feat(mfa): behavior redesign — withheld-token first-time setup, WebAuthn/Email/SMS as MFA factors, lockout + admin recovery#686

Open

lakhansamani wants to merge 28 commits into

mainfrom

feat/enforce-mfa-passkey-gate

Commits on Jul 14, 2026

fix(mfa): default new users into MFA when it's available server-wide
lakhansamani
committed
feat(mfa): lazily backfill existing users into the MFA default on login
lakhansamani
committed
feat(mfa): add --disable-webauthn-mfa, fold WebAuthn into EnableMFA derivation
lakhansamani
committed
docs(mfa): clarify --disable-mfa's effect on WebAuthn's MFA-factor role
lakhansamani
committed
revert(mfa): drop persisted MFA defaults, add pure effectiveMFAEnabled
lakhansamani
committed
feat(mfa): withhold token on first-time offer, unify passkey gate with resolveMFAGate
lakhansamani
committed
feat(mfa): rework skip_mfa_setup for the withheld-token model
lakhansamani
committed
feat(mfa): user-initiated lockout + admin reset via _update_user
lakhansamani
committed
feat(mfa): email/SMS OTP as enrolled MFA methods
lakhansamani
committed
feat(mfa): gate SignUp() the same way as Login()
lakhansamani
committed
feat(mfa): gate oauth_callback.go the same way as password login
lakhansamani
committed

Commits on Jul 15, 2026

Commits on Jul 16, 2026