From 4512f78033fd84fc45ca25d1ff3351ff98255933 Mon Sep 17 00:00:00 2001
From: Tero <tero.huttunen@eternityproject.fi>
Date: Sat, 29 Aug 2026 20:07:00 +0300
Subject: [PATCH] Add sfsr protection and admin pwd change script for
 powershell

---
 README.md                       |  31 ++++++++++++++++++++++++++
 TODO.md                         |   6 ++---
 __pycache__/app.cpython-314.pyc | Bin 31073 -> 31158 bytes
 app.py                          |   2 ++
 requirements.txt                |   1 +
 scripts/rotate-admin.ps1        |  37 +++++++++++++++++++++++++++++++
 scripts/test-smtp.ps1           |  38 ++++++++++++++++++++++++++++++++
 templates/admin_users.html      |   2 +-
 templates/auth.html             |   1 +
 templates/base.html             |   2 +-
 templates/editor.html           |   1 +
 templates/mfa.html              |   1 +
 templates/password_form.html    |   1 +
 13 files changed, 118 insertions(+), 5 deletions(-)
 create mode 100644 scripts/rotate-admin.ps1
 create mode 100644 scripts/test-smtp.ps1

diff --git a/README.md b/README.md
index a98a32a..60a09c8 100644
--- a/README.md
+++ b/README.md
@@ -17,12 +17,43 @@ Open `http://localhost:8000`, create the first account, and publish a field note
 
 The initial administrator account is `admin` with password `admin`, as requested for first-run access. Sign in, scan the displayed QR code with any iPhone or Android TOTP authenticator, and change this password before exposing the service to the internet. New registrations are held for approval in **Accounts**; accepted users must enroll a TOTP authenticator before they can publish.
 
+### Secure the initial administrator
+
+With the Docker service running, rotate the initial password locally. The command prompts for a new password without writing it to a file or command history. It also clears the old MFA binding so that the next administrator sign-in requires a new QR-based authenticator enrollment.
+
+```powershell
+.\scripts\rotate-admin.ps1
+```
+
+After it prints `ADMIN_PASSWORD_ROTATED_MFA_RESET`, sign in as `admin` with the new password, scan the fresh QR code with an authenticator application, and enter its six-digit code to complete enrollment. Store the new password in a password manager.
+
 ## Email and password recovery
 
 Registration now requires an email address. Members can change their password from the navigation. The sign-in page provides an email-based recovery link; it expires after one hour and can only be used once. Administrators can send the same recovery email to any approved member from **Accounts**.
 
+All browser POST forms are protected by server-validated CSRF tokens.
+
 Set `PUBLIC_URL` and the `MAIL_*` values in `.env` to send recovery emails. The SMTP account must support STARTTLS on the configured port. Review [TODO.md](TODO.md) before production deployment.
 
+### Configure SMTP delivery
+
+1. Copy `.env.example` to `.env` if it does not exist.
+2. Set `PUBLIC_URL=https://eternityproject.fi`.
+3. Enter the SMTP host, port, username, password or provider app password, and verified sender address. Use port `587` for STARTTLS.
+4. Rebuild the service so Compose applies the values:
+
+```sh
+docker compose up --build -d
+```
+
+5. Send a delivery test to an inbox you control:
+
+```powershell
+.\scripts\test-smtp.ps1 -To you@example.com
+```
+
+The command prints `SMTP_TEST_SENT_TO=<address>` only after the SMTP server accepts the message. Confirm the message arrives, then use **Forgot your password?** in the application to verify a real reset email and link.
+
 ## Production notes
 
 Put this service behind a TLS reverse proxy for `eternityproject.fi` (for example Caddy or Nginx). Set a strong unique `SECRET_KEY`; the Compose file intentionally refuses to start without it. Back up the `eternity_data` Docker volume, which contains accounts and posts.
diff --git a/TODO.md b/TODO.md
index 4ee4937..85ab7b6 100644
--- a/TODO.md
+++ b/TODO.md
@@ -4,8 +4,8 @@
 - [x] Local accounts, administrator approval, and TOTP MFA.
 - [x] QR-based MFA enrollment for iPhone and Android authenticators.
 - [x] Email addresses, member password changes, and expiring password-reset links.
-- [ ] Configure production SMTP credentials and verify outgoing email delivery.
-- [ ] Change the initial `admin` password and enroll its authenticator.
