Require 2FA to accept an org invite (#14485)

Co-authored-by: Mike Fiedler <[email protected]>

Author: ristomcgehee

warehouse/locale/messages.pot

@@ -1345,14 +1345,14 @@ msgid ""
 msgstr ""
 
 #: warehouse/templates/accounts/invite-confirmation.html:32
-#: warehouse/templates/accounts/organization-invite-confirmation.html:32
+#: warehouse/templates/accounts/organization-invite-confirmation.html:40
 #: warehouse/templates/manage/organizations.html:42
 #: warehouse/templates/manage/projects.html:52
 msgid "Accept"
 msgstr ""
 
 #: warehouse/templates/accounts/invite-confirmation.html:33
-#: warehouse/templates/accounts/organization-invite-confirmation.html:33
+#: warehouse/templates/accounts/organization-invite-confirmation.html:41
 #: warehouse/templates/manage/organizations.html:46
 #: warehouse/templates/manage/organizations.html:54
 #: warehouse/templates/manage/projects.html:53
@@ -1402,13 +1402,20 @@ msgstr ""
 msgid "Confirm Organization Invite"
 msgstr ""
 
-#: warehouse/templates/accounts/organization-invite-confirmation.html:26
+#: warehouse/templates/accounts/organization-invite-confirmation.html:34
 #, python-format
 msgid ""
 "Would you like to accept this invitation to join '%(organization_name)s' "
 "as an organization %(role_name)s?"
 msgstr ""
 
+#: warehouse/templates/accounts/organization-invite-confirmation.html:45
+#, python-format
+msgid ""
+"You must first enable <a href=\"%(href)s\">two-factor authentication</a> "
+"on your account before accepting an invitation to join an organization."
+msgstr ""
+
 #: warehouse/templates/accounts/profile.html:16
 #, python-format
 msgid "Profile of %(username)s"

warehouse/templates/accounts/organization-invite-confirmation.html

@@ -17,8 +17,16 @@
     {% trans %}Confirm Organization Invite{% endtrans %}
 {% endblock %}
 
-{% block main %}
+{% block prompt %}
+  {% if request.user.has_two_factor %}
+    {{ super() }}
+  {% else %}
+    <!-- Content hidden -->
+  {% endif %}
+{% endblock %}
 
+{% block main %}
+{% if request.user.has_two_factor %}
 <form method="POST">
   <div class="form-group">
     <input name="csrf_token" type="hidden" value="{{ request.session.get_csrf_token() }}">
@@ -33,5 +41,10 @@
     <input name="decline" type="submit" value="{% trans %}Decline{% endtrans %}" class="button">
   </div>
 </form>
+{% else %}{# user has not enabled 2FA #}
+{% trans href=request.route_path('manage.account.two-factor') %}
+You must first enable <a href="{{ href }}">two-factor authentication</a> on your account before accepting an invitation to join an organization.
+{% endtrans %}
+{% endif %}
 
 {% endblock %}