From 0b6208a0f7cf14befad00b35ed21113ed46ea7fe Mon Sep 17 00:00:00 2001
From: Oleg Bulkin <o.bulkin@gmail.com>
Date: Wed, 19 Jul 2017 19:55:22 -0700
Subject: [PATCH] [9.0][FIX][IMP] Backport of auth_totp bug fixes and
 improvements from v10 PR (#898)

* [FIX] auth_totp: Permissions fix and other tweaks
* Slightly reword README
* Replace LasLabs logo with OCA one
* Overload _build_model in res.users model to add two MFA fields to the model
class's list of self-writeable fields, allowing these fields to be edited by
users without admin permissions for their own record
* Update view_users_form_simple_modif and the unit tests in the module based
on the self-writeable field change

* [IMP] auth_totp: Admin support
* Add MFA fields to normal res.users form view for admin access
* Update record rules to give admins read/unlink access to MFA authenticators

* [FIX] auth_totp: User deletion
* Add ondelete='cascade' to the res.users.authenticator.create wizard model to
properly support deletion of users who have just created an MFA authenticator

* [FIX] auth_totp: Website compatibility
* Add website compatibility by modifying the decorator on one of the routes and
updating the login_success request parameter as needed
---
 auth_totp/README.rst                          |   6 ++--
 auth_totp/controllers/main.py                 |  10 ++++++-
 auth_totp/models/res_users.py                 |  10 ++++++-
 .../res_users_authenticator_security.xml      |  17 +++++++++--
 auth_totp/static/description/icon.png         | Bin 10319 -> 9455 bytes
 auth_totp/tests/test_res_users.py             |   6 ++++
 auth_totp/views/res_users.xml                 |  28 ++++++++++++++----
 .../wizards/res_users_authenticator_create.py |   1 +
 8 files changed, 64 insertions(+), 14 deletions(-)

diff --git a/auth_totp/README.rst b/auth_totp/README.rst
index 85a18c141..1046cf8ee 100644
--- a/auth_totp/README.rst
+++ b/auth_totp/README.rst
@@ -2,9 +2,9 @@
    :target: http://www.gnu.org/licenses/lgpl.html
    :alt: License: LGPL-3
 
-===========
-MFA Support
-===========
+====================
+MFA Support via TOTP
+====================
 
 This module adds support for MFA using TOTP (time-based, one-time passwords). 
 It allows users to enable/disable MFA and manage authentication apps/devices 
diff --git a/auth_totp/controllers/main.py b/auth_totp/controllers/main.py
index 52638d6dd..2262469be 100644
--- a/auth_totp/controllers/main.py
+++ b/auth_totp/controllers/main.py
@@ -55,6 +55,7 @@ class AuthTotp(Home):
 
         user.generate_mfa_login_token()
         request.session.logout(keep_db=True)
+        request.params['login_success'] = False
         return http.local_redirect(
             '/auth_totp/login',
             query={
@@ -64,7 +65,13 @@ class AuthTotp(Home):
             keep_hash=True,
         )
 
-    @http.route('/auth_totp/login', type='http', auth='none', methods=['GET'])
+    @http.route(
+        '/auth_totp/login',
+        type='http',
+        auth='public',
+        methods=['GET'],
+        website=True,
+    )
     def mfa_login_get(self, *args, **kwargs):
         return request.render('auth_totp.mfa_login', qcontext=request.params)
 
@@ -127,6 +134,7 @@ class AuthTotp(Home):
                 temp_user.generate_mfa_login_token(60 * 24 * 30)
                 token = temp_user.mfa_login_token
         request.session.authenticate(request.db, user.login, token, user.id)
+        request.params['login_success'] = True
 
         redirect = request.params.get('redirect')
         if not redirect:
diff --git a/auth_totp/models/res_users.py b/auth_totp/models/res_users.py
index 91c9a05a7..1d413ae8e 100644
--- a/auth_totp/models/res_users.py
+++ b/auth_totp/models/res_users.py
@@ -13,6 +13,13 @@ from ..exceptions import MfaTokenInvalidError, MfaTokenExpiredError
 class ResUsers(models.Model):
     _inherit = 'res.users'
 
+    @classmethod
+    def _build_model(cls, pool, cr):
+        model = super(ResUsers, cls)._build_model(pool, cr)
+        ModelCls = type(model)
+        ModelCls.SELF_WRITEABLE_FIELDS += ['mfa_enabled', 'authenticator_ids']
+        return model
+
     mfa_enabled = fields.Boolean(string='MFA Enabled?')
     authenticator_ids = fields.One2many(
         comodel_name='res.users.authenticator',
@@ -20,7 +27,8 @@ class ResUsers(models.Model):
         string='Authentication Apps/Devices',
         help='To delete an authentication app, remove it from this list. To'
              ' add a new authentication app, please use the button to the'
-             ' right.',
+             ' right. If the button is not present, you do not have the'
+             ' permissions to do this.',
     )
     mfa_login_token = fields.Char()
     mfa_login_token_exp = fields.Datetime()
diff --git a/auth_totp/security/res_users_authenticator_security.xml b/auth_totp/security/res_users_authenticator_security.xml
index a96b9cc9a..5e9adc1fb 100644
--- a/auth_totp/security/res_users_authenticator_security.xml
+++ b/auth_totp/security/res_users_authenticator_security.xml
@@ -6,13 +6,24 @@
 -->
 
