# `MishkaCmsCore.Accounts.SecondFactor.Pending`
[🔗](https://github.com/mishka-group/mishka_cms_core/blob/v0.0.1/lib/mishka_cms_core/accounts/_second_factor_pending.ex#L5)

The code step of a sign-in that could not ask for the code itself — one with a provider such as
Google or GitHub.

`MishkaCmsCoreWeb.AuthController` opens no session for an account with an authenticator. It hands
the sign-in page `token/1` instead: AshAuthentication's own token, with the purpose
`"second_factor"`, for that account, for five minutes, which is no bearer credential and signs
nobody in. The page's code step sends it back with a code to `sign_in_with_second_factor`
(`prepare/3`), where it is checked, spent, and exchanged for the short sign-in token the password
sign-in hands out — the same route then opens the session.

# `init`

# `prepare`

The preparation of `sign_in_with_second_factor`, before the code is asked: only the account the
`token` argument names, while it is a live `"second_factor"` token of this site; and after the
code passed, the token spent and a sign-in token on the account's `:token` metadata.

# `supports`

# `temporal_safe?`

# `token`

```elixir
@spec token(MishkaCmsCore.Accounts.User.t()) :: {:ok, String.t()} | {:error, term()}
```

A token that names `user` as waiting for its code, for five minutes.

---

*Consult [api-reference.md](api-reference.md) for complete listing*