email_code_login 1.0.0-alpha1

First alpha release. Email code login replaces the core sign-in and sign-up pages with a passwordless flow: the visitor
enters an email address, receives a one-time numeric code and is signed in, or gets an account created on the spot. Password
sign-in stays available on a second tab. The API and the configuration schema may still change before the first beta.

Features

• Sign-in and sign-up with a one-time code sent by email, on /login and /register; core
  /user/login and /user/register redirect there, keeping a local destination.
• Optional "Password" tab: sign-in by email address and password with core flood control and a single generic error
  message.
• No account enumeration: the same "we sent a code" step, limits and messages for known and unknown addresses.
• Codes are never stored: only an HMAC bound to the address, the code and the flow; single use, constant-time
  comparison.
• Rate limits in the core flood table: wrong codes per address and per IP, resend interval, codes sent per IP and per
  address.
• The flow is bound to the browser with an HttpOnly cookie secret and re-issued after a correct code; cross-site POSTs to
  the module's forms are refused.
• Sign-up step for unknown addresses: consent checkbox with an optional link, password none, optional or required.
• Change email confirmed by a code sent to the new address; change password form that asks for the current password only
  when needed.
• "Verified email" flag per account for other modules (service email_code_login.email_verification).
• Optional sign-in dialog (native dialog element) for links with the data-ecl-modal attribute.
• Events for account pre-create, account created, login, email changed and password changed; a hook to add fields to the
  sign-up step.
• Works on sites installed in a subdirectory. Russian translation included.

Requirements

• Drupal core 10.3 or later, or Drupal 11; core User module only.
• PHP intl extension recommended (international domain names).
• A working core mail transport and a real site email address.

Known limitations

• The module owns the paths /login and /register; sites or modules already using them will
  conflict. Core /user/login and /user/register are redirected.
• The per-address lockout can be abused: five wrong codes block code sign-in for that address until the code expires;
  password sign-in is not affected.
• No CAPTCHA or honeypot included; add one to email_code_login_code_form with hook_form_alter().
• Core JSON login and password reset endpoints are not changed.
• A code sign-in replaces the password; it is not two-factor authentication.
• Alpha: no upgrade path is guaranteed between alpha releases.