[server] Disable 2fa on legacy account recovery (#4463)

## Description

## Tests

server/cmd/museum/main.go

@@ -463,9 +463,10 @@ func main() {
 	privateAPI.POST("/trash/empty", trashHandler.Empty)
 
 	emergencyCtrl := &emergency.Controller{
-		Repo:     &emergencyRepo.Repository{DB: db},
-		UserRepo: userRepo,
-		UserCtrl: userController,
+		Repo:              &emergencyRepo.Repository{DB: db},
+		UserRepo:          userRepo,
+		UserCtrl:          userController,
+		PasskeyController: passkeyCtrl,
 	}
 	userHandler := &api.UserHandler{
 		UserController:      userController,

server/pkg/controller/emergency/controller.go

@@ -2,6 +2,7 @@ package emergency
 
 import (
 	"fmt"
+	"github.com/ente-io/museum/pkg/controller"
 
 	"github.com/ente-io/museum/ente"
 	"github.com/ente-io/museum/pkg/controller/user"
@@ -13,9 +14,10 @@ import (
 )
 
 type Controller struct {
-	Repo     *emergency.Repository
-	UserRepo *repo.UserRepository
-	UserCtrl *user.UserController
+	Repo              *emergency.Repository
+	UserRepo          *repo.UserRepository
+	UserCtrl          *user.UserController
+	PasskeyController *controller.PasskeyController
 }
 
 func (c *Controller) UpdateContact(ctx *gin.Context,
@@ -122,4 +124,4 @@ func validateUpdateReq(userID int64, req ente.UpdateContact) error {
 		}
 		return stacktrace.Propagate(ente.NewBadRequestWithMessage(fmt.Sprintf("Can not update state to %s", req.State)), "")
 	}
-	}
+}

server/pkg/controller/emergency/recovery.go

@@ -47,6 +47,13 @@ func (c *Controller) ChangePassword(ctx *gin.Context, userID int64, request ente
 	if err != nil {
 		return nil, err
 	}
+	// disable 2fa
+	if disableErr := c.UserCtrl.DisableTwoFactor(contact.UserID); disableErr != nil {
+		return nil, stacktrace.Propagate(disableErr, "failed to disable 2fa")
+	}
+	if disableErr := c.PasskeyController.RemovePasskey2FA(contact.UserID); disableErr != nil {
+		return nil, stacktrace.Propagate(disableErr, "failed to disable passkey")
+	}
 	resp, err := c.UserCtrl.UpdateSrpAndKeyAttributes(ctx, contact.UserID, request.UpdateSrp, false)
 	if err != nil {
 		return nil, stacktrace.Propagate(err, "")