Require MFA during bootstrap mode

src/internal/server/oidc/authorize.go

@@ -279,6 +279,14 @@ func (h *AuthorizeHandler) ServeHTTPCallback(w http.ResponseWriter, r *http.Requ
 	// Check MFA requirement.
 	mfaRequired, err := h.MFA.CheckMFARequired(ctx, result.Username)
 	if err != nil {
+		h.Emitter.Emit(ctx, telemetry.Event{
+			Timestamp: time.Now(),
+			EventType: telemetry.EventAuthFailure,
+			ClientID:  ps.ClientID,
+			Endpoint:  "/authorize/callback",
+			Result:    "failure",
+			ErrorType: "mfa_check_error",
+		})
 		http.Error(w, "mfa check error", http.StatusInternalServerError)
 		return
 	}