Failed Authenticator login behavior (1.0.11)

[n9jr]

Testing the fail back to email OTP after the set number of failed authenticator attempts. It did not fail back to OTP it let me login with just an id/password.

pi@zero:~ $ telnet pycluster 7300
Trying 192.168.224.14...
Connected to pycluster.
Escape character is '^]'.
login: n9jr-14
password:
authenticator code: 435555

Login failed (invalid code)
Connection closed by foreign host.
pi@zero:~ $ telnet pycluster 7300
Trying 192.168.224.14...
Connected to pycluster.
Escape character is '^]'.
login: n9jr-14
password:
authenticator code: 777777

Login failed (invalid code)
Connection closed by foreign host.
pi@zero:~ $ telnet pycluster 7300
Trying 192.168.224.14...
Connected to pycluster.
Escape character is '^]'.
login: n9jr-14
password:
Welcome, N9JR-14.
You're connected to N9JR-3, a pyCluster node in Milwaukee, WI.

Web: https://pycluster.n9jr.com
Contact: dxcluster@n9jr.com

[n9jr]

It did disable both TOTP and email for the user.

[n9jr]

And it enabled TOTP/email for N9JR when it removed it from N9JR-14

[AI3I]

Implemented locally for 1.0.12 after tracing the telnet failure path and all related MFA mutations.

Fixes:

• The repeated-failure transition from authenticator MFA to email OTP is now one atomic database operation for the exact callsign/SSID. It removes only that account's TOTP secret/failure counter and challenges while setting that same account's email override to required.
• On the threshold failure, telnet now sends and prompts for the email OTP on the same authenticated connection instead of disconnecting and relying on the next login.
• sysop/clearmfa, set/mfa authenticator, and unset/mfa now clear challenges only for the exact callsign/SSID. They no longer affect the base call or sibling SSIDs.
• Documentation and changelog were updated.

Regression coverage reproduces the report with AI3I-94 while AI3I and AI3I-95 have independent MFA state. After repeated bad authenticator codes, AI3I-94 alone transitions to required email OTP, the message is sent to AI3I-94's email, and login completes only after the correct emailed code. Base and sibling secrets, overrides, and challenges remain unchanged.

Validation:

• focused MFA/store/telnet tests: 13 passed
• full suite: 620 passed

Retest after deployment:

1. Configure independent MFA state on an exact SSID and its base call.
2. Enter bad authenticator codes until fallback triggers.
3. Confirm the same telnet connection says authenticator MFA was disabled and prompts for the emailed OTP.
4. Confirm the email is addressed for the exact SSID.
5. Confirm login requires the emailed code.
6. Confirm the base call and sibling SSIDs retain their original MFA state.

Leaving this open until deployed and live SSID validation is complete.