Fix(Feat): CA, Audits, Rte Limit

CA Encryption, Serials, Rate Limiter, Account suspension blocks login
Transfer Ownership & Delete Account

config/base.py

@@ -28,6 +28,11 @@ class BaseConfig:
     
     # Encryption key for sensitive data (client secrets, tokens, etc.)
     ENCRYPTION_KEY = os.getenv("ENCRYPTION_KEY", "dev-encryption-key-change-in-production")
+
+    # Encryption key for CA private keys stored in the database.
+    # Must be set to a strong random secret in production.
+    # Any string is accepted — it is SHA-256 derived to a 32-byte Fernet key internally.
+    CA_ENCRYPTION_KEY = os.getenv("CA_ENCRYPTION_KEY", "dev-ca-encryption-key-change-in-production")
     
     # Session configuration for WebAuthn cross-origin support
     SESSION_COOKIE_SECURE = os.getenv("SESSION_COOKIE_SECURE", "True").lower() == "true"
@@ -72,6 +77,13 @@ class BaseConfig:
     RATELIMIT_STORAGE_URL = os.getenv("RATELIMIT_STORAGE_URL", "redis://localhost:6379/1")
     RATELIMIT_DEFAULT = "100/hour"
 
+    # Per-endpoint auth rate limits (override via env vars for each environment)
+    RATELIMIT_AUTH_REGISTER = os.getenv("RATELIMIT_AUTH_REGISTER", "10 per minute; 50 per hour")
+    RATELIMIT_AUTH_LOGIN = os.getenv("RATELIMIT_AUTH_LOGIN", "20 per minute; 100 per hour")
+    RATELIMIT_AUTH_TOTP_VERIFY = os.getenv("RATELIMIT_AUTH_TOTP_VERIFY", "20 per minute; 100 per hour")
+    RATELIMIT_AUTH_FORGOT_PASSWORD = os.getenv("RATELIMIT_AUTH_FORGOT_PASSWORD", "5 per minute; 20 per hour")
+    RATELIMIT_AUTH_RESET_PASSWORD = os.getenv("RATELIMIT_AUTH_RESET_PASSWORD", "10 per minute; 30 per hour")
+
     # Logging
     LOG_LEVEL = os.getenv("LOG_LEVEL", "INFO")
     LOG_TO_STDOUT = os.getenv("LOG_TO_STDOUT", "False").lower() == "true"

config/testing.py

@@ -12,6 +12,9 @@ class TestingConfig(BaseConfig):
     # Explicitly set SECRET_KEY for testing
     SECRET_KEY = os.getenv("SECRET_KEY", "test-secret-key-for-testing")
 
+    # CA key encryption — use a fixed test key so tests are deterministic
+    CA_ENCRYPTION_KEY = os.getenv("CA_ENCRYPTION_KEY", "test-ca-encryption-key-fixed-for-tests")
+
     # Use in-memory SQLite for testing
     SQLALCHEMY_DATABASE_URI = "sqlite:///:memory:"
     SQLALCHEMY_ECHO = False