATOOL_EMAIL"); val != "" {
-		fmt.Printf("[entrypoint] IPATOOL_EMAIL is set (length: %d)\n", len(val))
-	} else {
-		fmt.Println("[entrypoint] IPATOOL_EMAIL is NOT set")
-	}
-	if val := os.Getenv("IPATOOL_PASSWORD"); val != "" {
-		fmt.Printf("[entrypoint] IPATOOL_PASSWORD is set (length: %d)\n", len(val))
-	} else {
-		fmt.Println("[entrypoint] IPATOOL_PASSWORD is NOT set")
-	}
-	if val := os.Getenv("IPATOOL_KEYCHAIN_PASSPHRASE"); val != "" {
-		fmt.Printf("[entrypoint] IPATOOL_KEYCHAIN_PASSPHRASE is set (length: %d)\n", len(val))
-	} else {
-		fmt.Println("[entrypoint] IPATOOL_KEYCHAIN_PASSPHRASE is NOT set - iOS downloads will fail!")
-	}
-	if val := os.Getenv("IPATOOL_AUTH_CODE"); val != "" {
-		fmt.Printf("[entrypoint] IPATOOL_AUTH_CODE is set (length: %d)\n", len(val))
-	} else {
-		fmt.Println("[entrypoint] IPATOOL_AUTH_CODE is not set (optional)")
+	// ipatool (iOS .ipa downloads) is OPTIONAL — only relevant if the operator
+	// configured IPATOOL_* credentials. Don't emit a scary "iOS downloads will
+	// fail" error line when the feature is simply unused (the common case).
+	switch {
+	case os.Getenv("IPATOOL_EMAIL") == "" && os.Getenv("IPATOOL_KEYCHAIN_PASSPHRASE") == "":
+		fmt.Println("[entrypoint] ipatool (iOS downloads) not configured — optional, skipping")
+	case os.Getenv("IPATOOL_EMAIL") != "" && os.Getenv("IPATOOL_PASSWORD") != "" && os.Getenv("IPATOOL_KEYCHAIN_PASSPHRASE") != "":
+		fmt.Println("[entrypoint] ipatool (iOS downloads) configured")
+	default:
+		fmt.Println("[entrypoint] ipatool partially configured — set IPATOOL_EMAIL, IPATOOL_PASSWORD and IPATOOL_KEYCHAIN_PASSPHRASE to enable iOS downloads")
 	}
 
 	fmt.Println("[entrypoint] Database schema initialization delegated to API/Bot startup")