scheb/2fa-email

scheb/2fa-email extends the scheb/2fa-bundle two-factor authentication framework for Symfony with an email-based provider: after a user’s primary login succeeds, this package generates a one-time authentication code, emails it via Symfony’s Mailer, and validates the code the user submits before completing login.

As a provider plugin rather than a standalone bundle, it implements the TwoFactorProviderInterface contract expected by the core 2fa bundle, giving applications a ready-made email-based second factor without needing to write code-generation, email dispatch, or code-validation logic themselves.

What You Get

• An EmailTwoFactorProvider implementing the core bundle’s TwoFactorProviderInterface
• A CodeGenerator for producing one-time authentication codes
• A SymfonyAuthCodeMailer that sends codes via Symfony’s Mailer component
• Event hooks (EmailCodeEvents::SENT, CHECK, VALID, INVALID) for observing the authentication flow
• A TwoFactorInterface contract for marking user entities as email-2FA-enabled and storing their current code

Common Use Cases

• Adding email one-time-code login verification to a Symfony application’s existing authentication flow
• Offering users a low-friction 2FA option that doesn’t require an authenticator app
• Auditing or reacting to 2FA code send/validate events via the Symfony event dispatcher
• Combining with other scheb 2FA providers (TOTP, Google Authenticator) to offer users a choice of second factor

Under The Hood

Architecture The package implements a single provider plugin against the core scheb/2fa-bundle’s extension points: EmailTwoFactorProvider checks whether a user has email-2FA enabled (via the TwoFactorInterface contract on the user entity), triggers CodeGenerator to create and persist a one-time code, and dispatches it through AuthCodeMailerInterface (implemented by SymfonyAuthCodeMailer). Validation uses hash_equals() for timing-safe comparison, and lifecycle events (SENT/CHECK/VALID/INVALID) are dispatched via Symfony’s event dispatcher so applications can hook into each step.

Tech Stack PHP 8.4/8.5 with a hard dependency on scheb/2fa-bundle (same-version pinned via self.version) and an optional dependency on symfony/mailer for the default mail-sending implementation, allowing applications to swap in a custom mailer if desired.

Code Quality The package is intentionally minimal — seven focused classes/interfaces split cleanly across Mailer/, Model/, and Security/TwoFactor/Provider/Email/ namespaces, each with a single, clearly named responsibility; timing-safe code comparison (hash_equals) reflects security-conscious implementation for an authentication-critical component. Test coverage for this specific provider lives in the parent scheb/2fa monorepo rather than in this subtree-split repo.

API Design Integration requires implementing the TwoFactorInterface on the application’s user entity and enabling the email provider in bundle configuration — a small, well-defined surface area consistent with the core bundle’s plugin-provider pattern, keeping the learning curve low for anyone already using scheb/2fa-bundle.