hey HN, supabase ceo here<p>In case it's not clear - MFA is Multi Factor Authentication, and this one is for you, the developer, to use within your own apps<p>The neat thing about this one is that it flows all the way through to the JWT so that you can use it in a Postgres Row Level Security Policy:<p><pre><code> create policy "Enforce MFA for all end users."
on table_name
as restrictive
to authenticated
using ( auth.jwt()->>'aal' = 'aal2' );
</code></pre>
You can see the `aal`, which is "Authenticator Assurance Level". This is aal1 for "no MFA", aal2 is 2 factor auth, etc...<p>A few of the team will be here to answer questions