@oneuptime/common 12.0.20 → 12.0.22

package/Server/API/UserTwoFactorBackupCodeAPI.ts

@@ -0,0 +1,258 @@
+import ObjectID from "../../Types/ObjectID";
+import Hostname from "../../Types/API/Hostname";
+import Protocol from "../../Types/API/Protocol";
+import Route from "../../Types/API/Route";
+import URL from "../../Types/API/URL";
+import OneUptimeDate from "../../Types/Date";
+import EmailTemplateType from "../../Types/Email/EmailTemplateType";
+import { DashboardRoute } from "../../ServiceRoute";
+import DatabaseConfig from "../DatabaseConfig";
+import MailService from "../Services/MailService";
+import UserService from "../Services/UserService";
+import User from "../../Models/DatabaseModels/User";
+import UserMiddleware from "../Middleware/UserAuthorization";
+import UserTwoFactorBackupCodeService, {
+  Service as UserTwoFactorBackupCodeServiceType,
+  TwoFactorBackupCodeStatus,
+} from "../Services/UserTwoFactorBackupCodeService";
+import TwoFactorBackupCode from "../Utils/TwoFactorBackupCode";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+  OneUptimeRequest,
+} from "../Utils/Express";
+import BaseAPI from "./BaseAPI";
+import UserTwoFactorBackupCode from "../../Models/DatabaseModels/UserTwoFactorBackupCode";
+import NotAuthenticatedException from "../../Types/Exception/NotAuthenticatedException";
+import Response from "../Utils/Response";
+import logger from "../Utils/Logger";
+
+/**
+ * The two routes a signed-in user needs to manage their recovery codes.
+ *
+ * Both act on the CALLER's own codes and nobody else's. There is deliberately
+ * no `:userId` parameter anywhere here: the owner is read from the validated
+ * access token, so there is no id for a caller to substitute and no ownership
+ * check to get wrong. `UserMiddleware.getUserMiddleware` is what puts it
+ * there.
+ */
+export default class UserTwoFactorBackupCodeAPI extends BaseAPI<
+  UserTwoFactorBackupCode,
+  UserTwoFactorBackupCodeServiceType
+> {
+  public constructor() {
+    super(UserTwoFactorBackupCode, UserTwoFactorBackupCodeService);
+
+    const crudApiPath: string =
+      new this.entityType().getCrudApiPath()?.toString() || "";
+
+    /*
+     * Mint a fresh set and return the plaintext codes.
+     *
+     * THIS RESPONSE IS THE ONLY COPY. Nothing is stored but keyed digests, so
+     * if the user closes the tab the codes are gone -- not recoverable by
+     * them, by an operator, or by anybody with the database. The UI is
+     * expected to make that unmissable, and the count of a previous set is
+     * returned alongside so the page can say what was just invalidated.
+     *
+     * It is a POST because it is destructive: calling it throws away every
+     * code the user was previously holding. A GET that silently voided a
+     * printed list -- on a browser prefetch, say -- would be a lockout with no
+     * user action behind it.
+     *
+     * NOT gated on `enableTwoFactorAuth`. Generating codes before turning two
+     * factor auth on is the sensible order to do it in, and refusing here
+     * would push users into the exact sequence -- enable first, find recovery
+     * later -- that produces the lost-device support ticket this whole feature
+     * exists to prevent.
+     */
+    this.router.post(
+      `${crudApiPath}/generate`,
+      UserMiddleware.getUserMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          const userId: ObjectID =
+            UserTwoFactorBackupCodeAPI.getCurrentUserId(req);
+
+          const previousStatus: TwoFactorBackupCodeStatus =
+            await UserTwoFactorBackupCodeService.getStatusForUser({
+              userId: userId,
+            });
+
+          const codes: Array<string> =
+            await UserTwoFactorBackupCodeService.regenerateForUser({
+              userId: userId,
+            });
+
+          /*
+           * The codes themselves are NEVER logged -- they are sign-in
+           * credentials, and logger output reaches stdout, the recent-log
+           * buffer and telemetry at once. The fact that a set was minted is
+           * worth recording: it is how an operator later reconstructs "who
+           * invalidated the codes this user says they had".
+           */
+          logger.info(
+            `Two factor backup codes regenerated for user: ${userId.toString()}`,
+          );
+
+          /*
+           * Tell the account holder, at their address rather than in this
+           * browser.
+           *
+           * This route is the destructive one and it is the one with the least
+           * standing in front of it: a session alone -- no password, no second
+           * factor -- silently voids every recovery code the user is holding.
+           * Somebody who has stolen a session can therefore remove the owner's
+           * way back in and leave no trace the owner would ever look at, and
+           * the owner finds out at the next sign-in they cannot complete.
+           *
+           * The mail does not prevent that; it makes it visible, which is the
+           * same bargain `sendTwoFactorBackupCodeUsedEmail` strikes on the
