feat(mfa): behavior redesign — withheld-token first-time setup, WebAuthn/Email/SMS as MFA factors, lockout + admin recovery

.github/workflows/storage-matrix.yml

@@ -0,0 +1,44 @@
+name: Storage backend matrix
+
+on:
+  # CI's `test` job only exercises SQLite (make test). This job runs the
+  # same provider_test.go suite against all 6 other backends via Docker
+  # containers (make test-all-db) - real coverage that otherwise never runs
+  # anywhere. Kept off the PR path since it's slow (multiple DB containers,
+  # Couchbase alone takes minutes to become healthy); PRs touching storage
+  # code get fast feedback via the path filter below instead of waiting on
+  # every unrelated PR.
+  pull_request:
+    paths:
+      - "internal/storage/**"
+      - "Makefile"
+      - "scripts/couchbase-test.sh"
+      - ".github/workflows/storage-matrix.yml"
+  schedule:
+    - cron: "0 3 * * *" # daily, catches regressions within a day either way
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+concurrency:
+  group: storage-matrix-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test-all-db:
+    name: Go tests (all storage backends)
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Run tests across all storage backends
+        run: make test-all-db

Dockerfile

@@ -58,7 +58,8 @@ RUN cd web/app && npm run build && cd ../dashboard && npm run build
 
 FROM alpine:3.23.3
 ARG ALPINE_EDGE_MAIN=https://dl-cdn.alpinelinux.org/alpine/edge/main
-RUN apk add --no-cache -X "${ALPINE_EDGE_MAIN}" "busybox>=1.37.0-r31"
+RUN apk add --no-cache -X "${ALPINE_EDGE_MAIN}" "busybox>=1.37.0-r31" && \
+    apk upgrade --no-cache
 
 ARG TARGETARCH=amd64
 

Makefile

@@ -88,7 +88,7 @@ dev:
 		--admin-secret=admin \
 		--client-id=kbyuFDidLLm280LIwVFiazOqjO3ty8KH \
 		--client-secret=60Op4HFM0I8ajz0WdiStAbziZ-VFQttXuxixHHs2R7r7-CW8GR79l-mmLqMhc-Sa \
-		--allowed-origins=localhost:8080,localhost:8090,localhost:9091,localhost:5173
+		--allowed-origins=localhost:8080,localhost:8090,localhost:9091,localhost:5173,localhost:5174
 
 test:
 	go clean --testcache && TEST_DBS="sqlite" $(GO_TEST_ALL)

cmd/mcp.go

@@ -100,6 +100,7 @@ func runMCP(_ *cobra.Command, _ []string) {
 	tokenProvider, err := token.New(&rootArgs.config, &token.Dependencies{
 		Log:                 &log,
 		MemoryStoreProvider: memoryStoreProvider,
+		StorageProvider:     storageProvider,
 	})
 	if err != nil {
 		log.Fatal().Err(err).Msg("failed to create token provider")

cmd/root.go

@@ -188,9 +188,10 @@ func init() {
 	// the effective Enable* / EnableMFA values from these flags.
 	f.BoolVar(&rootArgs.config.EnforceMFA, "enforce-mfa", false, "Enforce MFA for all users")
 	f.BoolVar(&rootArgs.config.DisableTOTPLogin, "disable-totp-login", false, "Disable TOTP-based MFA (enabled by default)")
+	f.BoolVar(&rootArgs.config.DisableWebauthnMFA, "disable-webauthn-mfa", false, "Disable WebAuthn/passkey as an MFA factor (enabled by default); does not affect WebAuthn/passkey as a primary login method")
 	f.BoolVar(&rootArgs.config.DisableEmailOTP, "disable-email-otp", false, "Disable email OTP MFA (enabled by default when email service is configured)")
 	f.BoolVar(&rootArgs.config.DisableSMSOTP, "disable-sms-otp", false, "Disable SMS OTP MFA (enabled by default when SMS service is configured)")
-	f.BoolVar(&rootArgs.config.DisableMFA, "disable-mfa", false, "Globally disable MFA (TOTP/email/SMS OTP), overriding the per-method flags; does not affect WebAuthn/passkey")
+	f.BoolVar(&rootArgs.config.DisableMFA, "disable-mfa", false, "Globally disable MFA (TOTP/email/SMS OTP), overriding the per-method flags; does not affect WebAuthn/passkey as a primary login method")
 	f.BoolVar(&rootArgs.config.EnableSignup, "enable-signup", true, "Enable signup")
 
 	// Cookies flags
@@ -535,6 +536,7 @@ func runRoot(c *cobra.Command, args []string) {
 	tokenProvider, err := token.New(&rootArgs.config, &token.Dependencies{
 		Log:                 &log,
 		MemoryStoreProvider: memoryStoreProvider,
+		StorageProvider:     storageProvider,
 	})
 	if err != nil {
 		log.Fatal().Err(err).Msg("failed to create token provider")