feat(mfa): user_mfa and webauthn_credentials collections

server/internal/services/coreindexes.go

@@ -41,3 +41,28 @@ func EnsureAuthIndexes() error {
 	}
 	return nil
 }
+
+// EnsureMFAIndexes is fatal on failure like EnsureAuthIndexes, and for the same
+// reason: these unique indexes are a security property, not an optimisation. A
+// duplicate (instance_id, user_id) would make "this user's factors" ambiguous,
+// and a duplicate credential_id would let an assertion resolve to two users.
+func EnsureMFAIndexes() error {
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	if _, err := db.Col("user_mfa").Indexes().CreateOne(ctx, mongo.IndexModel{
+		Keys:    bson.D{{Key: "instance_id", Value: 1}, {Key: "user_id", Value: 1}},
+		Options: options.Index().SetUnique(true),
+	}); err != nil {
+		return err
+	}
+
+	_, err := db.Col("webauthn_credentials").Indexes().CreateMany(ctx, []mongo.IndexModel{
+		{
+			Keys:    bson.D{{Key: "instance_id", Value: 1}, {Key: "credential_id", Value: 1}},
+			Options: options.Index().SetUnique(true),
+		},
+		{Keys: bson.D{{Key: "instance_id", Value: 1}, {Key: "user_id", Value: 1}}},
+	})
+	return err
+}

server/internal/services/mfa_scoped_test.go

@@ -0,0 +1,21 @@
+package services
+
+import "testing"
+
+// A tenant-scoped collection missing from ScopedCollections outlives its
+// instance when the instance is purged - here that means a former customer's
+// TOTP secrets and passkeys stay in the database forever.
+func TestMFACollectionsAreScoped(t *testing.T) {
+	for _, name := range []string{"user_mfa", "webauthn_credentials"} {
+		found := false
+		for _, got := range ScopedCollections {
+			if got == name {
+				found = true
+				break
+			}
+		}
+		if !found {
+			t.Errorf("%s is not in ScopedCollections", name)
+		}
+	}
+}

server/internal/services/migrate_instance.go

@@ -52,6 +52,8 @@ var ScopedCollections = []string{
 	"patch_policies",
 	"patch_runs",
 	"patch_run_outputs",
+	"user_mfa",
+	"webauthn_credentials",
 }
 
 // collectionRenames maps the two collections whose names change. Ordered so the