Skip isMfaRequired check when we know mfa is required.

web/packages/teleport/src/lib/useMfa.ts

@@ -71,16 +71,33 @@ export function useMfa(props: MfaProps): MfaState {
   const [attempt, getResponse, setMfaAttempt] = useAsync(
     useCallback(
       async (challenge?: MfaAuthenticateChallenge) => {
-        // If a challenge wasn't provided and we previously determined MFA is not
-        // required, this is a noop.
-        if (mfaRequired === false && !challenge) return;
-
-        challenge = challenge
-          ? challenge
-          : await auth.getMfaChallenge(props.req);
-        if (!challenge) {
-          setMfaRequired(false);
-          return;
+        // If a challenge was provided, the client has determined mfa is required.
+        if (challenge) setMfaRequired(true);
+
+        switch (mfaRequired) {
+          case false:
+            // Client previously determined MFA is not required, this is a noop.
+            break;
+          case !!challenge:
+            // Caller passed in a challenge, no need to retrieve one.
+            break;
+          default:
+            // mfa is required, or it's requirement is unknown.
+            let req = props.req;
+
+            // We already know MFA is required, skip the extra check.
+            if (mfaRequired === true) req.isMfaRequiredRequest = null;
+
+            challenge = await auth.getMfaChallenge(props.req);
+
+            // an empty challenge means either mfa is not required, or the user has no mfa devices.
+            if (!challenge) {
+              setMfaRequired(false);
+              return;
+            }
+
+            setMfaRequired(true);
+            break;
         }
 
         // Prepare a new promise to collect the mfa response retrieved
@@ -98,10 +115,7 @@ export function useMfa(props: MfaProps): MfaState {
           reject,
         };
 
-        // Set mfa requirement and options after we get a challenge for the first time.
-        setMfaRequired(true);
         setMfaOptions(getMfaChallengeOptions(challenge));
-
         setMfaChallenge(challenge);
         try {
           return await promise;