Reauth 2nd factor to change 2FA settings

[iandunn]

There's an upstream issue for this, but we'll probably need to do our own since we have the custom UI.

[dd32]

I've started work upstream in WordPress/two-factor#529 but there's a major catch - I've used WordPress sessions upstream, and WordPress.org doesn't support those.

In some brief testing, I believe that we can likely use WordPress Sessions on WordPress.org as well, there's some hacky-hackery that we could use to make WordPress see sessions, but have Trac/Codex use non-sessioned cookies. Either that, or just fix those to also use sessions finally.. I've done some work on Trac support already.

[StevenDufresne]

Can we narrow down the focus of this ticket? Maybe generated a specific to-do list?

[dd32]

@StevenDufresne Sure

• Reauth 2FA tokens when changing 2FA details.
  • Prompt user if it's been >xx mins since last 2FA challenge before displaying UI.

Dependencies:

• Upstream Revalidate two factor settings prior to allowing any two-factor changes to an account. two-factor#529
  • Which depends upon Store the two-factor details in the user session at login time two-factor#528
• WordPress Sessions
  • Wordress.org requires https://make.wordpress.org/systems/2023/03/09/upgrade-tracwpcookies-plugin/ before Sessions can be enabled

The dependencies are completed, but need testing, merging and/or systems.