Merge branch 'feature/auth-2fa-security' into main

Auth/registration/account-security overhaul: per-account lockout,
TOTP 2FA (RFC 6238) with recovery codes, trusted devices (30-day 2FA
skip), configurable email verification enforcement, and server-tracked
sessions (view/revoke/sign-out-others). Full security-settings UI and
login/OAuth 2FA challenge step.

# Conflicts:
#	JobTrackerApi/Services/StartupInitializationExtensions.cs

JobTrackerApi/Controllers/AuthController.cs

@@ -1,5 +1,6 @@
 using System.Text.Json;
 using System.Security.Claims;
+using JobTrackerApi.Data;
 using JobTrackerApi.Models;
 using JobTrackerApi.Services;
 using Microsoft.AspNetCore.Authorization;
@@ -21,8 +22,10 @@ public sealed class AuthController : ControllerBase
     private readonly IGoogleTokenValidator _googleTokens;
     private readonly IMicrosoftTokenValidator _microsoftTokens;
     private readonly ILogger<AuthController> _logger;
+    private readonly ITwoFactorPendingTokenService _twoFactorPending;
+    private readonly JobTrackerContext _db;
 
-    public AuthController(IConfiguration cfg, UserManager<ApplicationUser> users, ITokenService tokens, IAppEmailSender email, IGoogleTokenValidator googleTokens, IMicrosoftTokenValidator microsoftTokens, ILogger<AuthController> logger)
+    public AuthController(IConfiguration cfg, UserManager<ApplicationUser> users, ITokenService tokens, IAppEmailSender email, IGoogleTokenValidator googleTokens, IMicrosoftTokenValidator microsoftTokens, ILogger<AuthController> logger, ITwoFactorPendingTokenService twoFactorPending, JobTrackerContext db)
     {
         _cfg = cfg;
         _users = users;
@@ -31,6 +34,8 @@ public sealed class AuthController : ControllerBase
         _googleTokens = googleTokens;
         _microsoftTokens = microsoftTokens;
         _logger = logger;
+        _twoFactorPending = twoFactorPending;
+        _db = db;
     }
 
     [HttpGet("config")]
@@ -41,6 +46,7 @@ public sealed class AuthController : ControllerBase
         var googleEnabled = !string.IsNullOrWhiteSpace((_cfg["Auth:GoogleClientId"] ?? string.Empty).Trim());
         var microsoftEnabled = !string.IsNullOrWhiteSpace((_cfg["Auth:MicrosoftClientId"] ?? string.Empty).Trim());
         var allowRegistration = _cfg.GetValue("Auth:AllowRegistration", false);
+        var requireEmailVerification = _cfg.GetValue("Auth:RequireEmailVerification", false);
 
         return Ok(new
         {
@@ -49,12 +55,14 @@ public sealed class AuthController : ControllerBase
             microsoftEnabled,
             localEnabled = true,
             allowRegistration,
+            requireEmailVerification,
         });
     }
 
     public sealed record LoginRequest(string Email, string Password, bool RememberMe = true);
     public sealed record RegisterRequest(string Email, string Password, bool RememberMe = true);
     public sealed record AuthSessionResult(bool Authenticated, string Provider);
+    public sealed record TwoFactorRequiredResult(bool RequiresTwoFactor, string PendingToken);
     public sealed record GoogleLinkDto(bool Linked, string? Email, DateTimeOffset? LinkedAt);
     public sealed record MicrosoftLinkDto(bool Linked, string? Email, DateTimeOffset? LinkedAt);
     public sealed record MeResult(
@@ -83,7 +91,7 @@ public sealed class AuthController : ControllerBase
     [HttpPost("login")]
     [AllowAnonymous]
     [EnableRateLimiting("auth-login")]
-    public async Task<ActionResult<AuthSessionResult>> Login([FromBody] LoginRequest request, CancellationToken cancellationToken)
+    public async Task<IActionResult> Login([FromBody] LoginRequest request, CancellationToken cancellationToken)
     {
         var email = (request.Email ?? string.Empty).Trim();
         var password = request.Password ?? string.Empty;
@@ -94,17 +102,34 @@ public sealed class AuthController : ControllerBase
         var user = await _users.FindByEmailAsync(email) ?? await _users.FindByNameAsync(email);
         if (user is null) return Unauthorized();
 
-        var ok = await _users.CheckPasswordAsync(user, password);
-        if (!ok) return Unauthorized();
+        // Same generic 401 whether the account doesn't exist, is locked out, or the password is
+        // wrong -- don't let a client distinguish "locked" from "wrong password" (enumeration).
+        if (await _users.IsLockedOutAsync(user)) return Unauthorized();
 
-        await SignInWithAppSessionAsync(user, request.RememberMe, cancellationToken);
-        return Ok(new AuthSessionResult(true, "local"));
+        var ok = await _users.CheckPasswordAsync(user, password);
+        if (!ok)
+        {
+            await _users.AccessFailedAsync(user);
+            return Unauthorized();
+        }
+
+        await _users.ResetAccessFailedCountAsync(user);
+
+        // Same enumeration-avoidance discipline as the password-check branch above: this only
+        // runs once the password is already confirmed correct, so it can never be used to probe
+        // whether an email is registered.
+        if (_cfg.GetValue("Auth:RequireEmailVerification", false) && !user.EmailConfirmed)
+        {
+            return StatusCode(StatusCodes.Status403Forbidden, new { error = "email_not_verified" });
+        }
+
+        return await CompleteSignInAsync(user, request.RememberMe, "local", cancellationToken);
     }
 
     [HttpPost("register")]
     [AllowAnonymous]
     [EnableRateLimiting("auth-login")]
-    public async Task<ActionResult<AuthSessionResult>> Register([FromBody] RegisterRequest request, CancellationToken cancellationToken)
+    public async Task<IActionResult> Register([FromBody] RegisterRequest request, CancellationToken cancellationToken)
     {
         var allow = _cfg.GetValue("Auth:AllowRegistration", false);
         if (!allow) return StatusCode(403, "Registration is disabled.");
@@ -118,21 +143,35 @@ public sealed class AuthController : ControllerBase
         var existing = await _users.FindByEmailAsync(email);
         if (existing is not null) return BadRequest("User already exists.");
 
-        var user = new ApplicationUser { UserName = email, Email = email, EmailConfirmed = true };
+        var requireEmailVerification = _cfg.GetValue("Auth:RequireEmailVerification", false);
+        var user = new ApplicationUser { UserName = email, Email = email, EmailConfirmed = !requireEmailVerification };
         var res = await _users.CreateAsync(user, password);
         if (!res.Succeeded)
         {
             return BadRequest(string.Join("; ", res.Errors.Select(e => e.Description)));
         }
 
-        await SignInWithAppSessionAsync(user, request.RememberMe, cancellationToken);
-        return Ok(new AuthSessionResult(true, "local"));
+        if (requireEmailVerification)
+        {
+            try
+            {
+                await SendVerificationEmailAsync(user, cancellationToken);
+            }
+            catch (Exception ex)
+            {
+                // ponytail: don't fail registration over a flaky email send -- the account is
+                // created either way, the user can request a fresh link via resend-verification-email.
+                _logger.LogError(ex, "Failed to send verification email to {Email}", user.Email);
+            }
+        }
+
+        return await CompleteSignInAsync(user, request.RememberMe, "local", cancellationToken);
     }
 
     [HttpPost("google/exchange")]
     [AllowAnonymous]
     [EnableRateLimiting("auth-login")]
-    public async Task<ActionResult<AuthSessionResult>> ExchangeGoogleToken([FromBody] GoogleTokenRequest request, CancellationToken cancellationToken)
+    public async Task<IActionResult> ExchangeGoogleToken([FromBody] GoogleTokenRequest request, CancellationToken cancellationToken)
     {
         var token = (request.Token ?? string.Empty).Trim();
         if (token.Length == 0) return BadRequest("Google token is required.");
@@ -193,14 +232,13 @@ public sealed class AuthController : ControllerBase
             await _users.UpdateAsync(user);
         }
 
-        await SignInWithAppSessionAsync(user, request.RememberMe, cancellationToken);
-        return Ok(new AuthSessionResult(true, "google"));
+        return await CompleteSignInAsync(user, request.RememberMe, "google", cancellationToken);
     }
 
