Add a maintenance script to purge temporary recovery codes
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Reedy
	Mar 23 2026, 7:53 PM

Project Tags

Referenced Files

None

Subscribers

Description

While temporary recovery codes will have an expiration time/date, and will be unuseable, we should have a way to remove these from the database too.

This would allow sites to do this via cronjobs/similar.

Related Changes in Gerrit:

	Subject	Repo	Branch	Lines +/-
	Create maintenance script to purge expired temporary recovery codes	mediawiki/extensions/OATHAuth	master	+89 -0

Mentioned Here: T420200: Special:Recover2FAForUser should generate short-lived recovery codes
T420201: OATHAuth: Add support for expiring recovery codes

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Reedy triaged this task as Low priority.Mar 23 2026, 7:53 PM

Change #1269018 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/OATHAuth@master] Create maintenance script to purge expired temporary recovery codes

Change #1269018 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] Create maintenance script to purge expired temporary recovery codes

Reedy closed this task as Resolved.Apr 10 2026, 9:39 AM

Reedy claimed this task.