 <odoo>
-    <record id="auth_access_owners_only" model="ir.rule">
-        <field name="name">MFA Authenticators - Owner Only</field>
+    <record id="auth_access_owners" model="ir.rule">
+        <field name="name">MFA Authenticators - Owner Access</field>
         <field name="model_id" ref="model_res_users_authenticator"/>
         <field name="domain_force">[('user_id', '=?', user.id)]</field>
         <field name="perm_read" eval="True"/>
         <field name="perm_write" eval="True"/>
         <field name="perm_create" eval="True"/>
-        <field name="perm_unlink" eval="True"/> 
+        <field name="perm_unlink" eval="True"/>
+        <field name="groups" eval="[(4, ref('base.group_user'))]"/>
+    </record>
+
+    <record id="auth_access_admins" model="ir.rule">
+        <field name="name">MFA Authenticators - Admin Read/Unlink</field>
+        <field name="model_id" ref="model_res_users_authenticator"/>
+        <field name="perm_read" eval="True"/>
+        <field name="perm_write" eval="False"/>
+        <field name="perm_create" eval="False"/>
+        <field name="perm_unlink" eval="True"/>
+        <field name="groups" eval="[(4, ref('base.group_erp_manager'))]"/>
     </record>
 </odoo>
diff --git a/auth_totp/static/description/icon.png b/auth_totp/static/description/icon.png
index bb990930a39969c9e9bbd071819473f246a37aa2..3a0328b516c4980e8e44cdb63fd945757ddd132d 100644
GIT binary patch
literal 9455
zcmW++2RxMjAAjx~&dlBk9S+%}OXg)AGE&Cb*&}<C%<R2Kc9faym6aW`f0Dh5$js*d
z_}}Z!;XIG;_cPz`_vag-p{7Ve$Uq1H00~A(?iu(VaQlMefnU3&OozZXm@69d91cGG
z;O61r&je0NdamH#&)mKsXk?Zb_)B^>d0jUxM@u(PQx^-s)6<jB#=*|j%+$$(&(Xyy
zYgd8+09XKwoa}S2?48%%ZU#L~n^g{fE40h%YEx5by;GuJ(K|vI1uO;0m}=J7R4@Bs
z>97TX<v{QF=s?r`z`m$a0ZvrhBU7}{15RN9M`j!kv_Mp+3~{||YNuFzHNvhMYm3=Q
zo!q+OJ5(%-oNM^I^M%*luKMiVL`lo`bcKGymX7i3MIFWj1i|9+CGNvn`cu-RsK0Qh
zoYlwB>`ehR4?GS^qbkof1cslKgk<Uw6DeIxZyT_?=OwX|lwC*A?ac*gHF7jmS080$
z>U)h65qZ9Oc=ml_0temigYLJfnz{IDzUf>bGs4N!v3=Z3jMq&A#7%rM5eQ#dc?k~!
zVpnB`o+K7|Al`Q_U<UrcmRnh6jExs}l(hZs0%T~Dnpu-NENdhioRv(T{Qmv>;eD$B
zfJtP*jH`siUq~{KE)`jP2|#TUEFGRryE2`i0**z#*^6~AI|YzIWy$Cu#CSLW3q=GA
z6`?GZymC;dCPk~rBS%eCb`5OLr;RUZ;D`}um=H)BfVIq%7VhiMr)_#G0N#zrNH|__
zc+blN2UAB0=617@>_<D4$IPL<k1zq(*VmlDPer&h1n6`AG;9A!_W=N$JthhQWXZ<i
zGURc6f<i*joK3xSWaOOXxAc8ES>u;MPHN;P;N#YoE=)R#i$k_`UAA>WWCcEVMh~L_
zj--gtp&|K1#58Yz*AHCTMziU1Jzt_jG0I@qAOHsk$2}yTmVkBp_eHuY$A9)>P6o~I
z%aQ?!(GqeQ-Y+b0I(m9pwgi(IIZZzsbMv+9w{PFtd_<_(LA~0H(xz<Z(Qt1jC2cC|
z6WbMo9YgON{L#ZDl$sV4*<CP(>{=FhLB@(1&qHA5EJw1>>=%q2f&^X>IQ{!GJ4e9U
z&KlB)z(84HmNgm2hg2C0>WM{E(DdPr+EeU_N@57;PC2&DmGFW_9kP&%?X4}+xWi)(
z;)z%wI5>D4a*5XwD)P--sPkoY(a~WBw;E~AW`Yue4kFa^LM3X`8x|}ZUeMnqr}>kH
zG%WWW>3ml$Yez?i%)2pbKPI7?5o?hydokgQyZsNEr{a|mLdt;X2TX(#B1j35xPnPW
z*bMSSOauW>o;*=kO8ojw91VX!qoOQb)zHJ!odWB}d+*K?#sY_jqPdg{Sm2HdYzdEx
zOGVPhVRTGPtv0o}RfVP;Nd(|CB)<HrC1(%ZOEd8PI?r9b_$Cp-${bh59Z_R7n&YCp
zl8lfMpes*8{FVm;oJH@0LLoWmxD59u?JwHz2iRrAaE0`Hc&g;t5~$P*kdeOZn9OJ3
zRczo@ZkWU)RG+hcfH~{49Vvb3D(W0wRX#|$cA0Iqy^VR~(4hqA2AFI-rK!FM!#fJ_
zGFI@iqJOPXZ!=VjTS3dMuu~9xU3K1&?th;$)cqM#WGxbDEyB$y`#9j%>I;*t&QO8h
zFfekr30S!-LHmV_Su-W+rEwYXJ^;6&3|L$mMC8*bQptyOo9;>Qb9Q9`ySe3%V$A*9
zeKEe+b0{#KWGp$F+tga)0RtI)nhMa-K@JS}2krK~n8vJ=Ngm?R!9G<~RyuU0d?nz#
z-5EK$o(!F?hmX*2Yt6+coY`6jGbb7t<dboft~zeDZwK=+l2bFWs5^+|r{J6GO9Cwl
z&SW58BRs?XdFLuhtzl7WLbQ#~z#`jAB3AbSUg6jW6@qVd2Q~9qN(izT1y*>F#6nHA
zuKk=GGJ;ZwON1iAfG$E#Y7MnZVmrY|j0eVI(DN_MNFJmyZ|;w4tf@=CCDZ#5N_0K=
z$;R~bbk?}TpfDjfB&aiQ$VA}s?P}xPERJG{kxk5~R`iRS(SK5d+Xs9swCozZISbnS
zk!)I0>t=A<-^z(cmSFz3=jZ23u13X><0b)P)^1T_))Kr`e!-pb#q&J*Q`p+B6la%C
zuVl&0duN<;uOsB3%T9Fp8t{ED108<?)`y_~Hnd9AUX7h-H?jVuU|}My+C=TjH(jKz
zqMVr0re3S$H@t{zI95qa)+Crz*5Zj}Ao%4Z><+W(nOZd?gDnfNBC3>M8WE61$So|P
zVvqH0SNtDTcs<xiU1;=a39$d&&l5EwoIH1db#`S9Kw!YC1jhR)VbCWMptlUUkpfif
zMzi-i8)WL?|C$*Q?iqbS{w<lA9XN(rD)VS<zn>UdzaMDpT=Ty0pDHHNL@Z0w$Y`XO
z2M-_r1S+GaH%pz#Uy0*w$Vdl=X=rQXEzO}d6J^R6zjM1u&c9vYLvLp?W7w(?np9x1
zE_0JSAJCPB%i7p*Wvg)pn5T`8k3-uR?*NT|J`eS#_#54p>!p(mLDvmc-3o0mX*mp_
zN*AeS<>#^-{S%W<*mz^!X$w_2dHWpcJ6^j64qFBft-o}o_Vx80o0>}Du;>kLts;$8
zC`7q$QI(dKYG`Wa8#wl@V4jVWBRGQ@1dr-hstpQL)Tl+aqVpGpbSfN>5i&QMXfiZ>
zaA?T1VGe?rpQ@;+pkrVdd{klI&jVS@I5_iz!=UMpTsa~mBga?1r}a<Xwa$pLotZk<
zsykXwQO37I=aXew7x=}YWiW)^p)|C#g+)an!@j?EcY8C0t)BlK#y{YLtkJ6=D6H-5
zp2*ANf@>RBm1WS;TT*s0f0lY=JBl66Upy)-k4J}lh=P^8(SXk~0xW=T9v*B|gzIhN
z>qsO7dFd~mgxAy4V?&)=5ieYq?zi?ZEoj)&2o)RLy=<bK!vY7J*RP!&i_xU}i*o6o
z?xN*1<rEe1L2HBkCSgiYM3a|4w?Bo7CJL7?Eh;9An1m$1t?h1v92<Xg2(#)bjbL|o
zH_H0}!Og=1dOBynXHu>@hbCRcfT5ji<pmK_U*~T(A$I-*rM$8-BCv{=@=7F)2pdtU
