feat(core): Invalidate all sessions when MFA is enabled/disabled (#15524)

This commit is contained in:
Ricardo Espinoza
2025-05-21 02:59:22 -04:00
committed by GitHub
parent a1a33deee5
commit 2a35c19ef9
18 changed files with 92 additions and 76 deletions

View File

@@ -1,7 +1,6 @@
import { AuthIdentity } from '@n8n/db';
import { type User } from '@n8n/db';
import { AuthIdentityRepository } from '@n8n/db';
import { AuthUserRepository } from '@n8n/db';
import { UserRepository } from '@n8n/db';
import { Container } from '@n8n/di';
import type { ApiKeyScope, GlobalRole } from '@n8n/permissions';
@@ -73,11 +72,14 @@ export async function createUserWithMfaEnabled(
email,
});
await Container.get(AuthUserRepository).update(user.id, {
await Container.get(UserRepository).update(user.id, {
mfaSecret: encryptedSecret,
mfaRecoveryCodes: encryptedRecoveryCodes,
});
user.mfaSecret = encryptedSecret;
user.mfaRecoveryCodes = encryptedRecoveryCodes;
return {
user,
rawPassword: password,