From 72c0d8f512064d93bc43919f03561f5e6ae82364 Mon Sep 17 00:00:00 2001
From: jnfrati <nicofrati@gmail.com>
Date: Thu, 16 Apr 2026 15:25:19 +0200
Subject: [PATCH 1/2] implement enable mfa for local users toggle

---
 src/interfaces/Account.ts                  |  1 +
 src/modules/settings/AuthenticationTab.tsx | 39 ++++++++++++++++++++++
 2 files changed, 40 insertions(+)

diff --git a/src/interfaces/Account.ts b/src/interfaces/Account.ts
index c87c55e5..0f03a758 100644
--- a/src/interfaces/Account.ts
+++ b/src/interfaces/Account.ts
@@ -28,6 +28,7 @@ export interface Account {
     auto_update_version: string;
     auto_update_always: boolean;
     local_auth_disabled?: boolean;
+    local_mfa_enabled?: boolean;
   };
   onboarding?: AccountOnboarding;
 }
diff --git a/src/modules/settings/AuthenticationTab.tsx b/src/modules/settings/AuthenticationTab.tsx
index 40a37c15..f6d1461c 100644
--- a/src/modules/settings/AuthenticationTab.tsx
+++ b/src/modules/settings/AuthenticationTab.tsx
@@ -22,6 +22,7 @@ import { cn } from "@utils/helpers";
 import {
   CalendarClock,
   ExternalLinkIcon,
+  KeyRound,
   ShieldIcon,
   ShieldUserIcon,
   TimerResetIcon,
@@ -66,6 +67,15 @@ export default function AuthenticationTab({ account }: Readonly<Props>) {
     },
   );
 
+  // Local MFA (UI only, not wired to the backend yet)
+  const [isLocalMFAEnabled, setIsLocalMFAEnabled] = useState<boolean>(() => {
+    try {
+      return account?.settings?.local_mfa_enabled || false;
+    } catch (error) {
+      return false;
+    }
+  });
+
   // Peer Expiration
   const [
     loginExpiration,
@@ -105,6 +115,7 @@ export default function AuthenticationTab({ account }: Readonly<Props>) {
     peerInactivityExpirationEnabled,
     peerInactivityExpiresIn,
     peerInactivityExpireInterval,
+    isLocalMFAEnabled,
   ]);
 
   const saveChanges = async () => {
@@ -129,6 +140,7 @@ export default function AuthenticationTab({ account }: Readonly<Props>) {
               peer_approval_enabled: peerApproval,
               user_approval_required: userApprovalRequired,
             },
+            local_mfa_enabled: isLocalMFAEnabled
           },
         } as Account)
         .then(() => {
@@ -213,6 +225,33 @@ export default function AuthenticationTab({ account }: Readonly<Props>) {
             />
           </div>
 
+          {account.settings.local_auth_disabled || !account.settings.embedded_idp_enabled ?
+            (
+              <div className={"flex flex-col"}>
+                <FancyToggleSwitch
+                  value={isLocalMFAEnabled}
+                  onChange={setIsLocalMFAEnabled}
+                  dataCy={"local-mfa-enabled"}
+                  label={
+                    <>
+                      <KeyRound size={15} />
+                      Enable Local MFA
+                    </>
+                  }
+                  helpText={
+                    <>
+                      Require multi-factor authentication for users
+                      <br />
+                      authenticating with local credentials.
+                    </>
+                  }
+                  disabled={!permission.settings.update}
+                />
+              </div>
+            ) : null
+          }
+
+
           <div className={"flex flex-col"}>
             <FancyToggleSwitch
               value={loginExpiration}

From 39bba92add2c1ca44bc50f59f46da7a3341a240a Mon Sep 17 00:00:00 2001
From: jnfrati <nicofrati@gmail.com>
Date: Thu, 16 Apr 2026 17:36:53 +0200
Subject: [PATCH 2/2] fix visibility check

---
 src/modules/settings/AuthenticationTab.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/modules/settings/AuthenticationTab.tsx b/src/modules/settings/AuthenticationTab.tsx
index f6d1461c..6de21442 100644
--- a/src/modules/settings/AuthenticationTab.tsx
+++ b/src/modules/settings/AuthenticationTab.tsx
@@ -225,7 +225,7 @@ export default function AuthenticationTab({ account }: Readonly<Props>) {
             />
           </div>
 
-          {account.settings.local_auth_disabled || !account.settings.embedded_idp_enabled ?
+          {!account.settings.local_auth_disabled && account.settings.embedded_idp_enabled ?
             (
               <div className={"flex flex-col"}>
                 <FancyToggleSwitch