fix: prevent autofilled TOTP codes from being wiped on login

class-two-factor-core.php

@@ -154,14 +154,6 @@ public static function add_hooks( $compat ) {
 	public static function login_enqueue_scripts() {
 		$environment_prefix = file_exists( TWO_FACTOR_DIR . '/dist' ) ? '/dist' : '';
 
-		wp_register_script(
-			'two-factor-login',
-			plugins_url( $environment_prefix . '/providers/js/two-factor-login.js', __FILE__ ),
-			array(),
-			TWO_FACTOR_VERSION,
-			true
-		);
-
 		wp_register_script(
 			'two-factor-login-authcode',
 			plugins_url( $environment_prefix . '/providers/js/two-factor-login-authcode.js', __FILE__ ),
@@ -1127,7 +1119,7 @@ public static function login_html( $user, $login_nonce, $redirect_to, $error_msg
 		}
 		?>
 
-		<form name="validate_2fa_form" id="loginform" action="<?php echo esc_url( self::login_url( array( 'action' => $action ), 'login_post' ) ); ?>" method="post" autocomplete="off">
+		<form name="validate_2fa_form" id="loginform" action="<?php echo esc_url( self::login_url( array( 'action' => $action ), 'login_post' ) ); ?>" method="post">
 				<input type="hidden" name="provider"      id="provider"      value="<?php echo esc_attr( $provider_key ); ?>" />
 				<input type="hidden" name="wp-auth-id"    id="wp-auth-id"    value="<?php echo esc_attr( $user->ID ); ?>" />
 				<input type="hidden" name="wp-auth-nonce" id="wp-auth-nonce" value="<?php echo esc_attr( $login_nonce ); ?>" />

providers/class-two-factor-backup-codes.php

@@ -391,7 +391,7 @@ public function authentication_page( $user ) {
 		?>
 		<p>
 			<label for="authcode"><?php esc_html_e( 'Recovery Code:', 'two-factor' ); ?></label>
-			<input type="text" inputmode="numeric" name="two-factor-backup-code" id="authcode" class="input authcode" value="" size="20" pattern="[0-9 ]*" placeholder="<?php echo esc_attr( $code_placeholder ); ?>" data-digits="<?php echo esc_attr( $code_length ); ?>" />
+			<input type="text" inputmode="numeric" name="two-factor-backup-code" id="authcode" class="input authcode" value="" size="20" pattern="[0-9 ]*" placeholder="<?php echo esc_attr( $code_placeholder ); ?>" autocomplete="one-time-code" data-digits="<?php echo esc_attr( $code_length ); ?>" />
 		</p>
 		<?php
 		/**

providers/class-two-factor-email.php

@@ -374,7 +374,6 @@ public function authentication_page( $user ) {
 		<p class="two-factor-email-resend">
 			<input type="submit" class="button" name="<?php echo esc_attr( self::INPUT_NAME_RESEND_CODE ); ?>" value="<?php esc_attr_e( 'Resend Code', 'two-factor' ); ?>" />
 		</p>
-		<?php wp_enqueue_script( 'two-factor-login' ); ?>
 		<?php
 	}
 

providers/class-two-factor-totp.php

@@ -794,10 +794,6 @@ public function authentication_page( $user ) {
 		<?php
 		/** This action is documented in providers/class-two-factor-backup-codes.php */
 		do_action( 'two_factor_after_authentication_input', $this );
-		?>
-		<?php
-		wp_enqueue_script( 'two-factor-login' );
-
 		submit_button( __( 'Verify', 'two-factor' ) );
 	}
 

providers/js/two-factor-login-authcode.js

@@ -1,29 +1,35 @@
 /* global document */
 ( function() {
-	// Enforce numeric-only input for numeric inputmode elements.
+	// Enforce numeric-only input and normalize spacing for numeric inputmode
+	// authcode fields. Space insertion is derived from the current value
+	// (not a flag) so that autofilled codes — which deliver the full value
+	// in a single input event rather than character-by-character — are
+	// handled correctly.
 	var form = document.querySelector( '#loginform' ),
 		inputEl = document.querySelector( 'input.authcode[inputmode="numeric"]' ),
-		expectedLength = ( inputEl && inputEl.dataset ) ? inputEl.dataset.digits : 0,
-		spaceInserted = false;
+		expectedLength = ( inputEl && inputEl.dataset ) ? parseInt( inputEl.dataset.digits, 10 ) : 0,
+		halfLength = Math.floor( expectedLength / 2 );
 
 	if ( inputEl ) {
 		inputEl.addEventListener(
 			'input',
 			function() {
-				var value = this.value.replace( /[^0-9 ]/g, '' ).replace( /^\s+/, '' ),
+				var sanitized = this.value.replace( /[^0-9 ]/g, '' ).replace( /^\s+/, '' ),
+					digits    = sanitized.replace( / /g, '' ),
 					submitControl;
 
-				if ( ! spaceInserted && expectedLength && value.length === Math.floor( expectedLength / 2 ) ) {
-					value += ' ';
-					spaceInserted = true;
-				} else if ( spaceInserted && ! this.value ) {
-					spaceInserted = false;
+				// Insert a space at the midpoint when only the first half has
+				// been entered and no space is present yet. Checking the
+				// current value (not a flag) ensures this also fires after
+				// the field is cleared and re-typed.
+				if ( halfLength && sanitized.length === halfLength && digits.length === halfLength && sanitized.indexOf( ' ' ) === -1 ) {
+					sanitized += ' ';
 				}
 
-				this.value = value;
+				this.value = sanitized;
 
-				// Auto-submit if it's the expected length.
-				if ( expectedLength && value.replace( / /g, '' ).length === parseInt( expectedLength, 10 ) ) {
+				// Auto-submit once the full code length is reached.
+				if ( expectedLength && digits.length === expectedLength ) {
 					if ( form && typeof form.requestSubmit === 'function' ) {
 						form.requestSubmit();
 						submitControl = form.querySelector( '[type="submit"]' );