Name the address the code was sent to

[nursoda]

The login challenge said that a code had been sent, but not where to. A user who
receives nothing could not tell whether the account carries the right address at
all — the one question the screen has to answer before anyone reaches for their
mailbox. It now names the address in the same masked form the personal settings
use: a*@*.org.

The address sits inside the two existing sentences rather than on a line of its
own. A separate line would state the same fact twice, and as a bare fragment it
gives a translator no subject and no verb to make the address agree with; several
languages need it inside the sentence to inflect it at all.

Showing the address made a second thing urgent. EMailAddressMasker used to
return anything it could not parse unchanged — harmless while only the
settings read it, a disclosure once a login screen prints it. An address whose local part is quoted —
"jo hn"@example.org, which the standard allows — may hold a space or a second
@ and is delivered normally, and an address written
through occ passes no validation at all. Such a value is now hidden whole. The
placeholder for it names no address, so both screens that show one — the login
challenge and the enrolment step — turn it into the empty string and use the
wording that names no address instead.

Translations lag behind, on purpose

Three strings are new: the two sentences that name the address, and the
enrolment screen's variant without one (Codes will be sent to your primary email address., with a full stop where the existing one has a colon). Until Transifex has
them, a non-English instance renders them in English while every other string
stays translated — including the fallback sentences, which are unchanged and keep
their existing translations. This is the normal case, not an edge case, so expect
it to be visible.

The l10n bot runs almost daily, but it only sees strings that reached main.
Merging a few days before a release rather than on the day of it is what closes
this; there is nothing to fix in the code.

Not to be merged alone

Once the page names the address, a code that stays valid across an address change
would make that line name the wrong mailbox. security/drop-the-code-when-the-address-changes
is what closes that. Merge it first, or both together.

Checked

• 96 smoke checks green against Nextcloud 33.0.7 and 34.0.2 (tests/smoke/smoke.sh)
• unit, psalm, psalm taint, php-cs-fixer, eslint, stylelint and the Vitest suite green
• browser pass on a German instance through all four screen states: address named,
  reload, an address the mask cannot take apart, and no address at all
• the two new smoke assertions forced red by handing the template the raw address —
  exactly those two turned, and nothing else

🤖 Generated with Claude Code, verified, tweaked and approved by @nursoda.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!