Add TWO_FACTOR_ENABLED global kill-switch to MFA gate

MFAGateService::requiresChallenge() had no master on/off switch,
contradicting the SDS idp-mfa.md §10.1 rollout plan, which requires
being able to instantly revert to password-only login without a code
rollback if something goes wrong post-deploy.

config/two_factor.php gains an 'enabled' key (env TWO_FACTOR_ENABLED,
default true) checked first in requiresChallenge(), short-circuiting
before any per-user or device-trust evaluation.

Author: smarcet

.gitignore

@@ -52,4 +52,6 @@ model.sql
 /.phpunit.cache/
 docker-compose/mysql/model/*.sql
 public/assets/*.map
-public/assets/css/*.map
+public/assets/css/*.map
+.codegraph
+docs/plans

app/Services/Auth/MFAGateService.php

@@ -30,6 +30,9 @@ public function __construct(
 
     public function requiresChallenge(User $user, ?string $cookieToken): bool
     {
+        if (!config('two_factor.enabled', true)) {
+            return false;
+        }
         if (!$user->shouldRequire2FA()) {
             return false;
         }

config/two_factor.php

@@ -15,6 +15,18 @@
 use App\libs\Auth\Models\IGroupSlugs;
 
 return [
+    /*
+    |--------------------------------------------------------------------------
+    | Global Kill-Switch
+    |--------------------------------------------------------------------------
+    |
+    | Master switch for the whole 2FA gate (SDS idp-mfa.md §10.1 rollout plan).
+    | Defaults on; set TWO_FACTOR_ENABLED=false in a specific environment to
+    | instantly revert to password-only login with no code rollback needed.
+    |
+    */
+    'enabled' => env('TWO_FACTOR_ENABLED', true),
+
     /*
     |--------------------------------------------------------------------------
     | Enforced Groups

tests/Unit/MFAGateServiceTest.php

@@ -18,6 +18,7 @@
 use App\Services\Auth\IDeviceTrustService;
 use App\Services\Auth\MFAGateService;
 use Auth\User;
+use Illuminate\Support\Facades\Config;
 use Mockery;
 use Tests\TestCase;
 use Mockery\MockInterface;
@@ -110,4 +111,20 @@ public function testRequiresChallengePassesThroughEmptyStringCookieToDeviceTrust
 
         $this->assertTrue($this->service->requiresChallenge($user, ''));
     }
+
+    // -------------------------------------------------------------------------
+    // Global kill-switch (SDS idp-mfa.md §10.1): TWO_FACTOR_ENABLED=false must
+    // short-circuit the gate before any per-user or device-trust evaluation.
+    // -------------------------------------------------------------------------
+
+    public function testRequiresChallengeReturnsFalseWhenTwoFactorGloballyDisabled(): void
+    {
+        Config::set('two_factor.enabled', false);
+
+        $user = Mockery::mock(User::class);
+        $user->shouldNotReceive('shouldRequire2FA');
+        $this->deviceTrustService->shouldNotReceive('isDeviceTrusted');
+
+        $this->assertFalse($this->service->requiresChallenge($user, null));
+    }
 }