Repository: logto-io/logto
File: packages/core/src/routes/experience/classes/experience-interaction.ts (TypeScript)

Code before:
    await this.profile.assertUserMandatoryProfileFulfilled({
      hasVerifiedSocialIdentity: this.hasVerifiedSocialIdentity,
      hasVerifiedSsoIdentity: this.hasVerifiedSsoIdentity,
    });

    if (EnvSet.values.isDevFeaturesEnabled && !this.hasVerifiedSsoIdentity) {
      // Check if passkey sign-in is enabled in the sign-in experience, if yes, check if user has `WebAuthn`
      // type of MFA verification record in `users.mfaVerifications`. Suggest user to add a passkey if not.
      await this.mfa.checkPasskeySignInAvailability();
    }

    // Revalidate the new MFA data if any
    await this.mfa.checkAvailability();

    if (
      EnvSet.values.isDevFeaturesEnabled &&
      !this.hasVerifiedSsoIdentity &&
      this.#interactionEvent === InteractionEvent.SignIn
    ) {
      const adaptiveMfaResult = await this.adaptiveMfaValidator.getResult(user);
      await this.mfa.assertAdaptiveMfaBindingRequired(adaptiveMfaResult);
    }

    // MFA fulfilled
    if (!this.hasVerifiedSsoIdentity) {
      await this.mfa.assertUserMandatoryMfaFulfilled();
    }

    const {
      socialIdentity,
      enterpriseSsoIdentity,
      syncedEnterpriseSsoIdentity,
      jitOrganizationIds,
      socialConnectorTokenSetSecret,
      enterpriseSsoConnectorTokenSetSecret,
      ...rest
    } = this.profile.data;
    const { mfaSkipped, passkeySkipped, mfaVerifications } = this.mfa.toUserMfaVerifications();

    // Update user profile
    const updatedUser = await userQueries.updateUserById(user.id, {
      ...rest,
      ...conditional(
        socialIdentity && {
          identities: {
            ...user.identities,
            ...toUserSocialIdentityData(socialIdentity),
          },
        }
      ),
      ...conditional(

Review comment (suggestion):
Prefer to move the `assertAdaptiveMfaBindingRequired` into the `assertUserMandatoryMfaFulfilled.`  method. Also, double-check the product requirement, does adaptive mfa allied to SSO sign-in flow. 

Code after:

    // Profile fulfilled
    await this.profile.assertUserMandatoryProfileFulfilled({
      hasVerifiedSocialIdentity: this.hasVerifiedSocialIdentity,
      hasVerifiedSsoIdentity: this.hasVerifiedSsoIdentity,
    });

    if (EnvSet.values.isDevFeaturesEnabled && !this.hasVerifiedSsoIdentity) {
      // Check if passkey sign-in is enabled in the sign-in experience, if yes, check if user has `WebAuthn`
      // type of MFA verification record in `users.mfaVerifications`. Suggest user to add a passkey if not.
      await this.mfa.checkPasskeySignInAvailability();
    }

    // Revalidate the new MFA data if any
    await this.mfa.checkAvailability();

    // MFA fulfilled
    const isSignInEvent = this.#interactionEvent === InteractionEvent.SignIn;
    // Sign-in passkey verification (`SignInWebAuthn`) is already treated as MFA-fulfilled.
    const shouldSkipSubmitMfaFulfillment =
      this.hasVerifiedSsoIdentity || (isSignInEvent && this.hasVerifiedSignInWebAuthn);

    if (!shouldSkipSubmitMfaFulfillment) {
      if (isSignInEvent) {
        const adaptiveMfaResult = await this.adaptiveMfaValidator.getResult();
        await this.mfa.assertAdaptiveMfaBindingFulfilled(adaptiveMfaResult);
      }

      await this.mfa.assertUserMandatoryMfaFulfilled();
    }

    const {
      socialIdentity,
      enterpriseSsoIdentity,
      syncedEnterpriseSsoIdentity,
      jitOrganizationIds,
      socialConnectorTokenSetSecret,
      enterpriseSsoConnectorTokenSetSecret,
      ...rest
    } = this.profile.data;
    const { mfaSkipped, passkeySkipped, mfaVerifications } = this.mfa.toUserMfaVerifications();

    // Update user profile
    const updatedUser = await userQueries.updateUserById(user.id, {
      ...rest,
      ...conditional(
        socialIdentity && {
          identities: {
            ...user.identities,
            ...toUserSocialIdentityData(socialIdentity),
          },