Properly handle no MFA factors available on a given location

new-ui/src/shared/components/LocationCard/components/LocationCardMfaEdit/LocationCardMfaEdit.tsx

@@ -4,6 +4,7 @@ import { TooltipContent } from '../../../../providers/tooltip/TooltipContent';
 import { TooltipProvider } from '../../../../providers/tooltip/TooltipContext';
 import { TooltipTrigger } from '../../../../providers/tooltip/TooltipTrigger';
 import type { InstanceInfo, LocationInfo } from '../../../../rust-api/types';
+import { isPresent } from '../../../../utils/isPresent';
 import {
   ConnectionAbility,
   type ConnectionAbilityValue,
@@ -38,10 +39,13 @@ export const LocationCardMfaEdit = ({
   connectionAbility,
 }: Props) => {
   const stepCount = mfaStepCount(location);
+  const [method] = resolveMfaStepPlan(location, [], instance);
   const label =
     stepCount > 1
       ? mfaStepsToText(stepCount)
-      : mfaToText(resolveMfaStepPlan(location, [], instance)[0], instance);
+      : isPresent(method)
+        ? mfaToText(method, instance)
+        : 'Unavailable';
 
   const canEdit =
     connectionAbility === ConnectionAbility.Available &&

new-ui/src/shared/utils/mfa.test.ts

@@ -291,6 +291,15 @@ describe('resolveMfaStepPlan', () => {
     expect(resolveMfaStepPlan(location)).toEqual([MfaMethod.Email]);
     expect(resolveMfaStepPlan(location, [], instance)).toEqual([MfaMethod.Totp]);
   });
+
+  it('is empty when a step offers no factor', () => {
+    const location = {
+      ...locationOf([step(MfaMethod.Totp), step()]),
+      mfa_step_plan: [MfaMethod.Totp, MfaMethod.Fido2],
+    };
+    expect(resolveMfaStepPlan(location)).toEqual([]);
+    expect(connectionAbilityOf(location)).toBe(ConnectionAbility.Unavailable);
+  });
 });
 
 const instanceOf = (id: number, overrides: Partial<InstanceInfo> = {}): InstanceInfo => ({

new-ui/src/shared/utils/mfa.ts

@@ -143,8 +143,12 @@ export const resolveMfaStepPlan = (
   location: Pick<LocationInfo, 'connection_type' | 'mfa_steps' | 'mfa_step_plan'>,
   oneOffPlan: MfaMethodValue[] = [],
   instance?: MfaUsabilityInstance,
-): MfaMethodValue[] =>
-  mfaStepsOf(location).map((step, index) => {
+): MfaMethodValue[] => {
+  const steps = mfaStepsOf(location);
+  // Core keeps a step whose methods it filtered out (FIDO2 without a license), and no plan passes it.
+  if (steps.some((step) => step.methods.length === 0)) return [];
+
+  return steps.map((step, index) => {
     const usableMethods = usableMfaMethods(step, instance);
     const isUsable = (method: MfaMethodValue) =>
       usableMethods.some((entry) => entry.method === method);
@@ -157,6 +161,7 @@ export const resolveMfaStepPlan = (
 
     return (usableMethods[0] ?? step.methods[0]).method;
   });
+};
 
 /**
  * Whether the user has this factor set up. The instance's own report of the