Some more context: the old 2FA code sent a notification when a user had 2 or fewer recovery codes remaining, encouraging them to regenerate their recovery codes. (But there was no way to do that directly, so the text of the notification instead encouraged them to disable then re-enable 2FA.) In the refactor to make recovery codes a separate method, this behavior was lost (the code still exists, but it's never used). At first we thought this would be unnecessary, because each user only had 1 recovery code and we were planning to show them their new code after they logged in with their old code (T406281), but now that we've changed the number of recovery codes back to 10 this is a bit murkier.

@EMill-WMF We'll need to decide whether we should:

• Revive this notification, with updated language that correctly reflects how to regenerate your recovery codes; or
• Implement some version of T406281 where we draw the user's attention to their low number of recovery codes during the login process

(or maybe both?)

I do think both is the correct answer - I posted in https://phabricator.wikimedia.org/T406281 with some thoughts there.

Change #1275528 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/OATHAuth@master] Wire RecoveryCodeCountPresentationModel back into usage

https://gerrit.wikimedia.org/r/1275528

Change #1275528 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] Wire RecoveryCodeCountPresentationModel back into usage

https://gerrit.wikimedia.org/r/1275528