MFA & staff auth

The flow

Platform staff sign in with email + password against the platform API. With MFA on, the password check succeeds but the session token is parked: it is sealed inside a signed, httpOnly cookie together with the hash of a 6-digit code that is emailed to the user. Only after the code checks out is the real session released.

Stateless on purpose

• Nothing is stored server-side for the challenge — expiry and the attempt counter live in the signed payload, so tampering with either just invalidates the cookie and restarts the login.
• Codes are compared by hash with constant-time comparison.
• Five attempts, then the login restarts from the password step.

Enforcement

A platform-wide setting (force_mfa_email) requires the second factor for every staff login — a switch in the platform's settings surface, not a per-user opt-in that half the team forgets.

The rest of staff auth

• Sessions ride httpOnly cookies; the browser never holds a readable token, and sign-out actually revokes rather than just navigating away.
• Invited staff receive a temporary credential flow; never-signed-in users are visibly pending.
• Deactivating a staff member ends their access without deleting their history (their name stays on past actions and assignments).
• Role checks (owner / admin / member) are enforced in server actions and API handlers — hiding a button is UX, never the security boundary.