z5==tp!}A*&Xgf{F>gwtQGE{L*8<@Yd{zg;CsL5mvzfDY}P-wos_6PfprFVaeqNE%h
zKZhLtcQld;ZD+>=nqN~>GvROfueSzJD&<KAVm#0W>BE*}XfU|H&(FssBqY=hPCt`d
zH?@s2>I(|;fcW&YM6#V<T#ysvE$@4oRO>#!kUIP8$Nkdh0A(bEVj``-AAyYgwY~jB
zT|I7Bf@%;7aL7Wf4dZ%VqF$eiaC38OV6oy3Z#TER2G+fOCd9Iaoy6aLYbPTN{XRPz
z;U!V|vBf%H!}52L2gH_+j;`bTcQRXB+y9onc^wLm5wi3-Be}U>k_u>2Eg$=k!(l@I
zcCg+flakT2Nej3i0yn+g+}%NYb?ta;R<sv-KjYb}UVFjITQ)VAEWu*)Lz7*-f^A*H
z<25#Ynt~-Qh?$wWx4$1=T2`j@bKp!)3IXh(LC@)%WGW$+j(tGz(6#bGw&K0j=Np@B
zt}@t$R`z(>?(g5SnwsQ49U8Wng8d|{B+lyRcEDvR3+`O{zfmrmvFrL6acVP%yG98X
zo&+VBg@px@i)%o?dG(`T;n*$S5*rnyiR#=wW}}GsAcfyQpE|>a{=$Hjg=-*_K;UtD
z<sX7(ZJc+Q;#xP8uk`jnF@a^|TWw*55if6@@}%7lOBaGo9Ia-e?`RPQc^w^EWfhe}
zHWHTvDA+r}Xf5Yqpr;QU-88%QC9F_>#z-)AXwSRY?<M%E84!g*1GC?E>OPefw^iI+
z)AXz#PfEjlwTes|_{sB?4(O@fg0AJ^g8gP}ex9Ucf*@_^J(s_5jJV}c)s$`Myn|Kd
z$<h)Fm>6>}#q^n{4vN@+Os$m7KV+`}c%4)4pv@06af4-x5#wj!KKb%caK{A&Y#Rfs
z-po?Dcb1({W=6FKIUirH&(yg=*6aLCekcKwyfK^JN5{wcA3nhO(o}SK#!CINhI`-I
z1)6&n7O&ZmyFMuNwvEic#IiOAwNkR=u5it{B9n2sAJV5pNhar=j5`*N!Na;c7g!l$
z3aYBqUkqqTJ=Re-;)s!EOeij=7SQZ3Hq}ZRds%IM*PtM$wV<GYik+VfZene%bm(n6
z`r@rc^TVw7EN{|O7rORMlw)zt(Z#enc3joE#IIk!M)L8gk^go9E9AxiP9o#OqmvV>
z@;rlc*NRK7i3y5BETSKuumEN`Xu_8<BQ)z0!-JuC8x}?$qo8SEko}oUWNI(4h*VHO
zAi!Egy!f(o9aHs2dhSE6ki(be*&w&+WLOB<(b3T_Hide(NvVvLQV{BN|2?UJFaY*@
z9CXA5B_*8i5Bf6sn~d`R>GP1Ri=OK<SGIb#BCTo3qI#UBUg+dkR+2ilUwIg%XFV;l
z+>Q$@I^ko8>H6)4rjiG5{VBM>B|%`&&s^)jS|-_95&yc=GqjNo{zFkw%%HHhS~e=s
zD#sfS+-?*t|J!+ozP6KvtOl!R)@@-z24}`9{QaVLD^9VCSR2b`b!KC#o;Ki<+wXB6
zx3&O0LOWcg4&rv4QG0)4yb}7BFSEg~=IR5<g6yi=XozU}zReXL{rA%c`$IQAs<ObZ
zep*ITZ0C(~W*`?XH^l1t7&+qigAfY9tVJ5DH!~jY>#ZRj8kg}dS7_V&^%#Do==#`u
zpy6{ox?jWuR(;pg+f@mT>#HGWHAJRRDDDv~@(IDw&R>9643kK<aUZ^OhBu;1e6t#{
zxKehVgz`HT;A`FMivG<tq0OcrXwHUX_<$j<uk%m>#HN`!1vBJHnC+RM&yIh8{gG2q
zA%e*U3|N0XSRa~oX-3EAneep)@{h2vvd3Xvy$7og(sayr@95+e6~Xvi1tUqnIxoIH
zVWo*OwYElb#uyW{Imam6f2<eMTQj#)z8+N&ZY?tSPo%&2eVNU=4=?rlO<*9Twaxco
zEVE=Jh?_x>rGbjR!Y3`#gPqkv57dB6K^wRGxc9B(t|aYDGS=m$&S!NmCtrMMaUg(c
zc2qC=2Z`EEFMW-me5B)24AqF*bV5Dr-M5ig(l-WPS%CgaPzs6p_gnCIvTJ=Y<6!gT
zVt@AfYCzjjsMEGi=rDQHo0yc;HqoRNnNFeWZgcm?f;cp(6CNylj36DoL(?TS7eU#+
z7&mfr#y))+CJOXQKUMZ7QIdS9@#-}7y2K1{8)cCt0~-X0O!O?Qx#E4Og+;A2SjalQ
zs7r?qn0H044=sDN$SRG$arw~n=+T_DNdSrarmu)V6@|?1-ZB#hRn`uilTGPJ@fqEy
zGt(f0B+^JDP&f=r{#Y_wi#AVDf-y!RIXU^0jXsFpf>=Ji*TeqSY!H~AMbJdCGLhC)
zn7Rx+sXw6uYj;WRYrLd^5IZq@6JI1C^YkgnedZEYy<&4(z%Q$5yv#B<pkvWZft^C&
z;+zNo+VJNluxaDF!`gW+F0=MxsCQ~~#CYKa;ULfj5hTa8a6;d*(<eeQ7-ZQgz2et^
zf|7URfj;x*#HiF0wuBCOTEpbeD&kkENqolCm2#cQGHCeEC<&I3j+P6?sX?BPp4~46
zx-S~EJ>oo{AH8n$<d4loB?vL3RqXwK_COrQ6xRoWGOdFnWy(hhzrG8k;2k}8Zj&>a
zhb4Y3PWdr269&?V%uI$xMcUrMzl=;w<_nm*qr=c3Rl@i5wWB;e-`t7D&c-mcQl7x!
zZWB`UGcw=Y2=}~wzrfLx=uet<;m3~=8I~ZRuzvMQUQdr+yTV|ATf1Uuomr__nDf=X
zZ3WYJtHp_ri(}SQAPjv+Y+0=<GD??Na(2AG`s>fH4krOP@S&=zZ-t1jW1o@}z;xk8
z(Nz1co&El^HK^NrhVHa-_;&88vTU>_J33=%{if;BEY*J#1n59=07jrGQ#IP>@u#3A
z;!q+E1Rj3ZJ+!4bq9F8PXJ@yMgZL;>&gYA0%_Kbi8?S=XGM~dnQZQ!yBSgcZhY96H
zrWnU;k)qy`rX&&xlDyA%(a1Hhi5CWkmg(`Gb%m(HKi-7Z!LKGRP_B8@`7&hdDy5n=
z`OIxqxiVfX@OX1p(mQu>0Ai*v_cTMiw4qRt3~N<X{IYiJ3k=4u-u*nJEBnJ<OdI8P
zXmK`OYkO5a{YDhI3PL|H4m=p>Bvr9oBy0)r>w3p~V0SCm=An6@3n)>@z!|o-$HvDK
z|3D2ZMJkLE5loMKl6R^ez@Zz%S$&mbeoqH5`Bb){Ei21q&VP)hWS2tjShfFtGE+$z
zzCR$P#uktu+#!w)cX!<osOkId_HzAT-HD2N`M+v2l+zwdW%GgZbQMuhfE*hHjKXKg
z45hphqVETPDbX6wpTlZqza0gFaRGh`3L~0id)F6#%@9;w(e%PjzuD7@inuToA!B?F
zCMLJc!u{3N)s?lB-!11!GxXsCak8zQomO)gmn02f-5~OkMYnm~#jVwwYNw@LAv!KN
z-n`q1|AXw*TW>lWN1XU%K-r=s{|j?)Akf@q#3b#{6cZCuJ~gCxuMXRmI$nGtnH+-h
z+GEi!*X=AP<|fG`1>MBdTb?28JYc=fGvAi2I<$B(rs$;eoJCyR6_bc~p!XR@O-+sD
z=eH`-ye})I5ic1eL~TDmtfJ|8`0VJ*Yr=hNCd)G1p2MMz4C3^Mj?7;!w|Ly%JqmuW
zlIEW^Ft%z?*|fpXda>Jr^1noFZEwFgVV%|*XhH@acv8rdGxeEX{M$(vG{Zw+x(ei@
zmfXb22}8-?Fi`vo-YVrTH*C?a8%M=Hv9MqVH7H^J$KsD?>!SFZ;ZsvnHr_gn=7acz
z#W?0eCdVhVMWN12VV^$>WlQ?f;P^{(&pYTops|btm6aj>_Uz+hqpGwB)vWp0Cf5y<
zft8-je~nn?W11plq}N)4A{l8I7$!ks_x$PXW-2XaRFswX_BnF{R#6YIwMhAgd5F9X
zGmwdadS6(a^fjHtXg8=l?Rc0Sm%hk6E9!5cLVloEy4eh(=FwgP`)~I^5~pBEWo+F6
zSf2ncyMurJN91#cJTy_u8Y}@%!bq1RkGC~-bV@SXRd4F{R-*V<h953|jk-C&|3)z%
ze&_30-6q1)a0(!xXqA+_t(WC`HA_yYaW@>`bS+6;W5vZ(&+I<9$;-V|eNfLa5n-6%
z2(}&uGRF;p9<Q%jdNy1%e7XTzyu7EEQT(5LrnvX~T%K!IuDyHY`ZneVJu#k_1T)xA
z*yxB?y4!pOJ$DTZzBm|8OIQq+AtV25aJ+X5EJjAu><tfuiNClI2BSoMgqLnU-5t95
zEnZ(^g~1RgD=UMB({c;$HujG&%DqGF;5jI~roRT+(rOoS$6f6SsURIuAVkAeIVc~{
z5ZxLN%m%Z*Sg;qYCf3<$dE6~&w_!EBx%yl4YC~LH{FCFNRBc_I>2eS*sE*o<YSPrx
z{M(reV{~jKue#Y6ZOnqJia{fQc!UxV4m)l389OmzR6A3|2!i<P{r82jKw+zq4%@ny
znopi6g!1Vx9Bml#a~KdL2lp2C)qSTKIh43vgycQHfQb_I!kQY&p;X@Bz|{^SXsW1K
zP&Ag1CW_r6u5-4=s(W>R$@pexaqr*meB)VhmIg@h{uzkk$9~qh#cHhw#>O%)b@+(|
