Implement MFA Enforcement

src/hooks/useAuth.tsx

@@ -8,6 +8,7 @@ import { authLog, authWarn, authError } from '@/lib/authLogger';
 interface AuthContextType {
   user: User | null;
   session: Session | null;
+  aal: 'aal1' | 'aal2' | null;
   loading: boolean;
   pendingEmail: string | null;
   sessionError: string | null;
@@ -21,6 +22,7 @@ const AuthContext = createContext<AuthContextType | undefined>(undefined);
 function AuthProviderComponent({ children }: { children: React.ReactNode }) {
   const [user, setUser] = useState<User | null>(null);
   const [session, setSession] = useState<Session | null>(null);
+  const [aal, setAal] = useState<'aal1' | 'aal2' | null>(null);
   const [loading, setLoading] = useState(true);
   const [pendingEmail, setPendingEmail] = useState<string | null>(null);
   const [sessionError, setSessionError] = useState<string | null>(null);
@@ -84,17 +86,22 @@ function AuthProviderComponent({ children }: { children: React.ReactNode }) {
         authLog('[Auth] SIGNED_IN - user authenticated');
         setSession(session);
         setUser(session.user);
+        const userAal = (session.user as any).aal as 'aal1' | 'aal2' | undefined;
+        setAal(userAal || 'aal1');
         setLoading(false);
       } else if (event === 'INITIAL_SESSION') {
         if (session?.user) {
           authLog('[Auth] INITIAL_SESSION - user exists');
           setSession(session);
           setUser(session.user);
+          const userAal = (session.user as any).aal as 'aal1' | 'aal2' | undefined;
+          setAal(userAal || 'aal1');
           setLoading(false);
         } else {
           authLog('[Auth] INITIAL_SESSION - no user');
           setSession(null);
           setUser(null);
+          setAal(null);
           setLoading(false);
           return;
         }
@@ -102,11 +109,14 @@ function AuthProviderComponent({ children }: { children: React.ReactNode }) {
         authLog('[Auth] SIGNED_OUT - clearing state');
         setSession(null);
         setUser(null);
+        setAal(null);
         setLoading(false);
         return;
       } else {
         setSession(session);
         setUser(session?.user ?? null);
+        const userAal = session?.user ? ((session.user as any).aal as 'aal1' | 'aal2' | undefined) : null;
+        setAal(userAal || null);
       }
       
       // Detect confirmed email change: email changed AND no longer pending
@@ -214,6 +224,7 @@ function AuthProviderComponent({ children }: { children: React.ReactNode }) {
   const value = {
     user,
     session,
+    aal,
     loading,
     pendingEmail,
     sessionError,

src/hooks/useRequireMFA.ts

@@ -0,0 +1,21 @@
+import { useAuth } from './useAuth';
+import { useUserRole } from './useUserRole';
+
+export function useRequireMFA() {
+  const { aal } = useAuth();
+  const { isModerator, isAdmin, loading } = useUserRole();
+  
+  // MFA is required for moderators and admins
+  const requiresMFA = isModerator() || isAdmin();
+  
+  // User has MFA if they have AAL2
+  const hasMFA = aal === 'aal2';
+  
+  return {
+    requiresMFA,
+    hasMFA,
+    needsEnrollment: requiresMFA && !hasMFA,
+    aal,
+    loading,
+  };
+}