M2-07 Identity Provider Integration & MFA Enforcement for Admin Accounts

Milestone: M2 — Platform and Client Admin SOW Reference: FR7, INT8 Requirement Clarity: 🟡 Confirm which IdP(s) are actually required at MVP — SOW Appendix 1 lists Entra ID/Auth0/Okta as illustrative options under INT8, not a hard requirement to support all three Dev Status: 🟡 Partially prototyped — Auth0 login works; MFA enrollment/management has no in-app UI (schema-only via MfaMethod entity)

Overview

Enforce MFA for all admin accounts (highly recommended for all accounts), backed by the confirmed identity provider(s).

Backend Tasks

• Confirm with Curo which IdP(s) are actually in MVP scope (Auth0 only vs. also Entra ID/Okta)
• Enforce MFA at the Auth0 tenant/rule level for admin roles (currently only scripted for the single seed admin in initialize_admin.ts — needs a general policy, not a one-off)
• Expose an endpoint to enroll/list/remove a user's MFA methods (MfaMethod entity currently unused outside its own file)

Frontend Tasks

• Build an MFA enrollment/management screen (QR code for TOTP, etc., depending on confirmed method)
• Surface "MFA required" messaging/redirect for admin accounts without MFA configured

Dependencies

• M2-10 Auth0 login/session — this doc's "Phase 2" section is the direct source for the MFA work here.
• M2-08 Passkey support — related but separate authentication factor.

Acceptance Criteria

• MFA enforced for admin users
• Users can authenticate via supported identity provider (per SOW Appendix 3, FR7 acceptance criteria)

Existing Reference Material

• ../../requirements/user_stories/user-management/multi-factor-authentication.md
• M2-10-account-expiry-session-management.md — "Phase 2: Add MFA and passkey support" section

Blockers & Risks

• Needs decision: IdP scope (single vs. multiple) before estimating this task properly.