feat(auth): add two-factor authentication

[nijel]

Proposed changes

• Implemented using django-otp and django-otp-webauthn
• Support for TOTP, WebAuthn and recovery codes

Fixes #1681

Checklist

Pending tasks:

• Implement configuration views
• Implement generating backup codes
• Implement view backup codes with audit log tracking (compare to https://github.com/settings/auth/recovery-codes)
• Implement naming of security tokens (see How to set device name Stormbase/django-otp-webauthn#16)
• Implement TOTP registration
• Implement authentication flow for login
• Implement authentication flow for social auth
• Do manual testing
• Implement WebAuthn login flow
• Incompatible with CSRF_USE_SESSIONS = True Stormbase/django-otp-webauthn#14 needs to fixed (perhaps by Pass CSRF token directly as configuration, don't rely on presence of cookie or hidden input Stormbase/django-otp-webauthn#15) and fix released
• Not compatible with MySQL Stormbase/django-otp-webauthn#17 needs to be fixed and fix released

• Lint and unit tests pass locally with my changes.
• I have added tests that prove my fix is effective or that my feature works.
• I have added documentation to describe my feature.
• I have squashed my commits into logic units.
• I have described the changes in the commit messages.

Other information

[accesslint]

There are accessibility issues in these changes.

[Stormheg]

Hi, creator of django-otp-webauthn here 👋

Very cool to see my package being put to good use. It's pretty new, and has yet to prove itself in the context of a production site. Please keep me updated on any issues encountered 👍

[nijel]

I was originally thinking about two_factor, but it turned out to be too opinionated for our use-case, so I ended up trying django-otp-webauthn.

[codecov]

Codecov Report

Attention: Patch coverage is 87.15203% with 60 lines in your changes missing coverage. Please review.

Project coverage is 91.12%. Comparing base (6aee586) to head (4fe490a).
Report is 3005 commits behind head on main.

Files	Patch %	Lines
weblate/accounts/utils.py	45.94%	17 Missing and 3 partials ⚠️
weblate/accounts/views.py	91.32%	11 Missing and 6 partials ⚠️
weblate/accounts/forms.py	86.48%	8 Missing and 2 partials ⚠️
weblate/accounts/pipeline.py	46.15%	6 Missing and 1 partial ⚠️
weblate/accounts/models.py	85.71%	2 Missing and 2 partials ⚠️
weblate/accounts/tasks.py	80.00%	0 Missing and 1 partial ⚠️
weblate/accounts/templatetags/authnames.py	87.50%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #12173      +/-   ##
==========================================
+ Coverage   90.82%   91.12%   +0.30%     
==========================================
  Files         554      586      +32     
  Lines       57306    60072    +2766     
  Branches     9122     9502     +380     
==========================================
+ Hits        52046    54743    +2697     
- Misses       3640     3696      +56     
- Partials     1620     1633      +13     

Files	Coverage Δ
...s/0012_alter_auditlog_activity_profile_last_2fa.py	100.00% <100.00%> (ø)
weblate/accounts/tests/test_twofactor.py	100.00% <100.00%> (ø)
weblate/accounts/urls.py	69.23% <100.00%> (+2.56%)	⬆️
weblate/accounts/tasks.py	88.97% <80.00%> (+0.45%)	⬆️
weblate/accounts/templatetags/authnames.py	90.47% <87.50%> (+5.18%)	⬆️
weblate/accounts/models.py	86.80% <85.71%> (-0.37%)	⬇️
weblate/accounts/pipeline.py	78.81% <46.15%> (-2.98%)	⬇️
weblate/accounts/forms.py	90.09% <86.48%> (-0.58%)	⬇️
weblate/accounts/views.py	84.32% <91.32%> (+0.90%)	⬆️
weblate/accounts/utils.py	72.47% <45.94%> (-13.44%)	⬇️

... and 396 files with indirect coverage changes

[orangesunny]

Good to go like this

[sentry-io]

Suspect Issues

This pull request was deployed and Sentry observed the following issues:

• ‼️ InvalidEmail: Email couldn't be validated /accounts/complete/{backend}/ View Issue
• ‼️ AuthMissingParameter: Missing needed parameter state /accounts/complete/{backend}/ View Issue
• ‼️ AuthStateMissing: Session value state missing. /accounts/complete/{backend}/ View Issue
• ‼️ AuthMissingParameter: Missing needed parameter user /accounts/complete/{backend}/ View Issue
• ‼️ AuthMissingParameter: Missing needed parameter user /accounts/complete/{backend}/ View Issue

_{Did you find this useful? React with a 👍 or 👎}