kobotoolbox / kpi / 24993281612 / 9

82%

master: 76%

push

github

fix(mfa): prevent MFA re-enrollment lockouts by centralizing deactivation cleanup DEV-2023 (#6964)

### 📣 Summary
This PR fixes a desynchronization bug where deactivating an MFA wrapper
via the Django Admin UI left orphaned Authenticator records in the
database, breaking future re-enrollment. Cleanup logic has now been
centralized in the model to ensure safe, consistent deletion across both
API and Admin flows.

### 📖 Description
Previously, when a superuser disabled MFA through the Django Admin, the
associated django-allauth Authenticator records were not removed. This
left orphaned records in the database, causing a "Token Invalid" error
when the user attempted to re-enroll.

This PR introduces a robust, centralized deactivate() method on the
MfaMethodsWrapper model, ensuring that all related Authenticator records
are properly cleaned up whenever MFA is disabled, regardless of the
entry point (Admin or API).

4738 of 11904 branches covered (39.8%)

22071 of 35976 relevant lines covered (61.35%)

0.61 hits per line