Description

MFA is enforced at session login only. An OAuth application cannot demand a fresh MFA challenge before issuing an authorization code. There is no per-app MFA policy.

Rationale (roadmap: hermes-j33, P1)

Auth0 and Okta both support per-app MFA policies and step-up. Identified in j33.4.

Suggested approach

• Add a require_mfa flag (or mfa_policy) to the OAuth Application schema.
• In OAuthController.authorize/2, if the app requires MFA and the user's last MFA challenge is older than a threshold (or absent), redirect to /mfa/verify with a return-to-authorize target.
• Surface the policy in the consent screen.
• Files: lib/authify/o_auth/application.ex, lib/authify_web/controllers/oauth_controller.ex, lib/authify/mfa/flow.ex, migration.

Effort

M