wip

src/helpers.rs

···
 use chrono::Utc;
 use lettre::message::{MultiPart, SinglePart, header};
 use lettre::{AsyncTransport, Message};
-use rand::distr::{Alphanumeric, SampleString};
+use rand::distr::{Alphabetic, Alphanumeric, SampleString};
 use serde::de::DeserializeOwned;
 use serde_json::{Map, Value};
 use sqlx::SqlitePool;
···
 }
 
 /// Creates a random token of 10 characters for email 2FA
-pub fn get_random_token() -> String {
-    let full_code = Alphanumeric.sample_string(&mut rand::rng(), 10);
+pub fn get_random_token(oauth: bool) -> String {
+    let full_code = match oauth {
+        true => Alphabetic.sample_string(&mut rand::rng(), 10),
+        false => Alphanumeric.sample_string(&mut rand::rng(), 10),
+    };
     //The PDS implementation creates in lowercase, then converts to uppercase.
     //Just going a head and doing uppercase here.
     let slice_one = &full_code[0..5].to_ascii_uppercase();
···
     identifier: &str,
     password: &str,
     two_factor_code: Option<String>,
+    oauth: bool,
 ) -> anyhow::Result<AuthResult> {
     // Determine identifier type
     let id_type = IdentifierType::what_is_it(identifier.to_string());
···
         // Verify password before proceeding to 2FA email step
         let verified = verify_password(password, &password_scrypt).await?;
         if !verified {
+            if oauth {
+                return Ok(AuthResult::WrongIdentityOrPassword);
+            }
             //Theres a chance it could be an app password so check that as well
             return match verify_app_password(&state.account_pool, &did, password).await {
                 Ok(valid) => {
···
                 }
             }
 
-            return match create_two_factor_token(&state.account_pool, did).await {
+            return match create_two_factor_token(&state.account_pool, did, oauth).await {
                 Ok(code) => {
                     let mut email_data = Map::new();
                     email_data.insert("token".to_string(), Value::from(code.clone()));
···
                         .template_engine
                         .render("two_factor_code.hbs", email_data)?;
 
-                    let email = Message::builder()
+                    let email_message = Message::builder()
                         //TODO prob get the proper type in the state
                         .from(state.mailer_from.parse()?)
                         .to(email.parse()?)
···
                                         .body(email_body),
                                 ),
                         )?;
-                    match state.mailer.send(email).await {
-                        Ok(_) => Ok(AuthResult::TwoFactorRequired),
+                    match state.mailer.send(email_message).await {
+                        Ok(_) => Ok(AuthResult::TwoFactorRequired(mask_email(email))),
                         Err(err) => {
                             log::error!("Error sending the 2FA email: {err}");
                             Err(anyhow!(err))
···
 pub async fn create_two_factor_token(
     account_db: &SqlitePool,
     did: String,
+    oauth: bool,
 ) -> anyhow::Result<String> {
     let purpose = "2fa_code";
 
-    let token = get_random_token();
+    let token = get_random_token(oauth);
     let right_now = Utc::now();
 
     let res = sqlx::query(
···
                      VALUES (?, ?, ?, ?)
                      ON CONFLICT(purpose, did) DO UPDATE SET
                        token=excluded.token,
-                       requestedAt=excluded.requestedAt",
+                       requestedAt=excluded.requestedAt
+                       WHERE did=excluded.did",
     )
     .bind(purpose)
     .bind(&did)
···
         Some((count,)) => count > 0,
     })
 }
+
+/// Mask an email address into a hint like "2***0@p***m".
+pub fn mask_email(email: String) -> String {
+    // Basic split on first '@'
+    let mut parts = email.splitn(2, '@');
+    let local = match parts.next() {
+        Some(l) => l,
+        None => return email.to_string(),
+    };
+    let domain_rest = match parts.next() {
+        Some(d) if !d.is_empty() => d,
+        _ => return email.to_string(),
+    };
+
+    // Helper to mask a single label (keep first and last, middle becomes ***).
+    fn mask_label(s: &str) -> String {
+        let chars: Vec<char> = s.chars().collect();
+        match chars.len() {
+            0 => String::new(),
+            1 => format!("{}***", chars[0]),
+            2 => format!("{}***{}", chars[0], chars[1]),
+            _ => format!("{}***{}", chars[0], chars[chars.len() - 1]),
+        }
+    }
+
+    // Mask local
+    let masked_local = mask_label(local);
+
+    // Mask first domain label only, keep the rest of the domain intact
+    let mut dom_parts = domain_rest.splitn(2, '.');
+    let first_label = dom_parts.next().unwrap_or("");
+    let rest = dom_parts.next();
+    let masked_first = mask_label(first_label);
+    let masked_domain = if let Some(rest) = rest {
+        format!("{}.{rest}", masked_first)
+    } else {
+        masked_first
+    };
+
+    format!("{masked_local}@{masked_domain}")
+}

src/oauth_provider.rs

···
 };
 use axum::body::Body;
 use axum::extract::State;
+use axum::http::header::CONTENT_TYPE;
 use axum::http::{HeaderMap, StatusCode};
 use axum::response::{IntoResponse, Response};
 use axum::{Json, extract};
 use serde::{Deserialize, Serialize};
 use tracing::log;
 