-- [ ] Add CSRF protection to all state-changing forms.
+- [ ] Configure production SMTP credentials and verify outgoing email delivery. See the SMTP delivery steps in [README.md](README.md); complete after the test email is received.
+- [ ] Run `./scripts/rotate-admin.ps1`, then sign in as `admin` and scan the new MFA QR code to complete authenticator enrollment.
+- [x] Add CSRF protection to all state-changing forms.
 - [ ] Add automated database backups and test restoration.
 - [ ] Configure TLS reverse proxy and production domain for `eternityproject.fi`.
\ No newline at end of file
diff --git a/__pycache__/app.cpython-314.pyc b/__pycache__/app.cpython-314.pyc
index 51feb7da042d29bfdacd371e3ae4d3ad443e31fa..916674dd7b3c6209b2ff2ddba1d1fa0e56b0d1ce 100644
GIT binary patch
delta 5494
zcma)9eN0=|75BBV4KWxfA0`mMe8*r+2@oKG1j0uk5aK)_Nf#W~wV%Pn*yQ>dl5{Q6
zsxDO~HBE1|R;#KlTR%qHv}-M8>$-L8)^(HGD(k9L)7z>k)uwIzl9K$fjkfE~xsPYR
zFj_UOe%yD@@1A?kx#ygFef2uIbc0wMtXUg$@bAqWHtQTYXDuRsI9K<xPRnrlkX^Eu
z>yGFIGF%~5@V}K(CH&1Ct{SSAs)uT%nsS{dr$XncZ6&Bfr*rRP$K1v2x<0>5a&VE(
zJ)wxS=sw8KS@V{%JPyI?w4@|Lw)U%4uSitolG9TNn>8lCT^^VFNNTk@a{JU#>aS-V
zJJP^jZb(gzkgIOyajr*AGH+2g_cVhk>nK&34S7Posx!IfOZXK9Ux`)tRajLvp-A2P
z%WTZrC={zaw}?m5RHEt^HnpcK;e#`_gRd@CBDDymHl5T8!Jox7dq;&bn=VXRSEDU$
z70N;0F4zG(gbKh;VN|F@j<gL%ReZEvs0K-wPy^U4)B^4Rjd!EQ+&Y^ssjUZQ@4?xU
zlx>?e@?A-}L$y$-*U0-+d3l4dS8%qkCY8{r;q)gtuA4Yb8qPqHbL&l<W({XB$=Pxf
zr$xirt#TZ#T8^hfXiKq@-VXu$G<sjRHR)Y@iYE;V9T2%aLMPyes=0idR<p2O!yip@
zx^CihYdCv>qtwL?bx%*HurtL-S~sRzSJR_m_O8R+mt^kJF#FbFx>XAu{aOnlJ_GBp
z_b1tdYuLNjVGF>1ig&0{b3s#kMKa6Eq08Zat%hXIHwr@?hjh9?p-#66vfsUor(hfw
z_6Q^FhvrT)#@;i(VI{JqZ(JC3)2Jl+rNqVbOybxCI^^{J-ih8_z2gJ46h3Jgf*qj(
zp%S5recrq=@kz!cAvJ8jWgn?y=PixKHjve@w=F@^!WwEevhmDmki3*xX|DrG4D+|v
zPVo%nbbmM+6TN{u=r;IlWS?caNK3+*Rl0$+u|2j%vXLDJtYc5wwpQ=L)n)*@@=sA=
z4n;x|YH)+3^@So?Pg>cZirb0A@=C_rTVR%E04(e26plRr+=k$)4c2gUIu!9z@mM@W
z#Q?n>3GA_wdd2+2)si0K8ONnN5YUQ$GPo`rMv9)&euM&qL4<4oM;iSajt>LKY4Mmy
z`Q9;T*t&YB{S>#HTOwEc0(0zIaRpgo-z%Ns<~sBgZ!~TQ^}^_8b76tj+#nF{W-Vn~
zAaKF5r-&tG)F3OeH#B0<=?JR9*wxnZ;3=`Q#3P|&anTzK$ET?T(lcz{{tzfKRz&n9
z%A~5$?T|t`8Uc_u9PowX;sB*lN{u+X8v&KlA%tNB)Z#GFc^pR(77>mkoIt=eF%y7l
z2kWl38SjFLhuLk_Z}FHPYds3zaz-#74$t`{|BQpsUR(!J*VV3?zTgXo0$y>>7Yfr;
zF#mn_`<hA<9=D&c=B)fgX6+??@fs6Tu^DE6-ds_!2j~t1#nY9IQuL@8Q4GW?0t0C)
zD{~YX?}M)=*>=av5SbOnn1PhC;l|yivoKAoaH*AwF;Vi)`(m-hC=GzQr`g5EmQ1V?
zIc<<e=V&kcu<^l$o2zKdkxA=ONdxjSg?K~?&8-IbKDO*?EjhpiF)<SG&WW*@Z(4+`
z3*eH|?BA~XO}vP5xLh$oiN_<rNF;VNeMHDOb2g7|Px*~G3ihE69?sPw$O}bgq5i%8
zIHh7l^75R06iBbKMDqyv{dsdaX-le+(}N<Mi!U6ec|f9%tx;zTMFQe+dLE|VVB;;_
zpx|7~5ZRejkg64~08*X;S2p{o6!M2fZIhr+;0_2^SW(*;sG4qj-(a~PXBQB96H}d(
zkOS=UHs8{nIFrm-I)|T_O>_w%2S7H2;h0b1XUd$7`1yrNjcGz}K`2CU0m#<jh$K$a
zkaR++2#kZn;H2Cx%vO2<AcmO)6{l4Eb2yD~6-7rF*|jZE&^42mvy6hIM<;6^oGfNf
z^=u*+*sDDirl(Qb%|7Vax-^MHOguSnF6i^lLuP~`)BL!+p#VLIVvM@HLFsA{@wh~L
z_yqD7L>da7kTY-$85^Ic&*BP9Gx{R{M=s6B@e2s+gfdqXGT!Zq*z>&wTY0nNq2WQ|
zq0lS-@I=Fwuf~Ayh44w@(_TA)<1FoS>Xiuauq}Y>WEDmrHV`viL`x2^4+rd1+`xh_
zH*l?eSPAqjfNb6eR~fdhbNH1tzIVbsaNIA>OQC3l*0Y(xMkn8Xt-*43FiNMRsp_V`
z1_jo{D}#5Yk$YJ8NM|uWADpH99P!+h%zTDDFwzDk_}a)$GRsV(ZR3hNNccH`Y~)p|
zgud{L^DmXBS-A9Ggl{6?8L;!k`G?k?SOTRysd?`56EV`$ILlk&YdGSD*1;%-na>-t
zlBZ`-icp$Z8QqF!)I9d0o-DHu+*`n%vi*e?JS9cJCAM?FgFMYb`#Y9?1G6V{-K%}j
z9-j~RBr)Kk+-=ND#cdO`j>xpA_?@FU(UhYFNaiV)O2Z<Y!xE-z+*3<4Tc>mrgVG~^
z$C`xV65b=Tl^v5Un!XNd+7baFn`E}Y@T9p33MLw7&3!iZ?eW9yXe?ag+>DoSOLY$&
z-GZOENV$nje4#|&gqb0>d7>Kbu)Pz{kRP*^30F67MJcz?BWS<l@JHKzbJRk{!sNa8
zGBC!NIN1lmU!LqCq>H_O;5+1gcJIMT8+XZq++)=1j|N0~73h=f<%1H?TMjiDHut~;
zuWLCcS?o~qekw{lOXW1aZh@USJYG19<ewn$GeYYo=mfiQxW5B)dnFxIxMrleuxwPi
z2DU1Q&hxnBT?Cwv&8yZp^66z3ohm0+*x9L~-7g^F9VD2P{-fzEsmSa>7LPPP;XM3A
zui$#-7v8(<<Eg@I^ql@w1y3T+<G}RnK0@_NJvhA+0o#jGi+{xt&(*)-DCHw}dDT&r
z{2hT8@;`9&5d!y8uXxGFR*J`>NrhCiyrSC+67*78o66c$3MCzb>yG>MG0^!{r#8nI
zaXklir|&P|*x@^zr0%;odkwh+VD-kfDDOZ_mKePO^WR|4`gg*TkNpo48!tGVb(l3R
zaSwY~EO(;UvI%bbSd?lnS~=4<KTo3zqLP9C0@}COd*W@NvnyDmC%x>BncYz67iMb7
zMfTQAe2H&h)oj2Emb>`~tmciE{sKqXbm=b<>JeT+_!UC3tRN<6nDR2g3q$>lkgqtZ
zKCa-Q4mn6yfI%KgycP;!U%EB?&=Oz$1WYdz{+QsWIksXE10g9&dHT}FLF~xVG@QF&
zLSsKaE1ro-yXe=Ef<DQHm_(HZV^-d_6h*5K+$I>Fz;E7PF_ZrPw~BEQ-U}lA9E6W2
z=v=?S{sS1w8NRqQ6Qy{8b0_?$hF>MK?49`|OXw8+6oDt`XE@@XWNS?4q0dGUcOsRU
z+{G{QiT)Q?<N-J`l&C$46Hx#;Jt8jRPlFxPs*fO9<6;I7m6yEw$dNNJ;NJNt1j_*V
zdMR=3SQjZocN~+lJ{nV=V=mn09P5i+=#;I&urGGhyC?-+{um8X8_KRA{1HITT@>lj
zlVW_@1^p|IFD_by!i_9fvMo80lD-RmsCxT{1=%b{7D5!R^g~Fg;X<!B;+qq_Ud?0M
zq+Ct1Arz5h69rpC^UxA;_cmOUCy729h%QFFP!s+rJoVrmwGCCe5pG8aA}mRWJjSPR
zgufLiCcm7!y37kT<%h>RJUt%8c_WR+AqmbSk)P~yIN~jfzah@x=j#Y~qbMEcDvo&D
z<IUj)eqw#nl|DpFC?0It0_MVv!0nX{G#*)dTcvl+MFa7$xPw-};lTg8*ngNm-eGuG
rSIZuaU$<V%*QMt@(DJs~b}H?<DRFk;w|dLw^nHcK%Y~MGwHf~dWa6<>

delta 5338
zcma)9eNbH072mtC%aY|Y2_Jy~%h%%LQx*upBxDJJKuCZ*f~bM)Y<3^;blHXb-UEzL
zVy8{&AKD~0jx*_p_|a;tTJ5T>t>f3&v13!6PUEz`X{((&cC<RJai%kV)ag0*vHKn=
z$uu+hao)MVd+#~to^$Tq=RPBUy+pF=vNG4%;NOGn%+3GUdpfI-Ja@Y0g$B}Jrj{MH
ziKO47df>0Szr3$Pt>~*%E6Z#XIpwyAs#b#YY_{P67OX7t4ev8Pt*F*;s%?1Ksx{={
z5q4+ah7B1LHDYGH+Z-3O*gd3Vq;?`7HmOT&qSjB;58q_664LNQLNfnOTxGxNY%!<R
zZg3}Rugc6#>^;#0mRx1cy7l6Q#G1)DSK*g${C`;NC3{BR72{T!FBT;Byqax}LUB{8
zon0VB9<eB~tytXdGD1*h6E_#w)Mf~77>{HBfLKysi;&ipXsRt@DU7#@Wq@s>2XKox
zAeJLXZ3n4>OIyWC80iqJ0Iw6P0k^@5i@0L0x4@QMZ3k#?M{TibOO0iGXL9_Sq^*Kw
z+@BaPs}=W&b?qw$Db`y!T}e*EDo&$?vn$DITE)56!s$+Onpbgr7S8SjM`*EfCfdYS
zla=(o2iSL__cd)v@3xpcwO4G1$n6og0`?_VF6*$aEM8~f_a`~qR&lmlID3J^3$1!b
zV$X>!VyDSSS~rleu6n11>0g7nFUjn(Fn6uN+@G*e=(bu2@!7owdoaoFxs2Vr273tD
z4`AnE(`k96mEDn6l3OS4*?NP`7S6ZXHrrtQA&j=8PwW@>ve(i&$bR;9+J*Q#E;kX1
zA;Wdo?yiGfyShet=w|q&B?x5*9)xm)ig@O_C?Qqsn0ttL*#&ol14CBHzIIO%ACoeU
zgZ6`r3Xd1G3MQo2LtEgF?g~X>iWCSRp&js9$F9k2B)<4qX309RRx4;Ah3p|fFZ*4=
zmZ~nCod)1B{uxW8$x&Iw6^3BM7q2VS?WBb{i`xlhoy8;VK2Xzifb({G2<34AZp7q@
z5m}MglpGCEX-<==6s7?n%&}h=*McdZ72ilkMVz(+0ZsUjK~onT6kVj<2zdxS2-yHa
zD!mb9?8JJirbv|UtE9qrZN29>H=B;L2TBBTJNr$^I5$zSQ@msN=JYT~t4$1sXRIbl
zKsd$@m-@iO)1{9Pw`oid>-N+&V5I3@Tm}Q?_40@r0ds3nc}|l8N<^EY3XFc6eb;jq
z7P_`PY9~>4f2F)MhSO&N^mW$<BbwAhX^c__YI_lIQMw1A4*^#ZoHT}V6k#4=0bvmV
z=O|79s~x$sF+~kb(%1|Sy`-r07*Oto|LkPdn~*rySI@QH44-=Xq!x+H1l7>AK&T%y
z3LJsWyW-D$Fd~No(o9f}&?V3>voEVFz@Jj@TlS*M%r)cG$I^uI&VJwvDHKmwcc`&j
zq^MzR3a;;2Ns#p+Dg{*u%v2;bV6aXC;bAr@ya*dr*AAwT%}j0B<CH;7E7&Uy`Q!xq
zV?#?uIj)@A3tmz`D`-4Zx4M7^g$yd-oLb~%h+0&YXI8>}l3i?UEgt0qiWCh8W+X)k
zPDzk^A)Io8RW{X<7B<+F@3;>XPsin^PlywJIoiz1LV0Yi*;itEj2Q~?!?`?u;2nFp
zd6VNDC|+fMX&!)(XRh1Co;Whcp7Gt=mYk`(CMAe{FcP5~fJ?t;Sph`dAxFc~B3%ag
z4R%M%4hYE$Eq!EjasjhA_yUmYbIjAWF&ldTeK-NXXWeasF!xN`M=9>RQL7>N<0m^P
zA*1Yz>w?lz)FiW$M(`6;gx-OW1E8lw;1DqnEEQUapI1y@Oai(d0h*$XHn5ks6??e>
ze*8WUpkP8k5gEn%B&reKjg#$<q~<(|-${#)dRg6Q5qme^&Hn7qCFj{c{pHTbkg}cS
zcWqfZh$1G6zF}rE7?_2lm7`Mu>=XexOs~h`WgK2-G^VJusM4KWf&6)i%9FS1=_o@!
zYP0kSoPl{le*z%n(v2uTjj%?%#w~Hdl%NF&7&_j_bVn#61*y@)cszJy@ZjOxxRX4C
zu#G3;!S_b^JYKWQL*NYiy6f$39u_~Ssm7Li&Nv@Oag-JGdd9h-c~>{|ay#$C>GuHW
zX+v-wVMjWJUzsEO4-WS%hNM|ljzy`!SZ_nUAIX;+s%KBe=u}J%%mx)@Ax6XWRiI_W
zKkmIPm3)Iu4|Ejqb3!fU*5lb5Y4~II%Yil`vQGzg5}7scYg;nhLBb0Fx`Vd|;|TJv
zoNQ)MWa89sB76&hp9Mb#GZoi5$e$t^654O0JaPHSIOqvf^KSPml(^wukQ4_1@4H6s
z-i4zG#qsL>Tkx#L2cNf-M_K*>Uxf&IJtw45Dn%_(;&sSZe3spOKp>B?vj?`4*Vu0l
z6ddAFSjI(p6r9i}qEnI)h8)WQn||jZnR{zyr<sEZ_rN>0Q_OSX8PeC;O=3|owhKMm
z*uXr(H$dAG|BjdqzOeg8Zf{=(1zf^>n_qxzDeY$b^da!IoKRpfO{Et=)5}H<R>2C3
z2OlTTvFg#r9b?Ed%|?r%ePW0b?Gr>jCsDsxkNmcO6V&_IsnKqT?Zr_)A=_Bq*g0}H
zduptrfbZ)@?i>w-VquBC2lNs4;g|~a!#6agT!W>~%URD!);Lr;TtX^ON<Ed&)7Z0z
zM)GAO{|sRn0j)boM_B3j?yZ>0U$|h2#%XmXqC1RcffWqVc?#KoLO_L{wqlL2k-o{!
zjh8K5L~SMwM#FGF9|<Z_i_dbHZ{w)b=tPztV+N}qSLVUz8I3v09fiA=A1LmuyRfqb
zG#XjmU7v?BCq+CI@0<`YMW+u_`x1{!C$2P#!0YpGC}{}qBbb5UaaoB5j(mW?i~H{=
zeT=|EVK+j-<t&P4XUUh1_{kgTMcaN5(Qjj}nYwwXTkR?|O77(+FvQ<+iAMQz<RZ+n
z9|hk9$4(rnCpAAn?Z1$V&zhA-hue7aVMZzR66lY!cS1X1%BJuca)ehMYK1gQit?yq
zz;zdmEreq5nlPOKqc9%26UtkO(N*v8jNt4njm=9&0{<Imcd^XL8=XFojtZ<aTpT|+
z>97+&yL);Ml>gh)Uh+8mYFb<3He^|B;DyZ({XUq?`!#(LrBetmAqWUBBfNsJ9szHf
z6${O_o%ors(TGK&Ya0(S`Z-J?XX2mAGPbWnk+VzaAAe7rCv*;FJn+FU+)`LpW0aQx
zeF#)SrX`n;A<@iSew;jzNxSH6Na1l!fmf>WhDkGCx_p~?9AB_C0WPA*+c56^zdu(T
z3shDm`ZWwb82|pv?iA01AnNHsO`VSM`=2{;1ef6%E;BNBc!@ufzC<O@;jd8Qo@850
z=b_KWA?}2kyxher`9%MNGq6I1bR%j%L`4(;D|7*WD0EJ(^`z&vDCs~n-t~$1k)DnL
z58(Tr+99Q%iEpOcNj|zGh`K$d7*Dna+~yREDvwpsizxpAK+j!}=q*PjZK@Gko(93X
z)p(#3vIA<tQXNuUyWr<&V0XW$r%BOynZl(%hV!fVU?30;&PaiP<z4O6X2bA+*Hh%E
zsyiu|CC~D>=^Ipd>x5$q(EwCHC>B-mt<`~x4Iu;&Bm@QF*b*WKeE(C-a6NZrS^z32
z1TS=WmYhSqgTmD!(Pbp^<9iaNQ3U?JxC^B>5b*jjI?sD3Vdvvbf|otTYUH^NNs|hq
zoy}_bm6zRQuI)3iuojUzX(<F8+lcZJJFjhJ?`xOrmkQ(W&%bVW7rBO9j<;Oyp~Ce4
E0%V<xbN~PV

diff --git a/app.py b/app.py
index 9229910..ebbddd7 100644
--- a/app.py
+++ b/app.py
@@ -12,6 +12,7 @@ from secrets import token_urlsafe
 from hashlib import sha256
 
 from flask import Flask, abort, flash, g, redirect, render_template, request, session, url_for
+from flask_wtf.csrf import CSRFProtect
 import pyotp
 import qrcode
 from werkzeug.security import check_password_hash, generate_password_hash
@@ -30,6 +31,7 @@ app.config.update(
     MAIL_FROM=os.environ.get("MAIL_FROM", "noreply@eternityproject.fi"),
     PUBLIC_URL=os.environ.get("PUBLIC_URL", "http://localhost:8000").rstrip("/"),
 )
+csrf = CSRFProtect(app)
 
 
 def get_db():
diff --git a/requirements.txt b/requirements.txt
index d241df2..9a53685 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -2,3 +2,4 @@ Flask==3.1.1
 gunicorn==23.0.0
 pyotp==2.9.0
 qrcode[pil]==8.2
+Flask-WTF==1.2.2
diff --git a/scripts/rotate-admin.ps1 b/scripts/rotate-admin.ps1
new file mode 100644
index 0000000..f23621f
--- /dev/null
+++ b/scripts/rotate-admin.ps1
@@ -0,0 +1,37 @@
+$securePassword = Read-Host "Enter new admin password (10+ characters)" -AsSecureString
+$pointer = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($securePassword)
+
+try {
+    $password = [Runtime.InteropServices.Marshal]::PtrToStringBSTR($pointer)
+    if ($password.Length -lt 10) {
+        throw "The new password must have at least 10 characters."
+    }
+
+    $password | docker compose exec -T eternityproject python -c @'
+import sys
+from werkzeug.security import generate_password_hash
+from app import app, get_db
+
+password = sys.stdin.readline().rstrip("\r\n")
+if len(password) < 10:
+    raise SystemExit("The new password must have at least 10 characters.")
+with app.app_context():
+    database = get_db()
+    result = database.execute(
+        "UPDATE users SET password_hash = ?, mfa_secret = NULL, mfa_enabled = 0 WHERE username = 'admin' AND role = 'admin'",
+        (generate_password_hash(password),),
+    )
+    database.commit()
+    if result.rowcount != 1:
+        raise SystemExit("The administrator account was not found.")
