step-up

shared re-authentication prompt fired whenever a sensitive action returns 403 step_up_required. password field plus an optional 6-digit code (driven by mfaEnrolled); backup codes are accepted in the same field — the api dispatches on format.

tap a button below to walk through each variant. fixtures here resolve / reject in-memory so the modal can be exercised without the api.

import from @halwel/ui/components/auth/StepUpModal

variants

password-only — user without MFA

the simplest path: just a password. used pre-mandatory-MFA rollout for patients.

with MFA — TOTP + backup code accepted

provider + HQ + any post-rollout patient. accepts a 6-digit TOTP or an 8-12 char backup code in the same field.

with caller reason

callers pass a reason string when the context is non-obvious — e.g. switching HQ PC context, revealing PHI.

failing submit — inline error

onSubmit rejects so the modal shows the inline error banner; user can correct credentials and retry.