- Shipped
- 7 Agosti 2026, 01:02 UTC
- Author
- kamo
- Commit
- f98c5ed
Two places asked one question — how do I get into this account — so the second factor now lives beside the password on My Profile, in a card retitled "Password & Multi Factor Authentication". The enrollment flow moves out of the tab into **************** chrome-free so it renders as a row rather than a page: status pill, numbered QR/secret and code steps in one inset, and the same undismissable recovery-code dialog. The card header carries no Edit button now that it owns two independent actions — the password row has its own "Change password", the MFA row its own "Turn on". MFA stays self-only for the reason the tab was: SecurityService's MFA endpoints resolve the user from the caller's session and take no user parameter, so an admin on someone else's profile would be enrolling their own authenticator. Password change is broader (MANAGE_MEMBER_SECURITY, god), so that row alone renders there. Password state moves to PasswordSecurityCard, which fixes a dead branch on the way: the old card compared a *translated* passwordError against English literals, so "Current password is incorrect" never reached the field it belonged to. The error now carries its field.