[#2076] Fix admin index with 2fa

maykinmedia · Feb 8, 2024 · 13de0b8 · 13de0b8
1 parent 736f951
commit 13de0b8
Show file tree

Hide file tree

Showing 4 changed files with 11 additions and 18 deletions.
diff --git a/requirements/dev.txt b/requirements/dev.txt
@@ -312,7 +312,7 @@ django-elasticsearch-dsl==7.2.1
     # via
     #   -c requirements/ci.txt
     #   -r requirements/ci.txt
-django-extensions==3.1.3
+django-extensions==3.2.3
     # via -r requirements/dev.in
 django-extra-fields==3.0.2
     # via

diff --git a/src/open_inwoner/conf/base.py b/src/open_inwoner/conf/base.py
@@ -480,11 +480,6 @@
     "open_inwoner.accounts.backends.CustomOIDCBackend",
 ]
 
-# Allowing OIDC admins to bypass 2FA
-MAYKIN_2FA_ALLOW_MFA_BYPASS_BACKENDS = [
-    "open_inwoner.accounts.backends.CustomOIDCBackend",
-]
-
 
 SESSION_COOKIE_NAME = "open_inwoner_sessionid"
 SESSION_ENGINE = "django.contrib.sessions.backends.cache"
@@ -609,6 +604,11 @@
 ADMIN_INDEX_SHOW_REMAINING_APPS = False
 ADMIN_INDEX_AUTO_CREATE_APP_GROUP = False
 ADMIN_INDEX_SHOW_REMAINING_APPS_TO_SUPERUSERS = False
+ADMIN_INDEX_SHOW_MENU = True
+ADMIN_INDEX_DISPLAY_DROP_DOWN_MENU_CONDITION_FUNCTION = (
+    "open_inwoner.utils.django_two_factor_auth.should_display_dropdown_menu"
+)
+
 
 #
 # DJANGO-AXES (4.0+)
@@ -816,6 +816,10 @@
 TWO_FACTOR_PATCH_ADMIN = False
 TWO_FACTOR_WEBAUTHN_RP_NAME = f"OpenInwoner {ENVIRONMENT}"
 TWO_FACTOR_WEBAUTHN_AUTHENTICATOR_ATTACHMENT = "cross-platform"
+# Allow OIDC admins to bypass 2FA
+MAYKIN_2FA_ALLOW_MFA_BYPASS_BACKENDS = [
+    "open_inwoner.accounts.backends.CustomOIDCBackend",
+]
 
 # file upload limits
 MIN_UPLOAD_SIZE = 1  # in bytes

diff --git a/src/open_inwoner/conf/ci.py b/src/open_inwoner/conf/ci.py
@@ -60,10 +60,6 @@
 # Django privates
 SENDFILE_BACKEND = "django_sendfile.backends.development"
 
-# Two factor auth
-TWO_FACTOR_FORCE_OTP_ADMIN = False
-TWO_FACTOR_PATCH_ADMIN = False
-
 # THOU SHALT NOT USE NAIVE DATETIMES
 warnings.filterwarnings(
     "error",

diff --git a/src/open_inwoner/utils/django_two_factor_auth.py b/src/open_inwoner/utils/django_two_factor_auth.py
@@ -1,5 +1,3 @@
-from django.conf import settings
-
 from django_admin_index.utils import (
     should_display_dropdown_menu as default_should_display_dropdown_menu,
 )
@@ -8,12 +6,7 @@
 def should_display_dropdown_menu(request) -> bool:
     default = default_should_display_dropdown_menu(request)
 
-    two_factor_enabled = settings.TWO_FACTOR_PATCH_ADMIN
-    if not two_factor_enabled:
-        return default
-
-    # never display the dropdown in two-factor admin views
-    if request.resolver_match.view_name.startswith("admin:two_factor:"):
+    if request.resolver_match.view_name.startswith("maykin_2fa"):
         return False
 
     return default and request.user.is_verified()