kobotoolbox / kpi / 24240621179

82%

master: 76%

Build Type

push

github

Committed by web-flow

Commit Message

fix(mfa): enable safe MFA deactivation via Admin UI during all-auth transition DEV-1835 (#6925)

### 📣 Summary
This PR replaces the legacy Trench admin UI with the new all-auth
`MfaMethodsWrapper` admin and ensures that deleting a user's wrapper
correctly cascades to delete all underlying `Authenticator` and legacy
Trench `MfaMethod` records, preventing user lockouts.


### 📖 Description
During the transition from Trench to Django all-auth, deleting a user's
MFA method via the legacy Trench Admin UI were inadvertently leaving
behind orphaned all-auth `Authenticator` and `MfaMethodsWrapper`
records. This caused a desynchronization where
`UserProfile.is_mfa_active` would be False, but the orphaned all-auth
wrapper would still force the user into an MFA challenge, effectively
locking them out.

This PR:
- Replaces the legacy Trench admin interface with the all-auth based
`MfaMethodsWrapper` admin and ensures that deleting a wrapper properly
cascades to remove all associated records.
- The .delete() method on `MfaMethodsWrapper` has been overridden to
delete related `Authenticator` entries as well as the legacy Trench
`MfaMethod`.
- Additionally, `delete_queryset` has been overridden in the admin to
ensure bulk deletion actions trigger the same custom logic instead of
bypassing it via raw SQL.

Coverage Stats

7775 of 11960 branches covered (65.01%)

20 of 35 new or added lines in 3 files covered. (57.14%)

433 existing lines in 20 files now uncovered.

29604 of 36014 relevant lines covered (82.2%)

5.79 hits per line