AO3-7442 Add TOTP 2FA to users - #5823
Open
EchoEkhi wants to merge 13 commits into
Open
Conversation
github-actions
Bot
added
Has Migrations
pmonfort
self-requested a review
August 6, 2026 04:21
pmonfort
reviewed
Aug 7, 2026
pmonfort
left a comment
pmonfort
left a comment
Contributor
There was a problem hiding this comment.
Thanks for working on this! I left a few comments
|
|
||
| session[:otp_user_id] = user.id | ||
|
|
||
| session[:pwned] = user.respond_to?(:password_pwned?) && user.password_pwned?(user_params[:password]) if params[:user] && params[:user][:password] |
Contributor
There was a problem hiding this comment.
Could you try to keep lines to 80 characters max? There are several lines over 100 characters in the PR.
lydia-theda
reviewed
Aug 7, 2026
lydia-theda
left a comment
lydia-theda
left a comment
Contributor
There was a problem hiding this comment.
Back in May I took a quick look at the message wording so here are those comments.
|
|
||
| serialize :otp_backup_codes, type: Array, coder: YAML, yaml: { permitted_classes: [String] } | ||
|
|
||
| # Generate a TOTP secret it it does not already exist |
Contributor
There was a problem hiding this comment.
Suggested change
| # Generate a TOTP secret it it does not already exist | |
| # Generate a TOTP secret if it does not already exist |
| create: | ||
| incorrect_code: Incorrect verification code. Your code may have expired, or you may need to set up your authenticator app again. | ||
| page_title: Two-Step Verification Backup Codes | ||
| success: Successfully enabled two-step verification; please make note of your backup codes. |
Contributor
There was a problem hiding this comment.
In the interest of being explicitly clear to users, I think we should change "make note of" to more closely mirror the language used elsewhere about saving the backup codes. Something more like this?
(I haven't checked whether .write_codes_down appears on this same page, or if this particular phrasing will conflict with anything else. But a word like "save" is more clear than "note".)
Suggested change
| success: Successfully enabled two-step verification; please make note of your backup codes. | |
| success: Two-step verification was successfully enabled. Please save your backup codes in case you lose access to your authenticator app. |
| reset_backup_codes: | ||
| not_enabled: Please enable two-step verification first. | ||
| page_title: Two-Step Verification Backup Codes | ||
| success: Successfully reset your backup codes; please make note of your new backup codes, your old backup codes will no longer work. |
Contributor
There was a problem hiding this comment.
An initial attempt at aligning the wording with other messages across the site:
Suggested change
| success: Successfully reset your backup codes; please make note of your new backup codes, your old backup codes will no longer work. | |
| success: Your backup codes have been successfully regenerated. Please save your new backup codes, as your old backup codes will no longer work. |
| heading: About Two-Step Verification | ||
| app_setup: | ||
| heading: 'Step 1: Set up your authenticator app' | ||
| instructions: Use your authenticator app to scan the QR code or enter the manual setup key. If you are using the same device the app is installed on, click the import settings button. The app will give you a 6-digit code, which you'll use in the next step. |
Contributor
There was a problem hiding this comment.
Let's try to avoid the use of plain "app", because there are many people who use that word to refer to AO3.
Suggested change
| instructions: Use your authenticator app to scan the QR code or enter the manual setup key. If you are using the same device the app is installed on, click the import settings button. The app will give you a 6-digit code, which you'll use in the next step. | |
| instructions: Use your authenticator app to scan the QR code or enter the manual setup key. If you are using the same device your authenticator app is installed on, click the import settings button. The authenticator app will give you a 6-digit code, which you'll use in the next step. |
| qr_scan_note: Scan with your authenticator app | ||
| enter_code: | ||
| heading: 'Step 2: Enter your 6-digit code' | ||
| instructions: Enter the 6-digit code from your app to enable two-step verification. |
Contributor
There was a problem hiding this comment.
Suggested change
| instructions: Enter the 6-digit code from your app to enable two-step verification. | |
| instructions: Enter the 6-digit code from your authenticator app to enable two-step verification. |
github-actions
Bot
added
Coder Has Actioned Review
and removed
Reviewed: Action Needed
labels
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull Request Checklist
as the first thing in your pull request title (e.g.
AO3-1234 Fix thing)until they are reviewed and merged before creating new pull requests.
Issue
https://otwarchive.atlassian.net/browse/AO3-7442
Credit
EchoEkhi (He/Him)