feat: self-hosted env flag to require MFA for every dashboard user

Abierto
  • ¿Algo no está bien?
#5,025 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

  • #5034 de @MauryaQbit — cerrado sin fusionar

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
35/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
typescript
Área
authentication, security

Línea de trabajo

The request is a new opt-in MFA_REQUIRED webapp environment variable that gates dashboard access on TOTP MFA being enabled, and blocks users from disabling it. Start with how the webapp already handles sign-in, the existing TOTP opt-in flow, and where dashboard requests are authorized. Done means that with the flag set, an MFA-less user is redirected to setup and other dashboard routes refuse them, and with the flag unset behavior is unchanged. Because the issue has no discussion yet, confirm the design with the maintainers before building on the author's pending pull request.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Is your feature request related to a problem? Please describe.

Self-hosted instances can't require multi-factor authentication. TOTP MFA is opt-in for each user, magic-link login is always available, and users can turn MFA off themselves. Operators under compliance programs (FedRAMP, SOC 2, HIPAA) need to require a second factor for every dashboard user, not just recommend one.

Describe the solution you'd like to see

An opt-in MFA_REQUIRED webapp env var, off by default. When it's set:

  • A signed-in user without MFA is sent to a setup page. Other dashboard requests are refused until they enable it.
  • Users can't disable MFA.
Describe alternate solutions
  • Put an authenticating proxy (such as OIDC at the load balancer) in front of the dashboard. This adds infrastructure, and the MFA it enforces sits outside Trigger.dev.
  • Report users without MFA and follow up with them manually. This catches gaps but doesn't prevent access.
Additional information

I have an implementation ready and will open a PR that references this issue.

Lenguaje dominante
TypeScript
Estrellas
16.5k
Forks
1.5k
Merge medio
1 d 15 h
PR fusionados (30 d)
17

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de triggerdotdev/trigger.dev

Todos los issues de triggerdotdev/trigger.dev

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.