+           * login path. Re-prompting for the password here would be stronger
+           * still, and is the obvious next step -- it needs a re-authentication
+           * mechanism this codebase does not have yet, so it is deliberately
+           * not invented on this route alone.
+           *
+           * Detached and never awaited: an unreachable mail server must not
+           * fail a regeneration that has already replaced the user's codes,
+           * because the response carries the only copy of the new ones.
+           */
+          UserTwoFactorBackupCodeAPI.notifyCodesRegenerated({
+            userId: userId,
+            newCodeCount: codes.length,
+          }).catch((err: Error) => {
+            logger.error(err);
+          });
+
+          return Response.sendJsonObjectResponse(req, res, {
+            /*
+             * Hyphenated for the page to render as-is. The verify route
+             * normalizes whatever comes back, so a user may type them with
+             * the hyphen, without it, or with whatever spacing their password
+             * manager pasted in.
+             */
+            codes: codes.map((code: string) => {
+              return TwoFactorBackupCode.formatForDisplay(code);
+            }),
+            replacedCodeCount: previousStatus.total,
+          });
+        } catch (err) {
+          return next(err);
+        }
+      },
+    );
+
+    /*
+     * How many codes the caller has left.
+     *
+     * Carries no code material of any kind -- three numbers and a date -- so
+     * it is safe for the profile page to poll and safe to render anywhere a
+     * session already exists.
+     */
+    this.router.get(
+      `${crudApiPath}/status`,
+      UserMiddleware.getUserMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          const userId: ObjectID =
+            UserTwoFactorBackupCodeAPI.getCurrentUserId(req);
+
+          const status: TwoFactorBackupCodeStatus =
+            await UserTwoFactorBackupCodeService.getStatusForUser({
+              userId: userId,
+            });
+
+          /*
+           * A stale "you have 8 codes left" served out of a browser cache
+           * after the user has just regenerated is a user who thinks the
+           * button did nothing.
+           */
+          Response.setNoCacheHeaders(res);
+
+          return Response.sendJsonObjectResponse(req, res, {
+            total: status.total,
+            unused: status.unused,
+            generatedAt: status.generatedAt
+              ? status.generatedAt.toISOString()
+              : null,
+          });
+        } catch (err) {
+          return next(err);
+        }
+      },
+    );
+  }
+
+  /**
+   * Mail the owner that their backup codes were replaced.
+   *
+   * Separate from the handler so the handler stays readable, and `private
+   * static` because nothing outside this route should be announcing a
+   * regeneration that did not happen here.
+   *
+   * Reads the address itself rather than taking it from the request: the only
+   * thing the caller proved is which user they are, and the address this goes
+   * to has to be the one on the account, not one they supplied.
+   */
+  private static async notifyCodesRegenerated(data: {
+    userId: ObjectID;
+    newCodeCount: number;
+  }): Promise<void> {
+    const user: User | null = await UserService.findOneById({
+      id: data.userId,
+      select: {
+        email: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (!user || !user.email) {
+      return;
+    }
+
+    const host: Hostname = await DatabaseConfig.getHost();
+    const httpProtocol: Protocol = await DatabaseConfig.getHttpProtocol();
+
+    await MailService.sendMail({
+      toEmail: user.email,
+      subject: "Your OneUptime two factor backup codes were replaced",
+      templateType: EmailTemplateType.TwoFactorBackupCodesRegenerated,
+      vars: {
+        generatedAt: OneUptimeDate.getCurrentDateAsFormattedString(),
+        newCodeCount: data.newCodeCount.toString(),
+        twoFactorAuthUrl: new URL(
+          httpProtocol,
+          host,
+          new Route(DashboardRoute.toString()).addRoute(
+            "/user-profile/two-factor-auth",
+          ),
+        ).toString(),
+        homeUrl: new URL(httpProtocol, host).toString(),
+      },
+    });
+  }
+
+  /**
+   * The signed-in caller, from the token the middleware validated.
+   *
+   * Throws rather than returning null: every route in this file acts on the
+   * caller's own credentials, so "no caller" is not a case any of them can
+   * meaningfully proceed with. The middleware ahead of them should already
+   * have refused, which makes this a second lock rather than the first.
+   */
+  private static getCurrentUserId(req: ExpressRequest): ObjectID {
+    const userId: ObjectID | undefined = (req as OneUptimeRequest)
+      .userAuthorization?.userId;
+
+    if (!userId) {
+      throw new NotAuthenticatedException(
+        "You are not authenticated. Please sign in.",
+      );
+    }
+
+    return userId;
+  }
+}

