Type of change

• Bug fix
• New feature development
• Tech debt (refactoring, code cleanup, dependency upgrades, etc)
• Build/deploy pipeline (DevOps)
• Other

Objective

Given: a user does not have 2FA set up AND the user is not logging in with SSO
When: the user logs in on a new device AND this is not the first device the user has logged in on
Then: required Email 2FA

Code changes

• User.cs: Added method to clear 2FA
• BaseRequestValidator: Added logic to require and send email 2FA when there is a login on a new device that is not SSO and has no 2FA configured.
• NewDeviceLoginTwoFactorEmail.text.hbs: Added text template for the new email
• NewDeviceLoginTwoFactorEmail.html.hbs: Added html template for the new email
• HandlebarsMailService: Added method to send the new email with the email 2FA for new device's login
• UserService: Added logic to send the correct 2FA email depending on if that is because of a new device's login or of a configured email 2FA
• UserServiceTests: Added unit tests for the new logic on SendTwoFactorEmailAsync

Testing requirements

Test that on users that don't have SSO and don't have any 2FA set up, when login in new devices a 2FA is required and an email is received with the 2FA token and explaining why they are receiving that.
This shouldn't happen if the user has any 2FA set up or if they are login in with SSO.

Additional notes

Maybe it'd be a good idea to refactor the TwoFactorProvider set up to be done in some other object like a factory or a static method (or extension method) that builds the provider given the type and some additional arguments. On what I did I just copied the Email KeyValuePair<TwoFactorProviderType, TwoFactorProvider> as I saw it was done on other parts just not to refactor the other parts and tackle that all at once with some planning beforehand given that it may break core stuff.

Before you submit

• I have checked for formatting errors (dotnet tool run dotnet-format --check) (required)
• If making database changes - I have also updated Entity Framework queries and/or migrations
• I have added unit tests where it makes sense to do so (encouraged but not required)
• This change requires a documentation update (notify the documentation team)
• This change has particular deployment requirements (notify the DevOps team)