Page MenuHomePhabricator
Create Task
Maniphest T401774

Redesign UI for listing 2FA methods and adding new methods
Closed, ResolvedPublic
Actions

Assigned To
Catrope
Authored By
Catrope
Aug 13 2025, 5:14 AM
Tags
Referenced Files
F66004924: Screenshot 2025-09-10 at 21.46.47.png
Sep 10 2025, 8:49 PM
F66004923: Screenshot 2025-09-10 at 21.47.21.png
Sep 10 2025, 8:49 PM
F65751911: image.png
Aug 14 2025, 8:53 PM
F65751909: image.png
Aug 14 2025, 8:53 PM
F65751903: image.png
Aug 14 2025, 8:53 PM
F65751899: image.png
Aug 14 2025, 8:53 PM
F65746137: image.png
Aug 13 2025, 5:14 AM
F65745998: image.png
Aug 13 2025, 5:14 AM
View All 10 Files
Subscribers
AAlhazwani-WMF
Aklapper
Catrope
EMill-WMF
Mstyles
ReaperDawn
Reedy
View All 9 Subscribers

Description

New designs by @AAlhazwani-WMF:

image.png (1×553 px, 91 KB)
image.png (1×553 px, 110 KB)
image.png (1×533 px, 91 KB)
image.png (1×533 px, 88 KB)
When no 2FA methods are set upSuccess message after setting up a 2FA methodWith two methods set upExpanded accordion
  • Remove existing UI with separate "Enable" buttons for TOTP and WebAuthn
  • Add a "Two-factor authentication" section on Special:AccountSecurity (see T401771) which lists all registered 2FA methods as accordions
    • Each accordion contains the name and type of the method in its title (shown when collapsed)
    • When expanded, each accordion displays the creation timestamp, and "Rename" and "Delete" buttons (see also T401775: Allow 2FA methods to be renamed)
  • At the bottom of this section, add a ButtonGroup with two buttons, one for adding a TOTP app and one for WebAuthn
  • When a new 2FA method is added, or a method is removed, a success message should be displayed

Details

Related Changes in Gerrit:
SubjectRepoBranchLines +/-
Make group-oathauth-twofactorauth-member lowercasemediawiki/extensions/OATHAuthmaster+1 -1
Introduce IModule::isSpecial and ignore special modules in new UImediawiki/extensions/OATHAuthmaster+19 -0
New UI for Special:AccountSecuritymediawiki/extensions/OATHAuthmaster+402 -12
Remove "delete success" messagemediawiki/extensions/WebAuthnmaster+0 -8
Add "add key" and "delete success" messagesmediawiki/extensions/WebAuthnmaster+17 -2
Allow &action=enable to add a new key if WebAuthn is already enabledmediawiki/extensions/WebAuthnmaster+1 -4
Add feature flag for new SpecialOathManage UImediawiki/extensions/OATHAuthmaster+4 -0
Customize query in gerrit

Related Objects
Search...

Event Timeline

Catrope created this task.Aug 13 2025, 5:14 AM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptAug 13 2025, 5:14 AM
Catrope mentioned this in T401775: Allow 2FA methods to be renamed.Aug 13 2025, 5:16 AM
Catrope updated the task description. (Show Details)
Catrope mentioned this in T150601: Add option to generate new set of recovery codes.Aug 13 2025, 5:19 AM
Catrope updated the task description. (Show Details)
Catrope updated the task description. (Show Details)
Catrope updated the task description. (Show Details)
Catrope attached a referenced file: F65746137: image.png. (Show Details)Aug 13 2025, 6:07 PM
Catrope attached a referenced file: F65745998: image.png. (Show Details)
Catrope attached a referenced file: F65745849: image.png. (Show Details)
Catrope attached a referenced file: F65745831: image.png. (Show Details)
ReaperDawn subscribed.Aug 13 2025, 10:45 PM
Catrope updated the task description. (Show Details)Aug 14 2025, 5:32 PM
Catrope updated the task description. (Show Details)Aug 14 2025, 8:53 PM
Catrope claimed this task.Aug 19 2025, 4:18 PM
Catrope moved this task from Backlog to In Progress on the FY2025-26 WE4.6.2 Multiple Authenticators board.Aug 19 2025, 4:23 PM
Mstyles edited parent tasks, added: T399644: FY2025-26 WE4.6.2 Multiple Authenticators; removed: T242031: Allow multiple different 2FA devices.Aug 20 2025, 7:00 PM
gerritbot added a comment.Aug 26 2025, 5:53 PM

