Repository: inventree/InvenTree

Issue:
[FR] Update 2FA library
django-allauth-2fa have recently [added configurable redirect URLs](https://github.com/valohai/django-allauth-2fa/issues/142) - will be available in the 1.0 release

Once the 1.0 release is out, we should update and remove our custom view code.


Discussion:
@SchrodingersGat this will remove the need for a bunch of code, great news!
@SchrodingersGat should we just fork and release to PyPI like brother_ql to update now? Not sure when they will update.
Looking at https://github.com/valohai/django-allauth-2fa/issues/133 and https://github.com/valohai/django-allauth-2fa/issues/119 I am not sure if it is really maintained anymore.
I think if we have to add any further custom code, it would be worth it. At the moment our custom views are pretty "stable"?
This issue seems stale. Please react to show this is still important.
Seem like there is some movement in the repo again - not sure if there will be releases though - see https://github.com/valohai/django-allauth-2fa/issues/133 .
@SchrodingersGat should we start searching for alternatives?
This issue seems stale. Please react to show this is still important.
Still waiting for a release. Looking at https://github.com/valohai/django-allauth-2fa/issues/119 and other discussions I am not sure there are any concrete plans for a release.
At this point thinking about a fork and releasing that like brother_ql seems like a better idea than waiting - or switching out the 2fa library entirely for something modern with support for #4002.
@matmair sorry somehow I did not get notified of this one (or missed the notification). Are there any alternative packages which would drop-in for django-allauth-2fa?
Not without a bunch of work. There are some issues like token management, passkey, passwordless & magic link login etc. that would be easier with a custom user, groups and security stack.
In general, I would love to work on something like this as I reimplement the same things in all of my applications but I value #2789 #4826 #2817 higher rn
Fair enough, we'll leave this one hanging for now 

Resolving patch:
diff --git a/InvenTree/InvenTree/settings.py b/InvenTree/InvenTree/settings.py
--- a/InvenTree/InvenTree/settings.py
+++ b/InvenTree/InvenTree/settings.py
@@ -868,6 +868,8 @@
 ACCOUNT_DEFAULT_HTTP_PROTOCOL = get_setting('INVENTREE_LOGIN_DEFAULT_HTTP_PROTOCOL', 'login_default_protocol', 'http')
 ACCOUNT_LOGOUT_ON_PASSWORD_CHANGE = True
 ACCOUNT_PREVENT_ENUMERATION = True
+# 2FA
+REMOVE_SUCCESS_URL = 'settings'
 
 # override forms / adapters
 ACCOUNT_FORMS = {
diff --git a/InvenTree/InvenTree/urls.py b/InvenTree/InvenTree/urls.py
--- a/InvenTree/InvenTree/urls.py
+++ b/InvenTree/InvenTree/urls.py
@@ -38,9 +38,9 @@
                     CustomEmailView, CustomLoginView,
                     CustomPasswordResetFromKeyView,
                     CustomSessionDeleteOtherView, CustomSessionDeleteView,
-                    CustomTwoFactorRemove, DatabaseStatsView, DynamicJsView,
-                    EditUserView, IndexView, NotificationsView, SearchView,
-                    SetPasswordView, SettingsView, auth_request)
+                    DatabaseStatsView, DynamicJsView, EditUserView, IndexView,
+                    NotificationsView, SearchView, SetPasswordView,
+                    SettingsView, auth_request)
 
 admin.site.site_header = "InvenTree Admin"
 
@@ -191,10 +191,6 @@
     re_path(r'^accounts/social/connections/', CustomConnectionsView.as_view(), name='socialaccount_connections'),
     re_path(r"^accounts/password/reset/key/(?P<uidb36>[0-9A-Za-z]+)-(?P<key>.+)/$", CustomPasswordResetFromKeyView.as_view(), name="account_reset_password_from_key"),
 
-    # Temporary fix for django-allauth-2fa # TODO remove
-    # See https://github.com/inventree/InvenTree/security/advisories/GHSA-8j76-mm54-52xq
-    re_path(r'^accounts/two_factor/remove/?$', CustomTwoFactorRemove.as_view(), name='two-factor-remove'),
-
     # Override login page
     re_path("accounts/login/", CustomLoginView.as_view(), name="account_login"),
 
diff --git a/InvenTree/InvenTree/views.py b/InvenTree/InvenTree/views.py
--- a/InvenTree/InvenTree/views.py
+++ b/InvenTree/InvenTree/views.py
@@ -27,7 +27,6 @@
                                    PasswordResetFromKeyView)
 from allauth.socialaccount.forms import DisconnectForm
 from allauth.socialaccount.views import ConnectionsView
-from allauth_2fa.views import TwoFactorRemove
 from djmoney.contrib.exchange.models import ExchangeBackend, Rate
 from user_sessions.views import SessionDeleteOtherView, SessionDeleteView
 
@@ -664,9 +663,3 @@ class NotificationsView(TemplateView):
     """View for showing notifications."""
 
     template_name = "InvenTree/notifications/notifications.html"
-
-
-# Custom 2FA removal form to allow custom redirect URL
-class CustomTwoFactorRemove(TwoFactorRemove):
-    """Specify custom URL redirect."""
-    success_url = reverse_lazy("settings")


Test patch: