[#2076] Fix admin index with 2fa

maykinmedia · Feb 7, 2024 · d2df7c9 · d2df7c9
1 parent e7a0507
commit d2df7c9
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 7 deletions.
diff --git a/src/open_inwoner/conf/base.py b/src/open_inwoner/conf/base.py
@@ -480,11 +480,6 @@
     "open_inwoner.accounts.backends.CustomOIDCBackend",
 ]
 
-# Allowing OIDC admins to bypass 2FA
-MAYKIN_2FA_ALLOW_MFA_BYPASS_BACKENDS = [
-    "open_inwoner.accounts.backends.CustomOIDCBackend",
-]
-
 
 SESSION_COOKIE_NAME = "open_inwoner_sessionid"
 SESSION_ENGINE = "django.contrib.sessions.backends.cache"
@@ -609,6 +604,11 @@
 ADMIN_INDEX_SHOW_REMAINING_APPS = False
 ADMIN_INDEX_AUTO_CREATE_APP_GROUP = False
 ADMIN_INDEX_SHOW_REMAINING_APPS_TO_SUPERUSERS = False
+ADMIN_INDEX_SHOW_MENU = True
+ADMIN_INDEX_DISPLAY_DROP_DOWN_MENU_CONDITION_FUNCTION = (
+    "open_inwoner.utils.django_two_factor_auth.should_display_dropdown_menu"
+)
+
 
 #
 # DJANGO-AXES (4.0+)
@@ -816,6 +816,11 @@
 TWO_FACTOR_PATCH_ADMIN = False
 TWO_FACTOR_WEBAUTHN_RP_NAME = f"OpenInwoner {ENVIRONMENT}"
 TWO_FACTOR_WEBAUTHN_AUTHENTICATOR_ATTACHMENT = "cross-platform"
+# Allow OIDC admins to bypass 2FA
+MAYKIN_2FA_ALLOW_MFA_BYPASS_BACKENDS = [
+    "open_inwoner.accounts.backends.CustomOIDCBackend",
+]
+DISABLE_2FA = config("DISABLE_2FA", default=False)
 
 # file upload limits
 MIN_UPLOAD_SIZE = 1  # in bytes

diff --git a/src/open_inwoner/utils/django_two_factor_auth.py b/src/open_inwoner/utils/django_two_factor_auth.py
@@ -8,8 +8,7 @@
 def should_display_dropdown_menu(request) -> bool:
     default = default_should_display_dropdown_menu(request)
 
-    two_factor_enabled = settings.TWO_FACTOR_PATCH_ADMIN
-    if not two_factor_enabled:
+    if settings.DISABLE_2FA:
         return default
 
     # never display the dropdown in two-factor admin views