Apply review feedback:

- better form options
- define listener event on method instead of class
- avoid initializing new totp secret on every request

src/Controller/UserController.php

@@ -265,7 +265,7 @@ public function enableTwoFactorAuthAction(Request $req, #[VarName('name')] User
             throw $this->createAccessDeniedException('You cannot change this user\'s two-factor authentication settings');
         }
 
-        $secret = (string) $req->getSession()->get('2fa_secret', $authenticator->generateSecret());
+        $secret = (string) $req->getSession()->get('2fa_secret') ?: $authenticator->generateSecret();
         // Temporarily store this code on the user, as we'll need it there to generate the
         // QR code and to check the confirmation code.  We won't actually save this change
         // until we've confirmed the code

src/EventListener/ResolvedTwoFactorCodeCredentialsListener.php

@@ -17,9 +17,9 @@
 use Symfony\Component\EventDispatcher\Attribute\AsEventListener;
 use Symfony\Component\Security\Http\Event\AuthenticationTokenCreatedEvent;
 
-#[AsEventListener(event: AuthenticationTokenCreatedEvent::class, method: 'onAuthenticationTokenCreated', priority: 512)]
 class ResolvedTwoFactorCodeCredentialsListener
 {
+    #[AsEventListener(event: AuthenticationTokenCreatedEvent::class, priority: 512)]
     public function onAuthenticationTokenCreated(AuthenticationTokenCreatedEvent $event): void
     {
         if ($event->getPassport()->getBadge(ResolvedTwoFactorCodeCredentials::class)) {

src/Form/ResetPasswordFormType.php

@@ -26,8 +26,9 @@ class ResetPasswordFormType extends AbstractType
     public function configureOptions(OptionsResolver $resolver): void
     {
         $resolver
-            ->setDefault('user', null)
-            ->setAllowedTypes('user', User::class);
+            ->define('user')
+            ->allowedTypes(User::class)
+            ->required();
     }
 
     public function buildForm(FormBuilderInterface $builder, array $options): void

src/Form/Type/EnableTwoFactorAuthType.php

@@ -37,8 +37,9 @@ public function configureOptions(OptionsResolver $resolver): void
         $resolver
             ->setDefaults([
                 'data_class' => EnableTwoFactorRequest::class,
-                'user' => null,
             ])
-            ->setAllowedTypes('user', User::class);
+            ->define('user')
+            ->allowedTypes(User::class)
+            ->required();
     }
 }