Since tfa_basic_tfa_ready_require() shows a message when it returns TRUE, altering the value returned from that hook is not sufficient. It would not make sense to show Login disallowed. You are required to set up two-factor authentication. Please contact a site administrator. when the login is allowed.
To avoid Drupal core invokes tfa_basic_tfa_ready_require(), it is necessary to implement hook_module_implements_alter().
function custom_tfa_module_implements_alter(&$implementations, $hook) {
if ($hook == 'tfa_ready_require') {
unset($implementations['tfa_basic']);
}
}
Then, the module can implement its own hook_tfa_ready_require().
function custom_tfa_tfa_ready_require($account) {
return FALSE;
}
As a side note, custom_tfa_tfa_basic_tfa_ready_require_alter() would eventually be an alter hook implemented by the custom_tfa module for the hook_tfa_basic_tfa_ready_require() hook implementations. Leaving out the fact alter hooks get different parameters, hook_tfa_basic_tfa_ready_require() is not the hook implemented from tfa_basic_tfa_ready_require().
As a further note, alter hooks are invoked when the module that uses them calls drupal_alter(). Usually, for hook_HOOK_TYPE(), hook_HOOK_TYPE_alter() is invoked too; that is not always the case, though. In the cases where hook_HOOK_TYPE() is invoked, but hook_HOOK_TYPE_alter() is not invoked, implementing hook_module_implements_alter() is the solution, although it requires to duplicate code from the other module and to keep the new hook implementation updated each time the other module's hook is updated.
