Disable Verify button on first landing to the tfa form

Would a better solution be to just send the verification code when the TFA activation form is first displayed? Then the 'verify' button could stay, as well as the 'Send' button, but renamed to 'Resend' instead.

Seems counter-intuitive to have to click 'Send' first when you typically get the code sent automatically.

In a situation where there are multiple TFA methods enabled, the user might want to switch to another TFA method rather than Email. I think it is good not to send a TFA Email to user by default until the user explicitly click the 'Send' button.

Thanks @Nadim Hossain for the patch. Is it possible to have functional tests for the new feature?

Change to 'Need work' as functional tests for the new feature required.

@mingsong I am not sure I entirely agree with this.

The 'send' button is only rendered if email is setup as otp anyway (even with application code as well), so surely there's a way to trigger the automatic email if 'only' email otp is enabled. This is not only a user experience improvement but also a pretty standard practice.

At the very minimum, adding in some messaging on the page to indicate the user must first click 'send' to receive the code should be considered, as receiving the code automatically via email is a pretty standard practice in TFA, and without some messaging indicating users need to click it to even receive the first code isn't very use friendly.

If it could automatically send the email when the form loads, that seems like what I'd expect. It doesn't have to be the only method enabled for the user.

But an explicit Send initially would be fine too. If the Send/Resend action was done with a link, always displaying the Verify button would be OK. If Send is a form button, it should be the only one at first. It could even be in a different form above the current one, since you want Verify to be first to be the default.

We are currently working on a patch for this that enables a couple of global configuration options.

The first option allows you to toggle on/off 'send email automatically', which sends the email otp code on form load automatically. The button changes to say 'Resend'.

If the first option is not selected, it appends some additional (configurable) language to the form explicitly instructing the users to click the 'Send' button to receive their code. After they click send the button changes to 'Resend' instead of 'Send'.

The ability to switch TFA auth types remains the same.

It is counter-intuitive to show a form field to enter a value that a user will not have received. That's not how users expect 2FA to work. I spent 10 minutes trying to figure out email deliverability issues before I realized you have to click Send. It's not even the first button in the actions.

MR !6 mergeable take a another approach and implement the test for this new feature.

It has been two weeks, so I take the silence as Yes!

Thanks every one.