Fix: Trusted-Device-Cookie überlebt jetzt den Logout

- resp.delete_cookie('mfa_trust') aus /logout entfernt
- Cookie wird nur noch bei MFA-Deaktivierung/Passwort-Reset gelöscht
- Debug-Prints entfernt, users.json aufgeräumt

app.py

@@ -517,9 +517,6 @@ def login():
                         # Trusted Device prüfen (Cookie überspringt MFA)
                         trust_token = request.cookies.get("mfa_trust")
                         if trust_token:
-                            users_data = load_users()
-                            user_data = users_data.get(email, {})
-                            trusted = user_data.get("trusted_devices", [])
                             now = datetime.now()
                             # Abgelaufene Einträge bereinigen
                             active = [d for d in trusted
@@ -537,6 +534,8 @@ def login():
                                             if user.must_change_password:
                                                 return redirect("/change-password")
                                             return redirect("/admin")
+                                        else:
+                                            pass
                                     except (ValueError, KeyError):
                                         pass
                             if changed:
@@ -566,9 +565,7 @@ def logout():
     email = current_user.email if current_user.is_authenticated else "unknown"
     logout_user()
     add_history_entry("user_logout", f"User '{email}' abgemeldet", email)
-    resp = redirect("/login")
-    resp.delete_cookie("mfa_trust")
-    return resp
+    return redirect("/login")
 
 
 # -------------------------------------------------
@@ -597,6 +594,8 @@ def mfa_verify():
         totp = pyotp.TOTP(user.mfa_secret)
 
         if code and totp.verify(code):
+            login_user(user)
+            session.pop("mfa_user", None)
             # Trusted Device speichern wenn gewünscht
             remember_days = request.form.get("remember")
             if remember_days:
@@ -604,28 +603,22 @@ def mfa_verify():
                     days = int(remember_days)
                     if 1 <= days <= 365:
                         token = secrets.token_urlsafe(32)
-                        expires = datetime.now().isoformat()
-                        exp_date = datetime.now()
-                        exp_date = exp_date + timedelta(days=days)
+                        exp_date = datetime.now() + timedelta(days=days)
                         expires = exp_date.isoformat()
                         users_data = load_users()
                         trusted = users_data.setdefault(email, {}).setdefault("trusted_devices", [])
                         trusted.append({"token": token, "expires": expires})
                         save_users(users_data)
-                        resp = redirect("/admin")
+                        add_history_entry("user_login", f"User '{email}' angemeldet (mit MFA, Gerät für {days} Tage gespeichert)", email)
+                        target = "/change-password" if user.must_change_password else "/admin"
+                        resp = redirect(target)
                         resp.set_cookie("mfa_trust", token, max_age=days * 86400,
+                                        path="/",
                                         httponly=True, samesite="Lax",
                                         secure=False)
-                        login_user(user)
-                        session.pop("mfa_user", None)
-                        add_history_entry("user_login", f"User '{email}' angemeldet (mit MFA, Gerät für {days} Tage gespeichert)", email)
-                        if user.must_change_password:
-                            resp = redirect("/change-password")
                         return resp
                 except (ValueError, TypeError):
                     pass
-            login_user(user)
-            session.pop("mfa_user", None)
             add_history_entry("user_login", f"User '{email}' angemeldet (mit MFA)", email)
             if user.must_change_password:
                 return redirect("/change-password")

users.json

@@ -15,10 +15,11 @@
       "FC204A",
       "1D09D7"
     ],
-    "mfa_secret": "VOLBXT7HYK6BXBD32EGW7CMFLVD53QON"
+    "mfa_secret": "VOLBXT7HYK6BXBD32EGW7CMFLVD53QON",
+    "trusted_devices": []
   },
   "erik.thiele@cancom.de": {
-    "password_hash": "scrypt:32768:8:1$gyBs4dA7DhH9wA0u$c80f25262388095545733c95dd4e569eee610fa849a11dd28d4f504d09e23d3768adad26d4ed671975bd3dcbae5dc43bd982f4d475e6bc9d2ede088cb0b6c025",
+    "password_hash": "scrypt:32768:8:1$D8XYprsEYMO5EPrG$2829b18f77bbd7d9f0cbb945b0bdbc32e16d7889f8711881f82dd35accd26ddb7c31d3fa85e3b89d19d6d1f0b92d8d18765e1c82044188cab8fd0db2d35a0d15",
     "role": "admin",
     "sites": [],
     "must_change_password": false,
@@ -26,17 +27,23 @@
     "last_name": "Thiele",
     "department": "CSO",
     "notes": "Standort Stuttgart",
-    "mfa_secret": "CHKS2QZOJ45TSCLUN7FWO3MLTMRSS6Q3",
+    "mfa_secret": "LR5DYI3SQPMW5XWKO33HPETHY5TPOWRG",
     "mfa_enabled": true,
     "mfa_recovery_codes": [
-      "1FB378",
-      "AAD593",
-      "B4BCB9",
-      "9CB5C3",
-      "22D614",
-      "26F3B7",
-      "47FB5C",
-      "50BB59"
+      "7BBD93",
+      "EB1D3B",
+      "BEE291",
+      "D471D5",
+      "D43C00",
+      "75DBAC",
+      "8B00CB",
+      "7AF72D"
+    ],
+    "trusted_devices": [
+      {
+        "token": "5kMgj4JPxd2IHuzV5MagAAcYyi_DBImyGimBSvZUNVg",
+        "expires": "2026-07-24T15:40:28.955130"
+      }
     ]
   },
   "test1@test.de": {
@@ -51,6 +58,7 @@
     "first_name": "test",
     "last_name": "tester",
     "department": "addff",
-    "notes": "asdasdasd"
+    "notes": "asdasdasd",
+    "trusted_devices": []
   }
 }