[6.x] Skip two factor setup enforcement while impersonating

src/Http/Middleware/RedirectIfTwoFactorSetupIncomplete.php

@@ -17,6 +17,7 @@ public function handle(Request $request, Closure $next)
             && ($user = User::fromUser($request->user()))
             && $user->isTwoFactorAuthenticationRequired()
             && ! $user->hasEnabledTwoFactorAuthentication()
+            && ! session()->has('statamic_impersonated_by')
             && ! $this->isSetupUrl($request)
         ) {
             if (empty($user->two_factor_secret)) {

tests/Feature/Users/TwoFactorRoutesTest.php

@@ -67,6 +67,24 @@ public function cp_two_factor_setup_middleware_redirects_when_two_factor_is_enfo
             ->assertSessionHas('url.intended', cp_route('dashboard'));
     }
 
+    #[Test]
+    public function cp_two_factor_setup_middleware_does_not_redirect_when_impersonating()
+    {
+        config()->set('statamic.users.two_factor_enforced_roles', ['*']);
+
+        $impersonator = tap(User::make()->makeSuper()->email('impersonator@domain.com'))->save();
+        $user = tap(User::make()->makeSuper()->email('admin@domain.com'))->save();
+
+        $this
+            ->actingAs($user)
+            ->withSession(['statamic_impersonated_by' => $impersonator->id()])
+            ->get(cp_route('dashboard'))
+            ->assertOk();
+
+        $this->assertNull($user->fresh()->two_factor_secret);
+        $this->assertNull($user->fresh()->two_factor_recovery_codes);
+    }
+
     #[Test]
     #[DefineEnvironment('disableTwoFactor')]
     public function cp_two_factor_setup_middleware_does_not_redirect_when_two_factor_is_disabled()
@@ -148,6 +166,24 @@ public function frontend_two_factor_setup_middleware_does_not_regenerate_existin
         $this->assertEquals($existing, $user->fresh()->two_factor_secret);
     }
 
+    #[Test]
+    public function frontend_two_factor_setup_middleware_does_not_redirect_when_impersonating()
+    {
+        config()->set('statamic.users.two_factor_enforced_roles', ['*']);
+
+        $impersonator = tap(User::make()->makeSuper()->email('impersonator@domain.com'))->save();
+        $user = tap(User::make()->makeSuper()->email('admin@domain.com'))->save();
+
+        $this
+            ->actingAs($user)
+            ->withSession(['statamic_impersonated_by' => $impersonator->id()])
+            ->get('/test-frontend-route')
+            ->assertOk();
+
+        $this->assertNull($user->fresh()->two_factor_secret);
+        $this->assertNull($user->fresh()->two_factor_recovery_codes);
+    }
+
     #[Test]
     public function frontend_two_factor_setup_middleware_redirects_to_configured_url()
     {