A number of questions around this but none that address this specifically.
Some of the users will not have email addresses.
When they register, they have to enter at least one of the two. This is then validated. If email is entered that is validated. If not then phone number is validated.
The login screen should ask for (email address or mobile phone number) and password.
Some users will require MFA.
Passwordless authentication is not what they are looking for.
Is this doable? If so, how would I go about it?