fix(api)!: correct declared bounds and hide public bot mfa (#2485)

fluxer_api/src/api/oauth/OAuth2Mappers.ts

@@ -1,11 +1,19 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
+import {type UserAuthenticatorType, UserAuthenticatorTypes} from '@fluxer/constants/src/UserConstants';
 import {stripBannerForUser} from '../infrastructure/AssetEntitlementUtils';
 import type {Application} from '../models/Application';
 import type {User} from '../models/User';
 import {mapUserToPartialResponse} from '../user/UserMappers';
 import type {ApplicationBotResponse, ApplicationResponse} from './OAuth2Types';
 
+function getActiveAuthenticatorTypes(user: User): Array<UserAuthenticatorType> {
+	return Array.from(user.authenticatorTypes ?? []).filter(
+		(type): type is UserAuthenticatorType =>
+			type === UserAuthenticatorTypes.TOTP || type === UserAuthenticatorTypes.WEBAUTHN,
+	);
+}
+
 export function mapBotUserToResponse(
 	user: User,
 	opts?: {
@@ -13,6 +21,7 @@ export function mapBotUserToResponse(
 	},
 ): ApplicationBotResponse {
 	const partial = mapUserToPartialResponse(user);
+	const authenticatorTypes = getActiveAuthenticatorTypes(user);
 	return {
 		id: partial.id,
 		username: partial.username,
@@ -21,8 +30,8 @@ export function mapBotUserToResponse(
 		banner: stripBannerForUser(user),
 		bio: user.bio ?? null,
 		token: opts?.token,
-		mfa_enabled: (user.authenticatorTypes?.size ?? 0) > 0,
-		authenticator_types: user.authenticatorTypes ? Array.from(user.authenticatorTypes) : [],
+		mfa_enabled: authenticatorTypes.length > 0,
+		authenticator_types: authenticatorTypes,
 		flags: partial.flags,
 	};
 }