sherpadvisorylab stops MFA from locking out the wrong people

Multi-factor authentication is supposed to add a second lock to your account, not bar you from the building. But sherpadvisorylab found a gap: users who started setting up MFA and never finished could get wrongly blocked at the door, with no way back in. The cause was the login check treating a half-finished setup as if it were a real, verified second factor.

The fix is narrow and sensible. The system now confirms a user actually has a working second factor before demanding one. People who genuinely enrolled still get the full two-factor challenge; people who never completed it simply log in as normal instead of being locked out. Worth noting the team flagged a small trade-off in speed and error handling for anyone importing the change.