Matthew Schinckel

Pretty sure that they work: you just need to wrap the reference in an expression of some sort: you can't just use `ComputedField(F('foo__bar'))`

Lookups over M2M fields are a bit harder: you have possibly multiple records that you are referring to, so I'm not sure how that would work. I guess you could...

...but that might limit it to postgres.

I think maybe ManyToMany may be non-trivial. Requiring the user to use an Array constructer on a subquery might work though.

Ah, that's a ComputedField of an aggregate. I'll try to come up with a mechanism: it's possible a Subquery could work.

Ah, it looks to be doing an `.aggregate()` like call, when it should be an `.annotate()`.

When you do a `Phone.objects.get(pk=pk)`, it will give you the correct answer. But that's because there's only one.

I'm not sure this one will be easy to fix: we'd need to make the fields not in concrete_fields, which may cause other problems.

Allowing a user to disable 2FA when not verified means 2FA can always be bypassed.

Ah, it's because I'm using a "verify only when required, not on login" workflow. In that case, this view does not require verification, and so a user can disable 2FA...