Page MenuHomePhabricator
Create Task
Maniphest T405235

Create MediaWiki maintenance script to migrate older TOTP devices to modern TOTP + Recovery Codes configuration
Closed, ResolvedPublic
Actions

Description

This isn't urgent, as the current refactoring being completed under FY2025-26 WE4.6.2 Multiple Authenticators is being designed to accommodate both the current (soon to be "older") way of storing TOTP keys with scratch tokens and recovery codes as their own factor. But we will want to create a maintenance script to migrate the older TOTP devices within oathauth_devices to the "newer" state, where recovery codes will be decoupled as their own separate factor. The script should also encrypt (introduced in I0aaeb17ed) older TOTP secrets if they have not yet been converted.

Details

Related Changes in Gerrit:
SubjectAuthorRepoBranchLines +/-
Add maintenance script to migrate recovery tokens to their own deviceReedymediawiki/extensions/OATHAuthmaster+183 -0
Add maintenance script to migrate recovery tokens to their own deviceReedymediawiki/extensions/OATHAuthwmf/1.45.0-wmf.24+183 -0
Add maintenance script to migrate recovery tokens to their own deviceReedymediawiki/extensions/OATHAuthwmf/1.45.0-wmf.23+183 -0
Customize query in gerrit

Related Objects
Search...

Event Timeline

sbassett created this task.Sep 22 2025, 2:57 PM
A_smart_kitten edited projects, added: MediaWiki-extensions-OATHAuth; removed: Epic.Sep 22 2025, 5:58 PM
gerritbot added a comment.Sep 25 2025, 3:46 PM

Change #1191390 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/OATHAuth@master] Add maintenance script to migrate recovery tokens to their own device

https://gerrit.wikimedia.org/r/1191390

gerritbot added a project: Patch-For-Review.Sep 25 2025, 3:46 PM
sbassett updated the task description. (Show Details)Sep 25 2025, 3:47 PM
Reedy moved this task from Backlog to In Progress on the FY2025-26 WE4.6.2 Multiple Authenticators board.Sep 26 2025, 6:41 PM
sbassett changed the task status from Open to In Progress.Sep 28 2025, 2:12 PM
sbassett assigned this task to Reedy.
Reedy moved this task from Backlog to Features/Improvements on the MediaWiki-extensions-OATHAuth board.Oct 3 2025, 11:32 AM
Reedy mentioned this in T406953: Don't save scratch_tokens if empty array (like they are on new TOTP rows).Oct 10 2025, 12:17 AM
Reedy mentioned this in T407053: Potentially confusing behaviour re. the list of existing recovery codes shown when adding a new 2FA module.Oct 11 2025, 3:02 PM
Reedy added a parent task: T404363: Set OATHSecretKey value within Wikimedia production and migrate older 2fa data within oathauth_devices.Oct 11 2025, 3:47 PM
Reedy added a subtask: T406953: Don't save scratch_tokens if empty array (like they are on new TOTP rows).
Reedy mentioned this in T404363: Set OATHSecretKey value within Wikimedia production and migrate older 2fa data within oathauth_devices.
Reedy added a parent task: T407057: Run MoveRecoveryCodesFromTOTP.php.Oct 11 2025, 3:49 PM
Reedy removed a parent task: T404363: Set OATHSecretKey value within Wikimedia production and migrate older 2fa data within oathauth_devices.
Reedy added a project: MW-1.45-release.Oct 11 2025, 4:21 PM
Reedy closed subtask T406953: Don't save scratch_tokens if empty array (like they are on new TOTP rows) as Resolved.Oct 14 2025, 7:18 PM
Jdforrester-WMF moved this task from Blocker to Not a blocker on the MW-1.45-release board.Oct 15 2025, 10:26 PM
Catrope edited projects, added: FY2025-26 WE 4.6 - Account Security (WE 4.6.4 - 2FA improvements and passkey support); removed: FY2025-26 WE4.6.2 Multiple Authenticators.Oct 22 2025, 4:46 AM
Catrope moved this task from Inbox to Tech debt cleanup on the FY2025-26 WE 4.6 - Account Security (WE 4.6.4 - 2FA improvements and passkey support) board.Oct 22 2025, 5:02 AM
Catrope moved this task from Tech debt cleanup to Production maintenance on the FY2025-26 WE 4.6 - Account Security (WE 4.6.4 - 2FA improvements and passkey support) board.Oct 22 2025, 5:24 AM
gerritbot added a comment.Oct 22 2025, 10:06 PM

Change #1191390 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] Add maintenance script to migrate recovery tokens to their own device

https://gerrit.wikimedia.org/r/1191390

gerritbot added a comment.Oct 22 2025, 10:07 PM

Change #1198162 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/OATHAuth@wmf/1.45.0-wmf.24] Add maintenance script to migrate recovery tokens to their own device

https://gerrit.wikimedia.org/r/1198162

gerritbot added a comment.Oct 22 2025, 10:07 PM

Change #1198163 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/OATHAuth@wmf/1.45.0-wmf.23] Add maintenance script to migrate recovery tokens to their own device

https://gerrit.wikimedia.org/r/1198163

gerritbot added a comment.Oct 22 2025, 10:15 PM

Change #1198162 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@wmf/1.45.0-wmf.24] Add maintenance script to migrate recovery tokens to their own device

https://gerrit.wikimedia.org/r/1198162

gerritbot added a comment.Oct 22 2025, 10:15 PM

Change #1198163 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@wmf/1.45.0-wmf.23] Add maintenance script to migrate recovery tokens to their own device

https://gerrit.wikimedia.org/r/1198163

Reedy closed this task as Resolved.Oct 22 2025, 10:25 PM
Maintenance_bot removed a project: Patch-For-Review.Oct 22 2025, 10:30 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits