Follows up T400579: Add ability to make 2FA available to N% of users, and as a further optimisation past T404252: OATHAuth loading more from the database than needed...
Is there any benefit of adding users to the oathauth-twofactorauth group, if they already have the oathauth-enable right? And/or, depending on how we want to look it up, whether they even already have 2FA enabled?
And/or, depending on how we want to look it up, whether they even already have 2FA enabled?
Doing it based on whether 2FA is enabled would publicly disclose this information that should gated behind the oathauth-verify-user right.
Ontop of the maths being used to decide if they get put in that group anyway in the meantime... But yes, point taken :)
Since all users now have 2FA access I'm declining this task as I don't think it's relevant anymore.