Skip to content

Conversation

@Guitlle
Copy link
Contributor

@Guitlle Guitlle commented Oct 22, 2025

🗒️ Checklist

  1. run linter locally
  2. update developer docs (API, README, inline, etc.), if any
  3. for user-facing doc changes create a Zulip thread at #Support Docs Updates, if any
  4. draft PR with a title <type>(<scope>)<!>: <title> DEV-1234
  5. assign yourself, tag PR: at least Front end and/or Back end or workflow
  6. fill in the template below and delete template comments
  7. review thyself: read the diff and repro the preview as written
  8. open PR & confirm that CI passes & request reviewers, if needed
  9. delete this section before merging

Summary

Migrate MFA features from Trench to Django Allauth for better integration, maintainability.

Description

This update replaces all Trench-based multi-factor authentication (MFA) endpoints, views, and forms with a new implementation powered by Django Allauth. The change ensures tighter integration with the existing authentication system, simplifies configuration, and improves long-term maintainability.

💭 Notes

The MFA endpoints were changed to use the allauth MFA feature and removing trench. This covers these endpoints that are used in the frontend:

  • /api/v2/auth/str:method/activate/
  • /api/v2/auth/str:method/activate/confirm/
  • /api/v2/auth/str:method/codes/regenerate/
  • /api/v2/auth/str:method/deactivate/
  • /api/v2/auth/mfa/user-active-methods/

These are now based on the Authenticator model, which can handle TOTP codes and recovery codes.

👀 Preview steps

These endpoints are covered in unit tests, so no need to test. However we could test the following sequence to validate it's working ok:

  1. Log into your dev env
  2. Go to account settings
  3. Go to security
  4. Enable MFA and you can use pyotp to generate codes, or you can use an auth app in your phone
  5. Scan the QR code or copy the manual key, use pyotp:
>>> import pyotp
>>> key = '*****'
>>> totp = pyotp.TOTP(key)
>>> totp.now()

123456
  1. Enter the generated code and it should now show you the recovery codes. Download the file, and click the blue button
  2. You should see that there are two options now, reconfigure MFA and regenerate codes
  3. Test each one of these, it should allow you to follow the steps with no error messages in the KPI container logs or in the frontend app. Use pyotp to generate new codes, as shown above.

@Guitlle Guitlle changed the title Dev 749 mfa update endpoints feat(mfa): create new API endpoints and views to replace trench's DEV-749 Oct 24, 2025
@Guitlle Guitlle self-assigned this Oct 24, 2025
@Guitlle Guitlle changed the title feat(mfa): create new API endpoints and views to replace trench's DEV-749 feat(mfa): create new API endpoints and views to replace trench's DEV-749 DEV-750 Oct 24, 2025
@Guitlle Guitlle changed the title feat(mfa): create new API endpoints and views to replace trench's DEV-749 DEV-750 feat(mfa): replace trench based API endpoints, views and forms with allauth implementation DEV-749 DEV-750 Oct 24, 2025
@Guitlle Guitlle marked this pull request as ready for review October 27, 2025 22:41
@Guitlle Guitlle removed request for jnm and olive-KTB October 27, 2025 22:42
@Guitlle Guitlle changed the title feat(mfa): replace trench based API endpoints, views and forms with allauth implementation DEV-749 DEV-750 feat(mfa): replace trench based API endpoints, views and forms with allauth implementation DEV-749 Oct 27, 2025
@noliveleger noliveleger requested a review from rgraber as a code owner November 14, 2025 15:44
### 💭 Notes
The trench MFA data is copied to the allauth Authenticator and the
MfaMethodsWrapper models in order to remove the trench dependency. In
order to avoid disabling MFA for users it migrates the user MFA data
from trench when the user logs in. It also includes a long running
migration to migrate users MFA data in the background.
@noliveleger noliveleger removed the request for review from rgraber November 14, 2025 17:00
Copy link
Contributor

@noliveleger noliveleger left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@noliveleger noliveleger merged commit 8228dde into main Nov 14, 2025
11 checks passed
@noliveleger noliveleger deleted the dev-749-mfa-update-endpoints branch November 14, 2025 17:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants