From f0218228d68c7d77de1b40b0721bbba978ed846a Mon Sep 17 00:00:00 2001
From: Aleksander <170264518+t-aleksander@users.noreply.github.com>
Date: Wed, 9 Sep 2026 16:57:57 +0200
Subject: [PATCH] configuration of mfa factors

---
 common/client_types.proto | 31 +++++++++++++++++++++++++++++++
 v2/proxy.proto            |  6 ++++++
 2 files changed, 37 insertions(+)

diff --git a/common/client_types.proto b/common/client_types.proto
index a1ae8c5..d1d7ee1 100644
--- a/common/client_types.proto
+++ b/common/client_types.proto
@@ -396,6 +396,37 @@ message CodeMfaSetupFinishResponse {
   repeated string recovery_codes = 1;
 }
 
+// [2.2] MFA factor configuration for an enrolled device.
+// Authenticate with the device's polling token and public key.
+message MfaConfigStartRequest {
+  string token = 1;
+  string pubkey = 2;
+}
+
+message MfaConfigStartResponse {
+  string session_token = 1;
+  repeated MfaMethod available_methods = 2;
+  // True when no factor is configured and an email code is the only authorization method.
+  bool email_fallback = 3;
+  int64 deadline_timestamp = 4;
+}
+
+message MfaConfigSendCodeRequest {
+  string session_token = 1;
+}
+
+message MfaConfigSendCodeResponse {}
+
+message MfaConfigAuthorizeRequest {
+  string session_token = 1;
+  MfaMethod method = 2;
+  string code = 3;
+}
+
+message MfaConfigAuthorizeResponse {
+  int64 deadline_timestamp = 1;
+}
+
 // External OIDC authentication flow
 enum AuthFlowType {
   AUTH_FLOW_TYPE_UNSPECIFIED = 0;
diff --git a/v2/proxy.proto b/v2/proxy.proto
index c6a3e9b..c9e4743 100644
--- a/v2/proxy.proto
+++ b/v2/proxy.proto
@@ -117,6 +117,9 @@ message CoreResponse {
     defguard.enterprise.posture.v2.DevicePostureRejection device_posture_rejected = 20;
     PublicSettings public_settings = 21;
     defguard.client_types.ClientMfaStepStartResponse client_mfa_step_start = 22;
+    defguard.client_types.MfaConfigStartResponse mfa_config_start = 23;
+    defguard.client_types.MfaConfigAuthorizeResponse mfa_config_authorize = 24;
+    defguard.client_types.MfaConfigSendCodeResponse mfa_config_send_code = 25;
   }
 }
 
@@ -216,6 +219,9 @@ message CoreRequest {
     AcmeCertificate acme_certificate = 21;
     defguard.enterprise.posture.v2.DevicePostureCheckRequest device_posture_check = 22;
     defguard.client_types.ClientMfaStepStartRequest client_mfa_step_start = 23;
+    defguard.client_types.MfaConfigStartRequest mfa_config_start = 24;
+    defguard.client_types.MfaConfigAuthorizeRequest mfa_config_authorize = 25;
+    defguard.client_types.MfaConfigSendCodeRequest mfa_config_send_code = 26;
   }
 }