• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

kobotoolbox / kpi / 25568812093
82%
master: 76%

Build:
Build:
LAST BUILD BRANCH: main
DEFAULT BRANCH: master
Ran 08 May 2026 05:14PM UTC
Jobs 10
Files 912
Run time 2min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

08 May 2026 05:08PM UTC coverage: 81.879% (-0.04%) from 81.914%
25568812093

push

github

web-flow
fix(mfa): prevent superusers from deactivating MFA when `SUPERUSER_AUTH_ENFORCEMENT` is active DEV-1926 (#6928)

### đŸ“Ŗ Summary
Ensure administrative accounts remain protected by preventing superusers
from disabling two-factor authentication when a security enforcement
configuration is enabled.

### 💭 Notes
- Adds `EnforceSuperuserMFA` permission to ensure that if
`SUPERUSER_AUTH_ENFORCEMENT` is active, the deactivation endpoint will
return a 403 Forbidden
- Does not let the user open the MFA modal to deactivate on the Security
page
- Exposes `is_staff` and `is_superuser `(read-only) via the `/me/`
endpoint and adds `superuser_auth_enforcement` to the `/environment/`
endpoint. These additions allow the frontend to verify these values on
the Security page when determining if the MFA button needs to be
disabled.

### 👀 Preview steps

1. â„šī¸ have a superuser account
2. Login to the Django admin and activate the
`SUPERUSER_AUTH_ENFORCEMENT` under **Constance > Config**
4. Login to a regular user account
5. Activate Two-factor authentication under **Account Settings >
Security**
6. Login to the Django admin again as the superuser account and promote
the regular user to superuser
7. Log back in as the newly promoted user and navigate to **Account
Settings > Security**
8. 🔴 [on main] Toggle the "Disabled" button for Two-factor
authentication and it should successfully disable
9. đŸŸĸ [on PR] The "Disabled" button for Two-factor authentication is
grayed out with a tooltip when hovering over the button that says
"Superusers cannot deactivate their MFA."
10. Test and ensure these different scenarios work:
- IF user MFA is OFF -> user can't be made superuser
- IF user MFA in ON -> user can be made superuser
- IF superuser -> MFA can't be deactivated, either in the interface or
in Django, by the user or an admin.

---------

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

9107 of 12270 branches covered (74.22%)

19 of 54 new or added lines in 6 files covered. (35.19%)

530 existing lines in 30 files now uncovered.

30011 of 36653 relevant lines covered (81.88%)

5.74 hits per line

Uncovered Changes

Lines Coverage ∆ File
25
43.1
-12.45% kobo/apps/accounts/mfa/admin.py
4
41.0
-10.06% kobo/apps/accounts/mfa/models.py
3
63.64
-36.36% kobo/apps/accounts/mfa/permissions.py
2
46.37
-0.26% hub/admin/extend_user.py
1
40.0
-50.43% kpi/views/environment.py

Coverage Regressions

Lines Coverage ∆ File
72
68.65
-16.76% kpi/views/v2/asset.py
63
34.55
-57.27% kpi/views/v2/paired_data.py
58
59.53
-19.4% kpi/views/v2/data.py
47
40.0
-50.43% kpi/views/environment.py
32
50.75
-47.76% kpi/views/v2/asset_export_settings.py
29
63.16
-30.53% kpi/views/v2/asset_permission_assignment.py
27
34.0
-54.0% kobo/apps/data_collectors/authentication.py
27
45.16
-43.55% kpi/views/v2/attachment.py
25
55.56
-18.52% kpi/views/v2/asset_snapshot.py
19
51.22
-23.17% kobo/apps/accounts/mfa/views.py
19
51.06
-40.43% kpi/views/v2/import_task.py
18
66.04
-33.96% kpi/views/v2/export_task.py
14
0.0
-41.18% kobo/apps/accounts/mfa/adapter.py
14
86.26
-2.56% kobo/apps/openrosa/libs/utils/logger_tools.py
12
28.21
-30.77% kobo/apps/accounts/mfa/flows.py
9
41.0
-10.06% kobo/apps/accounts/mfa/models.py
7
74.07
-25.93% kpi/views/v2/attachment_delete.py
7
75.86
-24.14% kpi/views/v2/tag.py
5
66.18
0.0% kobo/apps/audit_log/models.py
5
76.0
-20.0% kpi/views/v2/asset_submission_counts.py
5
61.54
-38.46% kpi/views/v2/logout.py
3
86.67
-10.0% kpi/views/v2/asset_version.py
3
75.0
-25.0% kpi/views/v2/open_rosa.py
2
72.06
-1.47% kobo/apps/audit_log/signals.py
2
63.64
-4.55% kobo/apps/stripe/utils/limit_enforcement.py
2
88.24
-11.76% kpi/views/v2/service_usage.py
1
43.1
-12.45% kobo/apps/accounts/mfa/admin.py
1
63.64
-36.36% kobo/apps/accounts/mfa/permissions.py
1
92.31
-7.69% kpi/versioning.py
1
93.33
-6.67% kpi/views/v2/asset_usage.py
Jobs
ID Job ID Ran Files Coverage
1 25568812093.1 08 May 2026 05:14PM UTC 908
52.21
2 25568812093.2 08 May 2026 05:14PM UTC 910
53.42
3 25568812093.3 08 May 2026 05:14PM UTC 908
53.82
4 25568812093.4 08 May 2026 05:14PM UTC 908
52.51
5 25568812093.5 08 May 2026 05:15PM UTC 910
55.05
6 25568812093.6 08 May 2026 05:16PM UTC 910
65.86
7 25568812093.7 08 May 2026 05:16PM UTC 908
59.77
8 25568812093.8 08 May 2026 05:17PM UTC 910
60.87
9 25568812093.9 08 May 2026 05:17PM UTC 910
53.83
10 25568812093.10 08 May 2026 05:17PM UTC 912
68.05
Source Files on build 25568812093
  • Tree
  • List 912
  • Changed 7
  • Source Changed 0
  • Coverage Changed 7
Coverage ∆ File Lines Relevant Covered Missed Hits/Line Branch Hits Branch Misses
  • Back to Repo
  • 7036410f on github
  • Prev Build on main (#25568365571)
  • Next Build on main (#25585911541)
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc