psa-systems/bunyip
Watch
9
0
Fork
You've already forked bunyip
 0
Code Issues Pull requests Projects Releases 18 Packages Wiki Activity Actions

fix(web): collect TOTP code in disable-2FA form (BUNYIP-212) #229

Merged
Claude-Run merged 1 commit from fix/bunyip-212-disable-2fa-totp-code into main 2026-06-26 00:55:19 +02:00
Conversation 0 Commits 1 Files changed 2 +15 -9
Claude-Run commented 2026-06-26 00:50:44 +02:00
Member
Copy link

The sensitive-op re-prompt added in BUNYIP-138 makes the API require a fresh TOTP/recovery code (in addition to the password) before turning 2FA off, but the bunyip-web disable-2FA form was never updated to collect one, so a subscriber with 2FA enabled could never disable it from the UI.

Thread totp_code through the disable path, mirroring the sibling change-password / change-email / delete-account forms: add a required Two-Factor Code input to the disable-2FA form (it only renders when 2FA is on, so the code is always needed), add totp_code to DisableForm, forward it from settings_disable_2fa, and have auth_api::disable_2fa POST { password, totp_code } (empty-skip when blank). No API change; a missing or invalid code still surfaces via the existing /settings redirect-error path.

#BUNYIP-212

The sensitive-op re-prompt added in BUNYIP-138 makes the API require a fresh TOTP/recovery code (in addition to the password) before turning 2FA off, but the bunyip-web disable-2FA form was never updated to collect one, so a subscriber with 2FA enabled could never disable it from the UI. Thread totp_code through the disable path, mirroring the sibling change-password / change-email / delete-account forms: add a required Two-Factor Code input to the disable-2FA form (it only renders when 2FA is on, so the code is always needed), add totp_code to DisableForm, forward it from settings_disable_2fa, and have auth_api::disable_2fa POST { password, totp_code } (empty-skip when blank). No API change; a missing or invalid code still surfaces via the existing /settings redirect-error path. #BUNYIP-212
fix(web): collect TOTP code in disable-2FA form (BUNYIP-212)
All checks were successful
E2E / Playwright against deployment (pull_request) Successful in 50s
Details
Check / fmt + clippy + build + tests (pull_request) Successful in 4m26s
Details
Create release / Create release from merged PR (pull_request) Has been skipped
Details
42d2621271 
The sensitive-op re-prompt added in BUNYIP-138 makes the API require a fresh TOTP/recovery code (in addition to the password) before turning 2FA off, but the bunyip-web disable-2FA form was never updated to collect one, so a subscriber with 2FA enabled could never disable it from the UI.

Thread totp_code through the disable path, mirroring the sibling change-password / change-email / delete-account forms: add a required Two-Factor Code input to the disable-2FA form (it only renders when 2FA is on, so the code is always needed), add totp_code to DisableForm, forward it from settings_disable_2fa, and have auth_api::disable_2fa POST { password, totp_code } (empty-skip when blank). No API change; a missing or invalid code still surfaces via the existing /settings redirect-error path.

#BUNYIP-212
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
psa-systems/bunyip!229
No description provided.