🎨 Removes two_factor_enabled column in users db (🗃️) (#5063)

Author: pcrespov

packages/postgres-database/src/simcore_postgres_database/migration/versions/0ad000429e3d_rm_two_factor_enabled_col_in_users.py

@@ -0,0 +1,36 @@
+"""rm two_factor_enabled col in users
+
+Revision ID: 0ad000429e3d
+Revises: 215b2cac1dbc
+Create Date: 2023-11-21 18:30:35.437738+00:00
+
+"""
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision = "0ad000429e3d"
+down_revision = "215b2cac1dbc"
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.drop_column("users", "two_factor_enabled")
+    # ### end Alembic commands ###
+
+
+def downgrade():
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.add_column(
+        "users",
+        sa.Column(
+            "two_factor_enabled",
+            sa.BOOLEAN(),
+            server_default=sa.text("true"),
+            autoincrement=False,
+            nullable=False,
+        ),
+    )
+    # ### end Alembic commands ###

packages/postgres-database/src/simcore_postgres_database/models/users.py

@@ -100,14 +100,6 @@ class UserStatus(Enum):
         nullable=True,  # since 2FA can be configured optional
         doc="Confirmed user phone used e.g. to send a code for a two-factor-authentication",
     ),
-    sa.Column(
-        "two_factor_enabled",
-        sa.Boolean,
-        server_default=sa.sql.expression.true(),
-        nullable=False,
-        doc="Wheter 2FA is enabled at login by this user."
-        "NOTE that this is checked ONLY if application activates 2FA",
-    ),
     sa.Column("password_hash", sa.String, nullable=False),
     sa.Column(
         "primary_gid",

services/web/server/src/simcore_service_webserver/login/handlers_auth.py

@@ -98,7 +98,8 @@ async def login(request: web.Request):
         product=product,
     )
 
-    skip_2fa = not user.get("two_factor_enabled", True)
+    # Some roles have login privileges
+    skip_2fa: bool = UserRole(user["role"]) == UserRole.TESTER
     if skip_2fa or not settings.LOGIN_2FA_REQUIRED:
         return await login_granted_response(request, user=user)