2fa flow

backend/api/tests/test_views.py

@@ -29,7 +29,11 @@ def test_post__otp(self):
 
         assert response.status_code == 200
         self.assertDictEqual(
-            response.json(), {"auth_factors": [AuthFactor.Type.OTP]}
+            response.json(),
+            {
+                "auth_factors": [AuthFactor.Type.OTP],
+                "otp_bypass_token_exists": False,
+            },
         )
 
         self.user.userprofile.otp_secret = pyotp.random_base32()
@@ -45,7 +49,10 @@ def test_post__otp(self):
             )
 
         assert response.status_code == 200
-        self.assertDictEqual(response.json(), {"auth_factors": []})
+        self.assertDictEqual(
+            response.json(),
+            {"auth_factors": []},
+        )
 
 
 class TestClearExpiredView(CronTestCase):

backend/api/views.py

@@ -2,6 +2,7 @@
 
 from codeforlife.mixins import CronMixin
 from codeforlife.request import HttpRequest
+from codeforlife.user.models import AuthFactor
 from common.models import UserSession
 from django.contrib.auth import login
 from django.contrib.auth.views import LoginView as _LoginView
@@ -58,15 +59,20 @@ def form_valid(self, form: BaseAuthForm):
         # Save session (with data).
         self.request.session.save()
 
-        return JsonResponse(
-            {
-                "auth_factors": list(
-                    self.request.user.session.session_auth_factors.values_list(
-                        "auth_factor__type", flat=True
-                    )
+        response_data = {
+            "auth_factors": list(
+                self.request.user.session.session_auth_factors.values_list(
+                    "auth_factor__type", flat=True
                 )
-            }
-        )
+            )
+        }
+
+        if AuthFactor.Type.OTP in response_data["auth_factors"]:
+            response_data[
+                "otp_bypass_token_exists"
+            ] = self.request.user.otp_bypass_tokens.exists()
+
+        return JsonResponse(response_data)
 
     def form_invalid(self, form: BaseAuthForm):
         return JsonResponse(form.errors, status=status.HTTP_400_BAD_REQUEST)