Guard that requires a second factor (MFA). Returns 401 if no principal,
403 second-factor-required if the principal's amr holds none of
otp/pop.
The auth-session strategy OVERWRITES amr from its own record, so a
session principal cannot smuggle one in. Every other strategy's claims come
from something the application controls: the JWT strategy copies claims from
tokens the application itself signed, and a trusted issuer's toPrincipal
decides what an outside issuer's claims become. So a self-issued JWT
carrying amr: ['otp'] passes the guard — deliberately, and pinned by a
test.
A non-array amr is treated as ABSENT, not coerced. claims is
Record<string, unknown>, so an outside issuer or an application-built
principal can carry amr: 'otp' (a bare string). Reading that as a string and
calling .includes on it would make 'sotp' — or any string merely
CONTAINING the factor name — satisfy the guard.
Guard that requires a second factor (MFA). Returns 401 if no principal, 403
second-factor-requiredif the principal'samrholds none ofotp/pop.The
auth-sessionstrategy OVERWRITESamrfrom its own record, so a session principal cannot smuggle one in. Every other strategy's claims come from something the application controls: the JWT strategy copies claims from tokens the application itself signed, and a trusted issuer'stoPrincipaldecides what an outside issuer's claims become. So a self-issued JWT carryingamr: ['otp']passes the guard — deliberately, and pinned by a test.A non-array
amris treated as ABSENT, not coerced.claimsisRecord<string, unknown>, so an outside issuer or an application-built principal can carryamr: 'otp'(a bare string). Reading that as a string and calling.includeson it would make'sotp'— or any string merely CONTAINING the factor name — satisfy the guard.