anvil-works / anvil-runtime

The runtime engine for hosting Anvil web apps
https://anvil.works/open-source
Other
874 stars 116 forks source link

configure_mfa_with_form actually adds an mfa method - does not clear existing #81

Open yahiakala opened 4 months ago

yahiakala commented 4 months ago

The alert message implies that the function configure_mfa_with_form clears existing mfa methods. However, it appends the new mfa method to the existing ones, since the function add_mfa_method is not called with clear_existing=True

It should say something like "You have successfully added a two-factor authentication method". Or, more flexibly, it should have the option clear_existing which will then affect the append/clear and also the alert message.

`

    def configure_mfa_with_form(allow_cancel=False):

        error = None
        while True:
            mfa_method, password = _configure_mfa(None, error, True, allow_cancel, "Save")

            if mfa_method:
                try:
                    add_mfa_method(password, mfa_method)
                    alert("Your two-factor authentication configuration has been reset.")
                    return True
                except AuthenticationFailed as e:
                    error = e.args[0]
                except Exception as e:
                    error = str(e)
            else:
                return None

`

Happy to do a PR if you like :)