Skip to content

feat(mfa): Implement Multi-Factor Authentication (MFA) support#1517

Open
subhankarmaiti wants to merge 10 commits intomasterfrom
feat/flexible-factors-grant-support
Open

feat(mfa): Implement Multi-Factor Authentication (MFA) support#1517
subhankarmaiti wants to merge 10 commits intomasterfrom
feat/flexible-factors-grant-support

Conversation

@subhankarmaiti
Copy link
Copy Markdown
Contributor

No description provided.

dependabot Bot and others added 2 commits April 23, 2026 10:18
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@subhankarmaiti subhankarmaiti requested a review from a team as a code owner April 23, 2026 04:56
}

@ReactMethod
override fun mfaGetAuthenticators(mfaToken: String, factorsAllowed: ReadableArray?, promise: Promise) {
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Rename to getMfaAuthenticators ?

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

mfaGetAuthenticators Shouldn't this also be renamed to getMfaAuthenticators

@@ -177,6 +181,7 @@ class A0Auth0Module(private val reactContext: ReactApplicationContext) : A0Auth0

this.useDPoP = useDPoP ?: true
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

completely unrelated but shouldn't the default behaviour for Dpop be false ?

override fun mfaVerify(mfaToken: String, type: String, code: String, bindingCode: String?, promise: Promise) {
mfaBridge?.verify(mfaToken, type, code, bindingCode, promise)
?: promise.reject("NOT_INITIALIZED", "Auth0 not initialized")
}
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Noted you are following a pattern of mfa prefix . Ensure this is inline with what the auth0/react SDK also follows to maintain consistency ?

}

fun getAuthenticators(mfaToken: String, factorsAllowed: ReadableArray?, promise: Promise) {
val mfaClient = createAuthClient().mfaClient(mfaToken)
Copy link
Copy Markdown
Contributor

@pmathew92 pmathew92 Apr 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can't we just create one instance on AuthenticationAPIClient for this entire class ?

private val client by lazy { AuthenticationAPIClient(auth0).apply{
            if (useDPoP) {
           useDPoP(reactContext)
           }
      }
}
    

)
}

fun enroll(mfaToken: String, type: String, value: String?, promise: Promise) {
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Define type as enum so that its always limited to the supported factor

Comment thread example/android/app/build.gradle Outdated
applicationId "com.auth0example"
minSdkVersion rootProject.ext.minSdkVersion
targetSdkVersion rootProject.ext.targetSdkVersion
manifestPlaceholders = [auth0Domain: "dev-481o0jxuhhma72l4.us.auth0.com", auth0Scheme: "${applicationId}.auth0"]
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

remove the domain value from here

Comment thread ios/A0MfaBridge.swift Outdated
self.useDPoP = useDPoP
}

private func createAuthentication() -> Authentication {
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same comment as in Android. Can't we have 1 instance on Authentication fot this bridge class

Comment thread ios/A0MfaClient.swift
}
}

func enroll(mfaToken: String, type: String, value: String?, resolve: @escaping RCTPromiseResolveBlock, reject: @escaping RCTPromiseRejectBlock) {
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Make type as an enum instead of String

@subhankarmaiti subhankarmaiti force-pushed the feat/flexible-factors-grant-support branch from 71772d0 to 714794d Compare April 29, 2026 12:12
@auth0 auth0 deleted a comment from pmathew92 Apr 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants