How to fix insufficient_aal: Higher Authenticator Assurance Level required in Supabase

import { createClient } from '@supabase/supabase-js'

const supabase = createClient(SUPABASE_URL, SUPABASE_ANON_KEY)

// Get current session
const { data: { session } } = await supabase.auth.getSession()

// Check MFA factors for the user
const { data: factors } = await supabase.auth.mfa.getAuthenticatorAssuranceLevel()
console.log('Current AAL:', factors.currentLevel)
console.log('Next required AAL:', factors.nextLevel)

// Start MFA enrollment
const { data, error } = await supabase.auth.mfa.enroll({
  factorType: 'totp', // or 'sms'
})

// For TOTP, show QR code to user
if (data?.totp?.qr_code) {
  // Display QR code for user to scan with authenticator app
  console.log('QR Code URL:', data.totp.qr_code)
}

// After user scans QR code and enters code:
const { error: verifyError } = await supabase.auth.mfa.verify({
  factorId: data.id,
  code: userEnteredCode,
})

// For SMS MFA:
const { data: smsData } = await supabase.auth.mfa.enroll({
  factorType: 'sms',
  phone: userPhoneNumber,
})
// User will receive SMS with code to verify

// Before performing sensitive operations, check AAL
const { data: aalData } = await supabase.auth.mfa.getAuthenticatorAssuranceLevel()

if (aalData.currentLevel !== aalData.nextLevel) {
  // User needs to elevate authentication level
  // Redirect to MFA verification page
  window.location.href = '/auth/mfa-verify'
} else {
  // User has required AAL, proceed with operation
  await performSensitiveOperation()
}

// After MFA verification, retry the original request
const { error } = await performSensitiveOperation()
if (!error) {
  // Operation succeeded with elevated AAL
}

-- Example RLS policy that requires AAL2
CREATE POLICY "Require MFA for sensitive data" ON sensitive_table
FOR ALL USING (
  auth.jwt() ->> 'aal' = 'aal2'
  AND -- other conditions
);

-- Check current policies
SELECT * FROM pg_policies
WHERE tablename = 'your_table';

try {
  await performSensitiveOperation()
} catch (error) {
  if (error.message.includes('insufficient_aal')) {
    // Show user-friendly message
    showNotification({
      title: 'Additional Verification Required',
      message: 'This action requires multi-factor authentication. Please set up or verify MFA.',
      action: {
        label: 'Set up MFA',
        onClick: () => navigateToMfaSetup()
      }
    })

    // Optionally, store the intended action to retry after MFA
    localStorage.setItem('pending_action', JSON.stringify({
      action: 'sensitive_operation',
      params: operationParams
    }))
  }
}