Server-Side SpecKit

Complete backend specification for the eToro 2FA NestJS microservice

📦 NestJS Module Structure

src/
├── auth-2fa/
│   ├── auth-2fa.module.ts          # Auth2FAModule
│   ├── controllers/
│   │   ├── totp.controller.ts      # TOTP endpoints
│   │   ├── webauthn.controller.ts  # WebAuthn endpoints
│   │   ├── backup.controller.ts    # Backup codes
│   │   └── recovery.controller.ts  # Account recovery
│   ├── services/
│   │   ├── totp.service.ts         # TOTP logic (otplib)
│   │   ├── webauthn.service.ts     # WebAuthn (@simplewebauthn/server)
│   │   ├── backup-code.service.ts  # Backup code generation/verification
│   │   ├── recovery.service.ts     # Account recovery flow
│   │   ├── vault.service.ts        # Vault/HSM encryption client
│   │   └── audit.service.ts        # Audit logging
│   ├── guards/
│   │   ├── two-fa.guard.ts         # Require 2FA on protected routes
│   │   └── two-fa-setup.guard.ts   # Ensure user has active session
│   ├── decorators/
│   │   └── require-2fa.decorator.ts
│   ├── dto/
│   │   ├── totp-setup.dto.ts
│   │   ├── totp-verify.dto.ts
│   │   ├── webauthn-register.dto.ts
│   │   ├── webauthn-auth.dto.ts
│   │   └── backup-verify.dto.ts
│   ├── entities/
│   │   ├── user-2fa-settings.entity.ts
│   │   ├── totp-secret.entity.ts
│   │   ├── webauthn-credential.entity.ts
│   │   ├── backup-code.entity.ts
│   │   └── audit-log.entity.ts
│   └── constants/
│       └── 2fa.constants.ts
├── app.module.ts
└── main.ts

Module Registration

// auth-2fa.module.ts
@Module({
  imports: [
    TypeOrmModule.forFeature([
      User2FASettings, TotpSecret,
      WebAuthnCredential, BackupCode, AuditLog
    ]),
    ThrottlerModule.forRoot({ ttl: 300, limit: 5 }),
    VaultModule,
    RedisModule,
  ],
  controllers: [
    TotpController, WebAuthnController,
    BackupController, RecoveryController
  ],
  providers: [
    TotpService, WebAuthnService, BackupCodeService,
    RecoveryService, VaultService, AuditService,
    TwoFAGuard, TwoFASetupGuard
  ],
  exports: [TwoFAGuard, TotpService, WebAuthnService]
})
export class Auth2FAModule {}

🗄️ Database Schema

user_2fa_settings

Column	Type	Constraints	Description
id	UUID	PK, DEFAULT gen_random_uuid()	Primary key
user_id	BIGINT	UNIQUE, NOT NULL, FK → users.id	eToro user ID
is_enabled	BOOLEAN	DEFAULT false	2FA active?
primary_method	ENUM('totp','webauthn','sms')	NULLABLE	Primary 2FA method
totp_enabled	BOOLEAN	DEFAULT false	TOTP active
webauthn_enabled	BOOLEAN	DEFAULT false	WebAuthn active
backup_codes_remaining	SMALLINT	DEFAULT 0	Unused backup codes count
lockout_until	TIMESTAMPTZ	NULLABLE	Lockout expiry
failed_attempts	SMALLINT	DEFAULT 0	Current window failures
created_at	TIMESTAMPTZ	DEFAULT NOW()
updated_at	TIMESTAMPTZ	DEFAULT NOW()

totp_secrets

Column	Type	Constraints	Description
id	UUID	PK
user_id	BIGINT	UNIQUE, FK
encrypted_secret	BYTEA	NOT NULL	AES-256-GCM encrypted TOTP secret
iv	BYTEA(16)	NOT NULL	Initialization vector
vault_key_version	SMALLINT	NOT NULL	Vault transit key version used
algorithm	VARCHAR(10)	DEFAULT 'sha1'	HMAC algorithm
digits	SMALLINT	DEFAULT 6
period	SMALLINT	DEFAULT 30	Seconds per step
verified	BOOLEAN	DEFAULT false	User confirmed code works
created_at	TIMESTAMPTZ	DEFAULT NOW()

webauthn_credentials (Passkeys)

