Fix unauthorized url access

[renintw]

Fixes #188

This PR tidies up the code a bit for readability and DRYness and then makes sure users can't access the BackupCodes component via the URL bar when 2fa isn't enabled yet.

Screencast

Sandbox

fix.unauthorized.url.access.mov

[StevenDufresne]

I'm generally in favor of moving these up the component chain or abstracting them into a shared state/context. I prefer that to how we currently reference them in the components, especially since they are provided by a third party plugin. Changing them in one place is better in my opinion and would provide a better api for graceful error handling. We are also not consistently checking for whether an object is defined:

wporg-two-factor/settings/src/components/revalidate-modal.js

Line 49 in cae02ef

record[ '2fa_revalidation' ].expires_at = new Date().getTime() / 1000 + 3600;

With that being said, I do find it hard to follow which changes were need to fix the originating issue. Thoughts?

[iandunn]

I also find it harder to review PRs that do unrelated things, or get too big. What do you think about splitting those clean-up commits into a different PR?

I like the idea of pulling all the {provider}Enabled, hasPrimaryProvider, etc things into the Context object 👍🏻

[renintw]

Thanks for pointing it out. I've split the DRYness commits into a separate PR, only related stuff is left in this one.

I like the idea of pulling all the {provider}Enabled, hasPrimaryProvider, etc things into the Context object 👍🏻

IMHO, we might want to avoid using Context in this case as we're not dealing with prop drilling - passing data down through many levels of components, and also not dealing with passing down to many components. Overusing Context sometimes might make the code hard to maintain.

[renintw]

It has been rebased to trunk, and is ready for review again.

[adamwoodnz]

I actually had a go at doing just this recently and my approach was to reuse the internals of the clickScreenLink function, as this is almost exactly that. I created a branch which changed that to a basic navigation handler: https://github.com/WordPress/wporg-two-factor/compare/fix/unauthorized-backup-codes?expand=1

Events are handled at the component level and then navigateToScreen is called.

See what you think.

[renintw]

I like the enhancement 👍 Thanks for it.
I've cherry-picked the commits from your branch and tested the behavior on a sandbox, things worked as expected to me. Do you mind taking another look and reviewing again? Thanks.

[iandunn]

#200 introduced dd26ab3, so 26760b8 no longer needs to modify refreshRecord(), it can just update the callers.

[renintw]

#200 introduced dd26ab3, so 26760b8 no longer needs to modify refreshRecord(), it can just update the callers.

Thanks 👍 The code had been updated and so had the commit message. See f8abd29.

[adamwoodnz]

This works for me 👍

A couple of comments inline though