daycry / auth / 22545351205

64%

push

github

Make TOTP 2FA optional; add tests and session cleanup

Totp2FA no longer forces TOTP on users who haven't completed setup: createIdentity() now returns an empty string to skip the action for users without a confirmed TOTP, and returns 'totp' and inserts a pending marker for confirmed users. Stale pending markers are removed before inserting new ones. Session authenticator now clears auth_action/auth_action_message in completeLogin() and respects an empty secret from startUpAction() (treating the action as skipped). HasTotp() now only treats a confirmed identity (name='totp') as enabled, excluding unverified enrollment. UserSecurityController view calls were switched to use configurable view keys and a new security_overview view key was added to Auth config. Added comprehensive Totp2FATest unit tests and updated phpstan baseline to suppress a test-specific static method warning.

12 of 15 new or added lines in 4 files covered. (80.0%)

3086 of 4847 relevant lines covered (63.67%)

43.0 hits per line