CW-021 · Two-factor enrolment on mobile

Priority P2 · Area mobile · Estimate M · Phase 4

The app can complete a second factor — it shows a code field and accepts a generated or recovery code — but it cannot enrol one. Scanning a QR code with the phone that is displaying it does not work, so an account required to have a second factor is currently told to enrol in the web console first.

That is fine while the requirement only reaches privileged console roles. An organisation that turns on settings.security.requireMfa for everyone leaves its field staff unable to set themselves up from the only device they have.

Scope

Enrolment without a camera round-trip: show the secret, offer a "copy to clipboard" and a deep link that hands the otpauth:// URI straight to an authenticator app on the same device, then confirm with a code.

Acceptance

An employee with no console access can enrol and sign in using only the phone, and the recovery codes are shown once with a way to save them.

Files mobile/lib/features/auth/

Tracked in docs/backlog.md.

Start in mobile/lib/features/auth/ and trace the existing second-factor code and recovery-code flows, including the settings.security.requireMfa path. Define the enrolment entry point and verify the acceptance cases: a phone-only employee can enrol and sign in, and recovery codes are shown once with a way to save them.