Column	Type	Constraints	Description
id	UUID	PK
user_id	BIGINT	FK, INDEX
credential_id	BYTEA	UNIQUE, NOT NULL	WebAuthn credential ID (base64url)
public_key	BYTEA	NOT NULL	COSE public key (CBOR-encoded)
sign_count	BIGINT	DEFAULT 0, NOT NULL	Signature counter (clone detection)
transports	VARCHAR[]		['internal','hybrid','ble','usb','nfc']
device_name	VARCHAR(100)		User-friendly name (e.g. "iPhone 15 Pro")
last_used_at	TIMESTAMPTZ		Last successful authentication
aaguid	UUID		Authenticator attestation GUID (identifies make/model)
backup_eligible	BOOLEAN	DEFAULT false	BE flag — credential CAN be backed up (multi-device)
backup_state	BOOLEAN	DEFAULT false	BS flag — credential IS currently backed up/synced
device_type	VARCHAR(32)		'singleDevice' or 'multiDevice' (derived from BE)
credential_type	VARCHAR(20)	DEFAULT 'passkey'	'passkey' (discoverable) or 'security-key'
created_at	TIMESTAMPTZ	DEFAULT NOW()

-- Indexes
CREATE INDEX idx_webauthn_user ON webauthn_credentials(user_id);
CREATE UNIQUE INDEX idx_webauthn_cred ON webauthn_credentials(credential_id);
CREATE INDEX idx_webauthn_aaguid ON webauthn_credentials(aaguid);

-- Max 10 passkeys per user (enforced at app level, checked on insert)
-- Soft constraint: credential_type = 'passkey' → backup_eligible = true typically

backup_codes

Column	Type	Constraints	Description
id	UUID	PK
user_id	BIGINT	FK, INDEX
code_hash	VARCHAR(60)	NOT NULL	bcrypt hash of backup code
used	BOOLEAN	DEFAULT false
used_at	TIMESTAMPTZ
created_at	TIMESTAMPTZ	DEFAULT NOW()

2fa_audit_log

Column	Type	Constraints	Description
id	UUID	PK
user_id	BIGINT	INDEX
action	VARCHAR(50)	NOT NULL, INDEX	e.g. totp_setup, webauthn_auth_success
ip_address	INET
user_agent	TEXT
device_fingerprint	VARCHAR(64)		SHA-256 device ID
metadata	JSONB		Extra event data
created_at	TIMESTAMPTZ	DEFAULT NOW(), INDEX	Immutable, append-only

Partition by month. Retention: 7 years (regulatory). Table is INSERT-only (no UPDATE/DELETE grants).

🔌 API Endpoints

Method	Endpoint	Description	Auth	Rate Limit
POST	/api/v1/2fa/totp/setup	Generate TOTP secret + QR URI	Bearer	3/hour
POST	/api/v1/2fa/totp/verify	Verify code & enable TOTP	Bearer	5/5min
POST	/api/v1/2fa/totp/validate	Validate code during login	Temp token	5/5min
DELETE	/api/v1/2fa/totp	Disable TOTP (requires current code)	Bearer + 2FA	2/hour
POST	/api/v1/2fa/passkey/register/options	Get passkey registration options (resident key)	Bearer	3/hour
POST	/api/v1/2fa/passkey/register/verify	Verify & store passkey credential	Bearer	5/5min
POST	/api/v1/2fa/passkey/authenticate/options	Get auth options (discoverable or allow-list)	Temp token / None	5/5min
POST	/api/v1/2fa/passkey/authenticate/verify	Verify passkey assertion	Temp token / None	5/5min
GET	/api/v1/2fa/passkey/credentials	List user's registered passkeys	Bearer	30/min
DELETE	/api/v1/2fa/passkey/credentials/:id	Remove a passkey	Bearer + 2FA	5/hour
POST	/api/v1/2fa/passkey/rename	Rename a passkey device name	Bearer	10/hour
POST	/api/v1/2fa/backup-codes/generate	Generate 10 backup codes	Bearer + 2FA	1/day
POST	/api/v1/2fa/backup-codes/verify	Use a backup code	Temp token	3/15min
GET	/api/v1/2fa/status	Get user's 2FA configuration	Bearer	30/min
POST	/api/v1/2fa/recovery	Initiate account recovery	Email token	1/24hr

POST /api/v1/2fa/totp/setup — Generate TOTP Secret

Generates a new TOTP secret, encrypts via Vault, stores pending, and returns QR URI.

