add the emergency relocate/reset-mfa scripts the tests exercise

scripts/emergency/postgres/reset-mfa.sh

@@ -0,0 +1,92 @@
+#!/bin/sh
+#
+# PostgreSQL: Emergency script to disable a user's MFA (TOTP)
+# Use this if a user is locked out of MFA (lost their authenticator app)
+#
+# Usage:
+#   docker exec -it dockhand /app/scripts/emergency/postgres/reset-mfa.sh <username>
+#
+# Example:
+#   docker exec -it dockhand /app/scripts/emergency/postgres/reset-mfa.sh admin
+#
+
+set -e
+
+echo "============================================"
+echo "  Dockhand - Reset User MFA (PostgreSQL)"
+echo "============================================"
+echo ""
+
+# Check arguments
+if [ -z "$1" ]; then
+    echo "Usage: $0 <username>"
+    echo ""
+    echo "Example:"
+    echo "  $0 admin"
+    exit 1
+fi
+
+USERNAME="$1"
+
+# Check DATABASE_URL
+if [ -z "$DATABASE_URL" ]; then
+    echo "Error: DATABASE_URL environment variable not set"
+    echo ""
+    echo "Example: DATABASE_URL=postgres://user:pass@host:5432/dockhand"
+    exit 1
+fi
+
+cd /app 2>/dev/null || true
+
+# Check if user exists using psql
+USER_EXISTS=$(psql "$DATABASE_URL" -t -A -c "SELECT COUNT(*) FROM users WHERE username = '$USERNAME';" 2>/dev/null)
+
+if [ "$USER_EXISTS" = "0" ]; then
+    echo "Error: User '$USERNAME' not found"
+    echo ""
+    echo "Available users:"
+    psql "$DATABASE_URL" -t -A -c "SELECT username FROM users;" 2>/dev/null | while read user; do
+        echo "  - $user"
+    done
+    exit 1
+fi
+
+# Show current MFA state
+MFA_ENABLED=$(psql "$DATABASE_URL" -t -A -c "SELECT mfa_enabled FROM users WHERE username = '$USERNAME';" 2>/dev/null)
+if [ "$MFA_ENABLED" = "t" ] || [ "$MFA_ENABLED" = "true" ]; then
+    STATUS="enabled"
+else
+    STATUS="already disabled"
+fi
+
+echo "This script will disable MFA (TOTP) for user '$USERNAME'."
+echo "Backup codes will also be wiped — they cannot be reused."
+echo ""
+echo "Database: $DATABASE_URL"
+echo "Username: $USERNAME"
+echo "Current MFA: $STATUS"
+echo ""
+printf "Continue? [y/N]: "
+read CONFIRM
+
+case "$CONFIRM" in
+    [yY]|[yY][eE][sS])
+        ;;
+    *)
+        echo "Aborted."
+        exit 0
+        ;;
+esac
+
+echo ""
+echo "Disabling MFA for user '$USERNAME'..."
+psql "$DATABASE_URL" -c "UPDATE users SET mfa_enabled = false, mfa_secret = NULL, updated_at = NOW() WHERE username = '$USERNAME';"
+
+if [ $? -eq 0 ]; then
+    echo ""
+    echo "MFA disabled successfully for user '$USERNAME'."
+    echo "The user can now log in with just their password and can re-enable MFA from their profile."
+else
+    echo "Error: Failed to disable MFA"
+    exit 1
+fi