     [HttpPost("microsoft/exchange")]
     [AllowAnonymous]
     [EnableRateLimiting("auth-login")]
-    public async Task<ActionResult<AuthSessionResult>> ExchangeMicrosoftToken([FromBody] MicrosoftTokenRequest request, CancellationToken cancellationToken)
+    public async Task<IActionResult> ExchangeMicrosoftToken([FromBody] MicrosoftTokenRequest request, CancellationToken cancellationToken)
     {
         var token = (request.Token ?? string.Empty).Trim();
         if (token.Length == 0) return BadRequest("Microsoft token is required.");
@@ -261,8 +299,7 @@ public sealed class AuthController : ControllerBase
             await _users.UpdateAsync(user);
         }
 
-        await SignInWithAppSessionAsync(user, request.RememberMe, cancellationToken);
-        return Ok(new AuthSessionResult(true, "microsoft"));
+        return await CompleteSignInAsync(user, request.RememberMe, "microsoft", cancellationToken);
     }
 
     [HttpPost("logout")]
@@ -650,17 +687,112 @@ public sealed class AuthController : ControllerBase
         return NoContent();
     }
 
+    public sealed record VerifyEmailRequest(string UserId, string Token);
+
+    [HttpPost("verify-email")]
+    [AllowAnonymous]
+    [EnableRateLimiting("auth-email")]
+    public async Task<IActionResult> VerifyEmail([FromBody] VerifyEmailRequest request)
+    {
+        var userId = (request.UserId ?? string.Empty).Trim();
+        var token = request.Token ?? string.Empty;
+
+        if (userId.Length == 0) return BadRequest("UserId is required.");
+        if (token.Length == 0) return BadRequest("Token is required.");
+
+        var user = await _users.FindByIdAsync(userId);
+        if (user is null) return BadRequest("Invalid or expired link.");
+
+        var res = await _users.ConfirmEmailAsync(user, token);
+        if (!res.Succeeded)
+        {
+            return BadRequest("Invalid or expired link.");
+        }
+
+        return NoContent();
+    }
+
+    public sealed record ResendVerificationEmailRequest(string Email);
+
+    [HttpPost("resend-verification-email")]
+    [AllowAnonymous]
+    [EnableRateLimiting("auth-email")]
+    public async Task<IActionResult> ResendVerificationEmail([FromBody] ResendVerificationEmailRequest request, CancellationToken cancellationToken)
+    {
+        var email = (request.Email ?? string.Empty).Trim();
+        if (email.Length == 0) return NoContent();
+
+        // Mirrors request-password-reset's enumeration-avoidance: always NoContent, only actually
+        // send when there's a matching local account that still needs verifying.
+        var user = await _users.FindByEmailAsync(email);
+        if (user is null || user.EmailConfirmed || string.IsNullOrWhiteSpace(user.Email) || !await _users.HasPasswordAsync(user))
+        {
+            return NoContent();
+        }
+
+        try
+        {
+            await SendVerificationEmailAsync(user, cancellationToken);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Failed to send verification email to {Email}", user.Email);
+            return EmailDeliveryUnavailable("Verification email could not be sent right now. Please try again later.");
+        }
+
+        return NoContent();
+    }
+
+    private async Task SendVerificationEmailAsync(ApplicationUser user, CancellationToken cancellationToken)
+    {
+        var token = await _users.GenerateEmailConfirmationTokenAsync(user);
+
+        var baseUrl = (_cfg["App:PublicBaseUrl"] ?? string.Empty).Trim().TrimEnd('/');
+        if (string.IsNullOrWhiteSpace(baseUrl))
+        {
+            baseUrl = $"{Request.Scheme}://{Request.Host}";
+        }
+
+        var link = $"{baseUrl}/verify-email?userId={Uri.EscapeDataString(user.Id)}&token={Uri.EscapeDataString(token)}";
+
+        await _email.SendAsync(
+            user.Email!,
+            "Verify your email",
+            $"Welcome to Jobbjakt! Please verify your email address to finish setting up your account.\n\nVerification link:\n{link}\n\nIf you did not create this account, you can ignore this email.",
+            cancellationToken
+        );
+    }
+
     private IActionResult EmailDeliveryUnavailable(string detail)
     {
         return Problem(statusCode: StatusCodes.Status503ServiceUnavailable, title: "Email delivery unavailable", detail: detail);
     }
 
-    private async Task SignInWithAppSessionAsync(ApplicationUser user, bool rememberMe, CancellationToken cancellationToken)
+    // Shared by local/Google/Microsoft sign-in. If the account has TOTP 2FA enabled, this does
+    // NOT issue the real session -- it hands back a short-lived opaque pending token that only
+    // POST /api/auth/2fa/challenge can redeem, after the caller proves they hold the TOTP device
+    // (or a recovery code). This is the gate that makes 2FA actually mandatory rather than
+    // decorative: skipping straight to AppSessionIssuer here would defeat the whole feature.
+    private async Task<IActionResult> CompleteSignInAsync(ApplicationUser user, bool rememberMe, string provider, CancellationToken cancellationToken)
     {
-        var token = await _tokens.CreateAccessTokenAsync(user, cancellationToken);
-        var secure = Request.IsHttps || string.Equals(Request.Headers["X-Forwarded-Proto"], "https", StringComparison.OrdinalIgnoreCase);
-        Response.Cookies.Append(AuthSessionOptions.SessionCookieName, token, AuthSessionOptions.BuildSessionCookie(rememberMe, secure));
-        EnsureCsrfCookie(rememberMe, secure);
+        // "Trust this device" cookie check happens BEFORE the 2FA gate: if it matches a
+        // non-expired row for this exact user, skip straight to a real session, same as if 2FA
+        // weren't required at all. Falls through to the normal gate for any other outcome
+        // (no cookie, wrong user, expired, revoked) -- never errors, just doesn't skip.
+        if (user.TwoFactorEnabled && await TrustedDeviceService.IsDeviceTrustedAsync(_db, Request, user.Id, cancellationToken))
+        {
+            await AppSessionIssuer.IssueAsync(Request, Response, _tokens, _db, _cfg, user, rememberMe, cancellationToken);
+            return Ok(new AuthSessionResult(true, provider));
+        }
+
+        if (user.TwoFactorEnabled)
+        {
+            var pendingToken = _twoFactorPending.IssuePendingToken(user.Id, rememberMe);
+            return Ok(new TwoFactorRequiredResult(true, pendingToken));
+        }
+
+        await AppSessionIssuer.IssueAsync(Request, Response, _tokens, _db, _cfg, user, rememberMe, cancellationToken);
+        return Ok(new AuthSessionResult(true, provider));
     }
 
     private void EnsureCsrfCookie(bool persistent, bool? secureOverride = null)

