feat(core): bind SMS MFA (#7662)

Author: wangsijie

packages/core/src/routes/experience/classes/helpers.ts

@@ -212,6 +212,7 @@ export const getAllUserEnabledMfaVerifications = (
   }
 
   const email = currentProfile?.primaryEmail ?? user.primaryEmail;
+  const phone = currentProfile?.primaryPhone ?? user.primaryPhone;
 
   const implicitVerifications = [
     // Email MFA Factor: user has primaryEmail + Email factor enabled in SIE
@@ -224,6 +225,16 @@ export const getAllUserEnabledMfaVerifications = (
           },
         ] satisfies MfaVerification[])
       : []),
+    // Phone MFA Factor: user has primaryPhone + Phone factor enabled in SIE
+    ...(mfaSettings.factors.includes(MfaFactor.PhoneVerificationCode) && phone
+      ? ([
+          {
+            id: 'implicit-phone-mfa', // Fake ID for capability
+            type: MfaFactor.PhoneVerificationCode,
+            createdAt: new Date(user.createdAt).toISOString(),
+          },
+        ] satisfies MfaVerification[])
+      : []),
   ];
 
   return [...storedVerifications, ...implicitVerifications];

packages/core/src/routes/experience/classes/libraries/mfa-validator.ts

@@ -11,7 +11,10 @@ import {
 
 import { getAllUserEnabledMfaVerifications } from '../helpers.js';
 import { type BackupCodeVerification } from '../verifications/backup-code-verification.js';
-import { type EmailCodeVerification } from '../verifications/code-verification.js';
+import {
+  type EmailCodeVerification,
+  type PhoneCodeVerification,
+} from '../verifications/code-verification.js';
 import { type VerificationRecord } from '../verifications/index.js';
 import { type TotpVerification } from '../verifications/totp-verification.js';
 import { type WebAuthnVerification } from '../verifications/web-authn-verification.js';
@@ -21,26 +24,30 @@ const mfaVerificationTypes = Object.freeze([
   VerificationType.BackupCode,
   VerificationType.WebAuthn,
   VerificationType.EmailVerificationCode,
+  VerificationType.PhoneVerificationCode,
 ]);
 
 type MfaVerificationType =
   | VerificationType.TOTP
   | VerificationType.BackupCode
   | VerificationType.WebAuthn
-  | VerificationType.EmailVerificationCode;
+  | VerificationType.EmailVerificationCode
+  | VerificationType.PhoneVerificationCode;
 
 const mfaVerificationTypeToMfaFactorMap = Object.freeze({
   [VerificationType.TOTP]: MfaFactor.TOTP,
   [VerificationType.BackupCode]: MfaFactor.BackupCode,
   [VerificationType.WebAuthn]: MfaFactor.WebAuthn,
   [VerificationType.EmailVerificationCode]: MfaFactor.EmailVerificationCode,
+  [VerificationType.PhoneVerificationCode]: MfaFactor.PhoneVerificationCode,
 }) satisfies Record<MfaVerificationType, MfaFactor>;
 
 type MfaVerificationRecord =
   | TotpVerification
   | WebAuthnVerification
   | BackupCodeVerification
-  | EmailCodeVerification;
+  | EmailCodeVerification
+  | PhoneCodeVerification;
 
 const isMfaVerificationRecord = (
   verification: VerificationRecord

packages/core/src/routes/experience/profile-routes.ts

@@ -231,8 +231,16 @@ export default function interactionProfileRoutes<T extends ExperienceInteraction
           break;
         }
         case MfaFactor.PhoneVerificationCode: {
-          // TODO: Implement SMS verification code MFA binding
-          throw new Error('Not implemented yet');
+          if (!EnvSet.values.isDevFeaturesEnabled) {
+            throw new Error('Not implemented yet');
+          }
+
+          await experienceInteraction.profile.setProfileByVerificationId(
+            SignInIdentifier.Phone,
+            verificationId,
+            log
+          );
+          break;
         }
       }
 

packages/integration-tests/src/helpers/sign-in-experience.ts

@@ -185,6 +185,22 @@ export const enableMandatoryMfaWithEmailAndBackupCode = async () =>
     },
   });
 
+export const enableMandatoryMfaWithPhone = async () =>
+  updateSignInExperience({
+    mfa: {
+      factors: [MfaFactor.PhoneVerificationCode],
+      policy: MfaPolicy.Mandatory,
+    },
+  });
+
+export const enableMandatoryMfaWithPhoneAndBackupCode = async () =>
+  updateSignInExperience({
+    mfa: {
+      factors: [MfaFactor.PhoneVerificationCode, MfaFactor.BackupCode],
+      policy: MfaPolicy.Mandatory,
+    },
+  });
+
 export const enableMandatoryMfaWithWebAuthnAndBackupCode = async () =>
   updateSignInExperience({
     mfa: {