Add email OTP first-factor sign-in support

[Silviu Petrescu (spetrescu84)]

Summary

• map Native Auth V2 email-code sign-in start results to the public code-required state
• submit and resend first-factor email codes using sign-in-specific API IDs
• complete sign-in after code verification or transition into the existing MFA flow
• reject code operations for unsupported sign-up and unknown scenarios
• add regression coverage for code submission, resend, completion, invalid codes, and MFA transitions

Dependency

• Requires Add email OTP first-factor sign-in support microsoft-authentication-library-common-for-android#3252

Testing

• :msal:testLocalDebugUnitTest --tests com.microsoft.identity.nativeauth.v2.NativeAuthV2InterfaceKotlinTest --tests com.microsoft.identity.nativeauth.v2.NativeAuthV2SignInTest

[github-actions]

❌ Work item link check failed. Description does not contain AB#{ID}.

Click here to Learn more.

[Copilot]

🔵 Needs a closer look

It changes core authentication state-machine behavior for sign-in (including new first-factor OTP and MFA transitions) and depends on aligned Common changes, which warrants final human verification of end-to-end semantics and compatibility.

Pull request overview

This PR extends MSAL Native Auth V2 sign-in to support email one-time passcode (OTP) as a first factor, mapping Common’s V2 “code required” start responses into the public CodeRequired result and enabling submit/resend code operations using sign-in–specific Public API IDs, with transitions into the existing MFA flow when required.

Changes:

• Map V2 sign-in start CodeRequired results to NativeAuthResultV2.CodeRequired and expose code metadata (length, target label, channel).
• Update CodeRequiredStateV2 to use scenario-specific Public API IDs for submit/resend and support MFARequired as a submit-code outcome; reject unsupported scenarios.
• Add/extend regression tests covering first-factor code submission, resend, completion, invalid code recovery, and MFA transition behavior.

File summaries

File	Description
msal/src/main/java/com/microsoft/identity/nativeauth/NativeAuthPublicClientApplication.kt	Maps sign-in start CodeRequired into the public code-required state with email OTP metadata.
msal/src/main/java/com/microsoft/identity/nativeauth/statemachine/states/CodeRequiredStateV2.kt	Routes submit/resend to sign-in vs reset-password API IDs, rejects unsupported scenarios, and maps submit-code MFA transitions.
msal/src/test/java/com/microsoft/identity/nativeauth/v2/NativeAuthV2SignInTest.kt	Adds parity/regression tests for email OTP first-factor sign-in flows (submit, resend, complete, invalid, MFA transition).
msal/src/test/java/com/microsoft/identity/nativeauth/v2/NativeAuthV2InterfaceKotlinTest.kt	Adds coverage ensuring code operations reject unsupported scenarios (sign-up/unknown).

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.