feat(mfa): user_mfa and webauthn_credentials collections

server/internal/models/settings.go

@@ -11,3 +11,7 @@ type (
 // APITokenMaxDays re-exports shared.APITokenMaxDays so server/internal/services
 // can read the token lifetime cap without importing shared/models directly.
 func APITokenMaxDays(s *Settings) int { return shared.APITokenMaxDays(s) }
+
+// RequireMFA re-exports shared.RequireMFA so services can read the MFA policy
+// without importing shared/models directly.
+func RequireMFA(s *Settings) bool { return shared.RequireMFA(s) }

server/internal/models/user_mfa.go

@@ -0,0 +1,61 @@
+package models
+
+import (
+	"time"
+
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+// UserMFA is one user's multi-factor enrolment. It is a separate collection
+// rather than fields on User because User lives in vantage-shared, which Vantage
+// HQ also writes: MFA is a control-plane concern per instance.
+type UserMFA struct {
+	ID         bson.ObjectID `bson:"_id,omitempty" json:"-"`
+	InstanceID string        `bson:"instance_id" json:"-"`
+	UserID     string        `bson:"user_id" json:"-"`
+
+	// WebAuthnHandle is a random 64 bytes, never the user ID: the handle is
+	// returned to any origin that asks a resident credential for it.
+	WebAuthnHandle []byte `bson:"webauthn_handle" json:"-"`
+
+	// TOTPSecretEnc is AES-256-GCM hex via services.encryptString. Mirrored in
+	// vantage-shared's backup.ciphertextFields - change one, change the other.
+	TOTPSecretEnc string `bson:"totp_secret_enc,omitempty" json:"-"`
+
+	// TOTPConfirmedAt nil means setup was started but never confirmed, which
+	// does not count as an enrolled factor.
+	TOTPConfirmedAt *time.Time `bson:"totp_confirmed_at,omitempty" json:"totp_confirmed_at,omitempty"`
+
+	RecoveryCodes []RecoveryCode `bson:"recovery_codes,omitempty" json:"-"`
+
+	UpdatedAt time.Time `bson:"updated_at" json:"updated_at"`
+}
+
+// RecoveryCode stores only a SHA-256 hash: a leaked database yields no working
+// codes, exactly as api_tokens and agent tokens do.
+type RecoveryCode struct {
+	Hash   string     `bson:"hash"`
+	UsedAt *time.Time `bson:"used_at,omitempty"`
+}
+
+// WebAuthnCredential is one passkey. Nothing here is secret - a public key is
+// public - so no field is encrypted.
+type WebAuthnCredential struct {
+	ID         bson.ObjectID `bson:"_id,omitempty" json:"-"`
+	InstanceID string        `bson:"instance_id" json:"-"`
+	UserID     string        `bson:"user_id" json:"-"`
+
+	CredentialID []byte   `bson:"credential_id" json:"-"`
+	PublicKey    []byte   `bson:"public_key" json:"-"`
+	SignCount    uint32   `bson:"sign_count" json:"-"`
+	AAGUID       []byte   `bson:"aaguid" json:"-"`
+	Transports   []string `bson:"transports,omitempty" json:"transports,omitempty"`
+
+	// CredentialIDHex is the browser-facing identifier for rename and delete.
+	// The raw bytes never reach a URL.
+	CredentialIDHex string `bson:"credential_id_hex" json:"id"`
+
+	Name       string     `bson:"name" json:"name"`
+	CreatedAt  time.Time  `bson:"created_at" json:"created_at"`
+	LastUsedAt *time.Time `bson:"last_used_at,omitempty" json:"last_used_at,omitempty"`
+}