package/Server/EnvironmentConfig.ts

@@ -385,17 +385,10 @@ export const AnalyticsHost: string = process.env["ANALYTICS_HOST"] || "";
 export const GoogleTagManagerEnabled: boolean =
   IsBillingEnabled && process.env["GOOGLE_TAG_MANAGER_ENABLED"] !== "false";
 
-/*
- * Shared secret Cal.com signs booking webhooks with (App/API/CalWebhook.ts).
- * Server-only — must never be added to FRONTEND_ENV_ALLOW_LIST. Empty means
- * the webhook endpoint is disabled and answers 503.
- */
-export const CalWebhookSecret: string = process.env["CAL_WEBHOOK_SECRET"] || "";
-
 /*
  * Outbound marketing conversion webhooks.
  *
- * OneUptime does not store conversions. Signups, booked meetings and plan
+ * OneUptime does not store conversions. Signups and plan
  * upgrades/downgrades are POSTed to this endpoint as they happen and kept
  * nowhere afterwards, so an unset URL means those moments are simply not
  * measured — nothing accumulates waiting for one to be configured.

package/Server/Infrastructure/Postgres/SchemaMigrations/1789000000000-AddUserSlackAndMicrosoftTeams.ts

@@ -14,6 +14,10 @@ export class AddUserSlackAndMicrosoftTeams1789000000000
   public name = "AddUserSlackAndMicrosoftTeams1789000000000";
 
   public async up(queryRunner: QueryRunner): Promise<void> {
+    if (await this.isAlreadyApplied(queryRunner)) {
+      return;
+    }
+
     await queryRunner.query(
       `CREATE TABLE "UserSlack" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "slackUserId" character varying(100), "slackUserName" character varying(100), "userId" uuid, "createdByUserId" uuid, "deletedByUserId" uuid, "isVerified" boolean NOT NULL DEFAULT false, CONSTRAINT "PK_86de4cd76b41a08811fc403e23a" PRIMARY KEY ("_id"))`,
     );
@@ -106,6 +110,44 @@ export class AddUserSlackAndMicrosoftTeams1789000000000
     );
   }
 