JobTrackerApi/Controllers/SessionsController.cs

@@ -0,0 +1,104 @@
+using JobTrackerApi.Data;
+using JobTrackerApi.Models;
+using JobTrackerApi.Services;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Identity;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+
+namespace JobTrackerApi.Controllers;
+
+// List/revoke the server-tracked UserSession rows behind the JWTs AppSessionIssuer hands out.
+// Not 2FA-specific (any local-auth user has sessions, 2FA or not), hence its own small controller
+// rather than folding into TwoFactorController.
+[ApiController]
+[Route("api/auth/sessions")]
+[Authorize(AuthenticationSchemes = "local")]
+public sealed class SessionsController : ControllerBase
+{
+    private readonly UserManager<ApplicationUser> _users;
+    private readonly JobTrackerContext _db;
+
+    public SessionsController(UserManager<ApplicationUser> users, JobTrackerContext db)
+    {
+        _users = users;
+        _db = db;
+    }
+
+    public sealed record SessionDto(string Id, string? DeviceLabel, DateTimeOffset CreatedAtUtc, DateTimeOffset LastSeenAtUtc, DateTimeOffset ExpiresAtUtc, bool IsCurrentSession);
+
+    private string? CurrentSid => User.FindFirst("sid")?.Value;
+
+    [HttpGet]
+    public async Task<IActionResult> List(CancellationToken cancellationToken)
+    {
+        var user = await _users.GetUserAsync(User);
+        if (user is null) return Unauthorized();
+
+        var now = DateTimeOffset.UtcNow;
+        var currentSid = CurrentSid;
+        // IgnoreQueryFilters + an explicit UserId filter, same convention as
+        // TrustedDeviceService/TwoFactorController's device-list queries.
+        // Equality-only in the DB query, then filter/sort DateTimeOffset client-side: SQLite's EF
+        // Core provider cannot translate ">" or ORDER BY over DateTimeOffset to SQL ("SQLite does
+        // not support expressions of type 'DateTimeOffset' in ORDER BY clauses"), so ExpiresAtUtc
+        // comparison and the LastSeenAtUtc sort have to happen after materializing the (small,
+        // per-user) row set.
+        var candidates = await _db.UserSessions.IgnoreQueryFilters()
+            .Where(x => x.UserId == user.Id && x.RevokedAtUtc == null)
+            .ToListAsync(cancellationToken);
+
+        var sessions = candidates
+            .Where(x => x.ExpiresAtUtc > now)
+            .OrderByDescending(x => x.LastSeenAtUtc)
+            .Select(x => new SessionDto(x.Id, x.DeviceLabel, x.CreatedAtUtc, x.LastSeenAtUtc, x.ExpiresAtUtc, x.Id == currentSid))
+            .ToList();
+
+        return Ok(sessions);
+    }
+
+    [HttpDelete("{id}")]
+    public async Task<IActionResult> Revoke(string id, CancellationToken cancellationToken)
+    {
+        var user = await _users.GetUserAsync(User);
+        if (user is null) return Unauthorized();
+
+        var session = await _db.UserSessions.IgnoreQueryFilters().FirstOrDefaultAsync(x => x.Id == id && x.UserId == user.Id, cancellationToken);
+        if (session is null) return NotFound();
+
+        session.RevokedAtUtc = DateTimeOffset.UtcNow;
+        await _db.SaveChangesAsync(cancellationToken);
+
+        if (string.Equals(id, CurrentSid, StringComparison.Ordinal))
+        {
+            var secure = Request.IsHttps || string.Equals(Request.Headers["X-Forwarded-Proto"], "https", StringComparison.OrdinalIgnoreCase);
+            Response.Cookies.Delete(AuthSessionOptions.SessionCookieName, AuthSessionOptions.BuildExpiredCookie(secure));
+        }
+
+        return NoContent();
+    }
+
+    [HttpPost("revoke-others")]
+    public async Task<IActionResult> RevokeOthers(CancellationToken cancellationToken)
+    {
+        var user = await _users.GetUserAsync(User);
+        if (user is null) return Unauthorized();
+
+        var currentSid = CurrentSid;
+        var now = DateTimeOffset.UtcNow;
+        var others = await _db.UserSessions.IgnoreQueryFilters()
+            .Where(x => x.UserId == user.Id && x.RevokedAtUtc == null && x.Id != currentSid)
+            .ToListAsync(cancellationToken);
+
+        foreach (var session in others)
+        {
+            session.RevokedAtUtc = now;
+        }
+        if (others.Count > 0)
+        {
+            await _db.SaveChangesAsync(cancellationToken);
+        }
+
+        return NoContent();
+    }
+}