Change #1182195 had a related patch set uploaded (by Catrope; author: Catrope):

[mediawiki/extensions/OATHAuth@master] Add feature flag for new SpecialOathManage UI

https://gerrit.wikimedia.org/r/1182195

gerritbot added a project: Patch-For-Review.Aug 26 2025, 5:53 PM
gerritbot added a comment.Sep 3 2025, 10:52 AM

Change #1182195 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] Add feature flag for new SpecialOathManage UI

https://gerrit.wikimedia.org/r/1182195

ReleaseTaggerBot added a project: MW-1.45-notes (1.45.0-wmf.18; 2025-09-09).Sep 3 2025, 11:00 AM
Maintenance_bot removed a project: Patch-For-Review.Sep 3 2025, 11:31 AM
Catrope mentioned this in T403666: Display creation timestamp of each key on Special:AccountSecurity.Sep 3 2025, 8:27 PM
gerritbot added a comment.Sep 3 2025, 8:44 PM

Change #1184590 had a related patch set uploaded (by Catrope; author: Catrope):

[mediawiki/extensions/WebAuthn@master] Allow &action=enable to add a new key if WebAuthn is already enabled

https://gerrit.wikimedia.org/r/1184590

gerritbot added a project: Patch-For-Review.Sep 3 2025, 8:44 PM

Change #1184591 had a related patch set uploaded (by Catrope; author: Catrope):

[mediawiki/extensions/WebAuthn@master] Add "add key" and "delete success" messages

https://gerrit.wikimedia.org/r/1184591

gerritbot added a comment.Sep 3 2025, 8:45 PM

Change #1184594 had a related patch set uploaded (by Catrope; author: Catrope):

[mediawiki/extensions/OATHAuth@master] New UI for Special:AccountSecurity

https://gerrit.wikimedia.org/r/1184594

PatchDemoBot added a comment.Sep 3 2025, 9:19 PM

Test wiki created on Patch demo by Roan Kattouw (WMF) using patch(es) linked to this task:
https://012755790c.catalyst.wmcloud.org/w/

Reedy subscribed.Sep 10 2025, 8:49 PM

Screenshot 2025-09-10 at 21.47.21.png (621×574 px, 51 KB)

Screenshot 2025-09-10 at 21.46.47.png (625×493 px, 53 KB)

gerritbot added a comment.Sep 10 2025, 8:49 PM

Change #1184590 merged by jenkins-bot:

[mediawiki/extensions/WebAuthn@master] Allow &action=enable to add a new key if WebAuthn is already enabled

https://gerrit.wikimedia.org/r/1184590

gerritbot added a comment.Sep 10 2025, 8:50 PM

Change #1184591 merged by jenkins-bot:

[mediawiki/extensions/WebAuthn@master] Add "add key" and "delete success" messages

https://gerrit.wikimedia.org/r/1184591

ReleaseTaggerBot edited projects, added MW-1.45-notes (1.45.0-wmf.19; 2025-09-16); removed MW-1.45-notes (1.45.0-wmf.18; 2025-09-09).Sep 10 2025, 9:00 PM
Catrope mentioned this in T404268: Warn users before they delete their last 2FA key.Sep 10 2025, 10:01 PM
gerritbot added a comment.Sep 15 2025, 8:59 PM

