accounted

Files

T

Jakob Wennberg 52bfd7a399 perf(auth): skip the MFA factor lookup once the session is at AAL2 (#1933 )

The enforced-MFA branch of the proxy called supabase.auth.mfa.listFactors()
on every page, RSC and prefetch request for every MFA-verified user with a
company. auth-js implements listFactors() as a getUser() network round
trip, so hosted page requests paid two Supabase Auth calls in sequence.

At AAL2 a verified factor exists by construction (the session got there by
verifying a challenge on one), so the lookup only runs on the aal1/aal1
path (users mid-enrolment), where it still gates exactly as before. The one
case deferred is a user who unenrols their last factor mid-session: the
JWT keeps aal2 until the next refresh, so the enrolment bounce lands on the
refresh instead of the next click.

Tests: aal1/aal1 still asks for the factor list and bounces to /mfa/enroll;
at aal2 listFactors is never called (even with a factor list that would
read as empty) on page, RSC and prefetch requests; the step-up bounce and
the no-company skip are unchanged.

Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

2026-08-26 14:15:22 +02:00

fetch-all.test.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890 )

2026-07-04 15:58:06 +02:00

middleware.test.ts

perf(auth): skip the MFA factor lookup once the session is at AAL2 (#1933 )

2026-08-26 14:15:22 +02:00

proxy-timing.test.ts

feat(perf): measure the auth proxy per request (Server-Timing + proxy completed log) (#1922 )

2026-08-26 13:55:42 +02:00

rls.pg.test.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890 )