supabase / auth / 10910643205

push

github

fix: update aal requirements to update user (#1766)

## What kind of change does this PR introduce?

If a user has verified factors (mfa enabled) we should require an AAL2
session in order to proceed with any operation

We restrict phone, email, and password from updates as we consider those
as sensitive fields

Context:
https://supabase.slack.com/archives/C02AK9166FR/p1725466764804889

---------

Co-authored-by: Stojan Dimitrovski <sdimitrovski@gmail.com>

4 of 10 new or added lines in 2 files covered. (40.0%)

9139 of 15792 relevant lines covered (57.87%)

55.55 hits per line