fix: allow emailOTP only for epic store

[lorux0]

What does this PR change?

Fixes #9554
Works as mitigation change, not final solution.

Test instructions

1. Download epic store build
2. Check that you only have one login option: emailOTP
3. Go through the login and check is OK
4. Download the normal build
5. Check you have all of the login options enabled

Quality Checklist

• Changes have been tested locally
• Documentation has been updated (if required)
• Performance impact has been considered
• For SDK features: Test scene is included

Code Review Reference

Please review our Branch & PR Standards before submitting. It explains the automated review flow, QA/DEV approval requirements, and what each label does — especially useful for first-time contributors.

[github-actions]

Windows and Mac build successful in Unity Cloud! You can find a link to the downloadable artifact below.

Name	Link
Commit	8582a76
Logs	https://github.com/decentraland/unity-explorer/actions/runs/30673329384
Download Windows	https://github.com/decentraland/unity-explorer/suites/83187522625/artifacts/8810062580
Download Windows S3	https://explorer-artifacts.decentraland.org/@dcl/unity-explorer/branch/hotfix/epic-login/pr-24422-8582a76/Decentraland_windows64.zip
Download Mac	https://github.com/decentraland/unity-explorer/suites/83187522625/artifacts/8810067511
Download Mac S3	https://explorer-artifacts.decentraland.org/@dcl/unity-explorer/branch/hotfix/epic-login/pr-24422-8582a76/Decentraland_macos.zip
Built on	2026-08-01T00:14:29Z

[decentraland-bot]

PR Review — #9555 fix: allow emailOTP only for epic store

STEP 2 — Root-cause check

PASS. This is an acknowledged mitigation for #9554. Epic builds cannot receive decentraland:// deeplink callbacks, so wallet/social login is completely blocked. Hiding those options and forcing email OTP is a valid interim fix. The PR description explicitly states this is "not final solution" — acceptable.

STEP 3 — Design & integration

PASS. No new long-lived units introduced. The otherLoginMethodsEnabled flag flows through the existing controller → state → view pattern, which is the correct seam for this change. The installSource string is already injected into the controller; deriving isEpicBuild from it is the natural place. The LoginSelectionAuthState stores the flag and passes it to the view on Enter(int) — this correctly covers all entry points (Enter(int) called from Enter(ErrorType) and directly from the controller).

Owner search: N/A — no new lifecycle-managing units.

STEP 4 — Member audit

Member	File	Consumers	Verdict
OtherLoginContainer	LoginSelectionAuthView	Show() (1)	Serialized Unity reference — appropriate
ContinueWithTextContainer	LoginSelectionAuthView	Show() (1)	Serialized Unity reference — appropriate
otherLoginMethodsEnabled	LoginSelectionAuthState	Enter(int) → view.Show() (1)	State-machine pass-through — appropriate
EPIC_STORE_INSTALL_SOURCE	AuthenticationScreenController	OnViewInstantiated() (1)	Named constant — appropriate

STEP 5 — Line-level findings

See inline comments. Two P2 findings:

1. P2 — Null-forgiving operator (!) on viewInstance without justifying comment
2. P2 — ToggleOptionsPanelExpansion() bypasses the otherLoginMethodsEnabled guard on SetOptionsPanelVisibility

Security review

No security issues found. The change restricts available login methods (does not add new attack surface). The installSource comparison uses a build-time constant. No secrets, no injection vectors, no auth bypass.

STEP 6 — Complexity

COMPLEX — modifies login method availability in the authentication flow; touches 4 files including auth screen controller and state machine.

STEP 7 — QA assessment

QA_REQUIRED: YES — changes the login screen UI and available authentication methods for Epic builds. Needs manual verification on both Epic and non-Epic builds.

STEP 8 — Non-blocking warnings

None. Main scene not modified.

STEP 9 — Verdict

REVIEW_RESULT: PASS ✅
COMPLEXITY: COMPLEX
COMPLEXITY_REASON: Modifies login method availability in the authentication screen flow, gating UI and state by install source.
QA_REQUIRED: YES

---

Reviewed by Jarvis 🤖 · Requested by decentraland-bot via GitHub

[github-actions]

🔍 Jarvis reviewed this PR and found no blocking issues, but assessed it as complex — human DEV review is still required before merging.

[decentraland-bot]

Automated review

STEP 1 — Load context & set scope

Loaded CLAUDE.md, docs/README.md, docs/web3-authentication.md, docs/mvc.md, and docs/code-style-guidelines.md. Checked out PR #9555 locally and reviewed the changed auth UI/controller files plus related auth/provider wiring.

STEP 2 — Root-cause check

The immediate Epic blocker is that web3/social login depends on the decentraland:// callback, which Epic installs do not own. This PR mitigates the production blocker by exposing only Email OTP for Epic builds while leaving normal launcher builds unchanged. For that scoped mitigation, the diff addresses the immediate user-facing cause; the protocol-handler/web3 callback gap remains a separate follow-up.

STEP 3 — Design & integration

No new long-lived system/plugin/service/controller is introduced. The lifecycle owner for this UI remains Web3AuthenticationPlugin → AuthenticationScreenController, and state transitions remain in the existing auth FSM. The view changes stay inside LoginSelectionAuthView, consistent with docs/mvc.md view responsibilities.

