Right now, conditions for group membership set in $wgRestrictedGroups are checked only when user is added to the group. With 2FA, we'd like to be able to enforce it constantly, not only when the permissions were granted.
Even though half of this continuous enforcement is done in T414952: Prevent 2FA-required users from disabling their last 2FA method, we still need something that will help us introduce requirements to new groups. In these cases, it'll be helpful to make people aware of the conditions, before coming up with any more serious means like demoting.
We could potentially just keep the current $wgOATHRequiredForGroups mechanism, but it would be incompatible with more elaborate conditions that can be specified in $wgRestrictedGroups.
Acceptance criteria
- All group requirements configured with $wgRestrictedGroups (except for groups with 'canBeIgnored' => true) are continuously checked (similarly to how autopromotion works).
- If user is determined to no longer meet requirements for a given group, the group is disabled for them (not removed entirely, status similar to current effect of $wgOATHRequiredForGroups).
- Conditions for group membership for system users are not checked.