-#[derive(Serialize, Deserialize)]
-struct Root {
-    #[serde(rename = "CamelCaseJson")]
-    pub camel_case_json: i64,
-    #[serde(rename = "woahThisIsNeat")]
-    pub woah_this_is_neat: String,
-}
-
-#[derive(Serialize, Deserialize)]
+#[derive(Serialize, Deserialize, Clone)]
 pub struct SignInRequest {
     pub username: String,
     pub password: String,
···
 pub async fn sign_in(
     State(state): State<AppState>,
     headers: HeaderMap,
-    Json(payload): extract::Json<SignInRequest>,
+    Json(mut payload): extract::Json<SignInRequest>,
 ) -> Result<Response<Body>, StatusCode> {
     let identifier = payload.username.clone();
     let password = payload.password.clone();
···
 
     //TODO need to pass in a flag to ignore app passwords for Oauth
     // Run the shared pre-auth logic to validate and check 2FA requirement
-    match preauth_check(&state, &identifier, &password, auth_factor_token).await {
+    match preauth_check(&state, &identifier, &password, auth_factor_token, true).await {
         Ok(result) => match result {
             AuthResult::WrongIdentityOrPassword => oauth_json_error_response(
                 StatusCode::BAD_REQUEST,
                 "invalid_request",
                 "Invalid identifier or password",
             ),
-            AuthResult::TwoFactorRequired => {
+            AuthResult::TwoFactorRequired(masked_email) => {
                 // Email sending step can be handled here if needed in the future.
 
                 // {"error":"second_authentication_factor_required","error_description":"emailOtp authentication factor required (hint: 2***0@p***m)","type":"emailOtp","hint":"2***0@p***m"}
-                oauth_json_error_response(
-                    StatusCode::UNAUTHORIZED,
-                    "AuthFactorTokenRequired",
-                    "A sign in code has been sent to your email address",
-                )
+                let body_str = match serde_json::to_string(&serde_json::json!({
+                    "error": "second_authentication_factor_required",
+                    "error_description": format!("emailOtp authentication factor required (hint: {})", masked_email),
+                    "type": "emailOtp",
+                    "hint": masked_email,
+                })) {
+                    Ok(s) => s,
+                    Err(_) => return Err(StatusCode::BAD_REQUEST),
+                };
+
+                Response::builder()
+                    .status(StatusCode::BAD_REQUEST)
+                    .header(CONTENT_TYPE, "application/json")
+                    .body(Body::from(body_str))
+                    .map_err(|_| StatusCode::BAD_REQUEST)
             }
             AuthResult::ProxyThrough => {
                 //No 2FA or already passed
+                //I don't think it likes localhost. Maybe do
                 let uri = format!(
                     "{}{}",
                     state.pds_base_url, "/@atproto/oauth-provider/~api/sign-in"
···
                     req_headers.extend(headers.clone());
                 }
 
+                payload.email_otp = None;
                 let payload_bytes =
                     serde_json::to_vec(&payload).map_err(|_| StatusCode::BAD_REQUEST)?;
+                let body = serde_json::to_string(&payload).map_err(|_| StatusCode::BAD_REQUEST)?;
+
                 let req = req
                     .body(Body::from(payload_bytes))
                     .map_err(|_| StatusCode::BAD_REQUEST)?;

src/xrpc/com_atproto_server.rs

···
 use serde::{Deserialize, Serialize};
 use serde_json;
 use tracing::log;
+use tracing::log::log;
 
 #[derive(Serialize, Deserialize, Debug, Clone)]
 #[serde(rename_all = "camelCase")]
···
 pub struct CreateSessionRequest {
     identifier: String,
     password: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
     auth_factor_token: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
     allow_takendown: Option<bool>,
 }
 
 pub async fn create_session(
     State(state): State<AppState>,
     headers: HeaderMap,
-    Json(payload): extract::Json<CreateSessionRequest>,
+    Json(mut payload): extract::Json<CreateSessionRequest>,
 ) -> Result<Response<Body>, StatusCode> {
     let identifier = payload.identifier.clone();
     let password = payload.password.clone();
     let auth_factor_token = payload.auth_factor_token.clone();
 
     // Run the shared pre-auth logic to validate and check 2FA requirement
-    match preauth_check(&state, &identifier, &password, auth_factor_token).await {
+    match preauth_check(&state, &identifier, &password, auth_factor_token, false).await {
         Ok(result) => match result {
             AuthResult::WrongIdentityOrPassword => json_error_response(
                 StatusCode::UNAUTHORIZED,
                 "AuthenticationRequired",
                 "Invalid identifier or password",
             ),
-            AuthResult::TwoFactorRequired => {
+            AuthResult::TwoFactorRequired(_) => {
                 // Email sending step can be handled here if needed in the future.
                 json_error_response(
                     StatusCode::UNAUTHORIZED,
···
                 )
             }
             AuthResult::ProxyThrough => {
+                log::info!("Proxying through");
                 //No 2FA or already passed
                 let uri = format!(
                     "{}{}",