JobTrackerApi/Controllers/TwoFactorController.cs

@@ -0,0 +1,341 @@
+using System.Security.Cryptography;
+using System.Text;
+using JobTrackerApi.Data;
+using JobTrackerApi.Models;
+using JobTrackerApi.Services;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.DataProtection;
+using Microsoft.AspNetCore.Identity;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.RateLimiting;
+using Microsoft.EntityFrameworkCore;
+using OtpNet;
+using QRCoder;
+
+namespace JobTrackerApi.Controllers;
+
+// TOTP 2FA (RFC 6238) + recovery codes. Split out from AuthController (already 700+ lines)
+// rather than growing it further; shares the session cookie logic via AppSessionIssuer and the
+// pending-token handoff via ITwoFactorPendingTokenService.
+[ApiController]
+[Route("api/auth/2fa")]
+public sealed class TwoFactorController : ControllerBase
+{
+    private const int RecoveryCodeCount = 10;
+
+    private readonly UserManager<ApplicationUser> _users;
+    private readonly ITokenService _tokens;
+    private readonly JobTrackerContext _db;
+    private readonly ITwoFactorPendingTokenService _pending;
+    private readonly IDataProtector _protector;
+    private readonly IConfiguration _cfg;
+
+    public TwoFactorController(UserManager<ApplicationUser> users, ITokenService tokens, JobTrackerContext db, ITwoFactorPendingTokenService pending, IDataProtectionProvider protectionProvider, IConfiguration cfg)
+    {
+        _users = users;
+        _tokens = tokens;
+        _db = db;
+        _pending = pending;
+        _protector = protectionProvider.CreateProtector("totp-secret-v1");
+        _cfg = cfg;
+    }
+
+    public sealed record PasswordConfirmRequest(string CurrentPassword);
+    public sealed record SetupResult(string ManualEntryKey, string QrCodeDataUrl);
+    public sealed record VerifySetupRequest(string Code);
+    public sealed record VerifySetupResult(bool Enabled, IReadOnlyList<string> RecoveryCodes);
+    public sealed record StatusResult(bool Enabled, DateTimeOffset? EnabledAtUtc);
+    public sealed record RecoveryCodesResult(IReadOnlyList<string> RecoveryCodes);
+    public sealed record ChallengeRequest(string PendingToken, string Code, bool TrustDevice = false);
+    public sealed record TrustedDeviceDto(int Id, string? DeviceLabel, DateTimeOffset CreatedAtUtc, DateTimeOffset LastSeenAtUtc, DateTimeOffset ExpiresAtUtc, bool IsCurrentDevice);
+
+    [HttpPost("setup")]
+    [Authorize(AuthenticationSchemes = "local")]
+    [EnableRateLimiting("auth-login")]
+    public async Task<IActionResult> Setup([FromBody] PasswordConfirmRequest request, CancellationToken cancellationToken)
+    {
+        var user = await _users.GetUserAsync(User);
+        if (user is null) return Unauthorized();
+
+        if (!await _users.CheckPasswordAsync(user, request.CurrentPassword ?? string.Empty))
+        {
+            return BadRequest("Current password is incorrect.");
+        }
+
+        var secretBytes = KeyGeneration.GenerateRandomKey(20);
+        var base32Secret = Base32Encoding.ToString(secretBytes);
+
+        user.TotpPendingSecretEncrypted = _protector.Protect(base32Secret);
+        var result = await _users.UpdateAsync(user);
+        if (!result.Succeeded)
+        {
+            return BadRequest(string.Join("; ", result.Errors.Select(e => e.Description)));
+        }
+
+        var issuer = "JobTracker";
+        var label = Uri.EscapeDataString($"{issuer}:{user.Email}");
+        var otpauthUri = $"otpauth://totp/{label}?secret={base32Secret}&issuer={Uri.EscapeDataString(issuer)}&digits=6&period=30";
+
+        using var qrGenerator = new QRCodeGenerator();
+        using var qrData = qrGenerator.CreateQrCode(otpauthUri, QRCodeGenerator.ECCLevel.Q);
+        var pngQr = new PngByteQRCode(qrData);
+        var qrPngBytes = pngQr.GetGraphic(10);
+        var qrDataUrl = $"data:image/png;base64,{Convert.ToBase64String(qrPngBytes)}";
+
+        return Ok(new SetupResult(base32Secret, qrDataUrl));
+    }
+
+    [HttpPost("verify-setup")]
+    [Authorize(AuthenticationSchemes = "local")]
+    [EnableRateLimiting("auth-login")]
+    public async Task<IActionResult> VerifySetup([FromBody] VerifySetupRequest request, CancellationToken cancellationToken)
+    {
+        var user = await _users.GetUserAsync(User);
+        if (user is null) return Unauthorized();
+
+        if (string.IsNullOrWhiteSpace(user.TotpPendingSecretEncrypted))
+        {
+            return BadRequest("No pending 2FA setup. Call setup first.");
+        }
+
+        var base32Secret = _protector.Unprotect(user.TotpPendingSecretEncrypted);
+        if (!VerifyCode(base32Secret, request.Code))
+        {
+            return Unauthorized();
+        }
+
+        user.TotpSecretEncrypted = user.TotpPendingSecretEncrypted;
+        user.TotpPendingSecretEncrypted = null;
+        user.TwoFactorEnabled = true;
+        user.TotpEnabledAtUtc = DateTimeOffset.UtcNow;
+
+        var result = await _users.UpdateAsync(user);
+        if (!result.Succeeded)
+        {
+            return BadRequest(string.Join("; ", result.Errors.Select(e => e.Description)));
+        }
+
+        var codes = await RegenerateRecoveryCodesAsync(user.Id, cancellationToken);
+        return Ok(new VerifySetupResult(true, codes));
+    }
+
+    [HttpPost("disable")]
+    [Authorize(AuthenticationSchemes = "local")]
+    [EnableRateLimiting("auth-login")]
+    public async Task<IActionResult> Disable([FromBody] PasswordConfirmRequest request, CancellationToken cancellationToken)
+    {
+        var user = await _users.GetUserAsync(User);
+        if (user is null) return Unauthorized();
+
+        if (!await _users.CheckPasswordAsync(user, request.CurrentPassword ?? string.Empty))
+        {
+            return BadRequest("Current password is incorrect.");
+        }
+
+        user.TotpSecretEncrypted = null;
+        user.TotpPendingSecretEncrypted = null;
+        user.TwoFactorEnabled = false;
+        user.TotpEnabledAtUtc = null;
+
+        var result = await _users.UpdateAsync(user);
+        if (!result.Succeeded)
+        {
+            return BadRequest(string.Join("; ", result.Errors.Select(e => e.Description)));
+        }
+
+        await RemoveAllRecoveryCodesAsync(user.Id, cancellationToken);
+        return NoContent();
+    }
+
+    [HttpGet("status")]
+    [Authorize(AuthenticationSchemes = "local")]
+    public async Task<IActionResult> Status()
+    {
+        var user = await _users.GetUserAsync(User);
+        if (user is null) return Unauthorized();
+
+        return Ok(new StatusResult(user.TwoFactorEnabled, user.TotpEnabledAtUtc));
+    }
+
+    [HttpPost("recovery-codes/regenerate")]
+    [Authorize(AuthenticationSchemes = "local")]
+    [EnableRateLimiting("auth-login")]
+    public async Task<IActionResult> RegenerateRecoveryCodes([FromBody] PasswordConfirmRequest request, CancellationToken cancellationToken)
+    {
+        var user = await _users.GetUserAsync(User);
+        if (user is null) return Unauthorized();
+
+        if (!user.TwoFactorEnabled)
+        {
+            return BadRequest("Two-factor authentication is not enabled.");
+        }
+
+        if (!await _users.CheckPasswordAsync(user, request.CurrentPassword ?? string.Empty))
+        {
+            return BadRequest("Current password is incorrect.");
+        }
+
+        var codes = await RegenerateRecoveryCodesAsync(user.Id, cancellationToken);
+        return Ok(new RecoveryCodesResult(codes));
+    }
+
+    [HttpPost("challenge")]
+    [AllowAnonymous]
+    [EnableRateLimiting("auth-2fa-challenge")]
+    public async Task<IActionResult> Challenge([FromBody] ChallengeRequest request, CancellationToken cancellationToken)
+    {
+        var pendingToken = (request.PendingToken ?? string.Empty).Trim();
+        var code = (request.Code ?? string.Empty).Trim();
+        if (pendingToken.Length == 0 || code.Length == 0) return Unauthorized();
+
+        // Peek without consuming: only burn the pending token once the code actually checks out,
+        // so a mistyped code doesn't force the user back through password login.
+        var session = _pending.Resolve(pendingToken, consume: false);
+        if (session is null) return Unauthorized();
+
+        var user = await _users.FindByIdAsync(session.UserId);
+        if (user is null || !user.TwoFactorEnabled || string.IsNullOrWhiteSpace(user.TotpSecretEncrypted))
+        {
+            return Unauthorized();
+        }
+
+        var base32Secret = _protector.Unprotect(user.TotpSecretEncrypted);
+        var verified = VerifyCode(base32Secret, code) || await TryConsumeRecoveryCodeAsync(user.Id, code, cancellationToken);
+        if (!verified) return Unauthorized();
+
+        _pending.Resolve(pendingToken, consume: true);
+        await AppSessionIssuer.IssueAsync(Request, Response, _tokens, _db, _cfg, user, session.RememberMe, cancellationToken);
+
+        if (request.TrustDevice)
+        {
+            await TrustedDeviceService.IssueAsync(_db, Request, Response, user.Id, cancellationToken);
+        }
+
+        return Ok(new AuthController.AuthSessionResult(true, "local"));
+    }
+
+    [HttpGet("trusted-devices")]
+    [Authorize(AuthenticationSchemes = "local")]
+    public async Task<IActionResult> ListTrustedDevices(CancellationToken cancellationToken)
+    {
+        var user = await _users.GetUserAsync(User);
+        if (user is null) return Unauthorized();
+
+        var currentHash = TrustedDeviceService.CurrentDeviceTokenHash(Request);
+        // SQLite/Pomelo cannot translate DateTimeOffset ORDER BY to SQL (same issue as the
+        // expiry check in TrustedDeviceService), so sort after materializing.
+        var devices = await _db.TrustedDevices
+            .Where(x => x.UserId == user.Id)
+            .Select(x => new TrustedDeviceDto(x.Id, x.DeviceLabel, x.CreatedAtUtc, x.LastSeenAtUtc, x.ExpiresAtUtc, currentHash != null && x.TokenHash == currentHash))
+            .ToListAsync(cancellationToken);
+
+        return Ok(devices.OrderByDescending(x => x.LastSeenAtUtc).ToList());
+    }
+
+    [HttpDelete("trusted-devices/{id:int}")]
+    [Authorize(AuthenticationSchemes = "local")]
+    public async Task<IActionResult> RevokeTrustedDevice(int id, CancellationToken cancellationToken)
+    {
+        var user = await _users.GetUserAsync(User);
+        if (user is null) return Unauthorized();
+
+        var device = await _db.TrustedDevices.FirstOrDefaultAsync(x => x.Id == id && x.UserId == user.Id, cancellationToken);
+        if (device is null) return NotFound();
+
+        var currentHash = TrustedDeviceService.CurrentDeviceTokenHash(Request);
+        var isCurrentDevice = currentHash != null && string.Equals(device.TokenHash, currentHash, StringComparison.Ordinal);
+
+        _db.TrustedDevices.Remove(device);
+        await _db.SaveChangesAsync(cancellationToken);
+
+        if (isCurrentDevice)
+        {
+            TrustedDeviceService.ClearCookie(Request, Response);
+        }
+
+        return NoContent();
+    }
+
+    [HttpPost("trusted-devices/revoke-all")]
+    [Authorize(AuthenticationSchemes = "local")]
+    public async Task<IActionResult> RevokeAllTrustedDevices(CancellationToken cancellationToken)
+    {
+        var user = await _users.GetUserAsync(User);
+        if (user is null) return Unauthorized();
+
+        var devices = await _db.TrustedDevices.Where(x => x.UserId == user.Id).ToListAsync(cancellationToken);
+        if (devices.Count > 0)
+        {
+            _db.TrustedDevices.RemoveRange(devices);
+            await _db.SaveChangesAsync(cancellationToken);
+        }
+
+        TrustedDeviceService.ClearCookie(Request, Response);
+        return NoContent();
+    }
+
+    private static bool VerifyCode(string base32Secret, string? code)
+    {
+        code = (code ?? string.Empty).Trim();
+        if (code.Length == 0) return false;
+
+        var totp = new Totp(Base32Encoding.ToBytes(base32Secret));
+        // +-1 step (30s) of drift, the RFC 6238 standard tolerance for clock skew between the
+        // authenticator app and the server.
+        return totp.VerifyTotp(code, out _, new VerificationWindow(1, 1));
+    }
+
+    private async Task<bool> TryConsumeRecoveryCodeAsync(string userId, string code, CancellationToken cancellationToken)
+    {
+        var hash = HashRecoveryCode(code);
+        var match = await _db.TwoFactorRecoveryCodes
+            .IgnoreQueryFilters()
+            .FirstOrDefaultAsync(x => x.UserId == userId && x.CodeHash == hash && x.UsedAtUtc == null, cancellationToken);
+        if (match is null) return false;
+
+        match.UsedAtUtc = DateTimeOffset.UtcNow;
+        await _db.SaveChangesAsync(cancellationToken);
+        return true;
+    }
+
+    private async Task<IReadOnlyList<string>> RegenerateRecoveryCodesAsync(string userId, CancellationToken cancellationToken)
+    {
+        await RemoveAllRecoveryCodesAsync(userId, cancellationToken);
+
+        var now = DateTimeOffset.UtcNow;
+        var plainCodes = new List<string>(RecoveryCodeCount);
+        var rows = new List<TwoFactorRecoveryCode>(RecoveryCodeCount);
+        for (var i = 0; i < RecoveryCodeCount; i++)
+        {
+            var plain = GenerateRecoveryCode();
+            plainCodes.Add(plain);
+            rows.Add(new TwoFactorRecoveryCode { UserId = userId, CodeHash = HashRecoveryCode(plain), CreatedAtUtc = now });
+        }
+
+        _db.TwoFactorRecoveryCodes.AddRange(rows);
+        await _db.SaveChangesAsync(cancellationToken);
+        return plainCodes;
+    }
+
+    private async Task RemoveAllRecoveryCodesAsync(string userId, CancellationToken cancellationToken)
+    {
+        var existing = await _db.TwoFactorRecoveryCodes.IgnoreQueryFilters().Where(x => x.UserId == userId).ToListAsync(cancellationToken);
+        if (existing.Count == 0) return;
+        _db.TwoFactorRecoveryCodes.RemoveRange(existing);
+        await _db.SaveChangesAsync(cancellationToken);
+    }
+
+    private static string GenerateRecoveryCode()
+    {
+        var hex = Convert.ToHexString(RandomNumberGenerator.GetBytes(5)).ToLowerInvariant(); // 10 hex chars, 40 bits
+        return $"{hex[..5]}-{hex[5..]}";
+    }
+
+    // ponytail: recovery codes are already random high-entropy tokens (not user-chosen
+    // passwords), so a plain SHA-256 hash is sufficient -- no per-code salt or PBKDF2 needed.
+    private static string HashRecoveryCode(string code)
+    {
+        var normalized = code.Trim().ToLowerInvariant();
+        return Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes(normalized))).ToLowerInvariant();
+    }
+}

