Repository: logto-io/logto
File: packages/core/src/routes/experience/classes/helpers.ts (TypeScript)

Code before:
  }

  return [...userMfaVerifications, ...newMfaVerifications];
};

/**
 * Filter out backup codes mfa verifications that have been used
 */
const filterOutEmptyBackupCodes = (
  mfaVerifications: User['mfaVerifications']
): User['mfaVerifications'] =>
  mfaVerifications.filter((mfa) => {
    if (mfa.type === MfaFactor.BackupCode) {
      return mfa.codes.some((code) => !code.usedAt);
    }
    return true;
  });

/**
 * Get all enabled MFA verifications for a user (stored + implicit)
 * @param mfaSettings - MFA settings from sign-in experience
 * @param user - User object with mfaVerifications and profile data
 * @param userProfile - Optional profile override (for interaction contexts)
 * @returns Array of all enabled MFA verifications
 */
export const getAllUserEnabledVerifications = (
  mfaSettings: Mfa,
  user: User,
  userProfile?: { primaryEmail?: string }
): MfaVerification[] => {
  const storedVerifications = filterOutEmptyBackupCodes(user.mfaVerifications).filter(
    (verification) => mfaSettings.factors.includes(verification.type)
  );

  if (!EnvSet.values.isDevFeaturesEnabled) {
    return storedVerifications;
  }

  const profile = userProfile ?? {
    primaryEmail: user.primaryEmail ?? undefined,
  };

  const implicitVerifications = [
    // Email MFA Factor: user has primaryEmail + Email factor enabled in SIE
    ...(mfaSettings.factors.includes(MfaFactor.EmailVerificationCode) && profile.primaryEmail
      ? ([
          {
            id: 'implicit-email-mfa', // Fake ID for capability
            type: MfaFactor.EmailVerificationCode,
            createdAt: new Date(user.createdAt).toISOString(),
          },

Review comment (suggestion):
```suggestion
export const getAllUserEnabledMfaVerifications = (
```

Code after:
  }

  return [...userMfaVerifications, ...newMfaVerifications];
};

/**
 * Filter out backup codes mfa verifications that have been used
 */
const filterOutEmptyBackupCodes = (
  mfaVerifications: User['mfaVerifications']
): User['mfaVerifications'] =>
  mfaVerifications.filter((mfa) => {
    if (mfa.type === MfaFactor.BackupCode) {
      return mfa.codes.some((code) => !code.usedAt);
    }
    return true;
  });

/**
 * Get all enabled MFA verifications for a user (stored + implicit)
 * @param mfaSettings - MFA settings from sign-in experience
 * @param user - User object with mfaVerifications and profile data
 * @param currentProfile - Optional profile override (for current interaction contexts), in cases of MFA verification, this is not needed
 * @returns Array of all enabled MFA verifications
 */
export const getAllUserEnabledMfaVerifications = (
  mfaSettings: Mfa,
  user: User,
  currentProfile?: InteractionProfile
): MfaVerification[] => {
  const storedVerifications = filterOutEmptyBackupCodes(user.mfaVerifications).filter(
    (verification) => mfaSettings.factors.includes(verification.type)
  );

  if (!EnvSet.values.isDevFeaturesEnabled) {
    return storedVerifications;
  }

  const email = currentProfile?.primaryEmail ?? user.primaryEmail;

  const implicitVerifications = [
    // Email MFA Factor: user has primaryEmail + Email factor enabled in SIE
    ...(mfaSettings.factors.includes(MfaFactor.EmailVerificationCode) && email
      ? ([
          {
            id: 'implicit-email-mfa', // Fake ID for capability
            type: MfaFactor.EmailVerificationCode,
            createdAt: new Date(user.createdAt).toISOString(),
          },
        ] satisfies MfaVerification[])
      : []),