Add ability to require 2FA for specific roles (including Everybody) (#37701)

app/models/user.rb

@@ -226,7 +226,11 @@ class User < ApplicationRecord
   end
 
   def functional_or_moved?
-    confirmed? && approved? && !disabled? && !account.unavailable? && !account.memorial?
+    confirmed? && approved? && !disabled? && !account.unavailable? && !account.memorial? && !missing_2fa?
+  end
+
+  def missing_2fa?
+    !two_factor_enabled? && role.require_2fa?
   end
 
   def unconfirmed_or_pending?

app/models/user_role.rb

@@ -5,11 +5,12 @@
 # Table name: user_roles
 #
 #  id          :bigint(8)        not null, primary key
-#  name        :string           default(""), not null
 #  color       :string           default(""), not null
-#  position    :integer          default(0), not null
-#  permissions :bigint(8)        default(0), not null
 #  highlighted :boolean          default(FALSE), not null
+#  name        :string           default(""), not null
+#  permissions :bigint(8)        default(0), not null
+#  position    :integer          default(0), not null
+#  require_2fa :boolean          default(FALSE), not null
 #  created_at  :datetime         not null
 #  updated_at  :datetime         not null
 #
@@ -160,7 +161,7 @@ class UserRole < ApplicationRecord
     @computed_permissions ||= begin
       permissions = self.class.everyone.permissions | self.permissions
 
-      if permissions & FLAGS[:administrator] == FLAGS[:administrator]
+      if administrator?
         Flags::ALL
       else
         permissions
@@ -172,6 +173,10 @@ class UserRole < ApplicationRecord
     name
   end
 
+  def administrator?
+    permissions & FLAGS[:administrator] == FLAGS[:administrator]
+  end
+
   private
 
   def in_permissions?(privilege)
@@ -189,6 +194,7 @@ class UserRole < ApplicationRecord
 
     errors.add(:permissions_as_keys, :own_role) if permissions_changed?
     errors.add(:position, :own_role) if position_changed?
+    errors.add(:require_2fa, :own_role) if require_2fa_changed? && !administrator?
   end
 
   def validate_permissions_elevation