Security hardening: 12 improvements across the stack

1. env.ts: APP_KEY placeholder detection with validation
2. schema.prisma: password column widened to varchar(255) for argon2id
3. auth.ts: trustHost restricted to development only
4. next.config.ts: added CSP, HSTS, X-Frame-Options, and other security headers
5. api.ts: CORS restricted to APP_URL instead of wildcard
6. register-form.tsx: migrated from REST API fetch to server action (useActionState)
7. twofactor.ts + 2fa page: TOTP recovery codes (8 one-time codes, generated and displayed)
8. register.ts: password min length 8 + complexity requirements (upper, lower, digit)
9. register.ts + help-tickets.ts + radio-shouts.ts: Zod schema validation
10. rate-limit.ts: improved periodic cleanup with aggressive eviction at 10k buckets
11. guard.ts + admin actions: rate-limited admin actions (30 req/min per staff)
12. help-tickets.ts + radio-shouts.ts: content moderation via moderateOrThrow

src/lib/auth.ts

@@ -9,8 +9,40 @@ import { prisma } from "@/lib/prisma";
 import { clientIp, rateLimit } from "@/lib/rate-limit";
 import { env } from "@/env";
 
+async function verify2faCode(userId: number, code: string): Promise<boolean> {
+  const user = await prisma.user.findUnique({
+    where: { id: userId },
+    select: { twoFactorSecret: true, twoFactorRecoveryCodes: true },
+  });
+  if (!user?.twoFactorSecret) return false;
+
+  // Try TOTP first
+  try {
+    const secret = new LaravelEncrypter(env.APP_KEY!).decrypt(user.twoFactorSecret);
+    if (verifyTotp(code, secret)) return true;
+  } catch { /* fall through to recovery */ }
+
+  // Try recovery codes
+  if (user.twoFactorRecoveryCodes) {
+    let codes: string[];
+    try { codes = JSON.parse(user.twoFactorRecoveryCodes) as string[]; } catch { return false; }
+    const idx = codes.indexOf(code);
+    if (idx !== -1) {
+      codes.splice(idx, 1);
+      const remaining = codes.length > 0 ? JSON.stringify(codes) : null;
+      await prisma.user.update({
+        where: { id: userId },
+        data: { twoFactorRecoveryCodes: remaining },
+      });
+      return true;
+    }
+  }
+
+  return false;
+}
+
 export const { handlers, signIn, signOut, auth } = NextAuth({
-  trustHost: true,
+  trustHost: process.env.NODE_ENV === "development",
   session: { strategy: "jwt", maxAge: 24 * 60 * 60 },
   pages: { signIn: "/login" },
   providers: [
@@ -52,17 +84,11 @@ export const { handlers, signIn, signOut, auth } = NextAuth({
           });
         }
 
-        // Two-factor: if enabled, a valid TOTP code is required. The secret is
-        // Laravel-encrypted with APP_KEY (fail closed if it cannot be read).
+        // Two-factor: if enabled, a valid TOTP or recovery code is required.
         if (user.twoFactorConfirmedAt && user.twoFactorSecret) {
           const code = String(credentials?.code ?? "").trim();
           if (!code || !env.APP_KEY) return null;
-          try {
-            const secret = new LaravelEncrypter(env.APP_KEY).decrypt(user.twoFactorSecret);
-            if (!verifyTotp(code, secret)) return null;
-          } catch {
-            return null;
-          }
+          if (!(await verify2faCode(user.id, code))) return null;
         }
 
         // Record the successful login for the user's "session logs" page.