feat(github): Add 2FA enforcement check#2521
Conversation
- Add new two_factor_auth check that verifies all org members have 2FA enabled
- Uses GET /orgs/{org}/members?filter=2fa_disabled endpoint
- Iterates all orgs the connected user belongs to
- Emits individual findings per member without 2FA + org summary
- Gracefully handles 403 (insufficient permissions) with clear remediation
- Maps to TASK_TEMPLATES.twoFactorAuth evidence task
- Upgrade OAuth scope from read:org to admin:org (required for 2fa_disabled filter)
Note: Existing GitHub connections will need to be reconnected to grant
the admin:org scope. The check handles the 403 gracefully if the scope
is missing and guides users to reconnect.
PR SummaryMedium Risk Overview When non-compliant members exist, it emits FAIL findings per user plus an org-level summary finding, and includes targeted failure messaging for SSO authorization, rate limiting, and insufficient owner permissions. The check is exported and added to the GitHub manifest’s Reviewed by Cursor Bugbot for commit 30d09c4. Bugbot is set up for automated code reviews on this repo. Configure here. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
The 2FA check handles 403 gracefully and guides org owners to reconnect if needed. No reason to request broader permissions for all users when only org owners can use the 2FA filter anyway.
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
There are 2 total unresolved issues (including 1 from previous review).
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 901e45d. Configure here.
|
🎉 This PR is included in version 3.22.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
2 participants
What
Adds a new 2FA Enforcement check to the GitHub integration that verifies all organization members have two-factor authentication enabled.
How it works
GET /orgs/{org}/members?filter=2fa_disabledChanges
packages/integration-platform/src/manifests/github/checks/two-factor-auth.tsindex.ts: added check to manifest, upgraded OAuth scoperead:org->admin:orgScope change
The
admin:orgscope is required by GitHub to use thefilter=2fa_disabledparameter. This is a superset ofread:org, so existing functionality (branch protection, dependabot, sanitized inputs) continues to work. Existing connections will need to be reconnected to grant the new scope - the check handles the missing scope gracefully with a clear remediation message.Task mapping
Maps to
TASK_TEMPLATES.twoFactorAuth(frk_tt_68406cd9dde2d8cd4c463fe0)