z^IQgqzuj~Sk(J;swEM-3TrJAPCq9k^^^`q{IItKBRXYe}e0Tdr=Huf7da3$l4<V=<
zfr<*%iOB1EY}w3tF2Cwl7a2OS&~Y-lu<s)T^9=OFU8(CeN|63BiMxf*)5gesGU<eZ
z9DigzL3+quZ1o2T<KAZbCGJx&lrl*e#}Dpv24bZO$B<Yoc5hbeP0y?@P%|Tvw||e%
zV#e^q0D2R_Oq_c+=x5vP&hg4k+df{o7$aNZCM>PdpwWDop%^}n;dD#K4s#DYA8SHZ
z&1!riV4W4R7R#C))JH1~axJ)RYnM$$lIR%6fIVA@zV{XVyx}C+a-Dt8Y9M)^KU0+H
zR4IUb2CJ{Hg>CuaXtD50jB(_Tcx=Z$^W<wsNa}nUDpNk$q{>Yu2u5kubqmwp%drJ6
z?Fo40g!Qd<-l=TQxqHEOuPX0;^z7iX?Ke^a%XT<13TA^5`4Xcw6D@Ur&VT&CUe0d}
z1GjOVF1^L@>O)l@?bD~$wzgf(nxX1OGD8fEV?TdJcZc2KoUe|oP1#=$$7ee|xbY)A
zDZq+cuTpc(fFdj^=!;{k03C69lMQ(|>uhRfRu%+!k&<F<Z7l=VnwB^RA&^APMi=Tn
zNc}%IJL~xB4OP6bJNwAw)~Ma2=UP0dhr%X=kco(it+@F<#$xrIJ8@|{Buh<)h`xg?
z_U}pe=3#zmDfdqE4`Hyn<!?&CfCp#GTeXo8;AYd1Opd&cXER8cBSOF3iFJ#XPgQVp
zZSiQf7V^Dt?ITs8aMF~e1hq0P@^oB)#byh|6q_7F1B%ST%WL~J?ySn>YOi-3|1QKB
z<?_cUy)V3go%%^l)lRa=dmY_XQG3Z{Q?52d$qG}vIe|EZbYEtrR$rh(iS)O#dU-(>
z?n?eq1XP>p-IM$Z^C;2L3itnbJZAip*Zo0aw2bs8@(s^~*8T9go!%dHcAz2lM;`yp
zD=7&xjFV$S&5uDaiScyD?B-i1ze`+CoRtz`Wn+Zl&#<i<Zx(`=7k~{%`w&<EbG}U<
z0%E^8lyw>s4&}MO{@N!ufrzjG$B79)Y2d3tBk&)TxUTw@<TSeYlROCt(gU?O((-qu
zs>QS0TEL_?njX|<LXnSC4TlId(D4W|GQ?L@$3Ue@N8p=l9-sC<=z(lPk;^sT(v2*k
zc~vp#Hp`mXjzhml2NMCh^h5)sqsan+jJ_l<a4w|G&ac02hrz8#6|kFraA~rta0}!q
zB4BE{QWY7MtxHn_xB);Avf#Lf<GG<A?Q3JVyc1p8^H}$8(Gn=_&F1!m8$sKyeue+L
z5&392wm+wO;_oXoTEJ=wxVXk}dt<d~CgUUMW_PPTe(c<7n18#mVaX)vK}-PzZq7<b
zNJbVTFaq(8ZLx|A*G$H3ugT2aVziDEGa66FVt@hr1|D{RWN6yuqlglM!rp^YG;UpG
zrnm?ek079l3VoOU^p%f^A9Yzn8IVX?^rB4LbgJ|PONhzM_0{P?S(V$OI=u5IBjfT#
z0ntLLnhg5$0fAHJaG6HCx4X7;RmvMtE}8C>@vq?Uz(nBFK5Pq7*xj#u*R&i|?7+6#
z+|r_n#SW&LXhtheZdah{ZVoqwyT{D>MC3nkFF#N)xLi{p7J1jXlmVeb;cP5?e(=f#
zuT7fv<Q3o5LspCx-RPkzLw{VsDE>jSbjS781v?7{)-X3*?>tq?)Yd)~|1{BDS(pqC
zC}~H#WXlkUW*H5CDOo<)#x7%RY)A;ShGhI5s*#cRDA8YgqG(HeKDx+#(ZQ?386dv!
zlXCO)w91~Vw4AmOcATuV653fa9R$fyK8<JV*@W33SMHM;w!OmUXar{O;_8j>ul%rG
z-<zwGD)!Y{+(T{%ob~79zpXX%zulyiy1_UHWvu@YqxKAK3e9GO6Os4R0Naujn>wfS
zihugoZyr38Im?Zuh6@RcF~t1anQu7>#lPpb#}4cOA!EM11`%f*07RqOVkmX{p~KJ9
z^zP;K#|)$`^Rb{rnH<AdQ^(;gQMcF>GH{~>1(fawV0*Z#)}M`m8-?ZJV<+e}s9wE#
z)l&az?w^5{)`S(%MRzxdNqrs1n*-=jS^_jqE*5XDrA0+VE`5^*p3CuM<&dZEeCjoz
zR;uu_H9ZPZV|fQq`Cyw4nscrVwi!fE6ciMmX$!_hN7uF;jjKG)d2@aC4ropY)8<!P
zAOHj?oPbjQ%hh|vE_1IMB)43eQpeLi&)R>etW=xJvni)8eHi`H$%#zn^WJ<U7gogJ
z?A^!2J~rI78JH|Ml2EldmKY5K8;Zx(FGcBdM<5oe#G+nd6dObqz@Af%%M*aBE_pn8
zXQo2`Bw*IwvP3#1Ev<%YocpBodO9+Rw~`5*CY3{L;qf1PxV!r%NI+#Q1f8GU7$~#U
zAA9$4&g-k=8BYi*3i@0^UX}nTQVyOf)8T(}G^Ti?Vqvk~bJRR#EAQ?u`dClPxk@{;
zxvO?%jSX`2{8|^z0*C5DR1Z^>5NLc-rqk|u&&4Z6fD_m&JfSI1Bvb?b<*n&sfl0^t
z=HnmRl`XrFvMKB%9}>PaA`m-fK6a0(8=qPkWS5bb4=v?XcWi&hRY?O5HdulRi4?fN
zlsJ*N-0Qw+Yic@s0(2uy%F@ib;GjXt01F<S%GT3P{Ck&Y*^gWuie`o_g+ZNDNIV|F
z)zEe|Ij*4$H1(<RLz0($;AD3VsUJwI@liw^?fh(V?VC`Sz7h`*Q<VYlhbHJ?&h+!W
zAJC)U;Lx_QRaSNFYbyi|7+MeNTgA+Znh}qFzf>mx5XbRo6+n|pP(&nodMoap^z{~q
ziEeaUT@Mxe3vJSfI6?uLND(CNr=#^W<1b}jzW58bIfyWTDle$mmS(|x-0|2UlX+9k
zQ<WB5+u#`K#~J$81)#?BuTOKLk|+S>^EX7Nw}?EzVoBfT(-LT|=9N@^hcn-_p&sqG
z&*oVs2JSU+N4ZD`FhCAWaS;>|wH2G*Id|?pa#@>tyxX`+4HyIArWDvVrX)2WAOQff
z0qyHu&-S@i^MS-+j--!pr4fPBj~_8({~e1bfcl0wI1kaoN>mJL6KUPQm5N7lB(ui1
zE-o%kq)&djzWJ}ob<-GfDlkB;F31j-VHKvQUGQ3sp`CwyGJk_i!y^sD0fqC@$9|jO
zOqN!r!8-p==F@ZVP=U$qSpY(gQ0)59P1&t@y?5rvg<}E+GB}2<F#{*|k0E{$&_`~)
zkzDcsi#!7r<a8lPUCMj?{CK;e|9#-xj>6NYPp4f2YFQrQtot5mn3wu_qprZ=>Ig-$
zbW26Ws~IgY>}^5w`vTB(G`PTZaDiGBo5o(tp)qli|NeV(<Rzgqw(Ze!7hEGKKx((>
z@H_=R8V39rt5J5YB2Ky?4eJJ#b`_iBe2ot~6%7mLt5t8Vwi^Jy7|jWXqa3amOIoRb
zOr}WVFP--DsS`1WpN%~)t3R!arKF^Q$e12KEqU36AWwnCBICpH4XCsfnyrHr>$I$4
z!DpKX$OKLWarN7nv@!uIA+~RNO)l$$w}p(;b>mx8pwYvu;dD_unryX_N<mojSrG!`
zgkqx4t<XLL6ZUppvjeV9PJ6dG>hT8*Tj>BTrTTL&!?O+%Rv;b?B??gSzdp?6Uug9{
zd@V08Z$BdI?fpoCS$)t4mg4rT8Q_I}h`0d-vYZ^|dOB*Q^S|xqTV*<bTMtKO;_Z)R
zRSOJrd5TFO0aO%#%-sNa{`SiQ^$$1^@oUd&^lB{MKZ>vIg?@fVFSmMpaw0qtTRbx}
z({Pg?#{2`sc9)M5N$*N|4;^t$+Q<Wh^yJ?FzJ*$wiB{j;CMy+?m1MbsJo0ubR==f9
z>P?#mo<zt1E6=Ilm*nbmYmpxfAj7*m*Wh@=7|;!%(-pviW`nuCktLveet9^$*y^>v
zGVC@I*lBVrOU-%2y!7%)fAKjpEFsgQc4{amtiHb95KQEwvf<(3T<9-Zm$xIew#P22
zc2Ix|App^>v6(3L_MCU0d3W##AB<Fxl*nmny6_RsCu%1a)so}}uCXSzwY70Y@uTxK
z=5nu(N*2HDbrIcL)t_*{*84mvmV_Y9<vxHJJ;0gUdNjyW)jDb|@|j*qR8;gsMa5Ir
z02fHv=%xyN9VLv_ZLL4y|F*p$S^^T47m{aok5{rmM{$s7^Xu2!_fo1$IG6kkG_Tgx
zFfjPm3;g>0M~3D00EWoKZqsJYT(#@w$Y_H7G22M~ApVFTRHMI_3be)Lkn#0F*V8Pq
zc}`Cjy$bE;FJ6H7p=0y#R>`}-m4(0F>%@P|?7fx{=R^uFdISRnZ2W_xQhD{YuR3t<
z{6yxu=4~JkeA;|(J6_nv#>Nvs&FuLA&PW^he@t(UwFFE8)|a!R{`E`K`i^ZnyE4$k
z;(749Ix|oi$c3QbEJ3b~D_kQsPz~fIUKym($a_7dJ?o+40*OLl^{=&oq$<#Q(yyrp
z{J-FAniyAw9tPbe&IhQ|a`DqFTVQGQ&Gq3!C2==4x{6EJwiPZ8zub-iXoUtkJiG{}
zPaR&}_fn8_z~(=;5lD-aPWD3z8PZS@AaUiomF!G8I}Mf>e~0g#BelA-5#`cj;O5>N
Xviia!U7SGha1wx#SCgwmn*{w2TRX*I