Request

Headers:
  Authorization: Bearer <accessToken>

Body: (empty)

Response 200

{
  "secret": "JBSWY3DPEHPK3PXP",
  "qrUri": "otpauth://totp/eToro:user@email.com?secret=JBSWY3DPEHPK3PXP&issuer=eToro&algorithm=SHA1&digits=6&period=30",
  "algorithm": "SHA1",
  "digits": 6,
  "period": 30
}

Error Responses

Status	Code	Description
409	TOTP_ALREADY_ENABLED	User already has TOTP active
429	RATE_LIMIT_EXCEEDED	Too many setup attempts

POST /api/v1/2fa/totp/verify — Verify & Enable TOTP

Request

{
  "code": "738204"
}

Response 200

{
  "enabled": true,
  "method": "totp",
  "backupCodes": [
    "A1B2-C3D4", "E5F6-G7H8",
    "I9J0-K1L2", "M3N4-O5P6",
    "Q7R8-S9T0", "U1V2-W3X4",
    "Y5Z6-A7B8", "C9D0-E1F2",
    "G3H4-I5J6", "K7L8-M9N0"
  ]
}

POST /api/v1/2fa/totp/validate — Login Validation

Request

Headers:
  X-Temp-Token: <tempToken>

{
  "code": "738204"
}

Response 200

{
  "accessToken": "eyJhbG...",
  "refreshToken": "eyJhbG...",
  "expiresIn": 3600
}

Error Responses

Status	Code	Description
401	INVALID_TOTP_CODE	Code doesn't match
401	CODE_ALREADY_USED	Replay detected
423	ACCOUNT_LOCKED	Too many failed attempts
429	RATE_LIMIT_EXCEEDED	Throttled

DELETE /api/v1/2fa/totp — Disable TOTP

Request

{
  "code": "738204"
}

Response 200

{
  "disabled": true,
  "method": null
}

POST /api/v1/2fa/passkey/register/options — Get Passkey Registration Options

Returns WebAuthn registration options with residentKey: "required" for discoverable credentials (passwordless-ready). Excludes already-registered credentials.

Request

Headers:
  Authorization: Bearer <accessToken>

Body: (empty)

Response 200

{
  "challenge": "dGVzdC1jaGFsbGVuZ2U...",
  "rp": {
    "name": "eToro",
    "id": "etoro.com"
  },
  "user": {
    "id": "MTIzNDU...",
    "name": "user@email.com",
    "displayName": "Yoni"
  },
  "pubKeyCredParams": [
    { "type": "public-key", "alg": -7 },
    { "type": "public-key", "alg": -257 }
  ],
  "timeout": 120000,
  "attestation": "none",
  "authenticatorSelection": {
    "residentKey": "required",
    "requireResidentKey": true,
    "userVerification": "preferred",
    "authenticatorAttachment": "platform"
  },
  "excludeCredentials": [
    { "id": "existing-cred-base64url", "type": "public-key", "transports": ["internal"] }
  ]
}

Error Responses

Status	Code	Description
409	MAX_CREDENTIALS_REACHED	User already has 10 passkeys registered
429	RATE_LIMIT_EXCEEDED	Too many registration attempts

POST /api/v1/2fa/passkey/register/verify — Verify & Store Passkey

Request

{
  "attestation": {
    "id": "credential-id-base64url",
    "rawId": "Y3JlZGVudGlhbC1pZA...",
    "response": {
      "clientDataJSON": "eyJ0eXBl...",
      "attestationObject": "o2NmbXR...",
      "transports": ["internal", "hybrid"]
    },
    "type": "public-key",
    "clientExtensionResults": {
      "credProps": {
        "rk": true
      }
    },
    "authenticatorAttachment": "platform"
  },
  "deviceName": "iPhone 15 Pro"
}

Response 200

{
  "registered": true,
  "credentialId": "credential-id-base64url",
  "deviceName": "iPhone 15 Pro",
  "deviceType": "multiDevice",
  "backupEligible": true,
  "backupState": true,
  "transports": ["internal", "hybrid"]
}

Server-side: Stores credential_id, public_key, sign_count=0, transports, aaguid, backup_eligible (BE flag from authenticatorData), backup_state (BS flag). If this is user's first passkey, also generates backup codes.

POST /api/v1/2fa/passkey/authenticate/options — Get Auth Options

For standard 2FA: pass tempToken and get allowCredentials with user's registered passkeys. For passwordless/discoverable: omit tempToken and send empty allowCredentials.

