feat(auth): add MFA factors policy card

[HarshMN2345]

Adds the project-level MFA factors policy card to Auth → Security, so the new custom MFA factor is configurable from the console.

Appwrite generates and verifies the second-factor code without sending it; the app delivers it over whatever channel it likes (WhatsApp, Telegram, a voice call, a push notification). The card exposes all four factors — TOTP, email, phone, and custom — backed by PATCH /v1/project/policies/mfa-factors.

The card is hidden when listPolicies() omits mfa-factors, so a self-hosted server older than 1.9.6 never renders a control whose PATCH would 404.

SDK bump

The endpoint is in the published 1.9.x console spec (spec version 1.9.6, live on Cloud), but the pinned @appwrite.io/console build was 15.3.0 and predates it. This bumps the pin to ed09983 (16.0.0), which is a major release; the first commit carries the resulting migration:

Change in 16.0.0	Migration
Health service removed	Dropped from the SDK store — it was registered but never called
Models.CloudLocale → Models.Locale	Type annotation swap in 7 billing/address components; fields are identical
createTextEmbeddings moved off VectorsDB	Now via the new Embeddings service
UsageProject.executionsBreakdown removed	Re-sourced from the dimensional usage API (Usage.listEvents)
Composite resourceId split	Import/export calls now send databaseId + collectionId; csvImportBox reads parentResourceId + resourceId
Models.Database.type is now the SDK DatabaseType enum	Local union extracted from the SDK enum; toDatabaseType() narrows at the boundary

The SDK enum adds mysql, postgresql, and mongodb — dedicated backings this console has no UI for. Rather than widening the local union, it is now Extract<...>-ed from the SDK enum so a renamed or dropped value breaks the switch cases instead of drifting silently. toDatabaseType() throws on the unsupported ones, matching the entity dispatchers in (entity)/helpers/sdk.ts, which already threw on an unknown type.

Verification

bun run check (0 errors), bun run lint (0 errors), bun run test:unit (239 passing), and bun run build all pass. Warning counts are unchanged from the pre-bump baseline (91 / 319). bun install --frozen-lockfile succeeds.

Please review the usage breakdown change most closely — it is the one piece that is not a mechanical rename. The old per-function table arrived inside the same getUsage() response as executionsTotal; it now comes from Usage.listEvents plus a functions.list call to resolve names, capped at 25 rows ordered by value. It needs a sanity check against a project with real execution history.

Notes

• bun install dropped the sha512- integrity hashes from the three pkg.vc entries in bun.lock (bun 1.3.8). The frozen install still passes, but it is worth regenerating if CI pins a different bun.
• bun audit --audit-level high reports 4 high advisories (nanoid, js-yaml via eslint). These are unchanged from main — the lockfile diff touches only the three appwrite entries — and want a separate fix.

[appwrite]

Console (appwrite/console)

Project ID: 688b7bf400350cbd60e9

Sites (1)

Site	Status	Logs	Preview	QR
console-stage 688b7cf6003b1842c9dc	Ready	View Logs	Preview URL

Tip

SSR frameworks are fully supported with configurable build runtimes

[greptile-apps]

Greptile Summary

The PR adds project-level MFA-factor policy controls and upgrades the console SDK, including the required database, embeddings, locale, CSV migration, and usage API adaptations.

• Adds an MFA factors card for TOTP, email, phone, and custom factors, hidden when unsupported by the server.
• Gates MFA policy controls and submission on the project write scope.
• Replaces the removed execution breakdown field with dimensional usage events and function-name resolution.
• Migrates affected SDK calls and model types to the 16.0.0 API.

Confidence Score: 5/5

The PR appears safe to merge.

The previously reported permission failure is addressed by applying the established project-write gate to every MFA factor control and the submit button, and no blocking failure remains.

Important Files Changed

Filename	Overview
src/routes/(console)/project-[region]-[project]/auth/security/updateMfaFactors.svelte	Adds the MFA-factor policy form and now consistently disables its controls and submit action when the member lacks project write access.
src/routes/(console)/project-[region]-[project]/auth/security/+page.ts	Loads the optional MFA factors policy while preserving compatibility with servers that omit it.
src/routes/(console)/project-[region]-[project]/auth/security/+page.svelte	Conditionally renders the MFA factors policy card only when the policy is available.
src/lib/sdk/usage.ts	Reconstructs per-function execution totals from dimensional usage events and resolves display names in a bounded function query.
src/lib/stores/sdk.ts	Migrates SDK service registration by removing Health and adding Embeddings and Usage.
src/routes/(console)/project-[region]-[project]/settings/usage/[[invoice]]/+page.ts	Integrates the new asynchronous execution-breakdown source into usage-page loading.
src/lib/components/csvImportBox.svelte	Adapts CSV migration tracking to the SDK's split parent and resource identifiers.

_{Reviews (3): Last reviewed commit: "fix(usage): scope the executions breakdo..." | Re-trigger Greptile}