Prevent double notifications after TOTP disabled

[nlhkabu]

After TOTP is disabled, we get the following notifications:

We should not show the second "TOTP is available" message, because the user already knows it is available, and has chosen to disable it.

[nlhkabu]

@woodruffw - is this something you could please look into? Thx

[woodruffw]

Thanks for the ping!

Currently we don't track the user's previous second-factor state -- if they delete all of their 2FA methods, it's as if they never had any to begin with. I guess we could solve this by adding an additional column to the User model, something like has_deleted_second_factor, which we could then check before splashing that message.

One potential concern: we do want to nudge people to re-enable 2FA if they temporarily delete their method. If we add a column that indicates deletion status, we'll probably miss those people.

Maybe we could just make the notification less intrusive, e.g. only display it on the account management page and disable it for the current session if the user has deleted their 2FA method(s)? That would avoid the need to change the model, but would also prompt the user on every fresh session (a good thing, IMO).

[woodruffw]

cc @di @dstufft @ewdurbin @brainwane for ideas/feedback here: I'm personally in favor of always nudging the user to add a second factor if they don't currently have one, but think that we should change the current behavior to dismiss the splash if the user disabled their 2FA within the current session.

[di]

My opinion is that it's fine as-is, the number of users who see this is a small percentage, and it's not really a confusing message for them: They did just disable 2FA, and they should re-enable it.

Happy to defer to @nlhkabu here though.

(Also, I don't see a great way to do this without adding some very specific state to the User model here.)

[brainwane]

I'm taking this issue off the OTF security work milestone because it's going to be tricky to deal with user state. But finding a graceful way to deal with it is something I hope we can do in the medium term.