+  /*
+   * Did everything in `up` already run, under this migration's OLD name?
+   *
+   * This shipped as AddUserSlackAndMicrosoftTeams1788800000000 and was
+   * renumbered to 1789000000000 to clear a timestamp collision with
+   * DropMarketingConversionAddEnterpriseLicenseEmail. TypeORM identifies a
+   * migration by class NAME rather than by what it does, so every database
+   * that had already recorded the old name — anything tracking master between
+   * the two commits, which is every test and staging cluster — sees the
+   * renamed class as pending and runs it a second time, where
+   * `CREATE TABLE "UserSlack"` fails on the table it created itself. The
+   * runner stops at the first failure, so that single error holds back this
+   * migration and every migration added after it, on every boot.
+   *
+   * The probe is the table because the earlier run was all-or-nothing:
+   * migrations run one transaction each (DataSourceOptions sets
+   * migrationsTransactionMode: "each") and Postgres DDL is transactional, so
+   * "UserSlack" existing means every statement in `up` already committed.
+   * Nothing is left to do but let TypeORM record the new name.
+   *
+   * The superseded row in "migrations" is deliberately left alone. Deleting it
+   * would make this migration pending again for anyone who rolls the image
+   * BACK to a build that still registers the old name — the same failure, in
+   * the other direction. An unrecognised name in that table is inert.
+   */
+  private async isAlreadyApplied(queryRunner: QueryRunner): Promise<boolean> {
+    const userSlackTableExists: Array<{ exists: boolean }> =
+      await queryRunner.query(`
+            SELECT EXISTS (
+                SELECT FROM information_schema.tables
+                WHERE table_schema = 'public'
+                AND table_name = 'UserSlack'
+            )
+        `);
+
+    return Boolean(userSlackTableExists[0]?.exists);
+  }
+
   public async down(queryRunner: QueryRunner): Promise<void> {
     await queryRunner.query(
       `ALTER TABLE "UserOnCallLogTimeline" DROP CONSTRAINT "FK_a7206c19df5cdfe02cf3215a64c"`,

package/Server/Infrastructure/Postgres/SchemaMigrations/1789100000000-AddUserTwoFactorBackupCode.ts

@@ -0,0 +1,63 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Single-use two factor backup codes, so losing an authenticator app or a
+ * security key stops being an account lockout that only a master admin can
+ * undo.
+ *
+ * One row per code rather than an array column on User: consuming a code is
+ * then one conditional UPDATE that Postgres serialises for us, instead of a
+ * read-modify-write of an array where two simultaneous sign-ins would each
+ * write back a copy missing only their own code.
+ *
+ * `codeHash` holds an HMAC-SHA256 keyed by the instance EncryptionSecret and
+ * domain separated by the owning user -- never a code in the clear. It is a
+ * plain varchar rather than a `hashed: true` column because the write path's
+ * hashing lanes do neither of those things: the salted lane is scrypt (right
+ * for a guessable password, pure cost for a 2^50 random code) and the unsalted
+ * lane is a bare SHA-256 with no per-user binding. See
+ * Common/Server/Utils/TwoFactorBackupCode.ts.
+ *
+ * The (userId, codeHash) index is the sign-in lookup, which happens while
+ * somebody is locked out and waiting. `usedAt` is deliberately not in it: a
+ * user holds ten rows, so Postgres filters those in memory for nothing.
+ */
+export class AddUserTwoFactorBackupCode1789100000000
+  implements MigrationInterface
+{
+  public name: string = "AddUserTwoFactorBackupCode1789100000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "UserTwoFactorBackupCode" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "codeHash" character varying(100) NOT NULL, "usedAt" TIMESTAMP WITH TIME ZONE, "deletedByUserId" uuid, "userId" uuid, CONSTRAINT "PK_8007aa681bcad47b88b906319ed" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_19a5937a4f6bd993383b31f3a2" ON "UserTwoFactorBackupCode" ("userId", "codeHash") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserTwoFactorBackupCode" ADD CONSTRAINT "FK_b6f9bfb29ab554076a2d8dde717" FOREIGN KEY ("deletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    /*
+     * CASCADE, not SET NULL. An orphaned row would be a live sign-in
+     * credential for an account that no longer exists -- and, with `userId`
+     * null, invisible to every query in the service, which all key on the
+     * owner.
+     */
+    await queryRunner.query(
+      `ALTER TABLE "UserTwoFactorBackupCode" ADD CONSTRAINT "FK_dd1f93f94cd3a4f39435b56d944" FOREIGN KEY ("userId") REFERENCES "User"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "UserTwoFactorBackupCode" DROP CONSTRAINT "FK_dd1f93f94cd3a4f39435b56d944"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserTwoFactorBackupCode" DROP CONSTRAINT "FK_b6f9bfb29ab554076a2d8dde717"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_19a5937a4f6bd993383b31f3a2"`,
+    );
+    await queryRunner.query(`DROP TABLE "UserTwoFactorBackupCode"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -542,8 +542,8 @@ import { RemoveLlmCostBudgetAlertColumns1788500000000 } from "./1788500000000-Re
 import { AddDetectionRuleIncidentColumns1788600000000 } from "./1788600000000-AddDetectionRuleIncidentColumns";
 import { RemoveMarketingConversionUploadState1788700000000 } from "./1788700000000-RemoveMarketingConversionUploadState";
 import { DropMarketingConversionAddEnterpriseLicenseEmail1788800000000 } from "./1788800000000-DropMarketingConversionAddEnterpriseLicenseEmail";
-import { RedactStoredMonitorIngestSecrets1788900000000 } from "./1788900000000-RedactStoredMonitorIngestSecrets";
 import { AddUserSlackAndMicrosoftTeams1789000000000 } from "./1789000000000-AddUserSlackAndMicrosoftTeams";
+import { AddUserTwoFactorBackupCode1789100000000 } from "./1789100000000-AddUserTwoFactorBackupCode";
 import { MigrationName1787142779538 } from "./1787142779538-MigrationName";
 import { MigrationName1787156982416 } from "./1787156982416-MigrationName";
 