JobTrackerApi/Program.cs

@@ -183,12 +183,16 @@ builder.Services.AddIdentityCore<ApplicationUser>(options =>
         options.Password.RequireUppercase = false;
         options.Password.RequireNonAlphanumeric = false;
         options.Password.RequiredLength = 8;
+        options.Lockout.DefaultLockoutTimeSpan = TimeSpan.FromMinutes(15);
+        options.Lockout.MaxFailedAccessAttempts = 5;
+        options.Lockout.AllowedForNewUsers = true;
     })
     .AddRoles<IdentityRole>()
     .AddEntityFrameworkStores<JobTrackerContext>()
     .AddSignInManager();
 
 builder.Services.AddScoped<ITokenService, TokenService>();
+builder.Services.AddSingleton<ITwoFactorPendingTokenService, TwoFactorPendingTokenService>();
 
 builder.Services.AddSingleton<UniversalJobParser>();
 builder.Services.AddSingleton<IHostAddressResolver, DnsHostAddressResolver>();
@@ -282,16 +286,29 @@ builder.Services.AddAuthentication(options =>
 
                 return Task.CompletedTask;
             },
-            OnTokenValidated = context =>
+            OnTokenValidated = async context =>
             {
                 var userId = LocalAuthIdentity.GetRequiredUserId(context.Principal);
-                if (userId is not null)
+                if (userId is null)
                 {
-                    return Task.CompletedTask;
+                    context.Fail("Local tokens must include a subject/nameidentifier claim.");
+                    return;
                 }
 
-                context.Fail("Local tokens must include a subject/nameidentifier claim.");
-                return Task.CompletedTask;
+                // Resolve a fresh scoped JobTrackerContext for this one lookup -- OnTokenValidated
+                // runs outside the request's normal DI-constructor scope, so RequestServices (the
+                // per-request scope) must be used directly rather than a captured/singleton one.
+                // Fail closed if the session row is missing/revoked/expired (including tokens
+                // with no "sid" claim at all -- see LocalSessionValidator for why: every JWT
+                // issued going forward carries one, so a token without it is either pre-deploy
+                // (forces a single re-login for anyone already signed in when this ships --
+                // acceptable, same additive-forward cost the 2FA/trusted-device features on this
+                // branch already paid) or forged, and either way isn't proof of a live session.
+                var db = context.HttpContext.RequestServices.GetRequiredService<JobTrackerContext>();
+                if (!await LocalSessionValidator.IsValidAsync(db, context.Principal, DateTimeOffset.UtcNow))
+                {
+                    context.Fail("Session has been revoked or expired.");
+                }
             }
         };
         options.TokenValidationParameters = new TokenValidationParameters
@@ -378,6 +395,19 @@ builder.Services.AddRateLimiter(options =>
                 QueueProcessingOrder = QueueProcessingOrder.OldestFirst,
                 QueueLimit = 0,
             }));
+
+    // Brute-forcing a 6-digit TOTP code (1e6 space) is far more feasible than a password, so
+    // this gets a tighter window than auth-login.
+    options.AddPolicy("auth-2fa-challenge", context =>
+        RateLimitPartition.GetFixedWindowLimiter(
+            partitionKey: $"2fa:{context.Connection.RemoteIpAddress?.ToString() ?? "unknown"}",
+            factory: _ => new FixedWindowRateLimiterOptions
+            {
+                PermitLimit = 5,
+                Window = TimeSpan.FromMinutes(5),
+                QueueProcessingOrder = QueueProcessingOrder.OldestFirst,
+                QueueLimit = 0,
+            }));
 });
 
 var app = builder.Build();

JobTrackerApi/Services/AppSessionIssuer.cs

@@ -0,0 +1,41 @@
+using System.Security.Cryptography;
+using JobTrackerApi.Data;
+using JobTrackerApi.Models;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Configuration;
+
+namespace JobTrackerApi.Services;
+
+// Shared by AuthController (local/Google/Microsoft sign-in) and TwoFactorController (the
+// post-challenge sign-in) so the httpOnly session cookie + readable CSRF cookie are always
+// issued the same way, from one place. Also the single place a UserSession row is created, so
+// every JWT this app ever hands out has a matching server-side row Program.cs can revoke.
+public static class AppSessionIssuer
+{
+    public static async Task IssueAsync(HttpRequest request, HttpResponse response, ITokenService tokens, JobTrackerContext db, IConfiguration cfg, ApplicationUser user, bool rememberMe, CancellationToken cancellationToken)
+    {
+        var minutes = cfg.GetValue("Auth:JwtExpiresMinutes", 60 * 12);
+        if (minutes < 5) minutes = 5;
+        if (minutes > 60 * 24 * 30) minutes = 60 * 24 * 30;
+
+        var now = DateTimeOffset.UtcNow;
+        var session = new UserSession
+        {
+            Id = Guid.NewGuid().ToString("N"),
+            UserId = user.Id,
+            DeviceLabel = TrustedDeviceService.DescribeUserAgent(request.Headers["User-Agent"].ToString()),
+            CreatedAtUtc = now,
+            LastSeenAtUtc = now,
+            ExpiresAtUtc = now.AddMinutes(minutes),
+        };
+        db.UserSessions.Add(session);
+        await db.SaveChangesAsync(cancellationToken);
+
+        var token = await tokens.CreateAccessTokenAsync(user, session.Id, cancellationToken);
+        var secure = request.IsHttps || string.Equals(request.Headers["X-Forwarded-Proto"], "https", StringComparison.OrdinalIgnoreCase);
+        response.Cookies.Append(AuthSessionOptions.SessionCookieName, token, AuthSessionOptions.BuildSessionCookie(rememberMe, secure));
+
+        var csrf = Convert.ToHexString(RandomNumberGenerator.GetBytes(32)).ToLowerInvariant();
+        response.Cookies.Append(AuthSessionOptions.CsrfCookieName, csrf, AuthSessionOptions.BuildCsrfCookie(rememberMe, secure));
+    }
+}

