Logout users without 2FA when mandatory 2fa is enabled

Fixes #803

src/settings.js

@@ -138,8 +138,9 @@ const assert = require('assert'),
     paths = require('./paths.js'),
     safe = require('safetydance'),
     sysinfo = require('./sysinfo.js'),
+    tokens = require('./tokens.js'),
     translation = require('./translation.js'),
-    util = require('util'),
+    users = require('./users.js'),
     _ = require('underscore');
 
 const SETTINGS_FIELDS = [ 'name', 'value' ].join(',');
@@ -535,7 +536,18 @@ async function setDirectoryConfig(directoryConfig) {
 
     if (isDemo()) throw new BoxError(BoxError.BAD_FIELD, 'Not allowed in demo mode');
 
+    const oldConfig = await getDirectoryConfig();
     await set(exports.DIRECTORY_CONFIG_KEY, JSON.stringify(directoryConfig));
+
+    if (directoryConfig.mandatory2FA && !oldConfig.mandatory2FA) {
+        debug('setDirectoryConfig: logging out non-2FA users to enforce 2FA');
+
+        const allUsers = await users.list();
+        for (const user of allUsers) {
+            if (!user.twoFactorAuthenticationEnabled) await tokens.delByUserIdAndType(user.id, tokens.ID_WEBADMIN);
+        }
+    }
+
     notifyChange(exports.DIRECTORY_CONFIG_KEY, directoryConfig);
 }