Account

ProfileNameForm, ChangeEmailForm, ChangePasswordForm, TwoFactorSection and SignInAgain from packages/ui, each wired to a fixture that succeeds, rejects a specific input, or fails outright.

Profile name

ProfileNameForm

Save disables again once the draft matches what was last accepted.

Email

Whether the frontend-API session needs the current password to reissue a sensitive change.

Password required

You sign in with ada.lovelace@acme.co.

Password not required

You sign in with ada.lovelace@acme.co.

In a 320px column

You sign in with ada.lovelace@acme.co.

Submit, then check the confirmation line wraps under the button rather than moving it.

Password

Has a password

Asks for the current password before accepting a new one.

Confirmation mismatch

Type different values for New and Confirm, then submit — checked client-side before onSubmit runs.

No password yet

You don't have a password yet. Set one to sign in with your email and password.

Signed up via SSO or a magic link — this sets the first one.

Two-factor authentication

Both resting states fetch nothing. The QR code is a fresh TOTP secret and the backup codes are a recovery secret, so each appears only after the press that asks for it.

Off — at rest

2FA is off.

Turn it on and signing in will also ask for a 6-digit code from an authenticator app.

No QR code and no call until Set up is pressed.

On — at rest

2FA is on.

Signing in asks for a code from your authenticator app.

No backup codes in the page until Show backup codes is pressed.

Fetch fails

2FA is off.

Turn it on and signing in will also ask for a 6-digit code from an authenticator app.

Press Set up — the fixture fails, and the button is still there to press again.

Off — mid-enrolment

2FA is off.

Scan the QR code with an authenticator app, then enter the 6-digit code it shows.

QR code for your authenticator app

Where Set up lands. Enter 000000 and submit — the fixture always fails that code with "That code didn't match."

On — just enrolled

2FA is on.

Signing in asks for a code from your authenticator app.

Save these somewhere safe now. Each code signs you in once if you lose your authenticator.

  • 0000-1000
  • 0000-7173
  • 0001-3346
  • 0001-9519
  • 0002-5692
  • 0003-1865
  • 0003-8038
  • 0004-4211

Where a correct code lands. The codes are open rather than behind the disclosure: the only moment the user is told a recovery path exists.

On — codes couldn't be loaded

2FA is on.

Signing in asks for a code from your authenticator app.

Where a successful Enable lands when the read that carries the codes fails. Enrolled with no recovery path, so it says so; Show backup codes is the retry.

On — backup codes fetched

2FA is on.

Signing in asks for a code from your authenticator app.

Coming back to them later. Show backup codes reveals them without another call; Hide and Show again stays free.

Sessions

The control someone acting on a suspected compromise reaches for. The auth provider revokes every session and offers no way to spare the caller's, so the copy names this browser too.

Succeeds

Ends every session on your account, on every browser and device — including this one.

Press Sign out everywhere, then confirm — the dialog holds while the call runs, closes on success, and the outcome lands in a live region beside the button.

Fails

Ends every session on your account, on every browser and device — including this one.

Confirm — the dialog stays open with the reason inside it, so nothing suggests sessions were revoked when they weren't.

Log-in-again fallback

When the sign-in session these settings go through has lapsed in this browser. Logging in again through the in-app login renews it, and the link returns here.

SignInAgain

Changing these needs a fresh login. Log out and back in, and you'll come straight back here.

Log in again