Very cool. One small glitch though: If I have Phabricator and use this to log in, I should not be able to enable Flarums TOTP since it's not used even if activated. Instead, users that use OAuth to log in should be pointed to Phabricator to enable TOTP there.
However, I noticed that Flarum 2FA features 3 backup codes (which is a good idea!) but Phabricator doesn't!
Also, one cannot NOT use Phabricator if one wants to use the same username or email address. That indicates that it's a common user auth database. If so, the both logins should have feature parity, e.g. by redirection all user auth settings to one of both systems.
I now disabled TOTP in Flarum and enabled it in Phabricator. Works fine to log into Flaum even if not both were logged out. But I don't have backup codes. What would happen if I loose my Auth app?
