auth-mfa-user-data

GDPR (Art. 20 export / Art. 17 erasure) coverage for the auth-mfa feature’s user-mfa entity. Mounts the EXT_USER_DATA export + delete hooks so 2FA enrollment status is included in the user-data export bundle and a user’s TOTP secret + recovery codes are hard-deleted (via executor.forget, rebuild-safe) on a data-subject erasure request. Kept separate from auth-mfa so consumers without the user-data-rights pipeline don’t pull a hard dependency — requires user-data-rights, optionalRequires auth-mfa.

How it fits

What this feature needs to run (Requires).

flowchart TB
  n_auth_mfa_user_data["auth-mfa-user-data"]
  subgraph how_reqs["Requires / optional"]
    n_user_data_rights["user-data-rights"]
    n_auth_mfa["auth-mfa"]
  end
  n_user_data_rights --> n_auth_mfa_user_data
  n_auth_mfa -.->|optional| n_auth_mfa_user_data

Dependencies

• Requires: user-data-rights
• Optional: auth-mfa
• Activation: always on (not toggleable)

Extensions & cross-feature APIs

• Registers extension: userData → user-mfa