Merge remote-tracking branch 'origin/main'

packages/features/admin/src/lib/server/utils/is-super-admin.ts

@@ -1,5 +1,6 @@
 import { SupabaseClient } from '@supabase/supabase-js';
 
+import { checkRequiresMultiFactorAuthentication } from '@kit/supabase/check-requires-mfa';
 import { Database } from '@kit/supabase/database';
 
 /**
@@ -18,6 +19,14 @@ export async function isSuperAdmin(client: SupabaseClient<Database>) {
     return false;
   }
 
+  const requiresMultiFactorAuthentication =
+    await checkRequiresMultiFactorAuthentication(client);
+
+  // If user requires multi-factor authentication, deny access.
+  if (requiresMultiFactorAuthentication) {
+    return false;
+  }
+
   const appMetadata = data.user.app_metadata;
 
   return appMetadata?.role === 'super-admin';