Possibility to login via one-time authorization code (OTAC)

[kontrollanten]

Describe the problem to be solved

Currently users has to login via email and static password. Static passwords are hard to remember and is vulnerable for different kind of attacks.

Describe the solution you would like

Provide API and UX for plugins to implement login via OTAC. Example design:

This flow can be worked with regular login as well; in the first step only the email field is shown and in the next step the password field is shown.

What needs to be done in order to get plugins ability to implement this proposal:

• Divide the login flow into two steps.
• API for plugins to disable/hide the static password login and its settings (i.e. hide password from account settings).
• API for plugins to define a client login route.
• API for plugins to send emails. Not required, but would be nice to have.