coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Support opt-in MFA per browser client with authoritative enrollment checks
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 40s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
This commit is contained in:
tegwick 2026-09-13 00:27:28 +02:00
parent e1e292919a
commit ac8ed65203
14 changed files with 298 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/internal/server/oidc/authorize.go
View file

@ -375,7 +375,11 @@ func (h *AuthorizeHandler) decideAssurance(ctx context.Context, ps *PendingState
providerRequired := false
if !domain.ACRRequiresAAL2(ps.ACRValues) && (client == nil || client.MFARequired == nil) {
var err error
providerRequired, err = h.MFA.CheckMFARequired(ctx, username)
if client != nil && client.MFAOptional {
providerRequired, err = h.MFA.HasEnrolledFactor(ctx, username)
} else {
providerRequired, err = h.MFA.CheckMFARequired(ctx, username)
}
if err != nil {
return domain.AssuranceDecision{}, err
}