- Shipped
- August 3, 2026 at 4:13 AM UTC
- Author
- Kamo
- Commit
- c65a233
Backs UserMfaEnrollment and MfaRecoveryCode in kamo-shared-library — §164.312(d) Person or Entity Authentication, the gap the compliance assessment called disqualifying on its own. Both tables verified present in the cluster with the expected shape before the entities were pushed, so no service can build against a mapping whose table does not exist. Three details worth not losing to a later simplification: - SECRET_CIPHERTEXT holds ciphertext. The service refuses to write an enrollment at all when no key is configured, rather than degrading to plaintext. - LAST_USED_TIME_STEP is what makes a code single-use. A TOTP is valid for its whole 30-second step, so without it an intercepted code replays inside its own window. - Recovery codes get a row each rather than a serialized list, so redeeming one is a targeted update instead of a read-modify-write over the set — which under concurrency is exactly how a "single-use" code gets used twice.