feat: require_mfa setting and user_mfa ciphertext mirror

models/settings.go

@@ -35,6 +35,12 @@ type Settings struct {
 	// upgrade. Nil means enabled.
 	LocalLoginEnabled *bool `bson:"local_login_enabled,omitempty" json:"local_login_enabled,omitempty"`
 
+	// RequireMFA forces every password-authenticated member to hold a second
+	// factor. A pointer for the same reason LocalLoginEnabled is: absent must
+	// mean off, and a plain bool read from an old document would lock out an
+	// entire instance at upgrade.
+	RequireMFA *bool `bson:"require_mfa,omitempty" json:"require_mfa,omitempty"`
+
 	// VulnFindingRetentionDays is a pointer for the same reason
 	// WorkflowLogRetentionDays is: absent must mean the default, not zero.
 	// Nil is 90 days, 0 is forever. Only "fixed" findings are ever swept.
@@ -62,6 +68,12 @@ func LocalLoginEnabled(s *Settings) bool {
 	return *s.LocalLoginEnabled
 }
 
+// RequireMFA reads the MFA policy with its absent-means-off default. Every
+// caller must go through this rather than dereferencing the field.
+func RequireMFA(s *Settings) bool {
+	return s != nil && s.RequireMFA != nil && *s.RequireMFA
+}
+
 // APITokenMaxDays reads the token lifetime cap with its absent-means-uncapped
 // default. 0 means no cap. Every caller must go through this rather than
 // dereferencing the field.