Skript: 2FA für Mitarbeiter anzeigen, einschalten, abschalten

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/services/staffMfaAdmin.js

@@ -0,0 +1,38 @@
+import { config } from '../config.js'
+import {
+  getUserById,
+  listDocuments,
+  Query,
+  updateAppwriteUserEmailVerification,
+  updateAppwriteUserMfa,
+} from './appwriteAdmin.js'
+
+/**
+ * Mitarbeiter-2FA verwalten (scripts/mitarbeiter-2fa.mjs). Appwrite verlangt den E-Mail-Code nur, wenn
+ * die Adresse bestaetigt ist - deshalb beim Einschalten erst bestaetigen, dann 2FA an.
+ */
+export async function listStaffMfaStatus() {
+  const employees = await listDocuments(config.collections.employees, [Query.limit(100)])
+  const rows = []
+  for (const employee of employees) {
+    if (!employee.userId) continue
+    const user = await getUserById(employee.userId)
+    rows.push({
+      userId: employee.userId,
+      name: employee.displayName || user.name || '',
+      email: user.email || employee.email || '',
+      emailVerification: Boolean(user.emailVerification),
+      mfa: Boolean(user.mfa),
+    })
+  }
+  return rows
+}
+
+export async function enableStaffMfa(userId) {
+  await updateAppwriteUserEmailVerification(userId, true)
+  await updateAppwriteUserMfa(userId, true)
+}
+
+export async function disableStaffMfa(userId) {
+  await updateAppwriteUserMfa(userId, false)
+}