JobTrackerApi/Services/AuthSessionOptions.cs

@@ -7,6 +7,7 @@ public static class AuthSessionOptions
     public const string SessionCookieName = "jobtracker_auth";
     public const string CsrfCookieName = "XSRF-TOKEN";
     public const string CsrfHeaderName = "X-CSRF-TOKEN";
+    public const string TrustedDeviceCookieName = "jobtracker_td";
 
     public static CookieOptions BuildSessionCookie(bool persistent, bool secure)
     {
@@ -75,4 +76,35 @@ public static class AuthSessionOptions
             MaxAge = TimeSpan.Zero,
         };
     }
+
+    // Stricter than the session cookie (SameSite=Strict, never HttpOnly=false): this cookie's
+    // only job is "skip the 2FA prompt", so it must never be readable by JS and should not even
+    // be sent on cross-site navigations.
+    public static CookieOptions BuildTrustedDeviceCookie(bool secure)
+    {
+        return new CookieOptions
+        {
+            HttpOnly = true,
+            IsEssential = true,
+            SameSite = SameSiteMode.Strict,
+            Secure = secure,
+            Path = "/",
+            Expires = DateTimeOffset.UtcNow.AddDays(30),
+            MaxAge = TimeSpan.FromDays(30),
+        };
+    }
+
+    public static CookieOptions BuildExpiredTrustedDeviceCookie(bool secure)
+    {
+        return new CookieOptions
+        {
+            HttpOnly = true,
+            IsEssential = true,
+            SameSite = SameSiteMode.Strict,
+            Secure = secure,
+            Path = "/",
+            Expires = DateTimeOffset.UnixEpoch,
+            MaxAge = TimeSpan.Zero,
+        };
+    }
 }

JobTrackerApi/Services/LocalSessionValidator.cs

@@ -0,0 +1,30 @@
+using System.Security.Claims;
+using JobTrackerApi.Data;
+using Microsoft.EntityFrameworkCore;
+
+namespace JobTrackerApi.Services;
+
+// The actual revocation check behind Program.cs's "local" JwtBearer OnTokenValidated. Pulled out
+// of Program.cs so it's unit-testable without standing up a full TestServer/HTTP pipeline.
+public static class LocalSessionValidator
+{
+    public static async Task<bool> IsValidAsync(JobTrackerContext db, ClaimsPrincipal? principal, DateTimeOffset now, CancellationToken cancellationToken = default)
+    {
+        var sid = principal?.FindFirst("sid")?.Value;
+        // Fail closed: see the comment on the OnTokenValidated wiring in Program.cs for why a
+        // missing sid is rejected rather than grandfathered in.
+        if (string.IsNullOrWhiteSpace(sid)) return false;
+
+        var session = await db.UserSessions.IgnoreQueryFilters()
+            .FirstOrDefaultAsync(x => x.Id == sid, cancellationToken);
+        if (session is null || session.RevokedAtUtc is not null || session.ExpiresAtUtc <= now) return false;
+
+        if (now - session.LastSeenAtUtc > TimeSpan.FromMinutes(5))
+        {
+            session.LastSeenAtUtc = now;
+            await db.SaveChangesAsync(cancellationToken);
+        }
+
+        return true;
+    }
+}

JobTrackerApi/Services/StartupInitializationExtensions.cs

@@ -244,6 +244,9 @@ public static class StartupInitializationExtensions
             `MicrosoftSubject` longtext NULL,
             `MicrosoftEmail` longtext NULL,
             `MicrosoftLinkedAt` datetime(6) NULL,
+            `TotpSecretEncrypted` longtext NULL,
+            `TotpPendingSecretEncrypted` longtext NULL,
+            `TotpEnabledAtUtc` datetime(6) NULL,
             PRIMARY KEY (`Id`)
         ) CHARACTER SET=utf8mb4;
 
@@ -359,7 +362,10 @@ public static class StartupInitializationExtensions
             "GoogleLinkedAt" TEXT NULL,
             "MicrosoftSubject" TEXT NULL,
             "MicrosoftEmail" TEXT NULL,
-            "MicrosoftLinkedAt" TEXT NULL
+            "MicrosoftLinkedAt" TEXT NULL,
+            "TotpSecretEncrypted" TEXT NULL,
+            "TotpPendingSecretEncrypted" TEXT NULL,
+            "TotpEnabledAtUtc" TEXT NULL
         );
         """);
 
@@ -440,6 +446,9 @@ public static class StartupInitializationExtensions
                 EnsureColumn(conn, "AspNetUsers", "MicrosoftSubject", "ALTER TABLE AspNetUsers ADD COLUMN MicrosoftSubject TEXT NULL;");
                 EnsureColumn(conn, "AspNetUsers", "MicrosoftEmail", "ALTER TABLE AspNetUsers ADD COLUMN MicrosoftEmail TEXT NULL;");
                 EnsureColumn(conn, "AspNetUsers", "MicrosoftLinkedAt", "ALTER TABLE AspNetUsers ADD COLUMN MicrosoftLinkedAt TEXT NULL;");
+                EnsureColumn(conn, "AspNetUsers", "TotpSecretEncrypted", "ALTER TABLE AspNetUsers ADD COLUMN TotpSecretEncrypted TEXT NULL;");
+                EnsureColumn(conn, "AspNetUsers", "TotpPendingSecretEncrypted", "ALTER TABLE AspNetUsers ADD COLUMN TotpPendingSecretEncrypted TEXT NULL;");
+                EnsureColumn(conn, "AspNetUsers", "TotpEnabledAtUtc", "ALTER TABLE AspNetUsers ADD COLUMN TotpEnabledAtUtc TEXT NULL;");
 
                 static void EnsureUserRuleSettingsTable(DbConnection c)
                 {
@@ -623,10 +632,63 @@ public static class StartupInitializationExtensions
                     Exec(c, """CREATE INDEX IF NOT EXISTS "IX_TailoredCvDrafts_JobApplicationId" ON "TailoredCvDrafts" ("JobApplicationId");""");
                 }
 
+                static void EnsureTwoFactorRecoveryCodesTable(DbConnection c)
+                {
+                    Exec(c, """
+        CREATE TABLE IF NOT EXISTS "TwoFactorRecoveryCodes" (
+            "Id" INTEGER NOT NULL CONSTRAINT "PK_TwoFactorRecoveryCodes" PRIMARY KEY AUTOINCREMENT,
+            "UserId" TEXT NOT NULL,
+            "CodeHash" TEXT NOT NULL,
+            "CreatedAtUtc" TEXT NOT NULL,
+            "UsedAtUtc" TEXT NULL
+        );
+        """);
+
+                    Exec(c, """CREATE INDEX IF NOT EXISTS "IX_TwoFactorRecoveryCodes_UserId_UsedAtUtc" ON "TwoFactorRecoveryCodes" ("UserId", "UsedAtUtc");""");
+                }
+
+                static void EnsureTrustedDevicesTable(DbConnection c)
+                {
+                    Exec(c, """
+        CREATE TABLE IF NOT EXISTS "TrustedDevices" (
+            "Id" INTEGER NOT NULL CONSTRAINT "PK_TrustedDevices" PRIMARY KEY AUTOINCREMENT,
+            "UserId" TEXT NOT NULL,
+            "TokenHash" TEXT NOT NULL,
+            "DeviceLabel" TEXT NULL,
+            "CreatedAtUtc" TEXT NOT NULL,
+            "LastSeenAtUtc" TEXT NOT NULL,
+            "ExpiresAtUtc" TEXT NOT NULL
+        );
+        """);
+
+                    Exec(c, """CREATE INDEX IF NOT EXISTS "IX_TrustedDevices_UserId" ON "TrustedDevices" ("UserId");""");
+                    Exec(c, """CREATE INDEX IF NOT EXISTS "IX_TrustedDevices_TokenHash" ON "TrustedDevices" ("TokenHash");""");
+                }
+
+                static void EnsureUserSessionsTable(DbConnection c)
+                {
+                    Exec(c, """
+        CREATE TABLE IF NOT EXISTS "UserSessions" (
+            "Id" TEXT NOT NULL CONSTRAINT "PK_UserSessions" PRIMARY KEY,
+            "UserId" TEXT NOT NULL,
+            "DeviceLabel" TEXT NULL,
+            "CreatedAtUtc" TEXT NOT NULL,
+            "LastSeenAtUtc" TEXT NOT NULL,
+            "ExpiresAtUtc" TEXT NOT NULL,
+            "RevokedAtUtc" TEXT NULL
+        );
+        """);
+
+                    Exec(c, """CREATE INDEX IF NOT EXISTS "IX_UserSessions_UserId" ON "UserSessions" ("UserId");""");
+                }
+
                 EnsureGmailConnectionsTable(conn);
                 EnsureMicrosoftGraphConnectionsTable(conn);
                 EnsureImapConnectionsTable(conn);
                 EnsureCvTables(conn);
+                EnsureTwoFactorRecoveryCodesTable(conn);
+                EnsureTrustedDevicesTable(conn);
+                EnsureUserSessionsTable(conn);
 