literal 10319
zcmcI~c|6qZ*S|F)OEeVOLz$5lq=XWch_*4K#!?M#yQ$lnu@u=t$dV<cTgpsh8qwG#
zlPwg6Y`KkPvae%be%EK*-{<-MUeEXW^Xc`9nfYATb<TO8_j#XlO+{WYzaS(aCBVVK
zA!KsV=o$wH7aIKC!M_8162X|g1%B=O(-{5dbq|L>eQw{g=QxY?xMMGG;&$87{+j)5
ztRJr4{xk=N>a2;;*&Dvy6McBk1CE(LXJvKr1?TQ`y)jgVkvlL|BTaL&&X25iN=tuB
z&ukdJ_lh)Q)Aw0sgtmyQP5-PtJ#BMel%!MFkkV_Qu+!A$<lP7M0XyzibsV-!d_?XR
z!i<sB78BHTY28Ogb8{cGA5XK2`K#kwn_iYkUBdZRV!M=6#j2iOp9vT6_y6n<SxY@V
zI2Avuv1psFU-~t9Z@pJ#;E(D;ZSJZey#^Hy4p9g@L5?$aoE-9G4h|j(j^HXT_FH}g
z2S*4m`|bZ+RP}5b1`aNC<pNu75c=GE_&M5Rl?^$9qn_LCF7&?hkT<yMp)<FsEvG#B
z<y;MAC&ycvHDKh%H=gLXR*F0?W6gj$HHU}By-&!%iz{BXI}sdXwPFe!XJ}^Rh_n?L
z@Jmet5y^XI1Fguz@iuj*#MR?fTxaagvLfxpIj-m?^K-HfXh-bkx^h7U1Ohw$S@GU^
zGzUN8DGK~Z4}QztXb!!7TSDIUv==2H7`!@r@E=D{a3g^K2NA#lqZcTELkKT@M{)(%
z%f}N#!W>tQiX#*qL)nqcU$W)Aa_(Oy|M3}T+r_he`T+?J)?GQocKBNJa0nF}v>5xq
z#iYv|XN0==1UX*bQ9;)<fe=AtQ}A?-U@3|bKif=p2Y3Y`R?prl3$_NYeh`uP2MlXA
zL?4m?z|M951rc}$%*dhz{_*=VNY+DVC@0Q!=2P2nI4^$Y`fse;0qAd)#J4jmdcri+
zsG03eUK1S8dqxQ4WgF*t0MJ++k6_x}dKETBVz7}<-&!f~{0H<;M~McXI`)~1y$)Ak
zbn(CQ0RWYEPv(zI<7Ima0Rp1>SI7>*5VB+9jVgd|A!S^4-T#HrWQqejZO_Vp^B}!!
z+SEP24Uwt4tQE!4{uBfc(UTp-d$$<TV5$G?1H=huK#unKo!i`wNLMz@b_fv#yOSi7
zYq(wp{>#AI=i6+pP5{f}fB`m{|1F#U?tCC{o-2%(gDbjjtwA4bc#7YypEJFP-C|m%
zq1zVOWX=Glxdi_WWT>FnP!UDBp!$F;0+tr#e*^hZ_*b1!_t}Af&)9MXR~g=cen79d
z@DOUg0;YF3uNVloactAaA&~cs%=3ThYa1xAPad#7dkP+>2<43y0;&ca2Tr;G5C!EO
zOtn%x;BLv!3Ca&=>$gXNLkk-z$}WD0rSS#Zl>Gmx-~J!+E&A{Ex1Bldd}tk;-;k~_
z93cMutL%Zwuu(bz4`r86{vN1&woO0ESgqXZIL{Fgs%*#@IU=O=ymX^^NN#K9J4GD?
zWVca4*?B&OKnqjii|dx+z>$skwc-e>>oZq;XV2f_mY0P}jDLI?$9jz*B}>Nc$54zx
znLPQ45^#B1;IZYf8}(VJi2n=*vD>hGP;J7eu*H%yB6_C;?s(N$454x&l2Fw=3DUKI
z48y_DvOJ<_`48HXC?91Dj5Nwr@PaVu=PBqh{ruoqYzPjPYQxEo_>PihxqKOPwjZcF
ztNV!?2oPF2j*xWQL%W<SBK3>rnGJ>-`ePCY!~UUh`<q!zON#)GWe_Ka5^e$%7Dv2A
zVR)1II29cq8V|j33}q2@E3__Q!sdk!ms$geeg@cFHnG(kA6KFw?fiMKa3}LCJfxm-
z`$#=i;yLtpw)zfva<DT)O%%nUbvyEDot96`jFs)y;(3M|`859(aTWBHIBGYu>=6g+
zHgF(Kr_z7%>!2F-$9qn|4C635vBrP#gds-e*YEI?)ADDU(2AkdK{fI;>`YTC(DOID
z$S=ehW3}NY)&`>8cXF_RzQ@-l%?oq2$L*AeCoJ)gcl9qfTe8goj@iIoBz~n&bTAtH
z_&9;U65TO<#lutqvwV<>--N%5={3-12qpr~>#rz+7;t>#YN)6!8wO|4B&c+3a1xFF
zs)2omb2E=1BZ^Q3jsq{F-xey#-PT)bE+xdmnKB?n<jF9Y2L?Ysg>@{%!G10YyyOJ=
zJ&l7Qx=TQ^YCtZBLG(>_fQE%Vxc9sDr%4Zr;3TfbM;t=8AM)aA=m~6xL{ap6f9wd}
z@d4=A9kgOVU<4s)t1xpb6g<^@vQxrLo5Zzd!wJ2-nm)AdYz9oMnsaLc0_}<<wAG5E
znsxcVpHV>@xvw85GW!cplc)j+5fJL$`!+Gf`OPaG=s~p%AJ2N9eJ}kGyQ{GbwIk(R
zfMg`KJ?4=Ge>8GyCMp{$e%f#eWd@8_fh_!l^44Vkkai>e3L73C3A2k2)?TRW1-33K
z2YPmQ-5+gBY0cetiyJ&D12z`t{$i+k{yM7`Nm%IGTo_H5S=W!}<q}kRj%GUGScxY1
zvtVlyPAhTi*|$i9DEi2UiZO)XCN{w~9-sgA6iGl)5Y$X1bX3TYNqEq)Q4OabK1ps7
z1b1vs%48)98&dTUcc7yf2PKk{i9=$N%d_gZLU?=9P|UzJyIoN2U`q${<SA$DJ}>&6
zJq;z`37k|CPdD#gtMuv4fL3!)oz!00a}~q;2KD4PskO1E?}B6$<j>#ccLuj~mvs5=
zM1c%r#c;?v60;QY%9SQqasS8){fj}&==FQQ&Z@vrv^8kY_qPzz$LgtS5#ZgG5}%({
z`l#Jsfq!D>FkVXV{i@?HA)Bx3R8SWJr3Q0H${y8-q4a9&#jNDXsdrvae3!*x0R2DE
zkhe*F&eI0uc?5)7hyQ?2g|rKXcd=aYEA>(<^-_YRV}ddW>}X8)<SUE#S|s_m^u@n$
zNKxn@^Y<YZ8f9w_en15x<_DSHcwoOZM+C-c?Ryu3KTH0S*%(qI-`DkuAh^nB7+b=-
zg5pdh_z`b%$o?t3Erbh@8(vX_g~`l1fvgm0qvir~G)SW?R{{saFm*39G4h_OOa5{z
z7Uhv>8z_5Fk+Pns6l5K4p_L)#m^Hmu>j`1%-tFbn)7tf1Az{?0h<V{_OzPMlVJ4Oj
zwtO724gv3f7*(z$<rFyYL4^#T9g{_kj(72PG1Z|bN7k~Izm><Wtb8zaUO1$2Qj=RK
zlJF4tVcf=0!+Tpb>AQtHyfnelV~DnIY->LmNw{8YR5^n|D(+9aojWZn6ipaPA!r=V
zwGeEv`Vgn^q?$(%hZJgqr|n0bUG#bm=wpb9Y0I9L7m6jks4Fqu{y>Q|(c8SI2042Y
zN?`=y1Nrnp(i>%x!2Qw2waP;jyMwyLN~EH%&65o0Zbshvy`sUj`H5v=msC3i@NtMS
zjsEc~@+p2p1tdZgg#`4#X*EG!k}<xy!2K|49zY_B;1ow-%(*_;wxWiX-GgE{Ba5sn
zj;`&3GL9>BYSukSs-bu1UuApd7J2S?1RO_S(i$<6I3U~>Ozqwk?jQ<wd18|KHFQJ2
z6vO)qvlOq_gE$LuZ%~X&7#Rc7L)X&2+X-P+TsW<4<9=(LGAULXMQc<P4B=%sf230G
zmr})0K+|7|Tj?500G*<HCiBsfs8V{Qs1^(CQLl-iSgKTJW)JwR+ZR|W$_QMq_6x6Y
zto4y<0j9K0@kzjd7xOr}o_WWlZk9XSS`rQfu1qSDK+y<nV|gw={P?70Py@}IrVQtv
z!8~cJ0iGYW;#T~K)G?}n`%ItvpO~<EI*}@6iec?nHN`5B?feIUe5cEy?lYW;p#Buc
zwd2F89=?kvR4rV>L=wgZ^QdOn9~U7sPU&x>u?8i@dkVPd`BK3Qq@b2rl?||P3&JR`
zEZyBoFac5Gv|x+N%_pYcAV}HKfK`Sdd2fQx9oK9VVyHDx$0CWheDp5^4@6Ny_I~7$
zW}SeRJN~s5w=l;0P&B3z<*gn>gB`bQbneZ#ehMBbnf_StWzs*N8g-b|;L+k85H$O0
zI{m<PT@}Eg&->F}4K$wyN36PjqDBGzPDJoXF!Ig<5pGa4h0g4&6Ue0(8?!AIIx-gz
z&9zt5iJ`92kSz-PjUbPa9?5*Unv@#kGd2(o00=`2)H2L*Se8M_6^yYsie?X>1_V3Q
zMmV&%@TD=@MAnL-Rzg+7#<P&|#zXtxaN-I9qV)kwAB$(^$taAmBx<;`;G9lbjl%wj
zXFHPt83_B)&%PbMl!(B=>@mD5AU`$8%R1BYF58~!#d{^P@yZ_lzH3(udlf7t7ig-|
z_&c`wsHekcclbLTtrtTb{feCJ4*)_H5uVvggEi~c@e5C!hOhTdz)(ME$Q6of?NYRG
zpNmve&2zg*`2Mtz-5FlLtL|L0IlKo2MDS^*B@@nefnEdjNII5nj+FsE&5edIbWQ-}
zIs!bS?M2Z#RVh%(?kqT6_qgf(F6fM_HOQr&J%PNNK5V>VGC`|wa$HiEj3T^c<oWhs
zRwsXM^?ScK#NK)ISb25=1p8N{zLl$EA|jqfJ!$rcnq~=lmHpH&zYcpR%;dJ~j0sU;
zNx701{gfwR0Jk*DH>evUovXqF@(`uuK|Ka()kC~0qGw+|lk}qS9$6J+?*@*3pP!HI
zjN5e#P_>?YAVm%A6xnVk`efrH*9X{0!a+8>Ar8U>nKGE7eLu}x_KAYkX;6QG2xJI)
zmL53tPqw}ct_4Y0xpId)iK5zuepkmoQtjFGq|LgZWtTzj0~%O_tUv&_;4;-A0sw7-
z6Xg%_BknCts^G|OssLr!5YQ50K>A(3r;+EAsZqy3uS^QeS=(xBJ`Q{{#eCpg%kX(>
z;%{RM`~v_kUn($325g9gpZ9rv`3xdnnUwv6U<foZ#aQANR@DcmB?LCS?X~KjwZ<63
zP%fY{Sg+)M&SqXd`dJLsR#kyA8eY*0_Y?(v5()ZA8YqDp*cbI~o|?T@qcZF65DP*7
zLP$<QQh}p&Q-P%3@oH}HIk!G70i~*CXEsnSQ_PRXIr+kfZ9=lWy~-$i)UL)Z8Mgi|
zD+AocP^mUo<(O~c=~D)K-%+EKN&d-##uBeRQ+MF#H$a}%`;M+XnR#HhUCW&*GSvfF
zva527)7XRJ2(Tnto6~FIAsO>?tZzG}0W0nL)i~X(J3#ovP}ghc<XJJqa|GRrXu@v>
zm_9_&4CgUWKrs<SR&1g&NksxGcioCDhz4LowI81o81C>MN3E84elVO3afKy=58yGx
zHe-qMiJ`-!w69=AMvssF2E}`{Hw+@cSfJbFdT-d)M6Gu~?iU_Yj8+Uj|BsAK6OgsT
zK=iYSK^|;(gbM!<|8AtAX3Tyd(4}u>y9dIN{t?14P1b7CYY`Nxcr@XKNr$9G5T#BG
zl+ai5>5GGt4G=Q`HEr0))Axe%ZHLY|Mv9W8)UEm`x;Xpoc|~=O>T|MF@7~qp(Zbwv
zEuvp?=v)_Y5?UQTHkO~d=<oBm(PL$@pR(TL=)`RMGM!S+mZZvLy^@)%t>ygQKwdy)
zZ=i({ari~Sf&AakEeUI{^;0TzuCM+uct<}OYY~KKDop4wTRCBTGSxEQ-8Dq(Z=pWH
z<Tl;e3f=q(49>tMKk(Zn-?83K$1UrMF|QOYhH(Bi6}&uNE1H5b9Q$3ONhZ0iO0Eo8
z1RaihJ#pcL&`ZYf5b>jLRLcD5wdpwTL*zLfXV#_|S{gmNwPqWqO-@*R`iW)xOLn~(
zK57rAHICjAk&I6c@A>g*^Owhk^7XPHX4?)~RUqNJQ8c%s(Zqh80~Dw-^}Rb-?K*Pn
z?OCBm(i&~m-<Yb}YxrDp&^Eg6vEM83&s*iZTAD9;I!Z$5_pMfPwB-8THN0LU1V13Y
zSsF%c{E!ZG%--$oB4uR)RoWknJaUE&v)UsSyA!Cf5MYaq)S&9(re0S4;33nbm37rA
z;$H;|+Su0i6qWa9JtWcMyNImKOayf<^5?+%?_U@Cy;r6W$LO-f0*P^ihDYG1+C4##
zy2}i?z-d*3zMXF^kF|}3wwq+Wyi{`ioub1{7Z-<%{5y$he3mUNmUZWk^=7T;`~{~&
