Interface MfaOptions

Where a provider callback sends the browser when its sign-in resolved second-factor-required — the application's code form. A same-origin absolute path; anything else is refused when AuthPlugin(...) is called. Absent, the callback redirects to the sign-in's returnTo, where the application reads IAuthSessionService.pending to tell the pending state apart from an anonymous one.

How long a pending second-factor record may sit before it is refused, in milliseconds. Defaults to 300 000 (5 minutes). Must be a positive integer; anything else is refused when AuthPlugin(...) is called.

Decides whether a second factor is required for a given principal and set of methods. Return true to require a second factor; the sign-in then stores a pending record and resolves second-factor-required.

The principal is the one toPrincipal built (or the application's password login produced), and methods are the methods that produced it so far. An application whose provider already enforced MFA can answer false from the provider's claims.