Clearer setup and login wording. The setup form now explains what enabling
two-factor authentication by email does; the TFA entry form shows the masked
recipient address, reveals the code field only after a code has been sent,
and states how long the code stays valid.
(#3594505)
Enabling Email OTP now requires the account to have a valid email address.
(#3594505)
TfaEmailOtpValidation::__construct() gained EmailValidatorInterface,
EntityTypeManagerInterface, and MessengerInterface parameters; update
any custom subclasses accordingly.
The plugin no longer calls User::load() or \Drupal::messenger()
statically; both are injected. Behaviour is unchanged.
OTP emails are now sent with the recipient's preferred language code
instead of NULL. This fixes a fatal error with mail systems that
type-hint the language code (for example Mailer Plus / Symfony Mailer),
and makes token replacement use the same language that hook_mail()
already used to resolve the subject and body.
Requesting a code for an account that no longer exists now logs an error
and stops, instead of raising a fatal error. No code is generated or
stored for a missing account.
1.0.0 (2025‑11-25)
Disable Verify button on first landing to the tfa form
1.0.0‑rc1 (2025‑08‑07)
Release candidate for 1.0.0.
Compatible with Drupal 10 & 11.
1.0.0‑beta1 (2023‑12‑24)
Beta release. Includes migration note for Drush installation, cache clearing, and patch removal.