---
id: UJ-002
title: Recover an account and harden sign-in with 2FA
actors: [user]
surface: zync-www -> app.zync.is
goal: Restore account access or add a second factor without weakening authentication.
trigger: User cannot sign in or opens security settings.
preconditions:
  - Recovery email/identity is valid; 2FA enrollment requires an authenticated user and supported phone flow.
success_state: Password is reset or 2FA is enrolled/verified; invalid attempts do not create a session.
source_specs:
  - docs/specs/2026-05-30-foundation-auth-rbac.md
  - docs/specs/2026-05-31-auth-2fa.md
  - docs/specs/2026-05-31-session-security.md
---

## Happy path

1. User requests password recovery → Zync sends a time-limited reset link to the verified recovery channel.
2. User opens link and submits a new password → Zync validates token/expiry, updates credentials, and requires a fresh sign-in.
3. Authenticated user opens security settings → starts phone 2FA enrollment.
4. User completes Firebase phone OTP → Zync stores the enrolled state and requires OTP on subsequent sign-ins.
5. User signs in with password + valid OTP → Zync creates the normal tenant session.

## Alternate and failure paths

- Unknown account, expired/reused token, weak password, invalid OTP, replay, or rate limit → reject without revealing sensitive account state.
- User loses trusted device → use the documented recovery path; do not bypass 2FA through a client-only flag.

## Permissions and boundaries

- Recovery proves control of the recovery channel, not ownership of another tenant.
- Security changes invalidate or re-authenticate affected sessions according to session policy.

## Source specs

- `docs/specs/2026-05-30-foundation-auth-rbac.md`
- `docs/specs/2026-05-31-auth-2fa.md`
- `docs/specs/2026-05-31-session-security.md`