When two-factor protection is enabled, login now stays pending and money operations wait for a matching verification approval. A reusable SXCHNGE-themed EN/RU page shows the action being confirmed, preserves transaction details, and handles invalid/expired codes, resend cooldown, attempt limits, service errors and cancellation. Account settings support verified enable/disable.
Shared auth preserves DTO → mapper → service → data model → provider → UI. Email is the initial fixture; method-aware contracts and instructions also support future authenticator/TOTP adapters without email-only controls. The dummy wallet validates one-use, purpose/quote-bound approvals and retains idempotent retries and uncertain-outcome reconciliation. Analytics distinguishes intermediate verification from completed login, settings or settlement, without collecting codes or grants.
Validation: all 147 frontend tests; formatting of all 34 changed Dart files; analysis in app, sxchnge_auth, sxchnge_wallet and sxchnge_analytics; web build with Wasm dry run; diff checks. Browser checks at 1280×720 and 390×844 covered themed layout, invalid-code recovery, keyboard entry and confirmed settings. Widget coverage includes RU at 320px/1.6× text scale and every money entry point.
Initial service code: 123456; protection defaults off and resets on reload. No real email delivery, TOTP enrollment, recovery or production backend enforcement is connected. No security scan was requested or run. UX/measurement and integration details are recorded in docs/ux/two-factor.md, docs/implementation.md and the shared auth README.
When two-factor protection is enabled, login now stays pending and money operations wait for a matching verification approval. A reusable SXCHNGE-themed EN/RU page shows the action being confirmed, preserves transaction details, and handles invalid/expired codes, resend cooldown, attempt limits, service errors and cancellation. Account settings support verified enable/disable.
Shared auth preserves DTO → mapper → service → data model → provider → UI. Email is the initial fixture; method-aware contracts and instructions also support future authenticator/TOTP adapters without email-only controls. The dummy wallet validates one-use, purpose/quote-bound approvals and retains idempotent retries and uncertain-outcome reconciliation. Analytics distinguishes intermediate verification from completed login, settings or settlement, without collecting codes or grants.
Validation: all 147 frontend tests; formatting of all 34 changed Dart files; analysis in app, sxchnge_auth, sxchnge_wallet and sxchnge_analytics; web build with Wasm dry run; diff checks. Browser checks at 1280×720 and 390×844 covered themed layout, invalid-code recovery, keyboard entry and confirmed settings. Widget coverage includes RU at 320px/1.6× text scale and every money entry point.
Initial service code: `123456`; protection defaults off and resets on reload. No real email delivery, TOTP enrollment, recovery or production backend enforcement is connected. No security scan was requested or run. UX/measurement and integration details are recorded in `docs/ux/two-factor.md`, `docs/implementation.md` and the shared auth README.
Closes #32.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
When two-factor protection is enabled, login now stays pending and money operations wait for a matching verification approval. A reusable SXCHNGE-themed EN/RU page shows the action being confirmed, preserves transaction details, and handles invalid/expired codes, resend cooldown, attempt limits, service errors and cancellation. Account settings support verified enable/disable.
Shared auth preserves DTO → mapper → service → data model → provider → UI. Email is the initial fixture; method-aware contracts and instructions also support future authenticator/TOTP adapters without email-only controls. The dummy wallet validates one-use, purpose/quote-bound approvals and retains idempotent retries and uncertain-outcome reconciliation. Analytics distinguishes intermediate verification from completed login, settings or settlement, without collecting codes or grants.
Validation: all 147 frontend tests; formatting of all 34 changed Dart files; analysis in app, sxchnge_auth, sxchnge_wallet and sxchnge_analytics; web build with Wasm dry run; diff checks. Browser checks at 1280×720 and 390×844 covered themed layout, invalid-code recovery, keyboard entry and confirmed settings. Widget coverage includes RU at 320px/1.6× text scale and every money entry point.
Initial service code:
123456; protection defaults off and resets on reload. No real email delivery, TOTP enrollment, recovery or production backend enforcement is connected. No security scan was requested or run. UX/measurement and integration details are recorded indocs/ux/two-factor.md,docs/implementation.mdand the shared auth README.Closes #32.