Account Protection: Update password detection flow

[dkmyta]

Description

Updates the password detection flow to accomodate change to scope

TODOs:

• https://github.com/Automattic/jetpack-scan-team/issues/1683

Proposed changes:

• Hooks up the email endpoint
• Hooks up the password validation endpoint
• Updates the detection flow to send auth codes
• Optimization and organization improvements

Other information:

• Have you written new tests for your changes, if applicable?
• Have you checked the E2E test CI results, and verified that your changes do not break them?
• Have you tested your changes on WordPress.com, if applicable (if so, you'll see a generated comment below with a script to run)?

Jetpack product discussion

• https://github.com/Automattic/jetpack-scan-team/issues/1676

Does this pull request change what data or activity we track or use?

• No

Testing instructions:

• Checkout this branch
• Run Jurassic Tube
• Install and activate either Jetpack or Protect and enable the Account Protection settings
• Log out and proceed to the wp-login.php form an attempt to log in
• Ensure that after the validation fails you are redirected to wp-login.php?action=password-detection and that the initial state of the page is styled as per designs and you are presented relevant details and options
• Ensure that the Resend email action sends an additional email, and enforces a limit of 3 attempts
• Ensure an email is received and that the contents are as expected (via wp_mail() and WPcom server)
• Verify that supplying the correct auth code logs you in and you are appropriately redirected
• Ensure no regressions are introduced to core functionality and that the functionality only applies when the toggle is enabled
• Review the package code responsible for each task

Screenshot

[ArSn]

Except for the blog URL in the email, I think most of these points are just some small stuff suggestions. Nice work!

[dkmyta]

@ArSn Regarding this comment, I made an attempt to correct this only to recall why I set it that way originally - the static analysis check returns an error when I use a void return or hint. I couldn't find a proper combination to resolve that other than using never.

[ArSn]

Works well. 👍🏻

Two things of note:

• There is no "visual confirmation" when resending the 2FA mail, this may be confusing to users (showing a message that it was resent when it was might be wise)
• I don't think we're recommending the user to update the password anywhere in this flow right now (not sure if we have it planned in a different PR?)

Both are not blocking for this PR though.