                 // Legacy DB signature: migration history exists (AddCorrespondence applied), but 20260310195000 not recorded,
                 // and at least one of the new columns already exists.
@@ -780,6 +842,9 @@ public static class StartupInitializationExtensions
                     EnsureMySqlColumn(conn, "AspNetUsers", "MicrosoftSubject", "ALTER TABLE `AspNetUsers` ADD COLUMN `MicrosoftSubject` longtext NULL;");
                     EnsureMySqlColumn(conn, "AspNetUsers", "MicrosoftEmail", "ALTER TABLE `AspNetUsers` ADD COLUMN `MicrosoftEmail` longtext NULL;");
                     EnsureMySqlColumn(conn, "AspNetUsers", "MicrosoftLinkedAt", "ALTER TABLE `AspNetUsers` ADD COLUMN `MicrosoftLinkedAt` datetime NULL;");
+                    EnsureMySqlColumn(conn, "AspNetUsers", "TotpSecretEncrypted", "ALTER TABLE `AspNetUsers` ADD COLUMN `TotpSecretEncrypted` longtext NULL;");
+                    EnsureMySqlColumn(conn, "AspNetUsers", "TotpPendingSecretEncrypted", "ALTER TABLE `AspNetUsers` ADD COLUMN `TotpPendingSecretEncrypted` longtext NULL;");
+                    EnsureMySqlColumn(conn, "AspNetUsers", "TotpEnabledAtUtc", "ALTER TABLE `AspNetUsers` ADD COLUMN `TotpEnabledAtUtc` datetime NULL;");
 
                     if (!HasMySqlTable(conn, "RuleSettings"))
                     {
@@ -988,6 +1053,84 @@ public static class StartupInitializationExtensions
                         cmd.ExecuteNonQuery();
                     }
 
+                    if (!HasMySqlTable(conn, "TwoFactorRecoveryCodes"))
+                    {
+                        using var cmd = conn.CreateCommand();
+                        cmd.CommandText = @"CREATE TABLE IF NOT EXISTS `TwoFactorRecoveryCodes` (
+        `Id` int NOT NULL AUTO_INCREMENT,
+        `UserId` varchar(255) NOT NULL,
+        `CodeHash` varchar(255) NOT NULL,
+        `CreatedAtUtc` datetime(6) NOT NULL,
+        `UsedAtUtc` datetime(6) NULL,
+        PRIMARY KEY (`Id`)
+        );";
+                        cmd.ExecuteNonQuery();
+                    }
+
+                    EnsureMySqlAutoIncrementPrimaryKey(conn, "TwoFactorRecoveryCodes", "Id");
+
+                    if (!MySqlIndexExists(conn, "TwoFactorRecoveryCodes", "IX_TwoFactorRecoveryCodes_UserId_UsedAtUtc"))
+                    {
+                        using var cmd = conn.CreateCommand();
+                        cmd.CommandText = "CREATE INDEX `IX_TwoFactorRecoveryCodes_UserId_UsedAtUtc` ON `TwoFactorRecoveryCodes` (`UserId`, `UsedAtUtc`);";
+                        cmd.ExecuteNonQuery();
+                    }
+
+                    if (!HasMySqlTable(conn, "TrustedDevices"))
+                    {
+                        using var cmd = conn.CreateCommand();
+                        cmd.CommandText = @"CREATE TABLE IF NOT EXISTS `TrustedDevices` (
+        `Id` int NOT NULL AUTO_INCREMENT,
+        `UserId` varchar(255) NOT NULL,
+        `TokenHash` varchar(255) NOT NULL,
+        `DeviceLabel` varchar(255) NULL,
+        `CreatedAtUtc` datetime(6) NOT NULL,
+        `LastSeenAtUtc` datetime(6) NOT NULL,
+        `ExpiresAtUtc` datetime(6) NOT NULL,
+        PRIMARY KEY (`Id`)
+        );";
+                        cmd.ExecuteNonQuery();
+                    }
+
+                    EnsureMySqlAutoIncrementPrimaryKey(conn, "TrustedDevices", "Id");
+
+                    if (!MySqlIndexExists(conn, "TrustedDevices", "IX_TrustedDevices_UserId"))
+                    {
+                        using var cmd = conn.CreateCommand();
+                        cmd.CommandText = "CREATE INDEX `IX_TrustedDevices_UserId` ON `TrustedDevices` (`UserId`);";
+                        cmd.ExecuteNonQuery();
+                    }
+
+                    if (!MySqlIndexExists(conn, "TrustedDevices", "IX_TrustedDevices_TokenHash"))
+                    {
+                        using var cmd = conn.CreateCommand();
+                        cmd.CommandText = "CREATE INDEX `IX_TrustedDevices_TokenHash` ON `TrustedDevices` (`TokenHash`);";
+                        cmd.ExecuteNonQuery();
+                    }
+
+                    if (!HasMySqlTable(conn, "UserSessions"))
+                    {
+                        using var cmd = conn.CreateCommand();
+                        cmd.CommandText = @"CREATE TABLE IF NOT EXISTS `UserSessions` (
+        `Id` varchar(64) NOT NULL,
+        `UserId` varchar(255) NOT NULL,
+        `DeviceLabel` varchar(255) NULL,
+        `CreatedAtUtc` datetime(6) NOT NULL,
+        `LastSeenAtUtc` datetime(6) NOT NULL,
+        `ExpiresAtUtc` datetime(6) NOT NULL,
+        `RevokedAtUtc` datetime(6) NULL,
+        PRIMARY KEY (`Id`)
+        );";
+                        cmd.ExecuteNonQuery();
+                    }
+
+                    if (!MySqlIndexExists(conn, "UserSessions", "IX_UserSessions_UserId"))
+                    {
+                        using var cmd = conn.CreateCommand();
+                        cmd.CommandText = "CREATE INDEX `IX_UserSessions_UserId` ON `UserSessions` (`UserId`);";
+                        cmd.ExecuteNonQuery();
+                    }
+
                     // Schema reconciliation must never crash app startup: an index that fails
                     // (e.g. combined key exceeds MySQL's 3072-byte limit because an older
                     // migration made OwnerUserId wider than the varchar(255) this reconciler

JobTrackerApi/Services/TokenService.cs

@@ -10,7 +10,7 @@ namespace JobTrackerApi.Services;
 
 public interface ITokenService
 {
-    Task<string> CreateAccessTokenAsync(ApplicationUser user, CancellationToken cancellationToken = default);
+    Task<string> CreateAccessTokenAsync(ApplicationUser user, string? sessionId = null, CancellationToken cancellationToken = default);
 }
 
 public sealed class TokenService : ITokenService
@@ -24,7 +24,7 @@ public sealed class TokenService : ITokenService
         _users = users;
     }
 
-    public async Task<string> CreateAccessTokenAsync(ApplicationUser user, CancellationToken cancellationToken = default)
+    public async Task<string> CreateAccessTokenAsync(ApplicationUser user, string? sessionId = null, CancellationToken cancellationToken = default)
     {
         var jwtKey = (_cfg["Auth:JwtKey"] ?? "").Trim();
         if (string.IsNullOrWhiteSpace(jwtKey))
@@ -57,6 +57,9 @@ public sealed class TokenService : ITokenService
         foreach (var r in roles)
             claims.Add(new Claim(ClaimTypes.Role, r));
 
