It would be nice to be able to use the Login() feature with two-factor authentication. It is possible now but it asks for more reads than I actually want. For example, if I want to write an update to a document I now need to read the user object to check if 2fa is enabled, and in my own system check with a JWT if 2fa has been authenticated. Then I’ll write the document. This is still not secure, because you can bypass it by just getting the fauna token out of the JWT and use it to do the same thing, but then without 2fa. With the feature, I’m suggesting you will have inside the credentials object a 2fa code. And when you log in you will get an error if 2fa is enabled and not used to log in: “Hey what’s your 2fa key?”. Then you respond with the key that regenerates every 30 seconds. And then you get the access token. (All access tokens without 2fa validation will be invalidated/deleted). I hope this will be added.
Would an example that implement this help you? I could consider adding it to a series of authentication examples.