Request (2FA mode)

Headers:
  X-Temp-Token: <tempToken>

Body: (empty)

Request (Passwordless mode)

Headers: (none)

Body: (empty)
// Returns empty allowCredentials
// for discoverable credential flow

Response 200 (2FA)

{
  "challenge": "YXV0aC1jaGFsbGVuZ2U...",
  "allowCredentials": [
    {
      "id": "cred-1-base64url",
      "type": "public-key",
      "transports": ["internal", "hybrid"]
    },
    {
      "id": "cred-2-base64url",
      "type": "public-key",
      "transports": ["usb"]
    }
  ],
  "timeout": 120000,
  "userVerification": "preferred",
  "rpId": "etoro.com"
}

Response 200 (Passwordless)

{
  "challenge": "cGFzc3dvcmRsZXNz...",
  "allowCredentials": [],
  "timeout": 120000,
  "userVerification": "required",
  "rpId": "etoro.com"
}

POST /api/v1/2fa/passkey/authenticate/verify — Verify Assertion

Request

{
  "assertion": {
    "id": "credential-id-base64url",
    "rawId": "Y3JlZGVudGlhbC1pZA...",
    "response": {
      "clientDataJSON": "eyJ0eXBl...",
      "authenticatorData": "SZYN5YgO...",
      "signature": "MEUCIQC...",
      "userHandle": "MTIzNDU..."
    },
    "type": "public-key",
    "clientExtensionResults": {},
    "authenticatorAttachment": "platform"
  }
}

Response 200

{
  "accessToken": "eyJhbG...",
  "refreshToken": "eyJhbG...",
  "expiresIn": 3600,
  "credentialUsed": {
    "id": "credential-id-base64url",
    "deviceName": "iPhone 15 Pro"
  }
}

Server-side: Verifies signature, checks sign_count (must be > stored value or alert clone), updates last_used_at and sign_count. For passwordless: resolves user from userHandle in assertion.

GET /api/v1/2fa/passkey/credentials — List Passkeys

Response 200

{
  "credentials": [
    {
      "id": "cred-id-1",
      "deviceName": "iPhone 15 Pro",
      "deviceType": "multiDevice",
      "backupEligible": true,
      "backupState": true,
      "transports": ["internal", "hybrid"],
      "lastUsed": "2026-02-22T10:30:00Z",
      "createdAt": "2026-01-15T09:00:00Z"
    },
    {
      "id": "cred-id-2",
      "deviceName": "YubiKey 5",
      "deviceType": "singleDevice",
      "backupEligible": false,
      "backupState": false,
      "transports": ["usb", "nfc"],
      "lastUsed": "2026-02-20T14:00:00Z",
      "createdAt": "2026-02-01T11:00:00Z"
    }
  ],
  "maxCredentials": 10
}

DELETE /api/v1/2fa/passkey/credentials/:id — Remove Passkey

Request

DELETE /api/v1/2fa/passkey/credentials/cred-id-2

Headers:
  Authorization: Bearer <accessToken>
  X-2FA-Code: 738204  // Current TOTP or backup code

Response 200

{
  "deleted": true,
  "credentialId": "cred-id-2",
  "remainingCredentials": 1
}

Error Responses

Status	Code	Description
400	CANNOT_DELETE_LAST_METHOD	Cannot delete last passkey if it's the only 2FA method
404	CREDENTIAL_NOT_FOUND	Credential ID not found for this user

POST /api/v1/2fa/passkey/rename — Rename Passkey

Request

{
  "credentialId": "cred-id-1",
  "deviceName": "Work Phone"
}

Response 200

{
  "credentialId": "cred-id-1",
  "deviceName": "Work Phone",
  "updated": true
}

POST /api/v1/2fa/backup-codes/generate

Request

Headers:
  Authorization: Bearer <accessToken>

{ "currentCode": "738204" }

Response 200

{
  "codes": [
    "A1B2-C3D4", "E5F6-G7H8",
    "I9J0-K1L2", "M3N4-O5P6",
    "Q7R8-S9T0", "U1V2-W3X4",
    "Y5Z6-A7B8", "C9D0-E1F2",
    "G3H4-I5J6", "K7L8-M9N0"
  ],
  "warning": "Store these codes securely. Previous codes are now invalid."
}

