DevOps

Phase 2B

Mandatory MFA login

Active internal accounts now complete a password step followed by an MFA challenge. Public sign-up remains blocked and production owner onboarding stays invitation or bootstrap controlled.

Active accounts complete email and password verification first, then finish the login with an authenticator code or a recovery code. Pending, suspended, and disabled accounts receive the same public failure response and do not receive a session.

Sessions are database-backed, protected routes resolve them on the server, and sensitive actions require a fresh MFA-verified session.

Sign in

Accounts are bootstrap or invitation only. Public registration remains disabled.

Login now requires MFA for enrolled accounts. Public registration and general production owner onboarding still remain unavailable. Return to the foundation overview.