Enum MfaPolicy 

pub enum MfaPolicy {
    Disabled,
    Optional,
    Required,
    RequiredForRoles(&'static [Role]),
}

Framework-wide MFA enforcement policy.

Plain Copy enum (no trait object) — operators wire it onto Admin via [crate::admin::types::Admin::require_mfa]. The login_guard consults the active policy AFTER successful password verification and AFTER R2’s must_change_password check (commit #15 of the R3 plan).

Forward-only enforcement (D6). Switching to MfaPolicy::Required does NOT retroactively revoke existing sessions. Existing users without MFA enrolled are redirected to /admin/mfa/enroll at the next request that hits login_guard. The pattern mirrors R2’s must_change_password interstitial.

Default is MfaPolicy::Optional. R1 page copy contains zero MFA mention; the doctrine-9 floor in DESIGN_RECOVERY (email is convenience, not root of trust) sets the baseline. Operators who want MFA enforcement opt in explicitly.

Typical project wiring:

use rustio_admin::auth::{MfaPolicy, Role};

// Enforce for everyone:
let admin = Admin::new().require_mfa(MfaPolicy::Required);

// Enforce for privileged roles only:
const PRIVILEGED: &[Role] = &[Role::Administrator, Role::Supervisor];
let admin = Admin::new().require_mfa(MfaPolicy::RequiredForRoles(PRIVILEGED));

// Reject MFA enrolment outright (e.g. for a public-kiosk admin):
let admin = Admin::new().require_mfa(MfaPolicy::Disabled);

Variants

Disabled

MFA enrolment is rejected outright. Existing enrolments remain readable on the rustio_users row but the verify flow refuses to honour them. Used by deployments that have decided MFA is operationally inappropriate (kiosks, shared-credential workflows, etc.).

Optional

Default. Users may enrol; users without MFA can sign in with password alone. The pre-R3 framework behaviour.

Required

Every user must enrol. Forward-only — existing sessions remain valid; the login_guard redirects users without MFA to /admin/mfa/enroll at the next request.

RequiredForRoles(&'static [Role])

Required only for users whose Role appears in the slice. Forward-only with the same semantics as MfaPolicy::Required. Empty slice is equivalent to MfaPolicy::Optional — the policy reads “no role requires MFA” rather than “no users require MFA”.

Trait Implementations

impl Clone for MfaPolicy

fn clone(&self) -> MfaPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for MfaPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for MfaPolicy

fn default() -> Self

MfaPolicy::Optional is the framework default. R1 page copy contains zero MFA mention; operators opt into enforcement explicitly via [crate::admin::types::Admin::require_mfa].

impl Copy for MfaPolicy