2FA requirement support for interactions

[PlavorSeol]

Background

2FA is pretty good feature for security. mfa_level (2FA requirement for moderation) is good feature to encourage (almost force) guild (server) operators to enable 2FA, by requiring it for their duty.

However, almost all moderation bots allow bypassing 2FA requirement, checking only permissions and roles, probably because there is currently no reasonable way to enforce it without adding extra hassle besides the requirement itself.

Currently it is possible to determine certain user's 2FA status with identify OAuth2 scope, but this requires bots to add more hassle which requires users who need to use moderation commands to login first.

#4175 seems to suggest exposing user's 2FA status directly to bots as an alternative, however it seems to be very controversal, and a thing Discord does not want to do.

Proposed solution

Interactions have capability to validate some of requirements on Discord-side and deny the access without sending them to the application at all, so why not validate 2FA status in this way?

My proposal is to allow application commands to specify 2FA requirement status, and make Discord check for user's 2FA status when a command which requires 2FA is used in a guild where mfa_level is 1.

How it should work:

1. Application commands will have a new field called mfa_required which should be optional in current version of API, but can be required in the next version.
2. If a user uses a command, check if mfa_required is true for it, and mfa_level is 1 for the guild.
3. If 2 is true, check whether the user enabled 2FA or not, and deny the interaction if they did not and do not send it to the application at all.
4. This should have no effect in guilds where mfa_level is 0.

Message component support

It would be good if message components can specify 2FA requirement as well, for the following reasons:

• Message components are not necessarily tied to a user who initiated an interaction, for example a report from a user posted in private channel can have buttons for moderation actions.
• While currently there is no interaction permission for message components, bots can still check for permissions and roles themselves, but checking 2FA status without identify OAuth2 scope is not possible at all.