@@ -1094,6 +1094,6 @@ export default [
   AddDetectionRuleIncidentColumns1788600000000,
   RemoveMarketingConversionUploadState1788700000000,
   DropMarketingConversionAddEnterpriseLicenseEmail1788800000000,
-  RedactStoredMonitorIngestSecrets1788900000000,
   AddUserSlackAndMicrosoftTeams1789000000000,
+  AddUserTwoFactorBackupCode1789100000000,
 ];

package/Server/Services/ChangeEventService.ts

@@ -0,0 +1,11 @@
+import ClickhouseDatabase from "../Infrastructure/ClickhouseDatabase";
+import AnalyticsDatabaseService from "./AnalyticsDatabaseService";
+import ChangeEvent from "../../Models/AnalyticsModels/ChangeEvent";
+
+export class ChangeEventService extends AnalyticsDatabaseService<ChangeEvent> {
+  public constructor(clickhouseDatabase?: ClickhouseDatabase | undefined) {
+    super({ modelType: ChangeEvent, database: clickhouseDatabase });
+  }
+}
+
+export default new ChangeEventService();

package/Server/Services/EnterpriseLicenseService.ts

@@ -37,9 +37,9 @@ export class Service extends DatabaseService<EnterpriseLicense> {
         email: createdItem.email?.toString(),
         /*
          * No attribution source. A licence row is typed in by a human and
-         * carries no session, so its campaign is whatever the meeting_booked
-         * sharing its email carried — the join the receiver makes on
-         * emailHash, not something OneUptime can restate here.
+         * carries no session, so its campaign is whatever the earlier
+         * conversion sharing its email carried — the join the receiver makes
+         * on emailHash, not something OneUptime can restate here.
          */
         data: {
           enterpriseLicenseId: createdItem.id?.toString() || "",

package/Server/Services/Index.ts

@@ -77,6 +77,7 @@ import DataSourceService from "./DataSourceService";
 import AuditLogService from "./AuditLogService";
 import LogService from "./LogService";
 import SecurityEventService from "./SecurityEventService";
+import ChangeEventService from "./ChangeEventService";
 import MailService from "./MailService";
 import MetricService from "./MetricService";
 import MetricItemAggMV1mService from "./MetricItemAggMV1mService";
@@ -207,6 +208,7 @@ import UserOnCallLogTimelineService from "./UserOnCallLogTimelineService";
 import UserService from "./UserService";
 import UserSessionService from "./UserSessionService";
 import UserTotpAuthService from "./UserTotpAuthService";
+import UserTwoFactorBackupCodeService from "./UserTwoFactorBackupCodeService";
 import UserWebAuthnService from "./UserWebAuthnService";
 import UserSmsService from "./UserSmsService";
 import UserIncomingCallNumberService from "./UserIncomingCallNumberService";
@@ -494,6 +496,7 @@ const services: Array<BaseService> = [
   UserSlackService,
   UserMicrosoftTeamsService,
   UserTotpAuthService,
+  UserTwoFactorBackupCodeService,
   UserWebAuthnService,
 
