Block ROPC when email OTP FF enabled and user's email_otp_required_after attribute is in the past
What does this MR do and why?
This MR takes the great work @nmalcolm started and pulls out just the blocking logic that applies to blocking ROPC when using username and password when the :email_based_mfa feature flag is set and the user's email_otp_required_after attribute is in the past.
References
MR acceptance checklist
Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
Edited by Ash McKenzie