Folist 8afc421b0a Support password-protected MAX accounts (2FA on top of SMS) ... Full flow reverse-engineered and confirmed live: CHECK_CODE responds with a passwordChallenge (trackId + optional hint) instead of a login token when the account has a password set. A new opcode, CHECK_PASSWORD (0x0073), exchanges {trackId, password} for the same 663-char login token CHECK_CODE would have returned directly — from there it's an ordinary LOGIN. verifyCode() now returns a discriminated union (ok / password_required) instead of throwing either way, so callers can actually ask for a password instead of just failing. Wired through everywhere MAX auth happens: the web panel gets a new password step (with hint), setup.sh's console flow prompts for it too, and the dev auth-cli script handles it via the same file-polling pattern it already used for the SMS code. A wrong password doesn't burn the trackId (confirmed live) — both the web UI and setup.sh let you retry it freely without a fresh SMS. It's only consumed on success, matching MAX's own behavior.		2026-08-14 11:58:47 +03:00
..
auth-cli.ts	Support password-protected MAX accounts (2FA on top of SMS)	2026-08-14 11:58:47 +03:00