Log 2FA activities

[iandunn]

It'd be good to log Stream or MC events when:

• A 2FA provider is enabled/disabled - including the user who changed it (b/c it could be a super admin)
• A backup code is used
• The recovery process is used (details TBD)
• Anything else?

That way we have an audit trail to help if an account is compromised, and have stats around how often recovery is needed, etc.

Related WordPress/two-factor#462, WordPress/two-factor#476

It may be best to add something like do_action( 'two_factor_log', $event ) upstream, and that could be used for those issues above and for this issue. Having a centralized action would let this plugin automatically log new events that are added upstream, but we still conditionally ignore them if we wanted to.

[pkevan]

Anything else?

Depending on if we allow it or not:

• when backup codes are regenerated
• when a user runs out of unused backup codes since they are prompted to regenerate via an admin notice

I also wonder if we want to log the password reset due to 2FA failure, as per: WordPress/two-factor#482

[iandunn]

Yeah, those are good ideas 👍🏻

[dd32]

I think this would make sense to Contribute upstream to Stream, so I've opened xwp/stream#1386

[pkevan]

A lot of the potential logging hooks would move with the introduction of WordPress/two-factor#504, so probably worth waiting until that is merged before attempting to add in any new hooks.

[iandunn]

@pkevan 504 has merged now 👍🏻

[tellyworth]

Decision needed: is this a blocker for launching the MVP, or should we punt it to the next iteration?

[iandunn]

I think we can punt to clearly indicate that it's not a blocker for the MVP. If it merges before we launch, though, then we can definitely include it.