LCFS - 2FA type obfuscated link generator

**Problem Description**
In order to enable access to specific portal forms or pages without requiring a full user account or BCeID, external users with access to an organization’s email address need a secure way to authenticate and access limited functionality.

**Solution Needs**
- Ability for a user to initiate access via an email-based request (inbound or triggered workflow)
- Generate a secure, one-time use obfuscated link tied to the email address
- Link must expire after a defined period or after first use
- Link must route to a predefined form or page only (no broader portal access)
- Prevent unauthorized reuse, forwarding, or guessing of links
- Audit logging of link generation, access, and expiry
- Compliance with security and privacy requirements (e.g., protecting organization data)
- Consider alignment with existing authentication patterns in the portal

**Timebox**
- 1 to 2 days research and validation

**Outcome**
- Document viable approaches for implementing email-based 2FA or magic link access
- Identify recommended approach and associated risks
- Determine whether the approach is feasible within the current portal architecture
- If feasible, provide direction for next steps (e.g., design, security review, implementation)
- If not feasible, outline alternative options

**Additional Context**
- This feature is intended for users without BCeID or portal accounts but with authorized access to an organization email
- The obfuscated link acts as a one-time authentication mechanism similar to passwordless login
- Must consider risk of email compromise and whether additional verification is needed
- May require coordination with security policies and identity/access management standards