z<uku~`WIF&soH)Lw%V3ioNj~Sxb6PcS8M_ubX)V|%imbebx3Sh8i~rR@EQJa%mAUk
zgEz5C3_Yo^R7Hr>bP3P-%5CMF^J&tjVr9uv`$1`Wjz=-*WMH0-W+yG%%U%lopvYf&
zdgb?v=QD4MTVn?mvMrZloLMTD357)mc#^BS@7M|XW=$mJ1TcSd-_Bk0DIXS6vM7z(
z)^R4wa<$w|RS=ABP`ru*lC8}#8B)x#IE>swr=o(4l#Gt&W`!esVOK1Sb|ONwimTMD
zI}RVdIW^HkuTU=wV8K#EVo2$o&p{p{zap2`_NiF0eY>-}SyyM~V#oCQch%|x&f4#T
zXV!_{2^zD7t5b7)HL)O0Eq>w)`G)?AXZ=_EB~+}ZE9PS08`~N=C-+2wk`V(*Cr%6J
z2*B(=l_vMqu7ZA2;)cYvVVy%;vf^ki!sigWoH%^6K-9WR-<r8T>&Q%a1u4tUTI2~z
zYqaEM4#1lcWm3E)r>DQt0oT|SG~2Xbbe&)z1+Yo$t{UsI8D-)ZX8S8o__c24H$|}f
zicUH<lIY+`al|2YgEod#!yL_D3cOBVNzc{u8VQ#~L=b!j^Onntwpx5P$1>81K&PJ2
zm2|xi7~mTcUHN~8R_YDb*Ne1dNuqF|#}_-svpkHGp;c`S$D2Rywu8reja*NV%dC_q
zF`f_@_u`d-tPir<RI}Wbsw|bppO|Cy0vM4DwF;=2g(#Euwq;gNh$n0<Ep3v7IAO*e
zOB#O2xw=T*8e{+tkTsclCjcR0SSTCN`;GuGyaN=gZuJC6MI^lFTq>q-OGM7&T$Q&`
z2jKyvTcAn)I?UeoV1MB1K5Z`7#Bf7w`B;(_NF-aA!I9ZFyI$>^=oRi6`>aUuo)AUN
z(vTL|jjmA(F)OIuc?BI`3mqDe(FGw-)t&P4N&pQmny}vQ-10H8V^iAVL_LJQI^{I~
z-6zD_%(UKHQJ?`KF*zQM`p;dVA_IQ6RmV<lEwv}Q@$YrP>XEj`0A!s~<Goh^G1n{n
zgi?)O`*T$X6vx}IcNzhORUt)v!p0XKWN%l(d3C}M*ZEL+Rb)V5V4T~8vmY!_R~@8K
z-mc-kisO<>6U&E5Uu99eY^0TH=#7_2@<ny4n{eCs^*gn~IG8Oak`1&v$&4i5TIWxP
zKi-^GBB@A$c66z~Xv=nb4;1tdaTGHe9`W;B*S&$U13=n9HC|nY`aBdWf;3fz#+;SG
zu3=dSFhxZ`9S#I3hRUQ;T43!5Db-G1HY;-r%tao^WRfBw^L)oBlqLe0+po7${kx(s
zlU~NgCrvMJ)|Ifi46a*Oq0S@<*}r@hlj(nNE+(1=YwtR@a&KTprk_UV0d)N7T6_fv
zAebp|FclO-KuV!UbsYA{J3tb(y9RmopGWrhc$?<FzsvnAo;A0d-ET!vdhskj2p8o2
z!3N>U@27#WeBYJ2#xVB1qD(!SXaIw3YavJz--Tn6Clgt7(Vf;n*~BB^|7;xNk>-|~
z`h1%5SPx9wmo>pR6i`sBwRE#NFC1?h%nF$Fnx(lU3(}B#poz?rKfHwv`Is~+E&`rf
zQFp3P-0Dj#NE84a8hRj`^dlf2XRtzRN+5P{YGz$p9}p``2~@#ofoZ^+Vk{x$a0Fc5
zZ|2!`e-%K0JgS;@>!sCx*eA=7B*gxcd)@g3N87IUSEC0TUh{^;hMSMt0?&8T==Z1w
z_`U{(rCct8v{j=b{IG%P;FxeC+%EV?{px1pB>+Agr%X1Icuk{sYKWn#JiB)Hx7DrE
zK-DEt#n6h;R~ci%INm4n0O%YIX-|GWaHr!*uFKXSjnH7^4|OHK?awt^gL`UHl^AfX
zc+e2X>)LzH56d#A)X<B*A`=i%@DOE64eSUkp4AGj0;D2cl8w*r+EN;Oi$Ln*x>Lpb
ztr*U_gAMO5+eH#n2gin<4{2!hDwBd6PW#S{-FpSt#bt_(ga=1q8^a_kTqk$;gX<{p
z&lJPysztF(5!`-Dn8kUmg+YNVUg)ULtn(iVl>t}3ozPs$k@tkS76s;`?msZrhoB(9
zH-3+l;9w#)&KWkuX;m{zbYlp5?s~wKu`J5=K_rz+Wv>;e0^@om)eL#k`DlXiCn<I?
zRVA|Dk_An{9Z8wwoUQfVc6n1(|Ni0ArdbZXyBcs_*Q8K{I0@Inh7-w_OO|byZsI>>
zTh1baOqaqcmaOrWGmW`)AFHL;;Q<qAE$`@Rc!Bp77VqYNOrD+Ao$0@|(RuTIM_N{b
z<r4muOJLN^bAcJF`99w(PyXKE!(T4XFY-5_tQU%u{TlF??qB>;Q9GRffi5)z|4Zw4
zO5@wgJKf{Iy58f@joy7+_I_*5``D08exK~}bK=Uf_k+KJa;bm&b|TCAXO>1Qr@WU0
zdTKYMdR&T7rE4n-74NM}et9pg{GG3Wxj>j^F(%))cE(%l&-gcFd5pT$8x$pNng8Cf
z`B>VymAW=<(OkBok#J#aJ(ZePP4#aYMl~^)I`8L1r&N=NS`6mv?Ezfb-kLFlo`QOM
z?AfIrE>k<G%YLX5Xpxgv949zoWpq_YQnDzgD`9KHjjg$zi^lY-()`m!?q+vgvH+{V
zJrOMta3CF12pXCgnhRc1C9vi9jeAMeLLE$_&RDc{VlCZaDh1V=JKp*|ZMo?AD%j?S
zv7X5u8W6WY-_JcrW^X;pYpGrD|M%7b$3WH_&P3w72*Q!~#lX3o9bf6nqXp&MQ_){K
z{cmlSA<Ftm3x@)FCxYX;G9PzDf%CwG+;g~26~%3M7K%Wbd`FNt)9+e5Gm?G@92H3j
z(<CJ)J~kN~TV3da;cdr-M%x$%<DUfvP(^}F^;bY2PVBy5YIhlj^-@7Gm215x(9##S
z;eg@n!nO<+LqJa)``JQ6mJd36*zTQd%(b|10%twHvd7iC6{ye~O$w!+zQR<F%kVW^
zj5gl(V@v|wH(ZUN#6}YQztRg$9J2`3Nlv>ayBJ>0L-Ahq2b6%(+gKP5CQN&}aSaR=
zAO*y<9hM(3zF*Z{mcaD?qm~{JXnTwQI)Sz@*A<ZMb(7-VpBD%pZ5uek8WVY2QIGbm
zEI4r-)<d+7zwQ$DDE>`+;rE(40bJo86_l`|fTocSV@;&F($fx_RtNJ^kHH$^*3&1`
zonshj3#ZN*S>F_R4^M1XkR6#D-?ipztxL+Ey&9+)e!;SptW@E{7z>O2F06TsGG(eX
zE}1j93~ra!@kI07<hFx(iUHNE$(BL&`dnm6@>FepeePXQqDX1fnk|A9tO6>%zT6K>
zKTWE}w>0mlMb0F*Hlj#AJ{e!H5!Uw<Sp;sC>5d|{U{T!9RQ#}EpZbmr^~2cO@npZ1
z##AO2C~);q-UntQ9uU|%nK%_#@a+8e*7NyFq1TtG0amzI(@mwTHvQL2L@LefA`v)V
za(!J%z6NxiZ{Ym%i)B6{>snGS{y5%4q^Ce9tl6yMemSIv0(SS~SqaTRz@nN04h80&
z^7-4pXR`6pCLWZ9_CAz`D5~nlg^qG3tlqt9Fbj#T2>&ivA(+B!m;wEZ6R6Ek-axww
zN2w)RF@(FS5%4qE4S6$)`A-EB<H#p-em6~$A#rlDbh&Y3Iz>Y~)=OGfxI;w=-Z6-k
z$ut>s9^kG2!Vq{VZgpINa`<91l{GT-LnJ@wrVLI?+dz7DgJf}T?Dtdjc%{fMd`9NT
zm&F$r9R|Mdfa~0h28vyqj9#-Xe!z{dqx9iI?A>B|RN(Um?loD2!I)LYT2}Nkf1?h(
zpyUC^sV(QZx8ZR#QB<@OdU7#y-^$Ww|4K>8wp{7+Cyy>rrwVv2&nXhXV3CHQD@C}E
zKfo)G>cyHa;yi-d##3^AOV!;vVL@~EqmQ2pye$${Vx9fo2_QH0M3W+`Cl5Nw&rD6m
zn!2h>%2I<t^Z;`)YF*?T&1>`br38Uw72b|#MjhNa)O+{p-P&SadY9rq(w$}Y&V315
z=tJ35xZbCY=XF|p|9P>>O=nDhv8!dN_U6|32J>3_l1zjGrTW15$P3U7?iTbeU1&N;
z+W&E4DXlSIKyE9iwFQm7)a#QmFBHp)Qwl-O*ZEfsITth}=7^ey^VPJ@6?)+3uck-c
z-kezqa=b!}Ss>4g1g+lR2ntD=cJ+>=Og<rAPgomitGhV{<~pe?QG=Du8^@*jiMKlo
zGi*Aiu&mG@1E(}hc9?xwjm6tPRHk%96DqTMOFYdN|2UgSASGeFiYJRU8-HyT!Bbon
z@60Tos2~O0vOe)mpUkvPnts}#k@5yRd3DJ;-Cv|RBcnI{LdWY^8FAEL;j{27I=`8i
z(V=hYk;I(!11&T;c>d)b8sZft3v+Iugk(;T+^tee>XEqc8^4~H^1m4tsTdS7OaFuD
zV?FzL)2Zvb`~z?=v=$~SmY7R<cHL-97Hq3K^%}aPxs_@#Ltvrzx!t{bLbJl)b1BR(
zucUWOOaz+P{tZa0b($olQ>>QEte($GvawyME8Y5o_FnM({0qV_bnJ&$J}R97>(>i%
zD%Y9wOvmBM(gqI~Uu<SpM)9Af;7d#AU528tT2cu@D0}>Tz(W6#6UkhJh<AE4_)4)z
zbk7_ExA;R0-L~IKD+^;k`)rfzrjysA-_6m}g(!XRCS9IAPrAH3@b@>5>zuA3ZPu}9
zn#9wv9=fExP$ZF#r>I2{`kXN8B{{5yr7r?K!<6;x@wQykPoDTjd}FA`AuhN<!x{^J
zR9k|Ja6TTHSdY{Xan3!l*fDS*%Mi~f@i|<KJhM@@<%UYmz0IAX+`sZUu4RcAHOV#c
zs#V`APWD~~0*7?#S6vB25BQ}X%X#%NX%cCplA%7?<Aop9_wC0C8{Ry*cHW~vlQNPQ
zK}3*7T1;Yx9m73_4Ze4sAk)VJl?qZW_0ug0OSgLc3KurtAJE<D9Ec0_BTR3YcJ|@#
zyA;z`8kf$j`bWG=(wi>5X~gMLHi?(Z^iZ92<?3(`$A9j=KdSNKh+C@Lr=HAy`}gbd
z0XgCGg^BBKD{G-!e@f1*+8nOja-Mu<>*14MGT-uSGjnl_@^`=A-<v~EdfctVtr&U!
zPCSqfrx@0047I)W?4c4DNYUf!3c|~&o<W+OJ{yi6xI@?MwA3kvn7)j!$Rfl~=NMgb
zb&O`Oyh!de%tqh;3*WCn9g8!{zx*e|9oqWs3r45YL~V~dO-?ifp_(r%lB+9Osjo#2
zI3|N}&dmiIHi))vm9v7?-tu(vFJJq*Qn-^?rv#5CSTl()HXYWu;Jq)u9J(Q_n)&qR
z%Akl%0YjJ1tO3~>@KW4%axuVh4wel!tLQH1*@qrjA%nV3;_EOA>__XXSn7~}zfi~Y
z|N3j`>Z8(6)b)epGzlwXj7-nfZl-f|2(0>0Ibs4U8_O-0?L2&3uA<pU;B69|6xbi2
zyJnrHe!?Lxz^v_$io7ZTi#R+$>05r^sTuHvoO6#7eEn5W-}%Mo4RY$f_<sC^5#y4b
z@qQ}>Qbh>?4gSqm8r|q*7Up~EX>I$Qqrsd_Z4{T(_~q#mckTX47yS)&znj{#&W;)$
zI^={q#YbX@n{8te1h<{<MK7QhM0gXLm9~;s@51}1)p~OuKZ>wv^{MpNj3eL^SN(Y`
zL*wa@1g2`O`OhDpJlb*GE{6p3JeMD7=4}qWp1wuN;XL(gIo8FY$IrL$oNr-)?np6<
z3x4o|r7gyOZC4J?9`>@N?$TYIVwJ9Lr7PzqY)+B}t-*v~WEnw7w^>*Z$Rc!*s{|Ba
zv8rD3p>(GHCZ|C!NBYc~$AcD(6k4IIdegczp}DbOxT;}WAbg-P-{52QEb;KZ*>jc&
z&99`~_cE1uc`Yw1!qYK1IM%#p27#XW1C`L+%<R&?9<&-Ma=7arM-P(~<jXSCHT%>(
z>8ToYv-J3A8XOFHQbDd^xpSj09`?+Ax6Wh4hjS5L#V38Gf4i*VZ}XGs{4VpOyXhmf
zUUYKBOua~#qkueD<r?2~#ulH!DxtVd_*eM>(o5NRtp|PimEO(C|7ZW%?SDTw`0?@<
a*DemdjFG_u<xC}Lp^34%5y{Z*;r|1(OhNkq