+        if (!string.IsNullOrWhiteSpace(sessionId))
+            claims.Add(new Claim("sid", sessionId));
+
         var now = DateTime.UtcNow;
 
         var token = new JwtSecurityToken(

JobTrackerApi/Services/TrustedDeviceService.cs

@@ -0,0 +1,115 @@
+using System.Security.Cryptography;
+using System.Text;
+using JobTrackerApi.Data;
+using JobTrackerApi.Models;
+using Microsoft.AspNetCore.Http;
+using Microsoft.EntityFrameworkCore;
+
+namespace JobTrackerApi.Services;
+
+// "Trust this device for 30 days" -- lets a 2FA challenge be skipped on the same browser for a
+// month. Shared by AuthController (checks the cookie before gating on 2FA) and
+// TwoFactorController (issues/lists/revokes the cookie's backing row). Never stores the
+// plaintext token, only its SHA-256 hash.
+public static class TrustedDeviceService
+{
+    private static readonly TimeSpan Lifetime = TimeSpan.FromDays(30);
+
+    // Only returns true (and thus skips 2FA) when the cookie's hash matches a non-expired row
+    // for THIS SPECIFIC user -- UserId is part of the DB query itself, not a check applied
+    // after the fact, so a trusted-device cookie minted for user A can never skip 2FA for user
+    // B even if somehow presented on their request.
+    public static async Task<bool> IsDeviceTrustedAsync(JobTrackerContext db, HttpRequest request, string userId, CancellationToken cancellationToken)
+    {
+        var token = request.Cookies[AuthSessionOptions.TrustedDeviceCookieName];
+        if (string.IsNullOrWhiteSpace(token)) return false;
+
+        var hash = HashToken(token);
+        var now = DateTimeOffset.UtcNow;
+        // SQLite/Pomelo cannot translate DateTimeOffset relational comparisons (>) to SQL, so the
+        // expiry check has to happen after materializing the row -- fine here since the equality
+        // filters (UserId, TokenHash) already narrow this to at most one row.
+        var match = await db.TrustedDevices
+            .IgnoreQueryFilters()
+            .FirstOrDefaultAsync(x => x.UserId == userId && x.TokenHash == hash, cancellationToken);
+        if (match is null || match.ExpiresAtUtc <= now) return false;
+
+        match.LastSeenAtUtc = now;
+        await db.SaveChangesAsync(cancellationToken);
+        return true;
+    }
+
+    public static async Task IssueAsync(JobTrackerContext db, HttpRequest request, HttpResponse response, string userId, CancellationToken cancellationToken)
+    {
+        var token = Convert.ToHexString(RandomNumberGenerator.GetBytes(32)).ToLowerInvariant();
+        var now = DateTimeOffset.UtcNow;
+
+        db.TrustedDevices.Add(new TrustedDevice
+        {
+            UserId = userId,
+            TokenHash = HashToken(token),
+            DeviceLabel = DescribeUserAgent(request.Headers["User-Agent"].ToString()),
+            CreatedAtUtc = now,
+            LastSeenAtUtc = now,
+            ExpiresAtUtc = now.Add(Lifetime),
+        });
+        await db.SaveChangesAsync(cancellationToken);
+
+        var secure = request.IsHttps || string.Equals(request.Headers["X-Forwarded-Proto"], "https", StringComparison.OrdinalIgnoreCase);
+        response.Cookies.Append(AuthSessionOptions.TrustedDeviceCookieName, token, AuthSessionOptions.BuildTrustedDeviceCookie(secure));
+    }
+
+    public static void ClearCookie(HttpRequest request, HttpResponse response)
+    {
+        var secure = request.IsHttps || string.Equals(request.Headers["X-Forwarded-Proto"], "https", StringComparison.OrdinalIgnoreCase);
+        response.Cookies.Delete(AuthSessionOptions.TrustedDeviceCookieName, AuthSessionOptions.BuildExpiredTrustedDeviceCookie(secure));
+    }
+
+    // Used to flag "this device" in the trusted-devices list without ever sending a token or
+    // hash to the client -- just a boolean per row.
+    public static string? CurrentDeviceTokenHash(HttpRequest request)
+    {
+        var token = request.Cookies[AuthSessionOptions.TrustedDeviceCookieName];
+        return string.IsNullOrWhiteSpace(token) ? null : HashToken(token);
+    }
+
+    public static string HashToken(string token)
+    {
+        return Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes(token.Trim()))).ToLowerInvariant();
+    }
+
+    private static readonly (string Needle, string Label)[] BrowserMarkers =
+    {
+        ("Edg/", "Edge"),
+        ("OPR/", "Opera"),
+        ("Chrome/", "Chrome"),
+        ("Firefox/", "Firefox"),
+        ("Safari/", "Safari"),
+    };
+
+    private static readonly (string Needle, string Label)[] OsMarkers =
+    {
+        ("Windows", "Windows"),
+        ("Mac OS X", "Mac"),
+        ("iPhone", "iOS"),
+        ("iPad", "iOS"),
+        ("Android", "Android"),
+        ("Linux", "Linux"),
+    };
+
+    // ponytail: substring sniffing, not a real UA parser -- this only feeds a display label in
+    // a security-settings list ("Chrome on Windows"), nothing security-relevant depends on it.
+    // Public: also reused by AppSessionIssuer for UserSession device labels.
+    public static string? DescribeUserAgent(string? userAgent)
+    {
+        if (string.IsNullOrWhiteSpace(userAgent)) return null;
+
+        var browser = BrowserMarkers.FirstOrDefault(m => userAgent.Contains(m.Needle, StringComparison.Ordinal)).Label;
+        var os = OsMarkers.FirstOrDefault(m => userAgent.Contains(m.Needle, StringComparison.Ordinal)).Label;
+
+        if (browser is null && os is null) return userAgent.Length > 80 ? userAgent[..80] : userAgent;
+        if (browser is null) return os;
+        if (os is null) return browser;
+        return $"{browser} on {os}";
+    }
+}

JobTrackerApi/Services/TwoFactorPendingTokenService.cs

@@ -0,0 +1,47 @@
+using System.Security.Cryptography;
+using Microsoft.Extensions.Caching.Memory;
+
+namespace JobTrackerApi.Services;
+
+public sealed record PendingTwoFactorSession(string UserId, bool RememberMe);
+
+public interface ITwoFactorPendingTokenService
+{
+    string IssuePendingToken(string userId, bool rememberMe);
+    PendingTwoFactorSession? Resolve(string pendingToken, bool consume);
+}
+
+// ponytail: server-side opaque token in IMemoryCache, deliberately NOT a JWT. A JWT signed
+// with the app's normal signing key would be accepted by the "local" JWT bearer auth scheme
+// for every other endpoint unless its issuer/audience/claims were carefully kept out of that
+// scheme's validation -- an opaque cache-backed token can never be presented as a bearer
+// token, so it structurally cannot grant a real session by itself. Single instance is fine:
+// this is a short-lived (5 min), single-process dev/prod deployment, same as the rest of this
+// app's in-memory state (rate limiter, IMemoryCache already registered in Program.cs).
+public sealed class TwoFactorPendingTokenService : ITwoFactorPendingTokenService
+{
+    private static readonly TimeSpan Ttl = TimeSpan.FromMinutes(5);
+    private readonly IMemoryCache _cache;
+
+    public TwoFactorPendingTokenService(IMemoryCache cache)
+    {
+        _cache = cache;
+    }
+
+    public string IssuePendingToken(string userId, bool rememberMe)
+    {
+        var token = Convert.ToHexString(RandomNumberGenerator.GetBytes(32)).ToLowerInvariant();
+        _cache.Set(CacheKey(token), new PendingTwoFactorSession(userId, rememberMe), Ttl);
+        return token;
+    }
+
+    public PendingTwoFactorSession? Resolve(string pendingToken, bool consume)
+    {
+        var key = CacheKey(pendingToken);
+        if (!_cache.TryGetValue(key, out PendingTwoFactorSession? session)) return null;
+        if (consume) _cache.Remove(key);
+        return session;
+    }
+
+    private static string CacheKey(string token) => $"2fa-pending:{token}";
+}

JobTrackerApi/appsettings.Development.json

@@ -20,6 +20,7 @@
   "Auth": {
     "Require": true,
     "AllowRegistration": true,
+    "RequireEmailVerification": false,
     "JwtKey": "CHANGE_ME_DEV_ONLY_LONG_RANDOM_SECRET",
     "JwtIssuer": "JobTrackerApi",
     "JwtAudience": "job-tracker-ui",