coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Support opt-in MFA per browser client with authoritative enrollment checks
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 40s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
This commit is contained in:
tegwick 2026-09-13 00:27:28 +02:00
parent e1e292919a
commit ac8ed65203
14 changed files with 298 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

10
src/internal/domain/model.go
View file

@ -63,10 +63,12 @@ type Client struct {
Roles []string `yaml:"roles,omitempty" json:"roles,omitempty"`
// TokenLifetime overrides the server default for this confidential client.
// It is internal runtime policy, not identity data serialized into tokens.
TokenLifetime time.Duration `yaml:"-" json:"-"`
MFARequired *bool `yaml:"mfaRequired,omitempty" json:"mfaRequired,omitempty"`
RegistrationURL string `yaml:"registrationUrl,omitempty" json:"registrationUrl,omitempty"`
EnrollmentURL string `yaml:"enrollmentUrl,omitempty" json:"enrollmentUrl,omitempty"`
TokenLifetime time.Duration `yaml:"-" json:"-"`
// MFAOptional requires MFA for enrolled users, independently of RequireForAll.
MFAOptional bool `yaml:"mfaOptional,omitempty" json:"mfaOptional,omitempty"`
MFARequired *bool `yaml:"mfaRequired,omitempty" json:"mfaRequired,omitempty"`
RegistrationURL string `yaml:"registrationUrl,omitempty" json:"registrationUrl,omitempty"`
EnrollmentURL string `yaml:"enrollmentUrl,omitempty" json:"enrollmentUrl,omitempty"`
}
// Membership links a user to a group.