POST /api/v1/2fa/backup-codes/verify

Request

{
  "code": "A1B2-C3D4"
}

Response 200

{
  "accessToken": "eyJhbG...",
  "refreshToken": "eyJhbG...",
  "codesRemaining": 9,
  "warning": "You have 9 backup codes remaining"
}

GET /api/v1/2fa/status

Response 200

{
  "enabled": true,
  "primaryMethod": "totp",
  "totp": { "enabled": true, "configuredAt": "2026-02-22T14:00:00Z" },
  "webauthn": {
    "enabled": true,
    "credentials": [
      {
        "id": "cred-id-1",
        "deviceName": "iPhone 15 Pro",
        "lastUsed": "2026-02-22T10:00:00Z",
        "createdAt": "2026-01-15T09:00:00Z",
        "backedUp": true
      }
    ]
  },
  "backupCodes": { "remaining": 8, "generatedAt": "2026-02-22T14:00:00Z" },
  "recovery": { "email": "y***@etoro.com", "phone": "+972***1010" }
}

POST /api/v1/2fa/recovery

Request

{
  "email": "user@email.com",
  "identityProof": "base64-encoded-id-photo",
  "reason": "lost_device"
}

Response 202

{
  "recoveryId": "rec-uuid-123",
  "status": "pending_review",
  "estimatedTime": "24-48 hours",
  "message": "Recovery request submitted. You'll receive an email with next steps."
}

Recovery requires manual review by security team. User must verify identity via email link + ID document.

📖 User Stories

US-001: Enable TOTP Authentication

As a registered eToro user, I want to set up TOTP-based 2FA, so that my account has an additional layer of security.

✅ User can access 2FA settings from account security page
✅ System generates a TOTP secret and displays QR code
✅ User must verify a valid code before 2FA is activated
✅ 10 backup codes are generated and displayed once
✅ Audit log entry created on successful enable

US-002: Login with TOTP

As a user with TOTP enabled, I want to enter my authenticator code after password, so that my login is protected.

✅ After password validation, user is prompted for TOTP code
✅ Code accepts ±1 time step window (90 seconds)
✅ Same code cannot be reused (replay protection)
✅ 5 failed attempts triggers 5-minute lockout
✅ Option to use backup code or passkey instead

US-003: Register Passkey

As a user, I want to register my device's biometric as a passkey, so that I can log in without typing codes.

✅ User can add multiple passkeys (up to 10)
✅ Device biometric prompt (Face ID/fingerprint/Windows Hello) shown
✅ Credential stored with user-friendly device name (auto-suggested, editable)
✅ Resident key / discoverable credential enabled for passwordless-ready
✅ Works alongside TOTP (user chooses at login)
✅ Passkey synced via iCloud Keychain / Google Password Manager automatically
✅ backup_eligible and backup_state flags stored for credential management

US-004: Login with Passkey

As a user with registered passkeys, I want to authenticate using biometrics, so that login is fast and phishing-proof.

✅ After password, "Sign in with Passkey" shown as preferred option
✅ Biometric prompt appears with registered credential
✅ Sign counter is incremented (clone detection)
✅ Falls back to TOTP → backup code → recovery if passkey fails
✅ Cross-device auth via QR code (hybrid transport) when on unfamiliar device

US-004b: Passwordless Login with Passkey (Phase 3)

As a user with a discoverable passkey, I want to sign in without entering my username or password, so that login is instant.

✅ Login page supports conditional UI (WebAuthn autofill)
✅ Browser shows passkey suggestion in username field
✅ User taps suggestion → biometric → logged in (no password)
✅ userHandle in assertion maps to eToro user ID
✅ Audit log records passwordless_login event

US-004c: Manage Passkeys

As a user with registered passkeys, I want to view, rename, and delete my passkeys, so that I can manage my devices.

✅ List shows device name, last used date, created date, sync status
✅ User can rename passkeys (e.g., "iPhone 15 Pro" → "Work Phone")
✅ User can delete passkeys (requires 2FA verification)
✅ Cannot delete last passkey if it's the only 2FA method
✅ Warning when deleting a synced passkey (affects all synced devices)

US-004d: Cross-Device Passkey Authentication

As a user logging in on a device without my passkey, I want to use my phone as an authenticator via QR code, so that I can securely log in anywhere.

