CodeDev system / System reference

CodeDev authentication and Superadmin security

The private control-room security model: hidden route, strong passwords, TOTP MFA, recovery codes, lockouts, CSRF, session revocation, and authorization.

codedevsuperadminmfatotpcsrfauthorization

01Login flow

textAuthentication sequence

Private admin URL
   ↓
Email + password
   ↓
Pre-authentication state
   ↓
TOTP / recovery code
   ↓
Authenticated Flask-Login session
   ↓
Section/role authorization on every protected route

02Security controls

Passwords are hashed with scrypt.
TOTP secrets are stored encrypted and recovery codes are stored as hashes.
Account-level failed login/MFA/reauth counters support lockouts.
auth_version lets password/recovery/security changes invalidate existing sessions.
CSRF remains required for state-changing forms.
Admin responses use no-store/noindex controls and a private route derived from a secret seed when not explicitly configured.

03Emergency recovery

For hosts without an interactive shell, CodeDev supports a one-time environment-driven admin recovery flow. It requires an enable flag, matching account email, strong replacement password, and a fresh long nonce. Recovery resets relevant lockout/MFA state and invalidates older sessions. The temporary recovery variables should be removed immediately after successful recovery.