use new py package

backend/Pipfile

@@ -7,7 +7,7 @@ name = "pypi"
 # Before adding a new package, check it's not listed under [packages] at
 #   https://github.com/ocadotechnology/codeforlife-package-python/blob/{ref}/Pipfile
 # Replace "{ref}" in the above URL with the ref set below.
-codeforlife = {ref = "v0.13.8", git = "https://github.com/ocadotechnology/codeforlife-package-python.git"}
+codeforlife = {ref = "v0.13.9", git = "https://github.com/ocadotechnology/codeforlife-package-python.git"}
 # TODO: check if we need the below packages
 whitenoise = "==6.5.0"
 django-pipeline = "==2.0.8"
@@ -34,7 +34,7 @@ google-cloud-container = "==2.3.0"
 # Before adding a new package, check it's not listed under [dev-packages] at
 #   https://github.com/ocadotechnology/codeforlife-package-python/blob/{ref}/Pipfile
 # Replace "{ref}" in the above URL with the ref set below.
-codeforlife = {ref = "v0.13.8", git = "https://github.com/ocadotechnology/codeforlife-package-python.git", extras = ["dev"]}
+codeforlife = {ref = "v0.13.9", git = "https://github.com/ocadotechnology/codeforlife-package-python.git", extras = ["dev"]}
 # TODO: check if we need the below packages
 django-selenium-clean = "==0.3.3"
 django-test-migrations = "==1.2.0"

backend/api/views/user.py

@@ -56,6 +56,9 @@ def get_queryset(self):
     def perform_bulk_destroy(self, queryset):
         queryset.update(first_name="", is_active=False)
 
+    # def destroy(self, request: Request):
+    #     return super().des
+
     @action(
         detail=True,
         methods=["get", "patch"],

backend/sso/permissions.py

@@ -13,5 +13,5 @@ class UserHasSessionAuthFactors(BasePermission):
     def has_permission(self, request: Request, view: View):
         return (
             isinstance(request.user, User)
-            and request.user.session.session_auth_factors.exists()
+            and request.user.session.auth_factors.exists()
         )

backend/sso/views.py

@@ -94,7 +94,7 @@ def form_valid(self, form: BaseAuthForm):  # type: ignore
                 {
                     "user_id": user.id,
                     "auth_factors": list(
-                        user.session.session_auth_factors.values_list(
+                        user.session.auth_factors.values_list(
                             "auth_factor__type", flat=True
                         )
                     ),
@@ -125,10 +125,9 @@ class LoginOptionsView(APIView):
 
     def get(self, request: Request):
         user = t.cast(User, request.user)
-        session_auth_factors = user.session.session_auth_factors
 
         response_data = {"id": user.id}
-        if session_auth_factors.filter(
+        if user.session.auth_factors.filter(
             auth_factor__type=AuthFactor.Type.OTP
         ).exists():
             response_data[