Boss and tunnel-manager roles are always required to use 2FA
Shipped 2026-06-09
Extended the mandatory-2FA (requireTwoFa) rule so the boss account
(role_id 11) and tunnel managers (role_id 12) are always required to enable
two-factor authentication, independent of instructor currency.
Those roles are not required to hold instructor currency, so the previous gate
(currency_instructor = 1) meant they were never prompted to enable 2FA —
two of the most privileged account types on the platform were the least likely
to have it.
Instructor roles (8 / 9 / 10) are unchanged: still required only while they hold instructor currency, so former staff who become regular flyers are correctly exempt.
- Jira: [ticket?]
- PR: #686
- Author: @alexhobday
Last updated on