update UI

apps/server-rust/migrations/011_totp_reset.sql

@@ -0,0 +1,31 @@
+-- Short-lived, tenant-owned TOTP replacement enrollments.
+--
+-- The current TOTP secret remains authoritative until the replacement secret
+-- has produced a valid code. Raw enrollment tokens are never persisted, and
+-- pending secrets use the same authenticated encryption boundary as account
+-- TOTP secrets.
+
+CREATE TABLE IF NOT EXISTS pending_totp_resets (
+  id UUID PRIMARY KEY,
+  user_id UUID NOT NULL UNIQUE REFERENCES users(id) ON DELETE CASCADE,
+  enrollment_token_digest BYTEA NOT NULL UNIQUE
+    CHECK (octet_length(enrollment_token_digest) = 32),
+  totp_secret_ciphertext BYTEA NOT NULL
+    CHECK (octet_length(totp_secret_ciphertext) >= 16),
+  totp_secret_nonce BYTEA NOT NULL
+    CHECK (octet_length(totp_secret_nonce) = 24),
+  failed_attempts INTEGER NOT NULL DEFAULT 0 CHECK (failed_attempts >= 0),
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  expires_at TIMESTAMPTZ NOT NULL,
+  UNIQUE (user_id, id)
+);
+
+CREATE INDEX IF NOT EXISTS pending_totp_resets_expiry_idx
+  ON pending_totp_resets(expires_at);
+
+ALTER TABLE pending_totp_resets ENABLE ROW LEVEL SECURITY;
+ALTER TABLE pending_totp_resets FORCE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS pending_totp_resets_owner ON pending_totp_resets;
+CREATE POLICY pending_totp_resets_owner ON pending_totp_resets
+  USING (user_id = NULLIF(current_setting('app.user_id', true), '')::UUID)
+  WITH CHECK (user_id = NULLIF(current_setting('app.user_id', true), '')::UUID);