Multi-factor authentication available

Without MFA, a stolen or phished password is sufficient to compromise any account. CWE-308 (Use of Single-Factor Authentication) and OWASP A07 (Identification & Authentication Failures) both flag password-only auth as a systemic weakness. NIST 800-53 IA-2(1) mandates multi-factor authentication for privileged accounts and for any system handling sensitive data. Credential phishing is the most common initial access vector in reported breaches; MFA stops the majority of these attacks even after credentials are compromised. Admin accounts without MFA are an especially high-value target because a single compromise grants full application access.

Implement TOTP-based MFA using otplib. Store the secret encrypted; only mark totpEnabled: true after the user successfully verifies their first code:

import { authenticator } from 'otplib'

// Enrollment: generate and return QR code
const secret = authenticator.generateSecret()
const otpauth = authenticator.keyuri(user.email, 'YourApp', secret)
// Save encrypt(secret) to database with totpEnabled: false

// Verification: check code before enabling
const isValid = authenticator.check(userCode, secret)
if (isValid) await db.user.update({ where: { id }, data: { totpEnabled: true } })

Force MFA enrollment for admin roles on first login. Provide backup codes at enrollment time and store them hashed.