Disabling 2FA does not work with a backup token about django-allauth-2fa HOT 2 CLOSED

The use of has_valid_totp_device doesn't seem to check staticdevice_set, so that's likely what's wrong.

I actually see very few uses of this at all in the code -- does logging in via backup tokens still work?!

from django-allauth-2fa.

Logging in via backup tokens works. The difference is that for logging in this form is used -- reusing logic from django-otp:

from django_otp.forms import OTPAuthenticationFormMixin
class TOTPAuthenticateForm(OTPAuthenticationFormMixin, forms.Form)

For removal, there is only this logic:

class TOTPDeviceRemoveForm(forms.Form):
    def clean_token(self):
        for device in self.user.totpdevice_set.filter(confirmed=True):
            if device.verify_token(token):
                return token

from django-allauth-2fa.