feat(evals): add Next.js App Router MFA step-up eval

[sanchitmehtagit]

✏️ Changes

Adds a nextjs_mfa eval that measures MFA step-up authentication for @auth0/nextjs-auth0 v4 (App Router). This fills the gap left by the existing react_mfa, angular_mfa, and vue_mfa evals, which all target client-side SDKs.

What changed:

• src/evals/mfa/nextjs/PROMPT.md -- eval task (id: nextjs_mfa). Agent is asked to add a Transfer Funds feature that gates on MFA, building on a pre-wired scaffold.
• src/evals/mfa/nextjs/graders.ts -- 15 graders across L1-L5 + holistic judge, with v4-specific coverage:
  • L1: checks acr_values, amr, beforeSessionSaved (required to persist amr in v4 -- not stored by default), getSession, and the multi-factor policy URI
  • L2: blocks React SPA anti-patterns (loginWithRedirect, getIdTokenClaims) that would signal a confused server/client mix
  • L3: no secrets hardcoded in source, no tokens exposed to the browser
  • L4: amr read server-side, step-up redirect carries both acr_values and max_age=0
  • L5: blocks all v3 patterns (handleAuth, withPageAuthRequired, /api/auth/, AUTH0_ISSUER_BASE_URL); judges beforeSessionSaved is wired correctly on Auth0Client
• src/evals/scaffolds/nextjs/auth0-mfa/ -- full working Next.js App Router scaffold: package.json, tsconfig.json, next.config.mjs, .env.local (barkbook credentials), lib/auth0.ts (bare Auth0Client), middleware.ts (auth wired), app/layout.tsx, app/page.tsx, app/dashboard/page.tsx. Auth is fully set up so the agent focuses on MFA logic only, matching the pattern used by the React MFA scaffold.

Key v4-specific finding driving the grader design: in @auth0/nextjs-auth0 v4, amr is not included in session.user by default. The SDK filters ID token claims to a whitelist. The agent must add a beforeSessionSaved hook on Auth0Client to copy amr into the persisted session before it can be read via auth0.getSession().

• I described the changes on this PR.

🔮 Type of Change

• Standard
• Emergency
• Significant

🔗 References

No Jira ticket -- eval addition.

• I added at least one link (task, Slack thread, etc.) to explain why this change is needed.

📖 Documentation

No documentation update needed. The eval follows existing conventions documented in AGENTS.md and docs/ADDING_EVALS.md.

• I reflected this change in the (internal and/or user-facing) documentation, or explained why no update is needed.

🎯 Testing

npm run build && npm test pass. Smoke-tested with npm run evals -- --eval nextjs_mfa --mode baseline --dangerously-skip-sandbox: eval is discovered (20 evals found), runs end-to-end, and scores 73% on baseline (expected -- baseline has no tools, so L4/L5 graders are skipped).

• I described how I tested these changes, or explained why I did not.
• This change has integration, unit, or performance test coverage, or I explained why it does not.

🚀 Deployment

Eval-only change, no runtime code.

• This change can support multiple releases of the code serving traffic at the same time.
• This can be deployed at any time. If there are prerequisites, I listed them below and will ensure they are met before merging.

🔥 Rollback

Delete the src/evals/mfa/nextjs/ directory and src/evals/scaffolds/nextjs/auth0-mfa/ scaffold. No database or infra changes.

• I explained what rollback for this change looks like and how we recover quickly.

[coderabbitai]

Warning

Review limit reached

@sanchitmehtagit, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 49 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f3bda81d-9582-41ed-a380-86637d429b42

📥 Commits

Reviewing files that changed from the base of the PR and between 5d390aa and cff0357.

📒 Files selected for processing (10)

• apps/auth0-evals/src/evals/mfa/nextjs/PROMPT.md
• apps/auth0-evals/src/evals/mfa/nextjs/graders.ts
• apps/auth0-evals/src/evals/scaffolds/nextjs/auth0-mfa/app/dashboard/page.tsx
• apps/auth0-evals/src/evals/scaffolds/nextjs/auth0-mfa/app/layout.tsx
• apps/auth0-evals/src/evals/scaffolds/nextjs/auth0-mfa/app/page.tsx
• apps/auth0-evals/src/evals/scaffolds/nextjs/auth0-mfa/lib/auth0.ts
• apps/auth0-evals/src/evals/scaffolds/nextjs/auth0-mfa/middleware.ts
• apps/auth0-evals/src/evals/scaffolds/nextjs/auth0-mfa/next.config.mjs
• apps/auth0-evals/src/evals/scaffolds/nextjs/auth0-mfa/package.json
• apps/auth0-evals/src/evals/scaffolds/nextjs/auth0-mfa/tsconfig.json

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}