import {Command} from '@heroku-cli/command'
import * as Heroku from '@heroku-cli/schema'
import ux from 'cli-ux'

export default class Auth2faGenerate extends Command {
  static description = 'disables 2fa on account'

  static aliases = [
    'twofactor:disable',
    '2fa:disable',
  ]

  static example = `$ heroku auth:2fa:disable
Disabling 2fa on me@example.com... done`

  async run() {
    ux.action.start('Disabling 2fa')
    const {body: account} = await this.heroku.get<Heroku.Account>('/account'), {
        headers: {
          Accept: 'application/vnd.heroku+json; version=3.with_vaas_info',
        }
    }
    ux.action.start(`Disabling 2fa on ${account.email}`)
    if (account.vaas_enrolled) this.error('Cannot disable 2fa via CLI\nPlease visit your Account page on the Heroku Dashboad to manage 2fa')
    if (!account.two_factor_authentication) this.error('2fa is already disabled')
    const password = await ux.prompt('Password', {type: 'hide'})
    await this.heroku.patch('/account', {body: {password, two_factor_authentication: false}})
  }
}

import {Command} from '@heroku-cli/command'
import * as Heroku from '@heroku-cli/schema'
import ux from 'cli-ux'

export default class Auth2faGenerate extends Command {
  static description = 'disables 2fa on account'

  static aliases = [
    'twofactor:disable',
    '2fa:disable',
  ]

  static example = `$ heroku auth:2fa:disable
Disabling 2fa on me@example.com... done`

  async run() {
    ux.action.start('Disabling 2fa')
    const {body: account} = await this.heroku.get<Heroku.Account>('/account')
    ux.action.start(`Disabling 2fa on ${account.email}`)
    if (!account.two_factor_authentication) this.error('2fa is already disabled')
    const password = await ux.prompt('Password', {type: 'hide'})
    await this.heroku.patch('/account', {body: {password, two_factor_authentication: false}})
  }
}

--- 
+++ 
@@ -15,8 +15,13 @@
 
   async run() {
     ux.action.start('Disabling 2fa')
-    const {body: account} = await this.heroku.get<Heroku.Account>('/account')
+    const {body: account} = await this.heroku.get<Heroku.Account>('/account'), {
+        headers: {
+          Accept: 'application/vnd.heroku+json; version=3.with_vaas_info',
+        }
+    }
     ux.action.start(`Disabling 2fa on ${account.email}`)
+    if (account.vaas_enrolled) this.error('Cannot disable 2fa via CLI\nPlease visit your Account page on the Heroku Dashboad to manage 2fa')
     if (!account.two_factor_authentication) this.error('2fa is already disabled')
     const password = await ux.prompt('Password', {type: 'hide'})
     await this.heroku.patch('/account', {body: {password, two_factor_authentication: false}})
Add helpful error message for VaaS MFA users

* Soon, we will roll out a beta where users can have MFA/2FA for their
  Heroku Accounts using VaaS (verification as a service), a Salesforce
  platform that all clouds are adopting.
* In the next few months, we will migrate all existing Heroku 2FA users
  over to VaaS. The login experience will still be very similar for
these users, but they will be verifying themselves via the VaaS redirect
interface rather than on the Heroku home-grown 2FA flow.
* Users who are migrated over may not even know it, so they may attempt
  to disable MFA via CLI. While technically we could do some trickery
with the VaaS Admin API to make this possible, the intent of VaaS is
that users go into the VaaS manage page, which is accessible via the
Heroku Dashboard, to do all verifier management.
* This CLI command is used very rarely but we figure it doesn't hurt to
  add a helpful error message here rather than confusingly telling users
with VaaS MFA enabled that they do not have 2FA enabled (because they
do...it's just a *different* 2FA).
* https://gus.my.salesforce.com/a07B0000008TzijIAC
