medplum / medplum / 30479012945

92%

main: 92%

push

github

fix(server): generate an MFA secret on demand at enrollment (#9997)

A TOTP secret was only ever created when a user was invited with
`mfaRequired: true` or when they loaded `GET /auth/mfa/status`. Any other
user brought under an MFA requirement later — most notably by enabling the
project-wide `mfaRequired` setting — was prompted to enroll at login with
an enrollment URI containing `secret=undefined`, and `login-enroll`
rejected their authenticator code with `Secret not found`. Because the
login could not complete, they could not reach the Security page to have a
secret generated either, so the only way through was email-based MFA.

Generate and persist the secret when the enrollment payload is built.
`/auth/mfa/status` already did this, so both call sites now share
`buildTotpEnrollment`.

Signed-off-by: Derrick Farris <derrick@medplum.com>

22680 of 25763 branches covered (88.03%)

Branch coverage included in aggregate %.

9 of 9 new or added lines in 2 files covered. (100.0%)

40239 of 42634 relevant lines covered (94.38%)

12282.1 hits per line