Remove the two-factor entry point from the login form #84

New Issue

Closed

opened 2026-08-26 23:41:57 +00:00 by jcoffey-dev · 0 comments

jcoffey-dev commented

2026-08-26 23:41:57 +00:00

Owner

The login page offered "I have a two-factor code", which revealed a TOTP field. That field could never work: Stalwart accepts a TOTP code only through an OAuth flow and offers no password grant, so a client holding a username and password has nowhere to send one. The button advertised a feature the login path cannot honour, so it comes out until the flow works end to end.

What changed, all in web/src/views/Login.tsx:

Removed the "I have a two-factor code" button, the TOTP field, and its hint about app passwords.
Dropped the totp / showTotp state; the form passes "" to login(), which the server reads as no code given. The store signature and the server's totp handling are untouched.
A failed sign-in no longer reveals the field, and the invalid-credentials message is now plainly "Invalid username or password."

Two-factor setup in Settings → Security is unchanged; only the login-page entry point is gone.

Verified: tsc --noEmit clean, npm run lint clean, 77/77 tests pass.

🤖 Generated with Claude Code

Merged 2026-08-26 as coffey-labs/ihasmail@486ab2f0d0

_{Rebuilt from: git history, session transcript.}

The login page offered **"I have a two-factor code"**, which revealed a TOTP field. That field could never work: Stalwart accepts a TOTP code only through an OAuth flow and offers no password grant, so a client holding a username and password has nowhere to send one. The button advertised a feature the login path cannot honour, so it comes out until the flow works end to end. What changed, all in `web/src/views/Login.tsx`: - Removed the "I have a two-factor code" button, the TOTP field, and its hint about app passwords. - Dropped the `totp` / `showTotp` state; the form passes `""` to `login()`, which the server reads as no code given. The store signature and the server's `totp` handling are untouched. - A failed sign-in no longer reveals the field, and the invalid-credentials message is now plainly "Invalid username or password." Two-factor setup in Settings → Security is unchanged; only the login-page entry point is gone. Verified: `tsc --noEmit` clean, `npm run lint` clean, 77/77 tests pass. 🤖 Generated with [Claude Code](https://claude.com/claude-code) **Merged** 2026-08-26 as coffey-labs/ihasmail@486ab2f0d006 <sub>Rebuilt from: git history, session transcript.</sub>

This repo is archived. You cannot comment on issues.

1 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: coffey-labs/ihasmail-github-archive#84