[t2d]

Goal

First step towards enforcing TOTP in the Keycloak realm systemli: mail clients can't do TOTP, so users need separate passwords for them.

Changes

• Users create named app passwords under Account settings → App Passwords. The password is shown once; only its SHA-256 hash is stored.
• App passwords are accepted by the Dovecot passdb, Postfix SASL and Roundcube aliases APIs. They are not accepted by the web login, the Keycloak validate API or app:users:mailcrypt.
• MailCrypt: each app password stores its own copy of the private key, encrypted with the app password (same pattern as the recovery token). Creating one needs the main password, and creates a MailCrypt key if the user has none.
• App password logins update the last login time but don't dispatch LoginEvent, so they never create MailCrypt keys or trigger HIBP checks.
• App passwords survive password change and recovery (the MailCrypt key stays the same). They are deleted on admin reset (new key) and account deletion.
• Metrics: userli_users_app_password_total (users with at least one app password) and userli_app_passwords_total, next to userli_users_twofactor_total.
• Docs: new user page, plus notes in the security, delete and admin user docs.

Testing

• PHPUnit and Behat cover manager, auth handler, revocation, all four APIs and the account UI.
• Checked manually against the dev Dovecot: IMAP login with an app password for mailcrypt@example.org works and reads a mail that is stored encrypted on disk. Wrong passwords and other users' app passwords are rejected.

Screenshots

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
93.3% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud