Multi-Factor Authentication (MFA) Support

[TetianaKhomenko]

Description:

To improve platform security and meet enterprise and compliance requirements, we need to introduce Multi-Factor Authentication (MFA) for user accounts. MFA will provide an additional layer of protection beyond username and password, reducing the risk of unauthorized access.

Scope / Requirements:

1. MFA Methods

Support one or more of the following MFA methods:

• Time-based One-Time Passwords (TOTP) via authenticator apps (Google Authenticator, Authy, etc.)
• Email-based one-time codes (as an initial or fallback option)
• Backup recovery codes

2. User Experience

• Ability for users to enable/disable MFA in account security settings (subject to org policy)
• Clear enrollment and verification flow
• Recovery flow in case a user loses access to MFA device
• Graceful handling for first-time MFA setup after feature rollout

3. Organization & Admin Controls

• Option for organization admins to enforce MFA for all or selected users
• Role-based enforcement (e.g., admins required, viewers optional)
• Visibility into MFA status per user
• Support MFA enforcement via SSO / IdP where applicable

4. Security & Compliance

• Secure storage of MFA secrets
• Protection against brute-force MFA attempts
• Audit logging for MFA-related events (enable, disable, recovery, failures)

Acceptance Criteria:

• Users can successfully enroll and authenticate using MFA
• Admins can enforce MFA at the organization level
• Recovery options are available and documented
• MFA events are logged for auditing
• No regression in login performance or UX