function (user, context, callback) {
  if ((context.connection === 'github') && (!user.two_factor_authentication)) {
    // Force MFA for GitHub logins
    console.log('GitHub user not allowed to log in because 2FA was disabled on the account: '+user.user_id);
    return callback(null, user, global.postError('githubrequiremfa', context));
  } else if ((context.connection === 'firefoxaccounts') && (user.acr !== 'AAL2')) {
    // Force MFA for Firefox Accounts (FxA) logins
    // Note FxA also provides the standard `amr` values which can be used to specify which 2FA we want to allow.
    // See https://pages.nist.gov/800-63-3/sp800-63b.html regarding AAL2
    console.log('Firefox Accounts user not allowed to log in because 2FA was disabled on the account: '+user.user_id);
    return callback(null, user, global.postError('fxarequiremfa', context));

    // Forcing MFA for Google accounts is not currently supported
  } else {
    return callback(null, user, context);
  }
}

@@ -334,16 +334,17 @@
 text));%0A
+%0A
   %7D else
@@ -404,22 +404,44 @@
 ser.
-acr !== 'AAL2'
+fxa_twoFactorAuthentication !== true
 )) %7B

check the fxa 2fa param (comes from user info endpoint or id_token) instead of the AAL state (comes from id_token only)