kobotoolbox / kpi / 29029441589 / 2

81%

master: 76%

push

github

fix(mfa): enforce 2FA when an authenticated user logs in as another account DEV-2111 (#7223)

### 📣 Summary

Signing in with a second account's credentials while already logged in
now signs you into that account (prompting for 2FA when enabled) instead
of silently ignoring the new credentials.

### 📖 Description

Previously, if you were already logged in and submitted a different
account's credentials on the login form, the new login was silently
discarded. You stayed logged in as your original account and never saw a
2FA prompt. Now the stale session is dropped so the new login completes
normally, including its two-factor challenge.

### 💭 Notes

- Root cause: `ACCOUNT_AUTHENTICATED_LOGIN_REDIRECTS` is disabled, so an
already-authenticated user can POST the login form for a *different*
account. When that account has MFA enabled, allauth defers the login to
its 2FA stage, but the `mfa_authenticate` view redirects any
already-authenticated request away (allauth's `login_stage_required`
decorator), silently abandoning the pending login and leaving the
original user signed in. `MfaLoginView.form_valid` now logs the current
user out (only when the submitted credentials resolve to a different
account, and only after they validate) so the new login and its 2FA
challenge run on a clean, anonymous session.
- Two regression tests added in
`kobo/apps/accounts/mfa/tests/test_login.py`: one reproducing the bounce
(asserts the 2FA challenge is reached and the stale session is dropped),
and one guarding that a *failed* login attempt does not drop the
existing session.

### 👀 Preview steps

1. ℹ️ have two accounts: a regular one, and a superuser with 2FA (TOTP)
enabled
2. log in as the regular (non-superuser) account
3. navigate to `/admin/` — you get the login screen
4. enter the superuser's username and password
5. 🔴 [on main] you're bounced straight to the projects list, still
logged in as the regular user, with no 2FA prompt
6. 🟢 [on PR] you're taken to the 2FA ... (continued)

5073 of 12474 branches covered (40.67%)

19618 of 37062 relevant lines covered (52.93%)

0.53 hits per line