[Zippybonzo]

This is the commit that missed the #33 merge. It was pushed to the branch after GitHub had already computed that merge, so #33 landed with the email-verification change only and its description promised something the merge did not contain. Rebased onto the merged main here, unchanged.

What it fixes

#32 exempted only accounts with no local password, which missed the common case: an account created with mwdeploy:create-user and later signed into with the provider. Those kept being sent to TOTP enrolment — exactly what the exemption was meant to stop, and the reason this had to be said twice.

The exemption now follows the account: linked to the provider (oidc_subject is set), exempt. Whether it also has a password no longer matters.

Accounts the provider knows nothing about are unchanged, which is every account on an install without single sign-on. Enrolment stays available to everyone, exempt or not.

The cost, stated rather than buried

A linked account that keeps a local password can be entered by that password without the provider seeing it, and so without whatever MFA the provider enforces. Switching password sign-in off (#32) is what closes that, and is the intended configuration for an install relying on the provider for its second factor.

That trade-off is written into the README, docs/OPERATIONS.md and the sign-in settings screen itself, so it does not have to be rediscovered from behaviour later.

Testing

317 tests pass, pint --test clean, on the rebased base.

• an_account_linked_to_the_provider_is_not_forced_to_enrol — the no-password case, as before.
• a_linked_account_that_kept_its_password_is_exempt_too — the case Make single sign-on able to stand alone, and fix Authentik account linking #32 got wrong. This is the regression guard.
• a_local_account_with_no_provider_link_must_still_enrol — pins the half that did not change, so a future widening of this rule fails a test rather than quietly removing the requirement from every account.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QjX5f2ZtAKYfiQmzWaD8tp

---

Generated by Claude Code

[coderabbitai]

Warning

Review limit reached

Next included review available in 44 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 7dd93b57-9595-447b-b1e2-7bcddad95e02

📥 Commits

Reviewing files that changed from the base of the PR and between 78c64f6 and 142d814.

📒 Files selected for processing (6)

• README.md
• app/Http/Middleware/RequireTwoFactor.php
• app/Models/User.php
• docs/OPERATIONS.md
• resources/js/console/pages/AuthenticationSettingsPage.vue
• tests/Feature/TwoFactorEnforcementTest.php

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}