Fix send_codes for alt auth methods

iam/authmethods/m_email_otp.py

@@ -833,7 +833,7 @@ def authenticate(self, auth_event, request):
         # if otp_field_code is not None then post_verify_fields_on_auth already
         # disabled the user code
         if otp_field_code is None:
-            disable_previous_user_codes(user)
+            disable_previous_user_codes(user, auth_event)
 
         if not constant_time_compare(req.get('code').upper(), code.code):
             msg += f"code mismatch for user `{user.userdata}`: [dbcode = `{code.code}`] != [requested code = `{req.get('code').upper()}`]\n"

iam/authmethods/m_sms_otp.py

@@ -820,7 +820,7 @@ def authenticate(self, auth_event, request):
         # if otp_field_code is not None then post_verify_fields_on_auth already
         # disabled the user code
         if otp_field_code is None:
-            disable_previous_user_codes(user)
+            disable_previous_user_codes(user, auth_event)
 
         if not constant_time_compare(req.get('code').upper(), code.code):
             msg += f"code mismatch for user `{user.userdata}`: [dbcode = `{code.code}`] != [requested code = `{req.get('code').upper()}`]\n"

iam/authmethods/utils.py

@@ -936,7 +936,10 @@ def get_user_code(user, timeout_seconds=None):
         .order_by('-created')\
         .first()
 
-def disable_previous_user_codes(user):
+def disable_previous_user_codes(user, auth_event):
+    # do not disable previous codes if using fixed codes
+    if auth_event.auth_method_config.get('config', {}).get('fixed-code', False):
+        return
     Code\
         .objects\
         .filter(
@@ -1140,7 +1143,7 @@ def post_verify_fields_on_auth(user, req, auth_event, mode="auth"):
 
     # disable the user code if any
     if otp_field_code is not None:
-        disable_previous_user_codes(user)
+        disable_previous_user_codes(user, auth_event)
 
     return otp_field_code
 
@@ -1435,7 +1438,13 @@ def ret_error(log_error_message, error_message, error_codename):
         args=[
             [user.id,],
             get_client_ip(request)
-        ]
+        ],
+        # since the auth_event might have been patched, we need to pass the
+        # potentially patched auth_method and config
+        kwargs={
+            "auth_method": auth_event.auth_method,
+            "config": auth_event.auth_method_config.get('config')
+        }
     )
     LOGGER.info(
         f"{logger_name}.resend_auth_code.\n"\

iam/utils.py

@@ -345,7 +345,7 @@ def verify_admin_generated_auth_code(
         )
         return False, None
 
-    disable_previous_user_codes(user)
+    disable_previous_user_codes(user, auth_event)
 
     if not constant_time_compare(req_data['code'], code.code):  
         LOGGER.error(