bug(securityEvent): Add missing security event names to db

Because:
 - We're missing some security event names from some events in the db
 - And we're missing some security event names in the model
 - And some names have mismatching id

This commit:
 - Updates all security event names in 'fxa.securityEventNames' that are
   missing
 - Aligns all values on the model to match the db as source of truth

Author: nshirley

packages/db-migrations/databases/fxa/patches/patch-175-176.sql

@@ -0,0 +1,14 @@
+SET NAMES utf8mb4 COLLATE utf8mb4_bin;
+
+-- Bump these to your next migration numbers
+CALL assertPatchLevel('175');
+
+INSERT INTO securityEventNames (name) VALUES
+  ('account.password_upgrade_success'),
+  ('account.password_upgraded'),
+  ('account.recovery_phone_setup_failed'),
+  ('account.mfa_send_otp_code'),
+  ('account.mfa_verify_otp_code_success'),
+  ('account.mfa_verify_otp_code_failed');
+
+UPDATE dbMetadata SET value = '176' WHERE name = 'schema-patch-level';

packages/db-migrations/databases/fxa/patches/patch-176-175.sql

@@ -0,0 +1,11 @@
+-- SET NAMES utf8mb4 COLLATE utf8mb4_bin;
+--
+-- -- Remove only the rows this migration inserted.
+-- DELETE FROM securityEventNames WHERE name = 'account.password_upgrade_success';
+-- DELETE FROM securityEventNames WHERE name = 'account.password_upgraded';
+-- DELETE FROM securityEventNames WHERE name = 'account.recovery_phone_setup_failed';
+-- DELETE FROM securityEventNames WHERE name = 'account.mfa_send_otp_code';
+-- DELETE FROM securityEventNames WHERE name = 'account.mfa_verify_otp_code_success';
+-- DELETE FROM securityEventNames WHERE name = 'account.mfa_verify_otp_code_failed';
+--
+-- UPDATE dbMetadata SET value = '175' WHERE name = 'schema-patch-level';

packages/db-migrations/databases/fxa/target-patch.json

@@ -1,3 +1,3 @@
 {
-  "level": 175
+  "level": 176
 }

packages/fxa-auth-server/lib/routes/recovery-phone.ts

@@ -631,7 +631,7 @@ class RecoveryPhoneHandler {
     if (!replacedSuccess) {
       await this.glean.twoStepAuthPhoneReplace.failure(request);
       this.statsd.increment('account.recoveryPhone.changePhoneNumber.failure');
-      await recordSecurityEvent('account.recovery_phone_replace_failed', {
+      await recordSecurityEvent('account.recovery_phone_replace_failure', {
         db: this.db,
         request,
       });

packages/fxa-shared/db/models/auth/security-event.ts

@@ -47,17 +47,18 @@ export const EVENT_NAMES: Record<string, number> = {
   'account.recovery_codes_created': 33,
   'account.recovery_codes_signin_complete': 34,
   'account.must_reset': 35,
-  'account.recovery_phone_reset_password_success': 36,
+  'account.recovery_phone_reset_password_complete': 36,
   'account.recovery_phone_reset_password_failed': 37,
-  'account.password_upgrade_success': 38,
-  'account.password_upgraded': 39,
-  'account.recovery_phone_setup_failed': 40,
-  'account.recovery_phone_replace_failed': 41,
-  'account.recovery_phone_replace_complete': 42,
-  'account.recovery_phone_reset_password_complete': 43,
-  'account.mfa_send_otp_code': 44,
-  'account.mfa_verify_otp_code_success': 45,
-  'account.mfa_verify_otp_code_failed': 46,
+  'account.recovery_phone_replace_complete': 38,
+  'account.recovery_phone_replace_failure': 39,
+  'account.two_factor_replace_success': 40,
+  'account.two_factor_replace_failure': 41,
+  'account.password_upgrade_success': 42,
+  'account.password_upgraded': 43,
+  'account.recovery_phone_setup_failed': 44,
+  'account.mfa_send_otp_code': 45,
+  'account.mfa_verify_otp_code_success': 46,
+  'account.mfa_verify_otp_code_failed': 47,
 } as const;
 
 export type SecurityEventNames = keyof typeof EVENT_NAMES;