+print("ADMIN_PASSWORD_ROTATED_MFA_RESET")
+'@
+    if ($LASTEXITCODE -ne 0) {
+        exit $LASTEXITCODE
+    }
+}
+finally {
+    if ($pointer -ne [IntPtr]::Zero) {
+        [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($pointer)
+    }
+}
diff --git a/scripts/test-smtp.ps1 b/scripts/test-smtp.ps1
new file mode 100644
index 0000000..0e9bce1
--- /dev/null
+++ b/scripts/test-smtp.ps1
@@ -0,0 +1,38 @@
+param(
+    [Parameter(Mandatory = $true)]
+    [string]$To
+)
+
+$envFile = Join-Path $PSScriptRoot "..\.env"
+if (-not (Test-Path $envFile)) {
+    throw "Missing .env. Copy .env.example to .env and enter the SMTP settings."
+}
+
+Get-Content $envFile | ForEach-Object {
+    if ($_ -match "^\s*([^#=\s]+)\s*=\s*(.*)\s*$") {
+        [Environment]::SetEnvironmentVariable($matches[1], $matches[2], "Process")
+    }
+}
+
+$required = "MAIL_HOST", "MAIL_PORT", "MAIL_USERNAME", "MAIL_PASSWORD", "MAIL_FROM"
+$missing = $required | Where-Object { [string]::IsNullOrWhiteSpace([Environment]::GetEnvironmentVariable($_, "Process")) }
+if ($missing) {
+    throw "Missing required SMTP settings: $($missing -join ', ')"
+}
+
+$message = [System.Net.Mail.MailMessage]::new($env:MAIL_FROM, $To)
+$message.Subject = "Eternity Project SMTP verification"
+$message.Body = "SMTP delivery verification completed at $(Get-Date -Format o)."
+
+$client = [System.Net.Mail.SmtpClient]::new($env:MAIL_HOST, [int]$env:MAIL_PORT)
+$client.EnableSsl = $true
+$client.Credentials = [System.Net.NetworkCredential]::new($env:MAIL_USERNAME, $env:MAIL_PASSWORD)
+
+try {
+    $client.Send($message)
+    Write-Output "SMTP_TEST_SENT_TO=$To"
+}
+finally {
+    $message.Dispose()
+    $client.Dispose()
+}
diff --git a/templates/admin_users.html b/templates/admin_users.html
index a384a91..fe43551 100644
--- a/templates/admin_users.html
+++ b/templates/admin_users.html
@@ -10,7 +10,7 @@
       <strong>{{ user.username }}{% if user.role == 'admin' %} <small>ADMIN</small>{% endif %}<small class="email">{{ user.email or 'NO EMAIL' }}</small></strong>
       <span>{{ user.created_at[:10] }}</span>
       <span>{{ 'ENABLED' if user.mfa_enabled else 'PENDING' }}</span>
-      <span>{% if user.is_approved and user.role == 'member' %}<form method="post" action="{{ url_for('admin_password_reset', user_id=user.id) }}"><button class="button compact" type="submit">Reset password</button></form>{% elif user.is_approved %}APPROVED{% else %}<form method="post" action="{{ url_for('approve_user', user_id=user.id) }}"><button class="button compact" type="submit">Approve</button></form>{% endif %}</span>
+      <span>{% if user.is_approved and user.role == 'member' %}<form method="post" action="{{ url_for('admin_password_reset', user_id=user.id) }}"><input type="hidden" name="csrf_token" value="{{ csrf_token() }}"><button class="button compact" type="submit">Reset password</button></form>{% elif user.is_approved %}APPROVED{% else %}<form method="post" action="{{ url_for('approve_user', user_id=user.id) }}"><input type="hidden" name="csrf_token" value="{{ csrf_token() }}"><button class="button compact" type="submit">Approve</button></form>{% endif %}</span>
     </div>
     {% endfor %}
   </div>
diff --git a/templates/auth.html b/templates/auth.html
index 01e02e4..e1514c7 100644
--- a/templates/auth.html
+++ b/templates/auth.html
@@ -4,6 +4,7 @@
 <section class="auth-layout">
   <div class="auth-copy"><span class="signal-label">MEMBER ACCESS</span><h1>{{ 'Join the circuit.' if mode == 'register' else 'Resume the signal.' }}</h1><p>Accounts let you publish and maintain your own engineering notes.</p></div>
   <form class="auth-form" method="post">
+    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
     <label>Handle<input name="username" autocomplete="username" required pattern="[a-z0-9_-]{3,32}" placeholder="your-handle"></label>
     {% if mode == 'register' %}<label>Email<input name="email" type="email" autocomplete="email" required placeholder="you@example.com"></label>{% endif %}