✅ QR code displayed on desktop browser
✅ User scans with phone camera → BLE proximity check
✅ Biometric prompt on phone → assertion tunneled to desktop
✅ Works across ecosystems (iPhone authenticating on Windows)

US-004e: Passkey Nudge (Migration)

As a user currently using SMS or TOTP, I want to be prompted to upgrade to Passkey, so that I benefit from better security and UX.

✅ Post-login bottom sheet shown after successful SMS/TOTP login
✅ Shows speed comparison: "Sign in 5x faster with Passkey"
✅ "Set up now" (primary) and "Maybe later" (dismiss) buttons
✅ Dismissed nudge reappears after 7 days (max 3 times then stops)
✅ Nudge suppressed if device doesn't support WebAuthn

US-005: Use Backup Code

As a user who lost access to their authenticator, I want to use a backup code, so that I can still log in.

✅ Each backup code is single-use
✅ Warning shown when ≤3 codes remaining
✅ User prompted to regenerate when ≤2 remaining

US-006: Disable 2FA

As a user, I want to disable 2FA, so that I can simplify my login if needed.

✅ Requires current TOTP code or passkey verification
✅ Confirmation dialog warns about reduced security
✅ All TOTP secrets and backup codes are deleted
✅ WebAuthn credentials optionally retained
✅ Audit log entry created

US-007: Account Recovery

As a user who lost all 2FA methods, I want to recover my account, so that I'm not permanently locked out.

✅ Recovery requires email verification + ID document
✅ Manual review by security team (24-48 hour SLA)
✅ 2FA is temporarily disabled upon approval
✅ User forced to set up new 2FA within 72 hours

⚠️ Error Handling

HTTP	Error Code	Message	Action
400	INVALID_INPUT	Validation failed	Return field errors
401	INVALID_TOTP_CODE	Invalid verification code	Increment failure counter
401	CODE_ALREADY_USED	Code was already used	Log replay attempt
401	INVALID_BACKUP_CODE	Backup code invalid	Increment failure counter
401	WEBAUTHN_VERIFICATION_FAILED	Passkey verification failed	Log failure
403	2FA_REQUIRED	Two-factor auth required	Redirect to 2FA prompt
409	TOTP_ALREADY_ENABLED	TOTP is already active	—
409	MAX_CREDENTIALS_REACHED	Maximum 5 passkeys	—
423	ACCOUNT_LOCKED	Account locked due to failed attempts	Email alert sent
429	RATE_LIMIT_EXCEEDED	Too many attempts	Return retryAfter header
500	ENCRYPTION_ERROR	Internal security error	Alert engineering + PagerDuty

📦 Dependencies

Runtime

Package	Version	Purpose
`otplib`	^12.0	TOTP generation & verification
`@simplewebauthn/server`	^10.0	WebAuthn server operations
`@nestjs/throttler`	^5.0	Rate limiting
`qrcode`	^1.5	QR code generation (optional, client-side)
`node:crypto`	built-in	Random bytes, timing-safe compare
`bcrypt`	^5.1	Backup code hashing

Infrastructure

Service	Purpose
PostgreSQL 15+	Persistent storage
Redis 7+	Rate limiting, challenge cache
HashiCorp Vault	Transit encryption of TOTP secrets
Datadog	Monitoring & alerting

← Research · Architecture · Client SpecKit → · Swagger →

Server SpecKit

Server-Side SpecKit

📦 NestJS Module Structure

Module Registration

🗄️ Database Schema

🔌 API Endpoints

Request

Response 200

Error Responses

Request

Response 200

Request

Response 200

Error Responses

Request

Response 200

Request

Response 200

Error Responses

Request

Response 200

Request (2FA mode)

Request (Passwordless mode)

Response 200 (2FA)

Response 200 (Passwordless)

Request

Response 200

Response 200

Request

Response 200

Error Responses

Request

Response 200

Request

Response 200

Request

Response 200

Response 200

Request

Response 202

📖 User Stories

US-001: Enable TOTP Authentication

US-002: Login with TOTP

US-003: Register Passkey

US-004: Login with Passkey

US-004b: Passwordless Login with Passkey (Phase 3)

US-004c: Manage Passkeys

US-004d: Cross-Device Passkey Authentication

US-004e: Passkey Nudge (Migration)

US-005: Use Backup Code

US-006: Disable 2FA

US-007: Account Recovery

⚠️ Error Handling

📦 Dependencies

Runtime

Infrastructure