Overhaul 2FA/MFA: Insecure in current form

I have noticed some shortcomings of the approach to MFA/2FA implemented with Supabase Auth, specifically regarding the handling of multiple factors. In its current form, it allows users to login without a second verification factor leaving the handling of when and where 2FA is required to the application. While this is fine, there’s the problem with allowing users to enroll multiple authentication factors at once, _without_ requiring a second verification. From the perspective of an attacker this would mean that if they had gained access to your regular login credentials, bypassing 2FA would simply require enrolling another factor while not authenticated and removing legitimate factors afterwards, effectively rendering the whole system useless. While it can be implemented on an application level that this logic is inaccessible to the user without 2FA, there’s nothing stopping an attacker from calling the appropriate endpoints themselves, which is why I believe this issue needs to b…