From 696b5dd2125ad29e22acf0054bc9e73cef38909c Mon Sep 17 00:00:00 2001 From: Lakhan Samani Date: Wed, 22 Jul 2026 18:16:30 +0530 Subject: [PATCH] fix(types)!: drop is_multi_factor_auth_enabled from SignUpRequest Server removed the field from SignUpRequest in schema and proto (reserved field 15) as a security fix: it let unauthenticated signup callers disable MFA-on-by-default for their own new account. authorizerdev/authorizer#710, released 2.4.0-rc.6. Setting it now errors on GraphQL (unknown input field) and is silently dropped on REST/gRPC, so the SDK field was dead weight at best and misleading at worst. Vendored proto stubs still carry the old field 15; harmless since the SDK never sets it on the wire, but a full proto re-vendor against the server's updated .proto is separate follow-up work. BREAKING CHANGE: SignUpRequest no longer accepts is_multi_factor_auth_enabled. --- src/authorizer/types.py | 1 - 1 file changed, 1 deletion(-) diff --git a/src/authorizer/types.py b/src/authorizer/types.py index 834f0fb..92d136b 100644 --- a/src/authorizer/types.py +++ b/src/authorizer/types.py @@ -116,7 +116,6 @@ class SignUpRequest(_Request): roles: list[str] | None = None scope: list[str] | None = None redirect_uri: str | None = None - is_multi_factor_auth_enabled: bool | None = None app_data: dict[str, Any] | None = None state: str | None = None