Extra security layer for specific route

TLDR: app is going to be protected by OAuth (MS365/NextAuth) but I want to store more sensitive data. Is there a way to add a second security layer to specific routes which require a second factor on a daily or hourly basis to make this area more secure?

—————

Hi together,

actually the question is very specific. For my company I’m building (and currently running) an application which allows us to write service orders against customers (e.g. customer X, remote session/call/in house appointment, start, end, time you come back from in house and possibly signature of the customer).

This tool is used extensively as I wanted it to be and daily driver for all our technicians (what makes me very happy).

Current backend is a Directus API and a node server which hosts the application. The login of the system is with credentials against the users which are created inside of Directus. So far so good, the next time I’m going to replace authentication with OAuth against MS365 to make use of geolocation access rules and such features.

Now the question: I’m going to implement more features in that app, mostly important documentations about the customers network. IP ranges and addresses, server names, user accounts and so on, as this would increase the featureset enormously. As this data is very sensitive, is there a way to protect these routes more than the others?

I’m thinking about a daily or hourly second factor which is needed to access this area.

Is something like that possible?

Thanks y‘all