So I don't have to go modify production code to figure out that geolocation somehow blocks the login attempt.

Nevermind, I misread the code. You're setting $config['user'] to $login_as and then pass $config['user'], which of course leads to the same.

POC of an inspect command that gather some data.

Not really a full patch, but this seems to be necessary so we actually log in as user and not admin, which then also results in the folders being represented as INBOX instead of user/$name/INBOX@domain.

• Show "Redirecting..." message before redirect
• otp -> auth.token

Looks nice and concise. It seems the alternative would be to request the access token via a protected api route, which I suppose would require more manual handling to make the token then available to the server and refresh it when necessary, so this seems like a good option.

• Adjust cleanup to preserve the "before" timestamp.

Another less confusing option for the cache would be to use "before" and "after" in the cache instead of timestamps, because we really want to cache two separate things that a timestamp happens to separate usually (but not always).