     <label>Password<input name="password" type="password" autocomplete="{{ 'new-password' if mode == 'register' else 'current-password' }}" required {% if mode == 'register' %}minlength="10" placeholder="10+ characters"{% else %}placeholder="Your password"{% endif %}></label>
diff --git a/templates/base.html b/templates/base.html
index 03a9095..353fe40 100644
--- a/templates/base.html
+++ b/templates/base.html
@@ -23,7 +23,7 @@
         {% if current_user.role == 'admin' %}<a href="{{ url_for('admin_users') }}">Accounts</a>{% endif %}
         <a href="{{ url_for('change_password') }}">Password</a>
         <span class="user-chip">{{ current_user.username }}</span>
-        <form action="{{ url_for('logout') }}" method="post"><button class="text-button" type="submit">Log out</button></form>
+        <form action="{{ url_for('logout') }}" method="post"><input type="hidden" name="csrf_token" value="{{ csrf_token() }}"><button class="text-button" type="submit">Log out</button></form>
       {% else %}
         <a href="{{ url_for('login') }}">Sign in</a>
         <a class="button compact" href="{{ url_for('register') }}">Create account</a>
diff --git a/templates/editor.html b/templates/editor.html
index 5748778..98aa1af 100644
--- a/templates/editor.html
+++ b/templates/editor.html
@@ -3,6 +3,7 @@
 {% block content %}
 <section class="editor-wrap"><div class="section-head"><span>{{ 'EDIT TRANSMISSION' if post else 'NEW TRANSMISSION' }}</span><span>AUTHOR / {{ current_user.username }}</span></div>
 <form class="editor-form" method="post">
+  <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
   <label>Title<input name="title" required value="{{ post.title if post else '' }}" placeholder="A clear, useful heading"></label>
   <div class="two-col"><label>Category<input name="category" value="{{ post.category if post else 'Engineering' }}" placeholder="Engineering"></label><label>Summary<input name="excerpt" required value="{{ post.excerpt if post else '' }}" placeholder="The one-paragraph signal"></label></div>
   <label>Article<textarea name="body" required rows="16" placeholder="Write in plain text. Paragraph breaks are preserved.">{{ post.body if post else '' }}</textarea></label>
diff --git a/templates/mfa.html b/templates/mfa.html
index 798e156..61d9cd4 100644
--- a/templates/mfa.html
+++ b/templates/mfa.html
@@ -15,6 +15,7 @@
     {% endif %}
   </div>
   <form class="auth-form" method="post">
+    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
     <label>Authenticator code<input name="code" inputmode="numeric" autocomplete="one-time-code" required pattern="[0-9]{6}" maxlength="6" placeholder="000000"></label>
     <button class="button" type="submit">Verify account <span aria-hidden="true">→</span></button>
   </form>
diff --git a/templates/password_form.html b/templates/password_form.html
index b1c773a..09d228b 100644
--- a/templates/password_form.html
+++ b/templates/password_form.html
@@ -4,6 +4,7 @@
 <section class="auth-layout">
   <div class="auth-copy"><span class="signal-label">ACCOUNT SECURITY</span><h1>{% if mode == 'forgot' %}Recover the<br>signal.{% elif mode == 'reset' %}Set a new<br>password.{% else %}Update your<br>password.{% endif %}</h1><p>{% if mode == 'forgot' %}Enter the email address connected to your account. A secure reset link will arrive by email.{% else %}Choose a password with at least 10 characters.{% endif %}</p></div>
   <form class="auth-form" method="post">
+    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
     {% if mode == 'forgot' %}<label>Email<input name="email" type="email" autocomplete="email" required placeholder="you@example.com"></label>{% endif %}
     {% if mode == 'change' %}<label>Current password<input name="current_password" type="password" autocomplete="current-password" required></label>{% endif %}
     {% if mode != 'forgot' %}<label>New password<input name="password" type="password" autocomplete="new-password" required minlength="10" placeholder="10+ characters"></label>{% endif %}