Teardown/consumption trace: no new subscriptions, callbacks, native resources, or buffers were added. Existing AddListener/Submitted += hooks in LoginSelectionAuthState still have matching cleanup in Exit() via RemoveAllListeners() and Submitted -= OTPLogin.

STEP 4 — Member audit

New/changed public members:

• LoginSelectionAuthView.OtherLoginContainer: 1 consumer (Show) — serialized Unity reference, acceptable view wiring.
• LoginSelectionAuthView.ContinueWithTextContainer: 1 consumer (Show) — serialized Unity reference, acceptable view wiring.
• LoginSelectionAuthView.Show(int, bool, bool): 1 consumer (LoginSelectionAuthState.Enter(int)) — existing view API extended to receive login-method visibility.

No single-use derived predicate or redundant accessor issue found.

STEP 5 — Line-level review

Found one low-risk robustness issue below. Security pass: no security issues found.

STEP 6 — Complexity assessment

COMPLEX: this touches runtime authentication UI and login-method gating, which is user-facing and auth-sensitive even though the code diff is small.

STEP 7 — QA assessment

QA_REQUIRED: YES, because this changes runtime authentication UI behavior and must be verified on Epic and non-Epic builds.

STEP 8 — Non-blocking warnings

No main scene changes. CI is currently partially pending; approval-gate checks are failing only because QA/DEV approvals are still required.

REVIEW_RESULT: PASS ✅
COMPLEXITY: COMPLEX
COMPLEXITY_REASON: Runtime authentication UI and login-method gating are changed for Epic builds.
QA_REQUIRED: YES

---

Reviewed by Jarvis 🤖 · Requested by Ignacio Mazzara (<@U9ETM8CJH>) via Slack

[github-actions]

Warnings not reduced: 14004 => 14062 — remove at least 59 warnings to merge.

Warnings/errors in files changed by this PR (12)

Assets/DCL/AuthenticationScreenFlow/Views/LoginSelectionAuthView.cs:91  CSharpWarnings::CS8618  Non-nullable field 'animator' is uninitialized. Consider adding the 'required' modifier or declaring the field as nullable.
Assets/DCL/AuthenticationScreenFlow/Views/LoginSelectionAuthView.cs:92  CSharpWarnings::CS8618  Non-nullable field 'canvasGroup' is uninitialized. Consider adding the 'required' modifier or declaring the field as nullable.
Assets/DCL/AuthenticationScreenFlow/Views/LoginSelectionAuthView.cs:94  CSharpWarnings::CS8618  Non-nullable field 'loadingSpinner' is uninitialized. Consider adding the 'required' modifier or declaring the field as nullable.
Assets/DCL/AuthenticationScreenFlow/Views/LoginSelectionAuthView.cs:95  CSharpWarnings::CS8618  Non-nullable field 'mainElementsPanel' is uninitialized. Consider adding the 'required' modifier or declaring the field as nullable.
Assets/DCL/AuthenticationScreenFlow/Views/LoginSelectionAuthView.cs:88  CSharpWarnings::CS8618  Non-nullable field 'moreOptionsPanel' is uninitialized. Consider adding the 'required' modifier or declaring the field as nullable.
Assets/DCL/AuthenticationScreenFlow/AuthenticationScreenController.cs:95  CSharpWarnings::CS8618  Non-nullable members 'DiscordButtonClicked', 'OTPVerified', 'OTPResend', 'ProfileFinalized', 'fsm', 'audio' must contain non-null values when exiting constructor. Consider adding the 'required' modifiers or declaring the members as nullable.
Assets/DCL/AuthenticationScreenFlow/AuthenticationScreenController.cs:90  ConditionalAccessQualifierIsNonNullableAccordingToAPIContract  Conditional access qualifier expression is never null according to nullable reference types' annotations
Assets/DCL/AuthenticationScreenFlow/AuthenticationScreenController.cs:178  ConditionalAccessQualifierIsNonNullableAccordingToAPIContract  Conditional access qualifier expression is never null according to nullable reference types' annotations
Assets/DCL/AuthenticationScreenFlow/AuthenticationScreenController.cs:179  ConditionalAccessQualifierIsNonNullableAccordingToAPIContract  Conditional access qualifier expression is never null according to nullable reference types' annotations
Assets/DCL/AuthenticationScreenFlow/AuthenticationScreenController.cs:295  ConditionalAccessQualifierIsNonNullableAccordingToAPIContract  Conditional access qualifier expression is never null according to nullable reference types' annotations
Assets/DCL/AuthenticationScreenFlow/AuthenticationScreenController.cs:75  InconsistentNaming  Name 'CurrentRequestID' does not match rule 'members_should_be_pascal_case'. Suggested name is 'CurrentRequestId'.
Assets/DCL/AuthenticationScreenFlow/States/LoginSelectionAuthState.cs:90  RedundantSuppressNullableWarningExpression  The nullable warning suppression expression is redundant

[github-actions]

All Unity tests passed ✅

TESTS SUITE	Result	Passed	Failed	Skipped
EditMode	✅ Passed	24202	0	13
PlayMode	✅ Passed	236	0	5

[anicalbano]

✔️ Tested on Windows and macOS
✔️ Email OTP
✔️ Metamask
✔️ Google
✔️ New user

31.07.2026_21.25.32_REC.mp4