Feature addition: Multi-Factor Authentication

.gitignore

@@ -42,4 +42,4 @@ data-docs/backup
 data-docs/log
 data-docs/session
 data-docs/session_secret.txt
-data-docs/document.*
+data-docs/document.*

README.md

@@ -37,6 +37,7 @@ Feel free to join our official conversations. We would love to hear what feature
 * Fast and easy [navigation between notes](https://triliumnext.github.io/Docs/Wiki/note-navigation), full text search and [note hoisting](https://triliumnext.github.io/Docs/Wiki/note-hoisting)
 * Seamless [note versioning](https://triliumnext.github.io/Docs/Wiki/note-revisions)
 * Note [attributes](https://triliumnext.github.io/Docs/Wiki/attributes) can be used for note organization, querying and advanced [scripting](https://triliumnext.github.io/Docs/Wiki/scripts)
+* Direct OpenID and TOTP integration for more secure login
 * [Synchronization](https://triliumnext.github.io/Docs/Wiki/synchronization) with self-hosted sync server
   * there's a [3rd party service for hosting synchronisation server](https://trilium.cc/paid-hosting)
 * [Sharing](https://triliumnext.github.io/Docs/Wiki/sharing) (publishing) notes to public internet

config-sample.ini

@@ -43,4 +43,30 @@ cookieMaxAge=1814400
 [Sync]
 #syncServerHost=
 #syncServerTimeout=
-#syncServerProxy=
+#syncServerProxy=
+
+[MultiFactorAuthentication]
+# Set to true to enable TOTP authentication
+# This will require users to enter a one-time password in addition to their password to log in to Trilium
+# This is a security feature that adds an extra layer of protection to your account
+totpEnabled=false
+
+# Set the secret key for TOTP authentication
+# This is a security feature that adds an extra layer of protection to your account
+totpSecret=my-secret-key
+
+# Set to true to enable OAuth/OpenID authentication
+# This will allow users to log in to Trilium using an account from another service, like Google, to verify their identity
+ssoEnabled=false
+
+# Set the base URL for OAuth/OpenID authentication
+# This is the URL of the service that will be used to verify the user's identity
+oauthBaseUrl=http://localhost:8080
+
+# Set the client ID for OAuth/OpenID authentication
+# This is the ID of the client that will be used to verify the user's identity
+oauthClientId=my-client-id
+
+# Set the client secret for OAuth/OpenID authentication
+# This is the secret of the client that will be used to verify the user's identity
+oauthClientSecret=my-client-secret

db/schema.sql

@@ -126,6 +126,19 @@ CREATE TABLE IF NOT EXISTS "attachments"
     utcDateScheduledForErasureSince TEXT DEFAULT NULL,
     isDeleted    INT  not null,
     deleteId    TEXT DEFAULT NULL);
+CREATE TABLE IF NOT EXISTS "user_data"
+(
+    tmpID INT,
+    username TEXT,
+    email TEXT,
+    userIDEcnryptedDataKey TEXT,
+    userIDVerificationHash TEXT,
+    salt TEXT,
+    derivedKey TEXT,
+    isSetup TEXT DEFAULT "false",
+    UNIQUE (tmpID),
+    PRIMARY KEY (tmpID)
+);
 CREATE INDEX IDX_attachments_ownerId_role
     on attachments (ownerId, role);