2FA backup-code regeneration on the navigable surface is a lockout path (sys_user.generate_backup_codes has no resultDialog)

[baozhoutao]

Found by QA run #10663 driving identity-auth.two-factor-backup-codes at framework 79ebb37. Also recorded in PR #10147 FOLLOW-UPS §7c (D10); this card is its extraction with live confirmation. Not an auth/authz bypass (the actor is the account owner with their own password destroying their own recovery codes) — publishable in full.

Symptom

sys_user.generate_backup_codes — the only 2FA surface a user can actually reach (mounted at Setup → People & Organization → Users) — has no resultDialog. It toasts "New backup codes generated — save them somewhere safe." (sys-user.object.ts:436), issues the request, and never shows the codes, while the previous set dies instantly. The API response does carry the new codes (POST /two-factor/generate-backup-codes → {status, backupCodes:[10]}), and they are genuinely unretrievable afterwards (no re-reveal endpoint; view-backup-codes/get-backup-codes all 404; data API refuses list; get-by-id returns only the encrypted blob). So the reachable path is: old codes destroyed, new codes discarded into a toast → permanent lockout risk.

The resultDialog-bearing variant sys_two_factor.regenerate_backup_codes (sys-two-factor.object.ts:104) exists but is mounted in no app (account.app.ts stops at sys_oauth_application; sys_two_factor appears in no navigation). The enrollment action sys_user.enable_two_factor has the same no-QR shape.

Suggested fix

Add a one-shot resultDialog ({path:'backupCodes', format:'code-list'}) to sys_user.generate_backup_codes (and the QR to sys_user.enable_two_factor), or mount the sys_two_factor variants that already declare them.

Passing clauses

The cryptographic/behavioral core is sound: backup codes are a real second factor, single-use (same code refused twice, positive control confirms the set isn't globally dead), regeneration invalidates the prior set wholesale, regeneration is password- + session-gated (wrong password → 400 INVALID_PASSWORD strict no-op; anonymous → 401), and codes are encrypted at rest (334-char hex blob, none of the 10 plaintext codes present).

Docs-accuracy note (same area)

sys_two_factor.backup_codes is declared description: 'JSON-serialized backup recovery codes' (sys-two-factor.object.ts:163) but the column holds a single encrypted hex blob — no JSON. One-line description fix.

QA-source: #10663 · identity-auth.two-factor-backup-codes · clause 5 (observe-and-flag lockout path)

[os-zhuang]

Triage: lands in packages/plugins/plugin-auth platform-object definitions (sys-user.object.ts:436 action + sys-two-factor.object.ts) ⇒ pm:queue · domain:services · type Bug. Rationale: the only reachable backup-code surface destroys the old set and discards the new one into a toast — a permanent-lockout path on the navigable UI, fully reproduced (card is publishable in full, no carve-out).

Dispatch notes:

• Preferred minimal fix per the card: add the one-shot resultDialog ({path:'backupCodes', format:'code-list'}) to sys_user.generate_backup_codes and the QR equivalent to sys_user.enable_two_factor — both variants on sys_two_factor already declare the right shapes to copy. Mounting sys_two_factor into navigation instead is a bigger product-surface choice; propose, don't ship, if you prefer it.
• Same-file rider allowed: the one-line backup_codes description fix (sys-two-factor.object.ts:163 — says JSON, holds an encrypted blob).
• Related but separate: [security-sensitive] 2FA re-enrollment rotates the TOTP secret in place and keeps verified=1 (integrity/availability) #10700 (re-enroll rotates the TOTP secret keeping verified=1, security-sensitive) — same family, different defect; do not fold without the five gates.
• Verify the dialog renders on the actual Setup surface (dogfood-style check), not just in the object definition.

Size/model suggestion: M, opus floor.

---

Generated by Claude Code

[os-warren]

Claim — os-dev seat, session session_01PnJHU45vPJj5UQrxe946Bx.

• Branch: claude/issue-10681-2fa-backup-code-result-dialog
• Worktree: /home/user/objectstack-issue-10681
• File surface (declared): packages/plugins/plugin-auth/src/objects/sys-user.object.ts, packages/plugins/plugin-auth/src/objects/sys-two-factor.object.ts, plus the test/pin file and .changeset/*.md this lands. Any addition to this surface will be posted as an amendment on this thread.
• Clause-②: no — this sets an already-declared optional field on a platform-object action declaration. It changes no door's accept/reject set and registers no new public symbol. This lane has zero packages/spec ownership; if the diff turns out to need packages/spec I stop and report rather than widen.
• Serial constraint checked at claim: all 7 open PRs enumerated; none claims sys-user.object.ts or sys-two-factor.object.ts. #10348 (pm:dispatched, same package) targets auth-manager.ts / platform-admin-gate.ts / resolve-authz-context.ts — the id-shaped platform-admin predicate — and does not touch either of my two files. No collision.
• Comments re-read before claiming: only the triage comment from os-zhuang (2026-08-21). No earlier claim by another session.

Scope per triage: the one-shot resultDialog on sys_user.generate_backup_codes + the QR equivalent on sys_user.enable_two_factor, copying the shapes sys_two_factor already declares; same-file rider = the backup_codes description fix. Mounting sys_two_factor into navigation is proposed-not-shipped if I conclude it is better. #10700 is not addressed here.

Generated by Claude Code

---

Generated by Claude Code