Matt Molyneaux

Unless I am missing something, the permission class is on the view. As long as `OTPMiddleware` comes after whatever middleware is creating `request.user` it should Just Work™

Making `PhoneDevice` pluggable like `User` is probably the wrong way to go as you'd have to do it for every other type of device too. Based on your previous issue,...

Good catch! I'll do a quick review later once Travis has finished

Related #299

By the looks of https://github.com/w3c/webauthn/issues/1255 it seems the JS is not optional, so that's a huge :-1: from me. Not enough for me to reject this PR out of hand,...

It's on my todo list!

I have no preference on what testing framework you use, whatever you're already familiar with is probably best.

I'd like to wait for #425 to be merged before reviewing any more PRs

@jpaniagualaconich not sure I like bumping the minimum required version of Python to 3.8 just yet. 3.7 will still be receiving updates until June 2023: https://endoflife.date/python

@claudep I'll do a review, but I wouldn't mind a second pair of eyes to take a look.