feat(mfa): hide the primary passkey button when MFA is enforced

Also wires config.is_mfa_enforced through AuthorizerConfig /
AuthorizerContextPropsType and both default config objects in
AuthorizerContext - the field existed in the linked SDK's Meta type
but was never declared on the local config types, so referencing it
failed to typecheck.

Author: lakhansamani

src/components/AuthorizerPasskeyLogin.tsx

@@ -47,7 +47,13 @@ export const AuthorizerPasskeyLogin: FC<{
   const [loading, setLoading] = useState(false);
   const { setAuthData, config, authorizerRef } = useAuthorizer();
 
-  if (!isWebauthnSupported()) {
+  // When the org enforces MFA, passkey must never be offered as a
+  // standalone primary-login path - it would let a user skip the org's
+  // two-factor requirement entirely. The server refuses this independently
+  // (webauthn_login_verify checks EnforceMFA itself), but the button
+  // shouldn't invite the attempt in the first place: authenticator methods
+  // belong after a first factor has identified the user, not before.
+  if (!isWebauthnSupported() || config.is_mfa_enforced) {
     return null;
   }
 
@@ -94,6 +100,16 @@ export const AuthorizerPasskeyLogin: FC<{
         }
         return;
       }
+      if (res && !res.access_token) {
+        // Reachable only if this button somehow rendered despite the
+        // is_mfa_enforced guard above (e.g. a brief pre-config-load
+        // window) - the server is the real boundary and just refused to
+        // issue a token. Don't treat this as a successful login.
+        setError(
+          `Additional verification is required. Please sign in with your email and password instead.`
+        );
+        return;
+      }
       if (res) {
         setAuthData({
           user: res.user || null,

src/contexts/AuthorizerContext.tsx

@@ -39,6 +39,7 @@ const AuthorizerContext = createContext<AuthorizerContextPropsType>({
     is_multi_factor_auth_enabled: false,
     is_mobile_basic_authentication_enabled: false,
     is_phone_verification_enabled: false,
+    is_mfa_enforced: false,
   },
   configLoadError: null,
   user: null,
@@ -114,6 +115,7 @@ let initialState: AuthorizerState = {
     is_multi_factor_auth_enabled: false,
     is_mobile_basic_authentication_enabled: false,
     is_phone_verification_enabled: false,
+    is_mfa_enforced: false,
   },
 };
 

src/types/index.ts

@@ -22,6 +22,7 @@ export type AuthorizerConfig = {
   is_multi_factor_auth_enabled: boolean;
   is_mobile_basic_authentication_enabled: boolean;
   is_phone_verification_enabled: boolean;
+  is_mfa_enforced: boolean;
 };
 
 export type AuthorizerState = {
@@ -59,6 +60,7 @@ export type AuthorizerContextPropsType = {
     is_multi_factor_auth_enabled: boolean;
     is_mobile_basic_authentication_enabled: boolean;
     is_phone_verification_enabled: boolean;
+    is_mfa_enforced: boolean;
   };
   user: null | User;
   token: null | AuthToken;