feat: QR code login option in the web login page

The QR login plumbing (CallQrGenerator wrapping LoginWithQRCode, QR
rendering in Index) existed but nothing invoked it, and it could not
have worked from the web anyway: when the account has 2FA,
LoginWithQRCode asks for the password through Config("password"), which
with the convenience constructor prompts on the console - QR login only
worked when driving the library from a terminal.

Wire it end to end:
- The main client is now built with a custom config callback that
  routes the "password" request to the web UI: a QrPasswordNeeded event
  switches the login form to the 2FA password step and the value is
  handed back to the waiting login task, which blocks on a
  TaskCompletionSource (5 minute timeout) on its background thread.
- The login page offers "Log in with QR code" next to the phone step:
  it shows the tg://login QR (auto-refreshed by the library when each
  token expires), instructions and a back button; on success the shared
  post-login initialization runs and navigation proceeds as with the
  normal flow.
- DoLogin's post-login tail is extracted into CompleteLogin, reused by
  the QR flow.
- checkAuth: when a session exists but no user data file is saved (the
  QR case - there is no phone to save), attempt a silent session
  restore via DoLogin(null) instead of always bouncing to the phone
  step, so QR sessions survive app restarts.

Author: mateof

TelegramDownloader/Data/ITelegramService.cs

@@ -19,6 +19,7 @@ public interface ITelegramService
         Task<InvitationInfo?> getInvitationHash(long id);
         Task joinChatInvitationHash(string? hash);
         Task<User> CallQrGenerator(Action<string> func, CancellationToken ct, bool logoutFirst = false);
+        void ProvideQrLoginPassword(string password);
         Task<string> DownloadFile(ChatMessages message, string fileName = null, string folder = null, DownloadModel model = null, bool shouldAddToList = false);
         Task<Byte[]> DownloadFileStream(Message message, long offset, int limit);
         IAsyncEnumerable<byte[]> DownloadFileStreamChunks(Message message, long offset, long limit, CancellationToken ct = default);

TelegramDownloader/Data/TelegramService.cs

@@ -173,7 +173,20 @@ private void newClient()
             {
                 _logger.LogDebug(ex, "Could not snapshot the session file");
             }
-            client = new WTelegram.Client(Convert.ToInt32(GeneralConfigStatic.tlconfig?.api_id ?? Environment.GetEnvironmentVariable("api_id")), GeneralConfigStatic.tlconfig?.hash_id ?? Environment.GetEnvironmentVariable("hash_id"), UserService.USERDATAFOLDER + "/WTelegram.session");
+            string apiId = GeneralConfigStatic.tlconfig?.api_id ?? Environment.GetEnvironmentVariable("api_id");
+            string apiHash = GeneralConfigStatic.tlconfig?.hash_id ?? Environment.GetEnvironmentVariable("hash_id");
+            // Custom config callback instead of the convenience constructor: the
+            // QR login flow (LoginWithQRCode) asks for the 2FA password through
+            // Config("password") - with the default config that prompt would go
+            // to the console. Route it to the web UI instead.
+            client = new WTelegram.Client(what => what switch
+            {
+                "api_id" => apiId,
+                "api_hash" => apiHash,
+                "session_pathname" => UserService.USERDATAFOLDER + "/WTelegram.session",
+                "password" => RequestLoginPassword(),
+                _ => null
+            });
             ApplyConfiguredParallelTransfers(client);
             if (GeneralConfigStatic.config.ShouldShowLogInTerminal)
             {
@@ -585,9 +598,41 @@ async Task GuardedWorker(WTelegram.Client pc)
 
         #endregion
 
+        // 2FA password bridge for the QR login flow: WTelegram asks for the
+        // password via Config("password") on a background task; the UI is
+        // notified through QrPasswordNeeded and supplies the value with
+        // ProvideQrLoginPassword, unblocking the pending request.
+        private static TaskCompletionSource<string> qrPasswordRequest;
+        public static event EventHandler QrPasswordNeeded;
+
+        private static string RequestLoginPassword()
+        {
+            TaskCompletionSource<string> tcs = new TaskCompletionSource<string>(TaskCreationOptions.RunContinuationsAsynchronously);
+            qrPasswordRequest = tcs;
+            try
+            {
+                QrPasswordNeeded?.Invoke(null, EventArgs.Empty);
+            }
+            catch (Exception)
+            {
+            }
+            // Blocks the QR login background task, never the UI thread.
+            if (!tcs.Task.Wait(TimeSpan.FromMinutes(5)))
+                throw new TimeoutException("2FA password was not provided in time");
+            return tcs.Task.Result;
+        }
+
+        public void ProvideQrLoginPassword(string password)
+        {
+            qrPasswordRequest?.TrySetResult(password);
+        }
+
         public async Task<User> CallQrGenerator(Action<string> func, CancellationToken ct, bool logoutFirst = false)
         {
-            return await client.LoginWithQRCode(func, logoutFirst: logoutFirst, ct: ct);
+            User user = await client.LoginWithQRCode(func, logoutFirst: logoutFirst, ct: ct);
+            if (user != null)
+                await CompleteLogin();
+            return user;
         }
 
         public async Task<User> GetUser()
@@ -632,6 +677,16 @@ async Task<string> DoLogin(string loginInfo) // (add this method to your code)
                         return "pass"; // if user has enabled 2FA
                     default: break;
                 }
+            return await CompleteLogin();
+        }
+
+        /// <summary>
+        /// Post-login initialization shared by the interactive login flow and the
+        /// QR login flow: loads chats, resolves premium limits and notifies
+        /// subscribers.
+        /// </summary>
+        private async Task<string> CompleteLogin()
+        {
             await getAllChats();
             SetSplitSizeGB();
             if (client.User.flags.HasFlag(User.Flags.premium))
@@ -696,8 +751,20 @@ public async Task<string> checkAuth(string number, bool isPhone = false)
                 }
                 else
                 {
-                    _logger.LogInformation("No saved user data found, requesting phone");
-                    return "phone";
+                    // No saved phone (e.g. the session was created via QR login):
+                    // try to restore the session directly - Login(null) completes
+                    // silently when the stored session is still authorized and
+                    // returns the "phone" step otherwise.
+                    try
+                    {
+                        _logger.LogInformation("No saved user data found, attempting session restore");
+                        return await DoLogin(null) ?? "phone";
+                    }
+                    catch (Exception ex)
+                    {
+                        _logger.LogWarning(ex, "Session restore without saved user data failed, requesting phone");
+                        return "phone";
+                    }
                 }
 
             }

TelegramDownloader/Pages/Index.razor

@@ -43,6 +43,10 @@
                     <h1 class="login-title">Two-Factor Auth</h1>
                     <p class="login-subtitle">Enter your 2FA password</p>
                     break;
+                case "qr":
+                    <h1 class="login-title">Scan QR Code</h1>
+                    <p class="login-subtitle">Log in with your phone, no number needed</p>
+                    break;
                 case "ok":
                     <h1 class="login-title">Welcome Back!</h1>
                     <p class="login-subtitle">You are successfully authenticated</p>
@@ -81,6 +85,15 @@
                                        @bind-Value="Model!.value" placeholder="Enter your 2FA password" />
                         </div>
                         break;
+                    case "qr":
+                        <div class="text-center">
+                            <p class="login-subtitle" style="margin-bottom: 0;">
+                                Open Telegram on your phone and go to<br />
+                                <b>Settings &gt; Devices &gt; Link Desktop Device</b>,<br />
+                                then scan this code.
+                            </p>
+                        </div>
+                        break;
                     case "ok":
                         <div class="text-center">
                             <div class="success-badge">
@@ -98,6 +111,12 @@
                             <i class="bi bi-box-arrow-right"></i> Disconnect
                         </button>
                     }
+                    else if (Model.type == "qr")
+                    {
+                        <button class="btn-secondary-custom" type="button" @onclick="CancelQrLogin">
+                            <i class="bi bi-arrow-left"></i> Back to phone login
+                        </button>
+                    }
                     else
                     {
                         <button class="btn-primary-custom" type="submit">
@@ -119,6 +138,12 @@
                             </button>
                         }
                     }
+                    @if (Model.type == "phone")
+                    {
+                        <button class="btn-secondary-custom" type="button" @onclick="StartQrLogin">
+                            <i class="bi bi-qr-code-scan"></i> Log in with QR code
+                        </button>
+                    }
                 </div>
 
                 @if (!string.IsNullOrEmpty(imageString))
@@ -248,8 +273,75 @@
         }
     }
 
+    private bool qrMode = false;
+
+    private async Task StartQrLogin()
+    {
+        qrMode = true;
+        imageString = null;
+        Model.type = "qr";
+        source?.Cancel();
+        source = new CancellationTokenSource();
+        StateHasChanged();
+        TelegramService.QrPasswordNeeded += OnQrPasswordNeeded;
+        try
+        {
+            var user = await ts.CallQrGenerator(url => { _ = InvokeAsync(() => GenerateQR(url)); }, source.Token);
+            if (user != null)
+            {
+                imageString = null;
+                Model.type = "ok";
+                await InvokeAsync(StateHasChanged);
+                await isLogin();
+            }
+        }
+        catch (OperationCanceledException)
+        {
+            // User went back to phone login or left the page
+        }
+        catch (Exception ex)
+        {
+            Console.WriteLine($"QR login failed: {ex.Message}");
+            qrMode = false;
+            imageString = null;
+            Model.type = "phone";
+            await InvokeAsync(StateHasChanged);
+        }
+        finally
+        {
+            TelegramService.QrPasswordNeeded -= OnQrPasswordNeeded;
+        }
+    }
+
+    private void OnQrPasswordNeeded(object sender, System.EventArgs e)
+    {
+        // The QR was accepted on the phone but the account has 2FA: switch the
+        // form to the password step; Submit routes the value back to the
+        // pending QR login.
+        imageString = null;
+        Model.value = "";
+        Model.type = "pass";
+        _ = InvokeAsync(StateHasChanged);
+    }
+
+    private void CancelQrLogin()
+    {
+        qrMode = false;
+        imageString = null;
+        source?.Cancel();
+        Model.type = "phone";
+    }
+
     private async void Submit()
     {
+        if (qrMode && Model.type == "pass")
+        {
+            // 2FA password for a QR login: hand it to the waiting login task,
+            // which finishes the flow and navigates from StartQrLogin.
+            ts.ProvideQrLoginPassword(Model.value);
+            Model.value = "";
+            return;
+        }
         if (Model.type == "phone")
         {
             var phone = await JSRuntime.InvokeAsync<string>("getNumber");
@@ -308,6 +400,7 @@
 
     public void Dispose()
     {
+        TelegramService.QrPasswordNeeded -= OnQrPasswordNeeded;
         if (source != null)
         {
             if (source.Token.CanBeCanceled)