Feature: add QR code login for unauthenticated devices - #185
Open
mvsrcdst wants to merge 1 commit into
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
The official Telegram bot stopped sending me a login code entirely: no error, no way back in. Digging through
AuthorizationSequencePhoneEntryControllerNodefor an existing escape hatch, I found a dead debug hook (#if DEBUG && false, tap-to-reveal-QR gesture on a rawASImageNode) that already exported a login token but never rendered anything scannable. Built that into a real QR-login flow: an already-authorized device scans it and bypasses code delivery entirely.Official QR login only runs the other direction (unauthenticated Desktop/Web scanned by an authenticated mobile app).
Summary
The old debug hook only exported a token and drew it into a raw image view, nothing around it actually worked, so I built out the rest: proper error handling and a clean dismiss on the QR screen, and carried the account through correctly after a DC migration so the password step isn't left broken.
Along the way I ran into
AUTH_KEY_UNREGISTERED/AUTH_TOKEN_EXPIRED: log in via QR, log out, log back in, and the 2FA password check (or the token import) fails with this error. Real logs showed it's just a short server-side race: the auth key from the DC migration isn't recognized yet, and it clears up in 1-2 seconds if you simply retry. So instead of showing an error and making the user start over, the app now retries that quietly in the background: on the QR screen it silently shows a fresh code, and on the password screen it redoes the login and resubmits the same password automatically. The user only ever sees an alert if that genuinely doesn't work out after a several tries.Screenshots
Onboarding screen with no QR icon
Login screen with QR icon
QR code screen
Password prompt with close button
QR code expires but password sent
Testing