Skip to content

feat(mfa): add recovery codes unenroll guards - #2787

Open
fadymak wants to merge 1 commit into
masterfrom
fm/auth-1535
Open

feat(mfa): add recovery codes unenroll guards#2787
fadymak wants to merge 1 commit into
masterfrom
fm/auth-1535

Conversation

@fadymak

@fadymak fadymak commented Sep 4, 2026

Copy link
Copy Markdown
Contributor

Adds guards to:

  • Prevent unenrolling last verified non-recovery factor when a user still has a recovery code factor
  • Disallow the use of DELETE /factors/{id} endpoint for unenrolling recovery codes
    • We may choose to relax this in the future and unify the logic

@fadymak
fadymak requested a review from a team as a code owner September 4, 2026 07:20
depthfirst-app[bot]
depthfirst-app Bot reviewed Sep 4, 2026
View reviewed changes
Comment thread internal/api/mfa.go
xlgmokha
xlgmokha approved these changes Sep 4, 2026
View reviewed changes

@xlgmokha xlgmokha left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:shipit:

Comment thread internal/api/mfa.go
Comment thread internal/api/recovery_codes_test.go
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@depthfirst-app depthfirst-app[bot] depthfirst-app[bot] left review comments
@xlgmokha xlgmokha xlgmokha approved these changes
@hf hf hf approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@fadymak @xlgmokha @hf