Account security and TOTP MFA

The managed /account/security page shows the user's Auth providers and supplies real email, password, and authenticator-app controls. Email and password mutations reauthenticate password users at the server boundary. OAuth-only users see those controls disabled because they do not have a password identity to reauthenticate.

Configure authenticator MFA

AUTHENTICATION: {
  MFA_TOTP: {
    REQUIRED_FOR_SIGN_IN: true,
  },
},

Enrolment and factor management are always displayed. REQUIRED_FOR_SIGN_IN sends an enrolled user whose session is at AAL1 through /account/mfa before completing a password, OTP, magic-link, or OAuth sign-in destination. If no verified factor exists, the session has no AAL2 step to perform; the user may enrol from Security.

For local development, set both enroll_enabled = true and verify_enabled = true under [auth.mfa.totp] in supabase/config.toml, then restart the local Supabase stack. Hosted projects use their separate Auth MFA setting in the Supabase Dashboard; changing the local TOML file does not change a hosted project.

Supacharger uses Supabase Auth's listFactors, enroll, challengeAndVerify, and unenroll operations. It never stores a TOTP secret in application tables. An unverified enrolment can be cancelled. A verified factor requires a current six-digit code when the session needs to step up before removal.

Email and password changes

POST /api/account/email parses the request with Zod, verifies the current user and password identity, reauthenticates the current password, and asks Supabase Auth to send the secure email-change confirmation. The redirect returns to /account/security.

POST /api/account/update-password applies the configured password policy, verifies the current password, and calls auth.updateUser. OAuth-only accounts keep both forms visibly unavailable instead of exposing a control that cannot succeed.

Product presentation

The security route and non-visual behaviour are managed. A developer-owned src/supacharger.adapters/account/security-page.tsx starter may preserve an authorised product presentation. The CLI installs this adapter only when missing and never overwrites it. Specdrive uses this seam; its restricted presentation is not copied into the open-source Core.