👽️ Introduced /login InhibitDevice for 2FA Initial Login Phase.

clientapi/auth/login.go

@@ -45,6 +45,7 @@ func LoginFromJSONReader(ctx context.Context, r io.Reader, useraccountAPI uapi.C
 
 	var header struct {
 		Type          string `json:"type"`
+		InhibitDevice bool   `json:"inhibit_device"`
 	}
 	if err := json.Unmarshal(reqBytes, &header); err != nil {
 		err := &util.JSONResponse{
@@ -61,6 +62,7 @@ func LoginFromJSONReader(ctx context.Context, r io.Reader, useraccountAPI uapi.C
 			UserApi:       useraccountAPI,
 			Config:        cfg,
 			Rt:            rt,
+			InhibitDevice: header.InhibitDevice,
 		}
 	case authtypes.LoginTypeToken:
 		typ = &LoginTypeToken{

clientapi/auth/password.go

@@ -45,6 +45,7 @@ type LoginTypePassword struct {
 	UserApi       api.ClientUserAPI
 	Config        *config.ClientAPI
 	Rt            *ratelimit.RtFailedLogin
+	InhibitDevice bool
 }
 
 func (t *LoginTypePassword) Name() string {
@@ -61,6 +62,7 @@ func (t *LoginTypePassword) LoginFromJSON(ctx context.Context, reqBytes []byte)
 	if err != nil {
 		return nil, nil, err
 	}
+	login.InhibitDevice = t.InhibitDevice
 
 	return login, func(context.Context, *util.JSONResponse) {}, nil
 }

clientapi/auth/user_interactive.go

@@ -66,6 +66,7 @@ type LoginIdentifier struct {
 type Login struct {
 	LoginIdentifier                 // Flat fields deprecated in favour of `identifier`.
 	Identifier      LoginIdentifier `json:"identifier"`
+	InhibitDevice   bool            `json:"inhibit_device,omitempty"`
 
 	// Both DeviceID and InitialDisplayName can be omitted, or empty strings ("")
 	// Thus a pointer is needed to differentiate between the two

clientapi/routing/login.go

@@ -69,6 +69,17 @@ func Login(
 		if authErr != nil {
 			return *authErr
 		}
+		if login.InhibitDevice {
+			return util.JSONResponse{
+				Code: http.StatusOK,
+				JSON: loginResponse{
+					UserID:      login.Username(),
+					AccessToken: "",
+					HomeServer:  cfg.Matrix.ServerName,
+					DeviceID:    "",
+				},
+			}
+		}
 		// make a device/access token
 		authErr2 := completeAuth(req.Context(), cfg.Matrix.ServerName, userAPI, login, req.RemoteAddr, req.UserAgent())
 		cleanup(req.Context(), &authErr2)