From 4f26f725861107c0a16874c6a7fd5d273f083ffd Mon Sep 17 00:00:00 2001 From: Arunabha-Mukhopadhyay Date: Mon, 10 Aug 2026 14:11:21 +0530 Subject: [PATCH] Allow email-only /api/two-factor/send-email-login for mobile clients Mobile clients (iOS) may call /api/two-factor/send-email-login with only the user's email and without a MasterPasswordHash or an AuthRequest. Permit email-only requests so the server will send the email 2FA token in that flow.\n\nModified: src/api/core/two_factor/email.rs Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- src/api/core/two_factor/email.rs | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/api/core/two_factor/email.rs b/src/api/core/two_factor/email.rs index 44ba2e7f..d38bd873 100644 --- a/src/api/core/two_factor/email.rs +++ b/src/api/core/two_factor/email.rs @@ -86,7 +86,11 @@ async fn send_email_login(data: Json, client_headers: Client err!("AuthRequest doesn't exist", "Invalid device, IP or code") } } else { - err!("No password hash has been submitted.") + // Allow email-only requests to trigger sending an email 2FA token. + // Mobile clients (e.g. iOS) may call this endpoint with only the email when + // the token endpoint indicated 2FA is required. In that flow the client + // doesn't submit the master password hash or an auth request id, so + // permit sending the email token based solely on the user's email. } user