(Discontinued) Enforce two-factor authentication

[wxiaoguang]

Disclaimer: Since this PR doesn't seem to be merged easily (#13606 (comment)), and much more work need to do.

I just keep this PR for my personal usage, and update it with main branch regularly.

Anyone who want to continue the work for Enforced 2FA can pick this PR or start a new one.

---

• Ability to enforce two-factor authentication #880

Design:

1. A global setting security.ENFORCE_TWO_FACTOR_AUTH.
2. A user without 2FA can login and may explore, but can NOT read or write to any repositories.
3. Keep things as simple as possible.

[lunny]

How did you control the permssion?

[wxiaoguang]

How did you control the permssion?

I just studied the logic of IsRestricted. For my understanding, the key points of permission control are accessLevel and HasAccess->getUserRepoPermission. In these two functions, if GetTwoFactorByUID fails, the return value is AccessModeNone to reject user access.

And unit tests are also updated with 2FA cases.

More thoughts: why are the RepoList related functions not changed: as long as a user without 2FA will setup 2FA soon and then can access to the repositories, listing repositories before 2FA setup can not be a security problem. So I think it's good to keep these logics simple.

[lunny]

Maybe we could split it as two PRs, one is always requiring login with 2FA, another is changing the runtime permissions when login with 2fa or password only.

[techknowlogick]

There are new commits to this, is it still discontinued, or is it now a WIP?

Edit: nvm. I should've read the description

[lunny]

Does this affect the first admin user registry?

[wxiaoguang]

Discontinued (due to #13606 (comment)), I won't spend time on it.

---

I am still keeping updating my 2FA branch with main branch, and I am still using it in my instance.