[MINOR][FEATURE] Add Native Auth V2 OTP sign-in

[Sergei Demchenko (antrix1989)]

Summary

Add email one-time passcode support to the Native Auth V2 sign-in flow.

• Prefer email OTP when sign-in starts without a password, while preserving password-first behavior when a password is supplied.
• Surface email challenges through MSALNativeAuthCodeRequiredState.
• Complete sign-in after OTP verification and preserve scopes and claims across code resend.
• Use sign-in-specific telemetry for code-based sign-in operations.

Validation

• Added focused V2 flow-controller unit coverage for first-factor selection, fallback behavior, OTP completion and errors, and resend continuation preservation.
• Build and tests were not run, per request.

[Copilot]

Pull request overview

Adds email one-time passcode (OTP) support to the Native Auth V2 sign-in flow, including end-to-end continuation handling (start → challenge → verify → complete) and expanded unit test coverage to validate the new first-factor selection and OTP continuation paths.

Changes:

• Updated V2 sign-in to prefer email OTP when starting without a password (with fallback to password), and to surface OTP challenges via MSALNativeAuthCodeRequiredState.
• Added sign-in support to submitCode (scenario-aware behavior + telemetry).
• Added/updated V2 flow-controller unit tests for OTP sign-in, OTP completion/error handling, and resend continuation preservation; updated changelog entry.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
MSAL/test/unit/native_auth/controllers/v2/MSALNativeAuthFlowControllerSignInTests.swift	Updates/extends sign-in V2 unit tests to cover email OTP selection, submit-code completion, and resend continuation preservation.
MSAL/src/native_auth/controllers/v2/MSALNativeAuthFlowController.swift	Implements OTP-first selection when no password is supplied, adds sign-in handling to submitCode, and adjusts continuation mapping for sign-in OTP flows.
CHANGELOG.md	Adds a TBD entry for Native Auth V2 email OTP sign-in.

Suppressed comments (1)

MSAL/src/native_auth/controllers/v2/MSALNativeAuthFlowController.swift:117

• First-factor method selection is currently keyed off parameters.password == nil, which disagrees with later logic that treats an empty password as “not provided” (!password.isEmpty checks).

Impact: Passing an empty string can select the password method (and potentially skip email OTP) but still behave like “no password” later, leading to inconsistent results.

Recommendation: Use the same normalized “hasPassword” condition for method preference and fallback ordering.

        let preferredMethod = parameters.password == nil
            ? methods.first(where: { $0.channelType.isEmailType })
            : methods.first(where: { $0.channelType.isPasswordType })
        let fallbackMethod = parameters.password == nil
            ? methods.first(where: { $0.channelType.isPasswordType })
            : methods.first(where: { $0.channelType.isEmailType })
        guard let method = preferredMethod ?? fallbackMethod else {

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

MSAL/test/unit/native_auth/controllers/v2/MSALNativeAuthFlowControllerSignInTests.swift:288

• The test name says “whenPasswordSupplied…”, but the setup passes an empty string via signInParameters(password: ""). This is inconsistent with the adjacent test that explicitly calls out the “non-nil empty password” precondition, and makes it harder to understand which input shape is being exercised.

Recommendation: Rename the test to explicitly mention the non-nil empty password precondition (or change the setup to pass a non-empty password).

    func test_signIn_whenPasswordSuppliedAndOnlyEmailAvailable_returnsCodeRequired() async {