This PR implements Time-Based One-Time Password (TOTP) 2FA for FileBrowser, enhancing user security by requiring a verification code during login for users with 2FA enabled. It addresses multiple community requests for 2FA support.

Closes#286
Closes#1674
Closes#1827
Closes#2504
Closes#3371
Closes#3800

Description

The TOTP 2FA feature allows users to enable 2FA in their profile settings, scan a QR code or enter a Base32-encoded secret in an authenticator app (e.g., Google Authenticator), and verify codes at login. The flow is:

1. Enable 2FA in Settings > Profile > 2FA section by entering the password and receiving a QR code or secret.
2. Add the secret to an authenticator app.
3. Verify a TOTP code to activate 2FA.
4. On subsequent logins, enter a TOTP code after the password if 2FA is enabled.

Further comments

2FA could be handled by reverse proxies likeoauth2-proxy orauthelia, but this feature simplifies setup without requiring nginx/Apache knowledge.

New options

• To enable TOTP, you must configure a 32-byte encryption key in your configuration file.
  Generate a cryptographically secure 32-byte Base64-encoded key with this command:

  openssl rand -base64 32

  {"totp": {"encryption": {"key":"<32-byte-base64-encoded-string>"     }  }}

• The TOTP token expiration (default: 2 minutes) defines the validity window after initial authentication. Configure this via:

  • totp-token-expiration-time option in cli
  • totp > token > expiration > time in config file

New dependencies

• pquerna/otp on the back-end for TOTP handling
• @scure/base on the front-end for base32 encoding of TOTP secret

Localization

Added phrases toen.json but not other languages. Seek community help to translate phrases.

Improvements

1. Add rate limiting to/api/users/{id}/otp/check to prevent brute-force attacks.
2. Implement backup codes for when the authenticator device is unavailable.
3. Allow users to configure which routes require 2FA.

Documentation

While reviewing the documentation, I identified areas for improvement. Could you guide me to the documentation source (e.g., wiki repository) so I may submit updates?

🚨 Before submitting your PR, please indicate which issues are either fixed or closed by this PR. SeeGitHub Help: Closing issues using keywords.

• DO make sure you are requesting topull a topic/feature/bugfix branch (right side). Don't request your master!
• DO make sure you are making a pull request against themaster branch (left side). Also you should startyour branch offour master.
• DO make sure that File Browser can be successfully built. Seebuilds anddevelopment.
• AVOID breaking the continuous integration build.