Skript: 2FA für Mitarbeiter anzeigen, einschalten, abschalten

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/services/appwriteAdmin.js

@@ -132,6 +132,17 @@ export async function updateAppwriteUserLabels(userId, labels) {
   })
 }
 
+export async function updateAppwriteUserMfa(userId, mfa) {
+  return adminFetch(`/users/${userId}/mfa`, { method: 'PATCH', body: { mfa: Boolean(mfa) } })
+}
+
+export async function updateAppwriteUserEmailVerification(userId, emailVerification) {
+  return adminFetch(`/users/${userId}/verification`, {
+    method: 'PATCH',
+    body: { emailVerification: Boolean(emailVerification) },
+  })
+}
+
 export async function deleteAppwriteUser(userId) {
   return adminFetch(`/users/${userId}`, { method: 'DELETE' })
 }

server/services/staffMfaAdmin.js

@@ -0,0 +1,38 @@
+import { config } from '../config.js'
+import {
+  getUserById,
+  listDocuments,
+  Query,
+  updateAppwriteUserEmailVerification,
+  updateAppwriteUserMfa,
+} from './appwriteAdmin.js'
+
+/**
+ * Mitarbeiter-2FA verwalten (scripts/mitarbeiter-2fa.mjs). Appwrite verlangt den E-Mail-Code nur, wenn
+ * die Adresse bestaetigt ist - deshalb beim Einschalten erst bestaetigen, dann 2FA an.
+ */
+export async function listStaffMfaStatus() {
+  const employees = await listDocuments(config.collections.employees, [Query.limit(100)])
+  const rows = []
+  for (const employee of employees) {
+    if (!employee.userId) continue
+    const user = await getUserById(employee.userId)
+    rows.push({
+      userId: employee.userId,
+      name: employee.displayName || user.name || '',
+      email: user.email || employee.email || '',
+      emailVerification: Boolean(user.emailVerification),
+      mfa: Boolean(user.mfa),
+    })
+  }
+  return rows
+}
+
+export async function enableStaffMfa(userId) {
+  await updateAppwriteUserEmailVerification(userId, true)
+  await updateAppwriteUserMfa(userId, true)
+}
+
+export async function disableStaffMfa(userId) {
+  await updateAppwriteUserMfa(userId, false)
+}