Update email tfa patch to include "Disable Verify button on first landing to the tfa form"

[rebelmusic]

GovCMS/composer.json

Line 181 in 4217baa

"Create Email one-time-code Validation Plugin & related Setup Plugin - https://www.drupal.org/project/tfa/issues/2930541": "https://www.drupal.org/files/issues/2026-01-13/tfa-2930541-94.patch"

Any plans to get this in?

https://www.drupal.org/project/tfa_email_otp/issues/3469826

It is difficult to quantify how many users have been impacted by this design oversight, however, I have assisted numerous individuals who reported not receiving the 2FA email. Most initially report email deliverability issues and some report that email tfa is "not working".

[TobyWild]

+1 would be VERY useful! In the past I've had to do a form alter to provide additional description text and to change the weight of the buttons, but this is much cleaner.

[TobyWild]

@rebelmusic - This appears to be a patch to the module "tfa_email_otp" which is not in the Distro, we just have TFA.
The "tfa_email_otp" module only had a 1.0 release in November 2025.

While I do think it's an important usability issue, we would need a patch that alters the original TFA module code.

[TobyWild]

Ok, so this is a wacky one.

The TFA module doesn't include Email verification, it was originally only created from this Issue queue item (https://www.drupal.org/project/tfa/issues/2930541) which from it, creates the patch that is included in line 181 of the Composer.json.

This is already being included.

HOWEVER Apparently sick and tired of the patch not being included into the TFA module for the last SIX YEARS, it has been spun out to its own module.

So, we could remove the patch, and add the module:
composer require 'drupal/tfa_email_otp:^1.0'

Noting the comment on the module page:
If you migrated the email plugin from the patch, it is highly recommended using Drush to install this module to prevent a potential time-out error during the installation. Also, you have to make sure you clear the cache after installing this module and then remove the patch from your codebase (composer.json).

This is the prefered option, as the module has a D10/D11 stable release covered by the security advisory policy.
Compared with just a random patch from an issue queue.
The benefit being that the module release includes the updated Verify functionality, as that was released into the module as part of the stable 1.0.0 release.

Option Two is to use a second patch located in the tfa_email_otp, however it would need to be re-written because it's targeted on the tfa_email_otp file structure, and not the tfa module file structure.

This is provided by a second patch currently located in the tfa_email_otp module issue queue.
https://www.drupal.org/project/tfa_email_otp/issues/3469826