Skip to content

feat: 2FA enforcement#106

Draft
MatiasArriola wants to merge 4 commits into
deploy/widp/2.41.6.1from
feat/enforce-2fa
Draft

feat: 2FA enforcement#106
MatiasArriola wants to merge 4 commits into
deploy/widp/2.41.6.1from
feat/enforce-2fa

Conversation

@MatiasArriola

@MatiasArriola MatiasArriola commented Mar 5, 2026

Copy link
Copy Markdown

Task: https://app.clickup.com/t/869c45wmu

Implementation details:

2.41.6.1-eyeseetea-fork-2

  • allow 2FA restricted users to login while restricting access
  • mark 2FA restricted users session with a custom attribute
  • custom filter allows only necessary endpoints for restricted users to setup 2FA,
  • custom filter redirects restricted users to login-app when trying to navigate to any other app that is not login-app or user-profile-app
  • clear restriction upon 2FA enrollment

2.41.6.1-eyeseetea-fork-3

  • disallow restricted users from making api requests
    • thought this was already handled by the restriction and not in scope for this PR, but was not the case
    • after adding this change, also had to refresh the user in context after enrolling 2FA, to avoid getting incorrect unauthorized errors
    • restricted users still able to make requests to allowed endpoints necessary to complete 2FA setup

- mark 2fa restricted users session with a custom attribute
- custom filter allows only necessary endpoints for restricted users, and redirects to login-app when trying to navigate to any other app that is not login-app or user-profile-app
- clear restriction upon 2fa enrollment
…etup

- This change also required to refresh the user in context after enabling 2fa, so the new check works (the user instance was stale, as it had 2fa disabled)
- enforce2fa user will still be able to request allowedRequests from TwoFactorSetupRestrictionFilter
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant