UHF-9514: Documentation

modules/helfi_tfa/README.md

@@ -8,6 +8,20 @@ Provides default configuration for TFA module.
 2. Add a new secret called `TFA-ENCRYPTION-KEY` to Azure KeyVault and copy the key as value
 3. Enable `helfi_tfa` module
 
+## Exclude roles
+
+Go to Configuration -> TFA Settings (`/admin/config/people/tfa`) and uncheck the role from `Roles required to set up TFA` and save the form.
+
+Alternatively, you can override the roles setting in `all.settings.php`:
+```php
+$config['tfa.settings']['required_roles'] = [
+  'content_producer' => 'content_producer',
+  'admin' => 'admin',
+  'read_only' => '0',
+];
+```
+Setting the value to `0` means the role does not require TFA.
+
 ## Testing on local
 
 Modify `local.settings.php` file and add:

modules/helfi_tfa/helfi_tfa.install

@@ -37,7 +37,7 @@ function helfi_tfa_requirements($phase) : array {
  */
 function helfi_tfa_grant_permissions() : void {
   $roles = Role::loadMultiple();
-  $permissions = $requiredRoles = [];
+  $permissions = [];
 
   // Require all roles to setup TFA.
   foreach ($roles as $role) {
@@ -48,26 +48,9 @@ function helfi_tfa_grant_permissions() : void {
       'setup own tfa',
       'disable own tfa',
     ];
-    $requiredRoles[$role->id()] = $role->id();
   }
 
-  $bypassRoles = [
-    AccountInterface::AUTHENTICATED_ROLE,
-    'read_only',
-  ];
-
-  // Allow read only and authenticated roles to bypass TFA.
-  foreach ($bypassRoles as $rid) {
-    if (!isset($requiredRoles[$rid])) {
-      continue;
-    }
-    $requiredRoles[$rid] = '0';
-  }
   helfi_platform_config_grant_permissions($permissions);
-
-  $config = \Drupal::configFactory()->getEditable('tfa.settings');
-  $config->set('required_roles', $requiredRoles)
-    ->save();
 }
 
 /**
@@ -79,6 +62,24 @@ function helfi_tfa_install($is_syncing) : void {
   if ($is_syncing) {
     return;
   }
+  $roles = Role::loadMultiple();
+  $requiredRoles = [];
+
+  $bypassRoles = [
+    AccountInterface::ANONYMOUS_ROLE,
+    AccountInterface::AUTHENTICATED_ROLE,
+    'read_only',
+  ];
+  // Require all roles except 'read_only' to setup TFA.
+  foreach ($roles as $role) {
+    if (in_array($role->id(), $bypassRoles)) {
+      continue;
+    }
+    $requiredRoles[$role->id()] = $role->id();
+  }
+  $config = \Drupal::configFactory()->getEditable('tfa.settings');
+  $config->set('required_roles', $requiredRoles)
+    ->save();
 
   helfi_tfa_grant_permissions();
 }