feat(settings): Add MFA guard to 2FA setup from settings by vpomerleau · Pull Request #19432 · mozilla/fxa

vpomerleau · 2025-09-10T21:09:09Z

NOTE: This PR contains 2 commits, only 00ada1d is part of the review scope here.

Because

We want to guard the totp creation endpoints and flow

This pull request

Add MFA guard to 2FA setup from settings
Add MFA version of POST /recoveryCodes, /recovery_phone/confirm, /recovery_phone/change
Add Swagger docs for recovery phone routes
Use MFA authenticated endpoints added in feat(mfa): Add MFA endpoints for TOTP setup #19473
Update functional tests

Issue that this pull request solves

Closes: FXA-12229

Checklist

Put an x in the boxes that apply

My commit is GPG signed.
If applicable, I have modified or added tests which pass locally.
I have added necessary documentation (if appropriate).
I have verified that my changes render correctly in RTL (if appropriate).

Screenshots (Optional)

Please attach the screenshots of the changes made in case of change in user interface.

Other information (Optional)

packages/fxa-auth-client/lib/client.ts

packages/fxa-auth-server/docs/swagger/totp-api.ts

packages/fxa-auth-server/lib/routes/totp.js

packages/fxa-auth-server/test/local/routes/totp.js

packages/fxa-settings/src/models/Account.ts

packages/fxa-settings/src/components/Settings/UnitRowTwoStepAuth/index.tsx

packages/fxa-settings/src/components/Settings/index.tsx

packages/fxa-settings/src/components/Settings/index.test.tsx

packages/fxa-settings/src/pages/InlineRecoverySetupFlow/container.tsx

packages/fxa-settings/src/pages/InlineRecoverySetupFlow/interfaces.ts

dschom

Just a drive by with coments. I'll do a little manual testing, but the changes look great. Thanks for extra clean up, btw!

Because: * We want to guard the totp creation endpoints and flow This commit: * Add MFA authentication variants of the 2FA setup endpoints (existing endpoints conserved for inline flow) * Add MFA guard to 2FA setup from settings Closes #FXA-12229

dschom

Just did some manual testing, and it looks good to me! Thanks for these changes.

vpomerleau force-pushed the FXA-12229 branch 2 times, most recently from 7656f1c to 00ada1d Compare September 18, 2025 03:02

vpomerleau changed the title ~~WIP feat(auth, settings): Add MFA guard to 2FA setup from settings~~ feat(settings): Add MFA guard to 2FA setup from settings Sep 18, 2025

vpomerleau marked this pull request as ready for review September 18, 2025 03:21

vpomerleau requested a review from a team as a code owner September 18, 2025 03:21

dschom self-requested a review September 18, 2025 17:36