Refactor expiring recovery codes (and ExpiringRecoveryCodeGenerator) to allow user to only have expiring recovery codes for intial 2FA
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Reedy
	Jun 10 2026, 11:53 AM

Project Tags

Referenced Files

None

Subscribers

Details

Related Changes in Gerrit:

	Subject	Author	Repo	Branch	Lines +/-
	Start refactoring for initial recovery codes and their useage	Reedy	mediawiki/extensions/OATHAuth	master	+290 -84

Status	Assigned	Task
		Restricted Task
Open	None	T150898 Force OATHAuth (2FA) for certain user groups in Wikimedia production and Beta wikis
In Progress	Reedy	T428103 Enforce 2FA for all users on private wikis in WMF production
In Progress	None	T420792 Allow 2FA to be enforced for all accounts on a private wiki
Resolved	Reedy	T429556 Create script to log out all users not in compliance with 2FA
Resolved	Reedy	T428738 Create wrapper around Recover2FAForUser to send to all users that don't have 2FA
Resolved	Reedy	T428739 Refactor expiring recovery codes (and ExpiringRecoveryCodeGenerator) to allow user to only have expiring recovery codes for intial 2FA

Change #1300133 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/OATHAuth@master] ExpiringRecoveryCodeGenerator: Make sending email optional

Change #1300133 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] Start refactoring for initial recovery codes and their useage

Catrope closed this task as Resolved.Jul 17 2026, 7:37 PM

Catrope assigned this task to Reedy.