ENH Disable temporary sudo mode after login

behat.yml

@@ -15,6 +15,8 @@ default:
         - SilverStripe\Framework\Tests\Behaviour\CmsUiContext
         - SilverStripe\BehatExtension\Context\BasicContext
         - SilverStripe\BehatExtension\Context\EmailContext
+        - SilverStripe\BehatExtension\Context\FixtureContext:
+            - '%paths.modules.mfa%/tests/Behat/features/files/'
         - SilverStripe\MFA\Tests\Behat\Context\LoginContext
         - SilverStripe\CMS\Tests\Behaviour\ThemeContext
   extensions:

client/src/boot/cms/index.js

@@ -1,10 +1,8 @@
 /* global window */
 import registerComponents from './registerComponents';
 import registerReducers from './registerReducers';
-import registerTransformations from './registerTransformations';
 
 window.document.addEventListener('DOMContentLoaded', () => {
   registerComponents();
   registerReducers();
-  registerTransformations();
 });

src/Authenticator/LoginHandler.php

@@ -26,6 +26,7 @@
 use SilverStripe\Security\MemberAuthenticator\LoginHandler as BaseLoginHandler;
 use SilverStripe\Security\MemberAuthenticator\MemberLoginForm;
 use SilverStripe\Security\Security;
+use SilverStripe\Core\ClassInfo;
 
 class LoginHandler extends BaseLoginHandler
 {
@@ -576,6 +577,13 @@ public function jsonResponse(array $response, int $code = 200): HTTPResponse
      */
     protected function doPerformLogin(HTTPRequest $request, Member $member)
     {
+        // Deactivate sudo mode that was activated in doLogin()
+        $service = $this->getSudoModeService();
+        // Check if the service has a deactivate method, because it is not defined on the interface
+        if (ClassInfo::hasMethod($service, 'deactivate')) {
+            call_user_func([$service, 'deactivate'], $this->getRequest()->getSession());
+        }
+
         // Load the previously stored data from session and perform the login using it...
         $data = $request->getSession()->get(static::SESSION_KEY . '.additionalData') ?: [];
 

tests/Behat/features/mfa-enabled.feature

@@ -4,7 +4,8 @@ Feature: MFA is enabled for the site
   So that my site will be more secure
 
   Background:
-    Given I am logged in with "ADMIN" permissions
+    Given I add an extension "SilverStripe\BehatExtension\Extensions\ActivateSudoModeServiceExtension" to the "SilverStripe\Security\SudoMode\SudoModeService" class
+    And I am logged in with "ADMIN" permissions
     And I go to "/admin"
     Then I should see the CMS