feat(mfa): TOTP secrets, recovery codes and factor lookup

2026-09-16 08:30:55 +00:00
parent b78a9b3832
commit 25541345a8
6 changed files with 407 additions and 0 deletions
@@ -22,6 +22,10 @@ type UserMFA struct {
 	// vantage-shared's backup.ciphertextFields - change one, change the other.
 	TOTPSecretEnc string `bson:"totp_secret_enc,omitempty" json:"-"`

+	// TOTPPendingEnc holds a secret from an unconfirmed StartTOTPSetup call.
+	// Transient: never mirrored into vantage-shared's backup.ciphertextFields.
+	TOTPPendingEnc string `bson:"totp_pending_enc,omitempty" json:"-"`
+
 	// TOTPConfirmedAt nil means setup was started but never confirmed, which
 	// does not count as an enrolled factor.
 	TOTPConfirmedAt *time.Time `bson:"totp_confirmed_at,omitempty" json:"totp_confirmed_at,omitempty"`