The latter is T199118: Degrade/temporarily remove user rights/groups if 2FA isn't enabled

Some overlap/similarity with T150562: Be able to force OATHAuth for certain user groups too

Meeting minutes from 2019-05-08:

• Certain permissions should be suppressed if user is not 2FA
• @Bawolff suggests usage of new UserGetRightsRemove hook.
  • We should check if a precise error message in case a user looses the permission due to not having 2FA is possible. If not, it's no show stopper.
• List of permissions to supress should be defined by a configuration variable
  • Permission editinterface should be default

In T218215#5169499, @Osnard wrote:

We should check if a precise error message in case a user looses the permission due to not having 2FA is possible. If not, it's no show stopper.

It's not. The related task is T180888: All permission checks should be able to return a custom error message.

I think a somewhat hacky workaround would be possible, where PermissionManager tracks user right revocations (ie. instead of the cache looking like $username => [ $right, ... ] it would be something like $username => [ 'rights' => [ $right, ... ], 'revocations' => [ $right => $message, ... ] ]) and add an output parameter to PermissionManager::userHasRight and the like for the case where the right is available but revoked. UserGetRightsRemove would have to be changed but it's a new hook and not used much yet so that's not too bad.
(See T227975: Grant permission errors where the user has the right but the app does not have the grant are unclear for another use case for this.)

Thanks four you input @Tgr