@newskit-render/core 4.66.4 → 4.67.0

package/CHANGELOG.md

@@ -3,6 +3,17 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# [4.67.0](https://github.com/newscorp-ghfb/ncu-newskit-render/compare/@newskit-render/core@4.66.4...@newskit-render/core@4.67.0) (2026-07-14)
+
+
+### Features
+
+* **SVRS-6204:** limit MFA to certain pages ([#2062](https://github.com/newscorp-ghfb/ncu-newskit-render/issues/2062)) ([16de08d](https://github.com/newscorp-ghfb/ncu-newskit-render/commit/16de08d3bdbe6cefaf43e4a8d617e4a1fddaff8b))
+
+
+
+
+
 ## [4.66.4](https://github.com/newscorp-ghfb/ncu-newskit-render/compare/@newskit-render/core@4.66.3...@newskit-render/core@4.66.4) (2026-06-30)
 
 

package/cypress/support/commands.js

@@ -38,7 +38,8 @@ Cypress.Commands.add('GetAcsSession', (user = 'default') => {
     method: 'POST',
     url: 'https://login.staging-thesun.co.uk/services/session',
     headers: {
-      'Content-Type': 'application/vnd.newsuk.acs.createsession-v1+json',
+      'Content-Type': 'application/vnd.newsuk.acs.createsession-v1+json','x-nuk-waf-bypass':
+            '3739ebe98d7fc43bb0de9b70db0a424c5484599bb1325dfc2c1b3c88c5150db6',
     },
     body: {
       rememberMe: false,
@@ -62,7 +63,8 @@ Cypress.Commands.add('GetTnlAcsSession', (user = 'tnl') => {
     method: 'POST',
     url: 'https://login.staging-thetimes.com/services/session',
     headers: {
-      'Content-Type': 'application/vnd.newsuk.acs.createsession-v1+json',
+      'Content-Type': 'application/vnd.newsuk.acs.createsession-v1+json','x-nuk-waf-bypass':
+            '3739ebe98d7fc43bb0de9b70db0a424c5484599bb1325dfc2c1b3c88c5150db6',
     },
     body: {
       rememberMe: false,

package/helpers/getProviderPropsUtil.ts

@@ -4,17 +4,40 @@ import {
 } from '@newskit-render/my-account'
 import { publisher } from '../config'
 
+/**
+ * Playground allow-list of page providers that require step-up MFA.
+ * Mirrors the consumer-owned config (e.g. sun-myaccount `config/mfaPages`).
+ * Any provider not listed defaults to NO MFA. ANDed with the global
+ * ENABLE_STEPUP_MFA env flag which acts as a master kill-switch.
+ */
+const MFA_ENABLED_PROVIDERS = new Set([
+  'PersonalDetails',
+  'SubscriptionAndBilling',
+  'Payment',
+  'PaymentMethods',
+])
+
+const isMfaEnabledForProvider = (provider?: string): boolean =>
+  process.env.ENABLE_STEPUP_MFA === 'true' &&
+  !!provider &&
+  MFA_ENABLED_PROVIDERS.has(provider)
+
 export const getProviderPropsUtil = (context, options?) => {
   if (process.env.NODE_ENV === 'development' && publisher === 'TIMES') {
     return getProviderPropsTimes({
       context,
+      enableStepUpMfa: isMfaEnabledForProvider(context?.provider),
       options: {
         ...options,
       },
     })
   }
 
-  return getProviderProps(context, {
-    ...options,
-  })
+  return getProviderProps(
+    context,
+    {
+      ...options,
+    },
+    { enableStepUpMfa: isMfaEnabledForProvider(context?.provider) }
+  )
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@newskit-render/core",
-  "version": "4.66.4",
+  "version": "4.67.0",
   "description": "Newskit Render - Core package",
   "author": "",
   "license": "UNLICENSED",
@@ -123,5 +123,5 @@
     "@types/pino-std-serializers": "2.4.1",
     "@types/pino-pretty": "4.7.5"
   },
-  "gitHead": "83967e254ca425da9288ab5d2730b2b8a395912f"
+  "gitHead": "a4bba8eb0896c0060fa17207d7ee20f0f9da7ed7"
 }