add MFA, user web mail portal

internal/webui/admins.go

@@ -87,7 +87,7 @@ func (a *App) adminsList(w http.ResponseWriter, r *http.Request) {
 		}
 		rows = append(rows, M{"user": u, "domain_names": domainNames})
 	}
-	a.render(w, r, "admins.html", M{"active": "admins", "rows": rows})
+	a.render(w, r, "admins.html", M{"active": "admins", "rows": rows, "current_user_id": userFromContext(r).ID})
 }
 
 func (a *App) addAdminForm(w http.ResponseWriter, r *http.Request) {
@@ -221,6 +221,22 @@ func (a *App) adminWithManageAccess(w http.ResponseWriter, r *http.Request) (*db
 	return target, true
 }
 
+// resetAdminMFA clears a target admin's TOTP and passkeys — e.g. after a lost device
+// — so they can sign back in without a second factor (or under enforce_admin_mfa,
+// re-enroll from /account on their next login) without needing database access.
+func (a *App) resetAdminMFA(w http.ResponseWriter, r *http.Request) {
+	target, ok := a.adminWithManageAccess(w, r)
+	if !ok {
+		return
+	}
+	if err := a.DB.ResetAdminMFA(target.ID); err != nil {
+		setFlash(w, "error", "Error resetting MFA")
+	} else {
+		setFlash(w, "success", "MFA reset for "+target.Username)
+	}
+	http.Redirect(w, r, Prefix+"/admins", http.StatusFound)
+}
+
 func (a *App) removeAdmin(w http.ResponseWriter, r *http.Request) {
 	target, ok := a.adminWithManageAccess(w, r)
 	if !ok {