[SD-375] bypass tfa during pass reset use prlp

[MdNadimHossain]

Jira

https://digital-vic.atlassian.net/browse/SD-375
https://digital-vic.atlassian.net/browse/SD-421

Problem/Motivation

The password reset workflow in our SDP projects, managed by the PRLP module, is being deprioritized due to a route subscriber defined in the TFA module. This conflict is disrupting the current password reset process for SDP projects.

Fix

1. Override the TFA method and introduce a new route subscriber so that the password reset workflow is correctly handled by the PRLP module.
2. If the PRLP module is not enabled, fall back to the default password reset functionality provided by the TFA module.
3. By default, disable TFA for users with the previewer and secure_file_user roles.

Related PRs

Screenshots

TODO

[anthony-malkoun]

Why does this still have circleCI builds in it? Should the project be disconnected from Circle? Also, I don't think the failing GHA items ever worked?

[vincent-gao]

hey @MdNadimHossain
thanks for the changes

1. If possible, please use Dependency Injection to inject prlpController instead of directly instantiating it. This approach enhances modularity and testability.
2. $request ? $request->getSession()->set('pass_reset_' . $uid, $token) : $_SESSION['pass_reset_' . $uid] = $token; can be simplified to $request->getSession()->set('pass_reset_' . $uid, $token);. This change aligns with Drupal’s session handling practices, ensuring session consistency and better compatibility with symfony's request stack
3. If convenient, please replace $request = \Drupal::request() with $this->requestStack->getCurrentRequest(). Using the injected RequestStack service follows Drupal’s dependency injection practices and improves maintainability

[vincent-gao]

My comments don’t prevent this PR from being moved to testing.

[MdNadimHossain]

• $request ? $request->getSession()->set('pass_reset_' . $uid, $token) : $_SESSION['pass_reset_' . $uid] = $token; can be simplified to $request->getSession()->set('pass_reset_' . $uid, $token);. This change aligns with Drupal’s session handling practices, ensuring session consistency and better compatibility with symfony's request stack
• If convenient, please replace $request = \Drupal::request() with $this->requestStack->getCurrentRequest(). Using the injected RequestStack service follows Drupal’s dependency injection practices and improves maintainability

hi @vincent-gao
yup agree, dependency injection would have been the right approach. The problem here is, prlp module does not have any service defined for the PrlpController and that is why I have to instantiate it here. I could have added a service in the tfa custom module referring to the PrlpController class, but tfa really shouldn't have a dependency on that module, so avoiding adding unnecessary dependency.

I have added the other two changes you have requested. Please have a look now. thanks :)

[MdNadimHossain]

Why does this still have circleCI builds in it? Should the project be disconnected from Circle? Also, I don't think the failing GHA items ever worked?

@anthony-malkoun yes and needs to be cleaned up and also from the submodules. I will do it in a separate PR.

[vincent-gao]

lint! @MdNadimHossain 😃

[anthony-malkoun]

This looks fine to me. Thanks for cleaning up the other stuff.

[sharmasahil]

Review changes approved.