Struct MfaManager 

pub struct MfaManager {
    pub totp: TotpManager,
    pub sms: SmsKitManager,
    pub email: EmailManager,
    pub backup_codes: BackupCodesManager,
    /* private fields */
}

Centralized multi-factor authentication (MFA) manager.

MfaManager coordinates all MFA operations across different authentication factors including TOTP, SMS, email, and backup codes. It provides a unified interface for MFA setup, challenge generation, and verification while supporting multiple MFA methods simultaneously.

Supported MFA Methods

• TOTP (Time-based OTP): RFC 6238 compliant authenticator apps
• SMS: Text message-based verification codes
• Email: Email-based verification codes
• Backup Codes: Single-use recovery codes

Multi-Method Support

Users can enable multiple MFA methods simultaneously, providing flexibility and redundancy. The manager handles method coordination and fallback scenarios.

Security Features

• Challenge Expiration: Time-limited challenges prevent replay attacks
• Rate Limiting: Prevents brute force attacks on MFA codes
• Secure Code Generation: Cryptographically secure random code generation
• Method Validation: Validates MFA setup before enabling
• Audit Logging: Comprehensive logging of all MFA operations

Cross-Method Operations

The manager supports advanced scenarios like:

• Method fallback when primary method fails
• Cross-method challenge validation
• Method strength assessment
• Risk-based MFA requirements

Example

use auth_framework::auth_modular::mfa::MfaManager;

// Create MFA manager with storage backend
let mfa_manager = MfaManager::new(storage);

// Setup TOTP for a user
let setup_result = mfa_manager.totp.setup_totp("user123", "user@example.com").await?;

// Generate challenge
let challenge = mfa_manager.create_challenge("user123", MfaMethodType::Totp).await?;

// Verify user's response
let verification = mfa_manager.verify_challenge(&challenge.id, "123456").await?;

Thread Safety

The MFA manager is designed for concurrent use and safely coordinates access to underlying MFA method implementations.

Storage Integration

Integrates with the framework’s storage system to persist:

• User MFA method configurations
• Active challenges
• Usage statistics and audit logs
• Backup codes and secrets

Fields

totp: TotpManager

TOTP manager

sms: SmsKitManager

SMS manager (using SMSKit)

email: EmailManager

Email manager

backup_codes: BackupCodesManager

Backup codes manager

Implementations

impl MfaManager

pub fn new(storage: Arc<dyn AuthStorage>) -> Self

Create a new MFA manager

pub fn new_with_smskit_config( storage: Arc<dyn AuthStorage>, smskit_config: SmsKitConfig, ) -> Result<Self>

Create a new MFA manager with SMSKit configuration

pub async fn store_challenge(&self, challenge: MfaChallenge) -> Result<()>

Store an MFA challenge

pub async fn get_challenge( &self, challenge_id: &str, ) -> Result<Option<MfaChallenge>>

Get an MFA challenge

pub async fn remove_challenge(&self, challenge_id: &str) -> Result<()>

Remove an MFA challenge

pub async fn cleanup_expired_challenges(&self) -> Result<()>

Clean up expired challenges

pub async fn get_active_challenge_count(&self) -> usize

Get count of active challenges

pub async fn initiate_step_up_authentication( &self, user_id: &str, required_methods: &[MfaMethod], risk_level: RiskLevel, ) -> Result<CrossMethodChallenge>

MFA CROSS-METHOD OPERATIONS: Step-up authentication with multiple factors

pub async fn complete_cross_method_step( &self, challenge_id: &str, method: MfaMethod, response: &str, ) -> Result<CrossMethodCompletionResult>

Complete a specific method within a cross-method challenge

pub async fn get_available_methods( &self, user_id: &str, ) -> Result<Vec<MfaMethod>>

Get available MFA methods for a user

pub async fn perform_method_fallback( &self, user_id: &str, failed_method: MfaMethod, fallback_order: &[MfaMethod], ) -> Result<MethodFallbackResult>

Perform method fallback when primary method fails

pub async fn emergency_mfa_bypass( &self, user_id: &str, admin_token: &str, ) -> Result<bool>

Emergency MFA bypass using direct storage access This method provides a way to recover when all MFA methods fail