docs: Document requires_totp_mfa JWT claim#1281
Conversation
![promptless[bot]](https://avatars.githubusercontent.com/in/979718?s=60&v=4){kind=small}
| - **`project_id`**: Your Stack Auth project ID | ||
| - **`branch_id`**: The project branch (currently always `main`) | ||
| - **`refresh_token_id`**: ID of the associated refresh token | ||
| - **`requires_totp_mfa`**: Whether the user has TOTP multi-factor authentication enabled |
There was a problem hiding this comment.
Citation: Based on commit c8b5168 "Add requires_totp_mfa to JWT". The commit added requires_totp_mfa to tokens.tsx, schema-fields.ts, and the example JWT in jwt.mdx, but didn't add a description in the Stack Auth Specific Claims section. The field indicates whether the user has TOTP MFA enabled, as shown in the e2e tests in access-token-refresh.test.ts.
View source
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
|
Greptile SummaryThis PR fills a documentation gap by adding the missing
Confidence Score: 5/5
Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[User Signs In] --> B{Has TOTP MFA\nrequired?}
B -- No --> C[Issue JWT\nrequires_totp_mfa: false]
B -- Yes --> D[Issue partial JWT\nrequires_totp_mfa: true]
D --> E[Redirect to\nTOTP verification step]
E --> F{TOTP\nverified?}
F -- Yes --> G[Issue full JWT\nrequires_totp_mfa: true]
F -- No --> H[Auth rejected]
C --> I[Access granted]
G --> I
Reviews (1): Last reviewed commit: "Document requires_totp_mfa JWT claim" | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| - **`project_id`**: Your Stack Auth project ID | ||
| - **`branch_id`**: The project branch (currently always `main`) | ||
| - **`refresh_token_id`**: ID of the associated refresh token | ||
| - **`requires_totp_mfa`**: Whether the user has TOTP multi-factor authentication enabled |
There was a problem hiding this comment.
The added description says "Whether the user has TOTP multi-factor authentication enabled," but the internal OpenAPI spec in packages/stack-shared/src/interface/crud/users.ts describes this field as "Whether the user is required to use TOTP MFA to sign in". These are subtly different: a user could have TOTP configured without it being required at sign-in, or an admin could enforce MFA on users who already have TOTP set up. The claim name itself (requires_totp_mfa) and its SDK mapping to isMultiFactorRequired both reinforce the "required to use" semantics rather than simply "has enabled."
Consider aligning the docs with the existing internal description:
| - **`requires_totp_mfa`**: Whether the user has TOTP multi-factor authentication enabled | |
| - **`requires_totp_mfa`**: Whether the user is required to use TOTP MFA to sign in |
1 participant
Open this suggestion in Promptless to view citations and reasoning process
Adds documentation for the new
requires_totp_mfaclaim in the JWT Tokens guide. The commit added this field to the example JWT payload but didn't include a description in the "Stack Auth Specific Claims" section. This claim indicates whether the user has TOTP multi-factor authentication enabled.Trigger Events
stack-auth/stack-auth commit (dev): c8b5168 Add requires_totp_mfa to JWT
Promptless Research (1 webpage)
Agent Response
Tip: Request one-off documentation tasks in the Dashboard under New Task 🚀