Skip to content

Feature/enrollment onboarding - #966

Draft
PassionateBytes wants to merge 11 commits into
WordPress:masterfrom
PassionateBytes:feature/enrollment-onboarding
Draft

Feature/enrollment onboarding#966
PassionateBytes wants to merge 11 commits into
WordPress:masterfrom
PassionateBytes:feature/enrollment-onboarding

Conversation

@PassionateBytes

Copy link
Copy Markdown

What?

Fixes #

Why?

How?

Use of AI Tools

Testing Instructions

Screenshots or screencast

Before After

Changelog Entry

Added - New feature.
Changed - Existing functionality.
Deprecated - Soon-to-be removed feature.
Removed - Feature.
Fixed - Bug fix.
Security - Vulnerability.
Development Update - Development related updates.

masteradhoc and others added 11 commits March 22, 2026 00:01
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Add tests for role-based Two-Factor enforcement
Enforcement currently challenges users who have not configured Two-Factor with an
emailed code. That keeps the login flow intact, but it never asks those users to
configure a second factor of their own choosing.

This adds an enforcement method setting next to the enforced roles. The email
method stays the default and is unchanged. The enrollment method instead sends
users in an enforced role to a setup screen after they log in, and keeps the rest
of the admin unavailable until they have enabled a method.

The setup screen renders the provider UI of the profile screen and saves through
Two_Factor_Core::user_two_factor_options_update(), so providers configure
themselves exactly as they do on the profile screen. The profile screen itself,
the endpoints the providers post to, and the plugin's own REST routes stay
reachable while the enrollment is pending; other REST requests are refused.

Fixes WordPress#813
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants