Change 985617 had a related patch set uploaded (by Majavah; author: Majavah):

[mediawiki/extensions/OATHAuth@master] notifications: Store number of keys in notification data

https://gerrit.wikimedia.org/r/985617

Change 985618 had a related patch set uploaded (by Majavah; author: Majavah):

[mediawiki/extensions/OATHAuth@master] notifications: Show number of remaining devices

https://gerrit.wikimedia.org/r/985618

Change 985617 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] notifications: Store number of keys in notification data

https://gerrit.wikimedia.org/r/985617

Change 985618 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] notifications: Show number of remaining devices

https://gerrit.wikimedia.org/r/985618

I think all that's left on this one is when an "extra" device has been setup, and improving the wording/display for those in a similar way to the disable ones have been done

The current notifications are a good start and it looks like the current code will support email notifications for more than one authenticator. We will probably want the email notifications to be a bit more detailed about what authentication methods were enabled/disabled and possibly other kinds of notifications too.

The current notifications are:

When 2FA is enabled (user creates their first 2FA key):

Two-factor authentication has been enabled on {{GENDER:$2|your account}}.
If {{GENDER:$2|you}} did not do this, {{GENDER:$2|your account}} may have been compromised.

When an additional 2FA key is added: no notification is currently sent

When the user removes their last 2FA method:

Two-factor authentication has been disabled on {{GENDER:$2|your account}}.
If {{GENDER:$2|you}} did not do this, {{GENDER:$2|your account}} may have been compromised.

When an admin removes the user's last 2FA method for them:

Two-factor authentication has been disabled on {{GENDER:$2|your account}}.
If {{GENDER:$2|you}} did not request this, {{GENDER:$2|you}} should contact an administrator.

When the user removes a 2FA method, but it's not the last one:

A two-factor authentication device has been removed from {{GENDER:$2|your account}}.
If {{GENDER:$2|you}} did not do this, {{GENDER:$2|your account}} may have been compromised. There still {{PLURAL:$3|is an additional device|are $3 additional devices}} active on {{GENDER:$2|your account}}.

When an admin does that for them:

A two-factor authentication device has been removed from {{GENDER:$2|your account}}.
If {{GENDER:$2|you}} did not request this, {{GENDER:$2|you}} should contact an administrator. There still {{PLURAL:$3|is an additional device|are $3 additional devices}} active on {{GENDER:$2|your account}}.