feat(API): support V2 token and session token usage (#6180)

This PR adds support for userinfo and introspection of V2 tokens. Further V2 access tokens and session tokens can be used for authentication on the ZITADEL API (like the current access tokens).

internal/domain/user.go

@@ -60,6 +60,31 @@ func (f UserAuthMethodType) Valid() bool {
 	return f >= 0 && f < userAuthMethodTypeCount
 }
 
+// HasMFA checks whether the user authenticated with multiple auth factors.
+// This can either be true if the list contains a [UserAuthMethodType] which by itself is MFA (e.g. [UserAuthMethodTypePasswordless])
+// or if multiple factors were used (e.g. [UserAuthMethodTypePassword] and [UserAuthMethodTypeU2F])
+func HasMFA(methods []UserAuthMethodType) bool {
+	var factors int
+	for _, method := range methods {
+		switch method {
+		case UserAuthMethodTypePassword:
+			factors++
+		case UserAuthMethodTypePasswordless:
+			return true
+		case UserAuthMethodTypeU2F:
+			factors++
+		case UserAuthMethodTypeOTP:
+			factors++
+		case UserAuthMethodTypeIDP:
+			factors++
+		case UserAuthMethodTypeUnspecified,
+			userAuthMethodTypeCount:
+			// ignore
+		}
+	}
+	return factors > 1
+}
+
 type PersonalAccessTokenState int32
 
 const (