feat(mfa): optional MFA setup, passkey as a second factor, and close the EnforceMFA passkey bypass#685

Merged

lakhansamani merged 11 commits into

mainfrom

feat/enforce-mfa-passkey-gate

Jul 14, 2026

Commits on Jul 13, 2026

chore: ignore .worktrees/ (local git-worktree scratch dir)
lakhansamani
committed
feat(mfa): add has_skipped_mfa_setup_at to the user record
lakhansamani
committed
feat(mfa): add pure MFA-gate decision function with unit tests
lakhansamani
committed
feat(mfa): issue a session immediately and offer (not force) TOTP setup when MFA isn't enforced
lakhansamani
committed
test(mfa): add regression guard for TOTP MFA gate token-withholding
lakhansamani
committed
feat(mfa): add skip_mfa_setup mutation, blocked when MFA is enforced
lakhansamani
committed
fix(mfa): check auth before EnforceMFA in skip_mfa_setup
lakhansamani
committed