diff --git a/auth_totp/tests/test_res_users.py b/auth_totp/tests/test_res_users.py
index a0b030593..b6098eb68 100644
--- a/auth_totp/tests/test_res_users.py
+++ b/auth_totp/tests/test_res_users.py
@@ -27,6 +27,12 @@ class TestResUsers(TransactionCase):
         self.test_user.authenticator_ids = False
         self.env.uid = self.test_user.id
 
+    def test_build_model_mfa_fields_in_self_writeable_list(self):
+        '''Should add MFA fields to list of fields users can modify for self'''
+        ResUsersClass = type(self.test_user)
+        self.assertIn('mfa_enabled', ResUsersClass.SELF_WRITEABLE_FIELDS)
+        self.assertIn('authenticator_ids', ResUsersClass.SELF_WRITEABLE_FIELDS)
+
     def test_check_enabled_with_authenticator_mfa_no_auth(self):
         '''Should raise correct error if MFA enabled without authenticators'''
         with self.assertRaisesRegexp(ValidationError, 'locked out'):
diff --git a/auth_totp/views/res_users.xml b/auth_totp/views/res_users.xml
index c4aa01518..6a584c4f0 100644
--- a/auth_totp/views/res_users.xml
+++ b/auth_totp/views/res_users.xml
@@ -6,6 +6,23 @@
 -->
 
