After the mailed code verifies, ActivateByCode consults the login gates
with source password, as Login does. A gate answer (for example a
second-factor challenge) replaces the token response and sets no session
cookie; a gate error answers the opaque 500. The account is activated
either way. Without a gate, or when every gate allows, the answer is
unchanged. With require_activation off an account can enable a second
factor before it activates, so the mailed code no longer stands in for it.
- TestLoginGates: registry order, first result or error wins, nil gates,
concurrent Add and Check, CheckLoginGates without a registry
- TestLoginGateOrder: refused first factors never reach a gate, rehash
before a challenge, restore and reactivate mail only after the gates,
gate answers pass through, refresh never asks a gate
- TestPasswordChangedSources: reset, change and admin set fire once inside
the write's transaction; rehash and registration fire none
- TestResetTwoFactorAction: offered only with a service and a factor,
danger, permission, transaction and rollback
