Admin cannot disable TFA for a user

Unfortunately it is impossible to to fix access check only for one route as the same custom access code is used all over.

Attempted to fix the bug by the smallest possible change.

High level glance:

Per 🐛 The "tfa_trusted_browser" plugin does not exist. Needs work we would not want to allow blind admin access to tfa.validation.setup

For tfa.disable and tfa.plugin.reset
Cursory glance it is an AND condition between _custom_access and _permission:

Can we just do

-    _permission: 'disable own tfa'
+    _permission: 'disable own tfa+administer tfa for other users'

Ref: https://www.drupal.org/docs/drupal-apis/routing-system/structure-of-routes →

Resulting Policy: Must validate through _custom_access AND have permission ( "disable own tfa" OR "administer tfa for other users")
(Unless this is a newer change in policy support? would need to test older core to validate).

Thinking further, suggestion from #3 would likely allow admins to disable their own TFA which would be a step too far on the change.

Looking deeper at the code MR it looks like tfa.validation.setup might still be safe as is (I missed it was an early return).

This probably primarily just needs the PHPStan warnings fixed, leaving as NW for that.

I wish we had testing on this, however it seems there is nowhere reliably testing just this code at the moment, making it a bit of an undue burden to make it a condition for allowing through. Will likely want a followup issue to add unit tests for accessSelfOrAdmin().

PHPStan should be happy now.

Visually looks good.

I want to run through a few rounds of manual testing (validate admins can't disable their own TFA if they don't have the disable self permission, make sure average users can not edit TFA for others, etc) which is going to require me to full lab this adding a slight delay to commit, however I do not foresee any of those manual tests failing.

Adding manual testing tag to remind myself.

This MR fixes the problem, and is working nicely for me.

Manually tested:
User with 'setup own tfa' can setup own token.
User with 'setup own tfa' can not setup tokens for other users.
User with 'disable own tfa' can disable own token
User with without 'disable own tfa' can not disable TFA.
User with 'administer tfa for other users' can admin other users TFA, including disabling TFA.
User with 'administer tfa for other users' but not 'disable own tfa' can not disable TFA for self.

Committed to dev.

Automatically closed - issue fixed for 2 weeks with no activity.