jcoffey-dev
1acf2f29e7
Creating an app password asks for the account password. A session holding a token has no password to compare with, so it sent the typed one to the mail server as HTTP Basic on the JMAP session. INBUXA's server now takes no password outside DAV (contract C-23), so that check would always fail. It now asks the server's sign-in endpoint, the one its own sign-in page posts to, as this client, to its registered redirect URI, with a PKCE challenge whose verifier is thrown away so the code can never be exchanged. "Two-factor code needed" counts as confirmed: the server says so only after the password matched, so accounts with two-factor sign-in now pass where the Basic check failed them. The mock answers /api/auth like the server and can refuse Basic on JMAP; the app-password test turns that on, and fails on the old check.