Change #1188455 had a related patch set uploaded (by Catrope; author: Catrope):

[mediawiki/extensions/WebAuthn@master] Remove "delete success" message

https://gerrit.wikimedia.org/r/1188455

gerritbot added a comment.Sep 16 2025, 6:22 PM

Change #1188455 merged by jenkins-bot:

[mediawiki/extensions/WebAuthn@master] Remove "delete success" message

https://gerrit.wikimedia.org/r/1188455

ReleaseTaggerBot edited projects, added MW-1.45-notes (1.45.0-wmf.20; 2025-09-23); removed MW-1.45-notes (1.45.0-wmf.19; 2025-09-16).Sep 16 2025, 7:00 PM
Reedy mentioned this in T404765: Move HTML building to template.Sep 16 2025, 7:45 PM
Reedy moved this task from Backlog to User Experience on the MediaWiki-extensions-OATHAuth board.Sep 16 2025, 7:47 PM
gerritbot added a comment.Sep 16 2025, 9:10 PM

Change #1184594 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] New UI for Special:AccountSecurity

https://gerrit.wikimedia.org/r/1184594

Catrope closed this task as Resolved.Sep 16 2025, 9:13 PM
Catrope moved this task from In Progress to Done on the FY2025-26 WE4.6.2 Multiple Authenticators board.
Maintenance_bot removed a project: Patch-For-Review.Sep 16 2025, 9:31 PM
Reedy mentioned this in T404806: Remove $wgOATHAllowMultipleModules and $wgOATHAuthNewUI.Sep 16 2025, 11:38 PM
PatchDemoBot added a comment.Sep 18 2025, 12:58 AM

Test wiki on Patch demo by Roan Kattouw (WMF) using patch(es) linked to this task was deleted:

https://012755790c.catalyst.wmcloud.org/w/

gerritbot added a comment.Sep 18 2025, 2:55 PM

Change #1189516 had a related patch set uploaded (by SBassett; author: SBassett):

[mediawiki/extensions/OATHAuth@master] Ignore special modules in new UI display

https://gerrit.wikimedia.org/r/1189516

gerritbot added a project: Patch-For-Review.Sep 18 2025, 2:55 PM
gerritbot added a comment.Sep 22 2025, 6:27 PM

Change #1189516 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] Introduce IModule::isSpecial and ignore special modules in new UI

https://gerrit.wikimedia.org/r/1189516

Maintenance_bot removed a project: Patch-For-Review.Sep 22 2025, 6:31 PM
Reedy mentioned this in T405840: Use of Html::successBox doesn't seem to be styled on Special:AccountSecurity.Sep 27 2025, 4:31 PM
Reedy mentioned this in T405887: DisableForm would wipe out all 2FA of type.Sep 29 2025, 9:01 AM
Catrope mentioned this in T406253: Add JS-based Codex Dialogs for rename and delete buttons on Special:AccountSecurity.Oct 2 2025, 6:15 PM
gerritbot added a comment.Oct 23 2025, 6:09 PM

Change #1198336 had a related patch set uploaded (by Krinkle; author: Majavah):

[mediawiki/extensions/OATHAuth@master] Make group-oathauth-twofactorauth-member lowercase

https://gerrit.wikimedia.org/r/1198336

gerritbot added a project: Patch-For-Review.Oct 23 2025, 6:09 PM
gerritbot added a comment.Oct 23 2025, 6:32 PM

Change #1198336 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] Make group-oathauth-twofactorauth-member lowercase

https://gerrit.wikimedia.org/r/1198336

ReleaseTaggerBot edited projects, added MW-1.45-notes (1.45.0-wmf.25; 2025-10-28); removed MW-1.45-notes (1.45.0-wmf.20; 2025-09-23).Oct 23 2025, 7:00 PM
Maintenance_bot removed a project: Patch-For-Review.Oct 23 2025, 7:31 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits