From b15a480e2ed84c8e78b720ec52652d7efc8e29f1 Mon Sep 17 00:00:00 2001
From: Lakhan Samani <lakhan.m.samani@gmail.com>
Date: Wed, 22 Jul 2026 18:16:36 +0530
Subject: [PATCH] fix(types)!: remove is_multi_factor_auth_enabled from
 SignUpRequest
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Server (authorizerdev/authorizer PR #710, release 2.4.0-rc.6) removed
this field from SignupRequest/input SignUpRequest — it let an
unauthenticated signup caller bypass the server's MFA-on-by-default
policy for their own new account. Field stays valid on
UpdateProfileRequest and admin UpdateUserRequest; only the signup path
lost it.

BREAKING CHANGE: SignUpRequest/SignupRequest no longer has
is_multi_factor_auth_enabled. Passing it to signup() is now ignored by
the server.
---
 src/types.ts | 1 -
 1 file changed, 1 deletion(-)

diff --git a/src/types.ts b/src/types.ts
index c84342c..8cd0ddb 100644
--- a/src/types.ts
+++ b/src/types.ts
@@ -205,7 +205,6 @@ export interface SignUpRequest {
   roles?: string[] | null;
   scope?: string[] | null;
   redirect_uri?: string | null;
-  is_multi_factor_auth_enabled?: boolean | null;
   state?: string | null;
   app_data?: Record<string, any> | null;
 }