 <odoo>
+    <record id="view_users_form" model="ir.ui.view">
+        <field name="name">User Form - MFA Settings</field>
+        <field name="model">res.users</field>
+        <field name="inherit_id" ref="base.view_users_form"/>
+        <field name="arch" type="xml">
+            <xpath expr="//group[@name='messaging']" position="after">
+                <group string="MFA Settings" name="mfa_settings" col="8">
+                    <p colspan="8">Note: Please have user add at least one authentication app/device before enabling MFA.</p>
+                    <label for="mfa_enabled" colspan="3"/>
+                    <field name="mfa_enabled" colspan="5" nolabel="1"/>
+                    <label for="authenticator_ids" colspan="3"/>
+                    <field name="authenticator_ids" widget="many2many_tags" options="{'no_create': True}" domain="[('user_id', '=', id)]" colspan="5" nolabel="1"/>
+                </group>
+            </xpath>
+        </field>
+    </record>
+
     <record id="view_users_form_simple_modif" model="ir.ui.view">
         <field name="name">Change My Preferences - MFA Settings</field>
         <field name="model">res.users</field>
@@ -13,12 +30,11 @@
         <field name="arch" type="xml">
             <xpath expr="//footer" position="before">
                 <group string="MFA Settings" name="mfa_settings" col="8">
-                    <div colspan="8" class="oe_mb8">
-                        <span>Note: Please add at least one authentication app/device before enabling MFA.</span>
-                    </div>
-                    <field name="mfa_enabled"/>
-                    <newline/>
-                    <field name="authenticator_ids" widget="many2many_tags" options="{'no_create': True}" colspan="7"/>
+                    <p colspan="8">Note: Please add at least one authentication app/device before enabling MFA.</p>
+                    <label for="mfa_enabled" colspan="3"/>
+                    <field name="mfa_enabled" readonly="0" colspan="5" nolabel="1"/>
+                    <label for="authenticator_ids" colspan="3"/>
+                    <field name="authenticator_ids" widget="many2many_tags" options="{'no_create': True}" colspan="4" readonly="0" nolabel="1"/>
                     <button string="Add New App/Device" type="action" name="%(res_users_authenticator_create_action)d" colspan="1"/>
                 </group>
             </xpath>
diff --git a/auth_totp/wizards/res_users_authenticator_create.py b/auth_totp/wizards/res_users_authenticator_create.py
index 48b7fcab2..e7c1203c3 100644
--- a/auth_totp/wizards/res_users_authenticator_create.py
+++ b/auth_totp/wizards/res_users_authenticator_create.py
@@ -47,6 +47,7 @@ class ResUsersAuthenticatorCreate(models.TransientModel):
              ' will be tied to',
         readonly=True,
         index=True,
+        ondelete='cascade',
     )
     confirmation_code = fields.Char(
         string='Confirmation Code',