improve security, store secretKey using Secret from hudson utils

pom.xml

@@ -15,7 +15,9 @@
   <packaging>hpi</packaging>
 
   <name>MFA Google Auth Plugin</name>
-  <description>Multi-Factor Authentication with Google Authenticator.</description>
+  <description>Adds TOTP-based Multi-Factor Authentication (MFA/2FA) to Jenkins using Google Authenticator.
+  Enhances security by requiring a time-based one-time password in addition to regular credentials.
+  Features QR code setup, per-user enforcement, and secure secret storage.</description>
   <url>https://github.com/jenkinsci/${project.artifactId}-plugin</url>
   <licenses>
     <license>

src/main/java/io/jenkins/plugins/MfaUserProperty.java

@@ -22,12 +22,13 @@ import hudson.model.User;
 import hudson.model.UserProperty;
 import hudson.model.UserPropertyDescriptor;
 import hudson.util.FormValidation;
+import hudson.util.Secret;
 import org.kohsuke.stapler.DataBoundConstructor;
 import org.kohsuke.stapler.QueryParameter;
 
 public class MfaUserProperty extends UserProperty {
     private final boolean mfaEnabled;
-    private final String secretKey;
+    private final Secret secretKey;
 
     @DataBoundConstructor
     public MfaUserProperty(boolean mfaEnabled, String secretKey, String totpCode) throws FormException {
@@ -44,7 +45,7 @@ public class MfaUserProperty extends UserProperty {
             }
         }
         this.mfaEnabled = mfaEnabled;
-        this.secretKey = secretKey;
+        this.secretKey = Secret.fromString(secretKey);
     }
 
     public boolean isMfaEnabled() {
@@ -52,6 +53,10 @@ public class MfaUserProperty extends UserProperty {
     }
 
     public String getSecretKey() {
+        return secretKey.getPlainText();
+    }
+
+    public Secret getEncryptedSecretKey() {
         return secretKey;
     }
 

src/main/java/io/jenkins/plugins/MfaVerifyAction.java

@@ -63,14 +63,14 @@ public class MfaVerifyAction implements RootAction {
 
         if (mfa != null && mfa.isMfaEnabled()) {
             String code = req.getParameter("totpCode");
-            if (TOTPUtil.verifyCode(mfa.getSecretKey(), code)) {
+            if (TOTPUtil.verifyCode(mfa.getEncryptedSecretKey(), code)) {
                 // Proteção simplificada - apenas marca como verificado
                 HttpSession session = req.getSession();
                 session.setAttribute("mfa-verified", true);
-                
+
                 // Alternativa: Rotaciona o ID da sessão sem invalidá-la
                 session = req.getSession(true);
-                
+
                 LOGGER.log(Level.INFO, "MFA verification successful for user: " + u.getId());
                 rsp.sendRedirect(req.getContextPath() + "/");
                 return;

src/main/java/io/jenkins/plugins/TOTPUtil.java

@@ -15,6 +15,7 @@ package io.jenkins.plugins;
 
 import com.warrenstrange.googleauth.GoogleAuthenticator;
 import com.warrenstrange.googleauth.GoogleAuthenticatorKey;
+import hudson.util.Secret;
 
 public class TOTPUtil {
 
@@ -28,6 +29,14 @@ public class TOTPUtil {
         return String.format("otpauth://totp/%s@%s?secret=%s&issuer=%s", user, host, secret, issuer);
     }
 
+    public static boolean verifyCode(Secret secret, String code) {
+        try {
+            return verifyCode(secret.getPlainText(), code);
+        } catch (Exception e) {
+            return false;
+        }
+    }
+
     public static boolean verifyCode(String secret, String code) {
         try {
             int codeInt = Integer.parseInt(code);

src/main/resources/index.jelly

@@ -1,4 +1,6 @@
 <?jelly escape-by-default='true'?>
 <div>
-    TODO
+  Adds TOTP-based Multi-Factor Authentication (MFA/2FA) to Jenkins using Google Authenticator.
+  Enhances security by requiring a time-based one-time password in addition to regular credentials.
+  Features QR code setup, per-user enforcement, and secure secret storage.
 </div>