Two-step verification errors

Causes and remedies for the error codes of two-step verification set-up and of restricted sessions.

`error.mfa_required`

Text in the console: Two-step verification is required before this works. Complete the verification and try again.
Meaning for API clients: The session is restricted until multi-factor authentication completes.
Code: FAILED_PRECONDITION, HTTP 412

Argument	What it holds
`reason`	why the session is restricted, here `mfa_required`.

Cause. The account must set up two-step verification before the session can do anything else. Until then, the session is restricted and the API answers with this code for every operation except the ones that set up verification.

Remedy.

Set up two-step verification: Set up two-step verification. With the CLI, kyvernon auth totp enrol prints the secret, and kyvernon auth totp confirm <code> confirms it with a code from the authenticator app.
Store the recovery codes that appear after the confirmation in a safe place. They are shown once.
Repeat the operation.

`error.mfa.already_enrolled`

Text in the console: Two-step verification is already set up for this account.
Meaning for API clients: TOTP is already set up.
Code: FAILED_PRECONDITION, HTTP 412

Cause. Two-step verification is already set up for the account, or a set-up that is in progress was confirmed already.

Remedy.

Keep using the authenticator app that you set up.
To start again, an administrator removes the enrolment first: kyvernon users reset-mfa <username>. The user then sets up verification again.
To get new recovery codes, run kyvernon auth totp recovery-codes <code>. The old codes stop working.

`error.mfa.not_enrolled`

Text in the console: Two-step verification is not set up for this account.
Meaning for API clients: TOTP is not set up.
Code: FAILED_PRECONDITION, HTTP 412

Cause. The operation needs two-step verification, for example creating new recovery codes, and the account has none set up.

Remedy.

Set up two-step verification first: Set up two-step verification, or kyvernon auth totp enrol.
Repeat the operation after the confirmation.

`error.mfa.not_enrolling`

Text in the console: No two-step verification set-up is in progress. Start the set-up again.
Meaning for API clients: No TOTP enrolment is pending.
Code: FAILED_PRECONDITION, HTTP 412

Cause. A code was sent to confirm the set-up, but no set-up is in progress for the account. The set-up was never started or was reset.

Remedy.

Start the set-up again: kyvernon auth totp enrol. In the console, use Set up two-step verification.
Confirm it with a current code: kyvernon auth totp confirm <code>.