kobotoolbox / kpi / 24993281612

82%

master: 76%

Build Type

push

github

Committed by web-flow

Commit Message

fix(mfa): prevent MFA re-enrollment lockouts by centralizing deactivation cleanup DEV-2023 (#6964)

### 📣 Summary
This PR fixes a desynchronization bug where deactivating an MFA wrapper
via the Django Admin UI left orphaned Authenticator records in the
database, breaking future re-enrollment. Cleanup logic has now been
centralized in the model to ensure safe, consistent deletion across both
API and Admin flows.

### 📖 Description
Previously, when a superuser disabled MFA through the Django Admin, the
associated django-allauth Authenticator records were not removed. This
left orphaned records in the database, causing a "Token Invalid" error
when the user attempted to re-enroll.

This PR introduces a robust, centralized deactivate() method on the
MfaMethodsWrapper model, ensuring that all related Authenticator records
are properly cleaned up whenever MFA is disabled, regardless of the
entry point (Admin or API).

Coverage Stats

7794 of 11991 branches covered (65.0%)

5 of 30 new or added lines in 3 files covered. (16.67%)

24 existing lines in 1 file now uncovered.

29614 of 36059 relevant lines covered (82.13%)

5.78 hits per line