   WorkflowLogService,
@@ -641,6 +644,7 @@ export const AnalyticsServices: Array<
   RumSessionChunkService,
   AuditLogService,
   SecurityEventService,
+  ChangeEventService,
 ];
 
 export default services;

package/Server/Services/UserService.ts

@@ -45,6 +45,7 @@ import ProductAnalytics from "../Utils/ProductAnalytics";
 import MarketingEventUtil from "../Utils/Marketing/MarketingEventUtil";
 import { MarketingEventType } from "../../Types/Marketing/MarketingEvent";
 import UserTotpAuthService from "./UserTotpAuthService";
+import UserTwoFactorBackupCodeService from "./UserTwoFactorBackupCodeService";
 import UserWebAuthnService from "./UserWebAuthnService";
 import BadDataException from "../../Types/Exception/BadDataException";
 import NotFoundException from "../../Types/Exception/NotFoundException";
@@ -819,6 +820,18 @@ export class Service extends DatabaseService<Model> {
     const verifiedTwoFactorAuthMethodCount: number =
       await this.countVerifiedTwoFactorAuthMethods(userId);
 
+    /*
+     * Read separately from the method count above, and NOT added to it. See
+     * the note on `deriveTwoFactorAuthStatus`: folding recovery codes into the
+     * configured-method count would report an account whose authenticator is
+     * gone as fully set up, and login would keep sending it to the challenge
+     * screen until the last code was spent.
+     */
+    const unusedTwoFactorBackupCodeCount: number =
+      await UserTwoFactorBackupCodeService.countUnusedForUser({
+        userId: userId,
+      });
+
     return {
       hasPassword: Boolean(user.password),
       isEmailVerified: Boolean(user.isEmailVerified),
@@ -828,6 +841,7 @@ export class Service extends DatabaseService<Model> {
         verifiedMethodCount: verifiedTwoFactorAuthMethodCount,
       }),
       verifiedTwoFactorAuthMethodCount: verifiedTwoFactorAuthMethodCount,
+      unusedTwoFactorBackupCodeCount: unusedTwoFactorBackupCodeCount,
       hasPendingPasswordResetLink: hasPendingPasswordResetLink,
     };
   }
@@ -845,6 +859,17 @@ export class Service extends DatabaseService<Model> {
    * Counting unverified rows would therefore report a user who has never once
    * typed a code as fully configured -- and that user is precisely the one an
    * operator is looking at the page to help.
+   *
+   * BACKUP CODES ARE NOT COUNTED HERE, for a related reason one step further
+   * on. This number decides `deriveTwoFactorAuthStatus`, which decides whether
+   * login shows the two factor CHALLENGE or sends the account through
+   * enrolment. An account whose only remaining material was recovery codes
+   * would, if they counted, be shown a challenge it cannot answer except by
+   * spending a code -- one per sign-in, with no way to enrol a new
+   * authenticator, until the last one is gone. Recovery codes are the way back
+   * in to an account with a factor it cannot reach; they are not a factor.
+   * `UserAuthenticationStatus.unusedTwoFactorBackupCodeCount` reports them
+   * separately.
    */
   @CaptureSpan()
   private async countVerifiedTwoFactorAuthMethods(
@@ -1036,6 +1061,23 @@ export class Service extends DatabaseService<Model> {
       },
     });
 
+    /*
+     * The recovery codes go with the authenticators, and this is not
+     * bookkeeping. A backup code signs somebody in on its own, so a reset that
+     * cleared the TOTP secret but left a printed list of codes alive would
+     * have revoked nothing that an attacker who took the phone -- and the
+     * paper next to it -- still holds. "Reset two factor auth" has to mean all
+     * of the second-factor material, not the part that is easiest to see.
+     *
+     * It also matters in the harmless direction: the user is about to be sent
+     * through enrolment at their next sign-in, and codes minted against an
+     * authenticator that no longer exists are dead weight nobody would think
+     * to clear.
+     */
+    await UserTwoFactorBackupCodeService.deleteAllForUser({
+      userId: user.id!,
+    });
+
     /*
      * Ordered after the deletes, not before. A session that survives a reset
      * is a session that never has to prove the second factor again, which