Reconcile recovery by support reference and bound provider lookup

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

src/user_engine/factor_recovery.py

@@ -60,6 +60,7 @@ def page(csrf, result=None, submitted=None, management_url=''):
         'factor_not_owned_by_target':'That authenticator no longer belongs to this login. Check the target.',
         'reference_conflict':'This support reference belongs to another recovery. Check the recorded operation.',
         'invalid_request':'Enter a valid login and support reference.',
+        'account_not_found':'This directory login was not found. Check the exact login name.',
     }
     if failure:
         message=messages.get(failure,'Recovery could not be confirmed. A change may have occurred. Retry the same confirmation to reconcile the result, or check the support reference. Do not start another recovery blindly.')
@@ -72,6 +73,14 @@ def page(csrf, result=None, submitted=None, management_url=''):
         if result.get('replayed'):html+=' This retry confirmed the earlier change without repeating it.'
         html+='</p><h2>Return control to the user</h2><ol><li>Have the user sign in to authenticator management with their own password.</li><li>Enroll a replacement authenticator and prove possession with a generated code.</li><li>Test a fresh application sign-in with the new code before closing the support case.</li></ol><p>Applications requiring MFA remain inaccessible until a working factor is available. Never send passwords, setup QR codes or verification codes to the support case.</p>'
         if management_url:html+='<p><a href="'+escape(management_url,quote=True)+'">Open authenticator management</a></p>'
+    if result.get('status')=='not_found':
+        html+='<p>No provider recovery record matches this reference. Check the reference; this does not prove that no other operation occurred.</p>'
+    if result.get('status')=='pending':
+        html+='<h2>Recovery completion needs reconciliation</h2><p>Login: '+escape(result['user'])+'; authenticator: '+escape(result['serial'])+'. Current state: '+('active' if result['active'] else 'disabled')+'.</p>'
+        if result.get('confirmation'):
+            html+=apply_form(common,result['confirmation'],'Reconcile this recovery')
+        else:
+            html+='<p>The original administrator must reconcile this operation using the same support reference.</p>'
     factors=result.get('factors',[])
     if result.get('status')=='preview' and not factors:
         html+='<p>No active authenticators were found for this login. Check the spelling and account. No change was made.</p>'
@@ -81,6 +90,7 @@ def page(csrf, result=None, submitted=None, management_url=''):
     if failure and submitted.get('confirmation'):
         html+=apply_form(common,submitted['confirmation'],'Retry this recovery')
     html+='<form method="post" action="/platform/factor-recovery">'+common+hidden('action','preview')+'<label>Directory login <input name="user" maxlength="150" required value="'+escape(str(submitted.get('user','')),quote=True)+'"></label><label>Support reference <input name="reference" maxlength="150" required value="'+escape(str(submitted.get('reference','')),quote=True)+'"></label><button type="submit">Preview authenticators</button></form>'
+    html+='<form method="post" action="/platform/factor-recovery">'+common+'<input type="hidden" name="action" value="status"><label>Existing support reference <input name="reference" maxlength="150" required></label><button type="submit">Check recovery result</button></form>'
     html+='<p><a href="/platform">Cancel and return to platform administration</a> · <a href="/platform/activity">Investigate support activity</a></p>'
     return html