working version

src/main/java/eu/oskar3123/spigot2fa/Main.java

@@ -31,7 +31,7 @@ public class Main extends JavaPlugin
     @Override
     public void onDisable()
     {
-
+        this.tfaHandler.abortAll();
     }
 
     private void registerCommands()

src/main/java/eu/oskar3123/spigot2fa/command/TFACommand.java

@@ -21,7 +21,7 @@ public class TFACommand implements CommandExecutor, TabCompleter
     private TFAHandler th;
     private final Map<String, String[]> TAB_COMPLETE_MAP = new HashMap<>();
     {
-        TAB_COMPLETE_MAP.put("", new String[]{"add", "remove", "<code>"});
+        TAB_COMPLETE_MAP.put("", new String[]{"activate", "remove", "<code>"});
         TAB_COMPLETE_MAP.put(":remove", new String[]{"[player]"});
     }
 
@@ -74,7 +74,7 @@ public class TFACommand implements CommandExecutor, TabCompleter
                 return true;
             }
         }
-        else if (args.length >= 1 && args[0].equalsIgnoreCase("add"))
+        else if (args.length >= 1 && args[0].equalsIgnoreCase("activate"))
         {
             if (!player.hasPermission("2fa.activate"))
             {
@@ -99,6 +99,12 @@ public class TFACommand implements CommandExecutor, TabCompleter
                 return true;
             }
             else
+            {
+                player.sendMessage("Confirm the activation by typing /2fa <code>.");
+                return true;
+            }
+        }
+        else if (args.length >= 1)
         {
             String secret = th.getKey(player.getUniqueId());
             String pCode = StringUtils.join(args);
@@ -115,7 +121,6 @@ public class TFACommand implements CommandExecutor, TabCompleter
                 return true;
             }
         }
-        }
         else
         {
             if (th.isInProcess(player.getUniqueId()))

src/main/java/eu/oskar3123/spigot2fa/handler/TFAHandler.java

@@ -4,6 +4,7 @@ import eu.oskar3123.spigot2fa.Main;
 import eu.oskar3123.spigot2fa.map.QRMapRenderer;
 import eu.oskar3123.spigot2fa.tfa.TFA;
 import org.bukkit.Bukkit;
+import org.bukkit.Location;
 import org.bukkit.Material;
 import org.bukkit.configuration.Configuration;
 import org.bukkit.entity.Player;
@@ -28,6 +29,19 @@ public class TFAHandler
         this.plugin = plugin;
     }
 
+    public void abortAll()
+    {
+        for (Player player : Bukkit.getOnlinePlayers())
+        {
+            if (!isInProcess.containsKey(player.getUniqueId()))
+            {
+                continue;
+            }
+            isInProcess.remove(player.getUniqueId());
+            player.getInventory().setItemInMainHand(new ItemStack(Material.AIR));
+        }
+    }
+
     public boolean shouldBypassCode(Player player)
     {
         UUID uuid = player.getUniqueId();
@@ -94,6 +108,7 @@ public class TFAHandler
     public void creatingFailed(Player player)
     {
         remove(player.getUniqueId());
+        player.getInventory().setItemInMainHand(new ItemStack(Material.AIR));
     }
 
     public boolean matchCode(String secret, String code)
@@ -147,6 +162,9 @@ public class TFAHandler
             mapMeta.setMapId(view.getId());
             map.setItemMeta(mapMeta);
             player.getInventory().setItemInMainHand(map);
+            Location loc = player.getLocation();
+            loc.setPitch(90f);
+            player.teleport(loc);
             player.sendMap(view);
             return true;
         }

src/main/java/eu/oskar3123/spigot2fa/listener/AuthListener.java

@@ -50,7 +50,6 @@ public class AuthListener implements Listener
     {
         if (plugin.tfaHandler.shouldBypassCode(event.getPlayer()))
         {
-            event.getPlayer().sendMessage("bypassed 2fa check");
             return;
         }
         final Player player = event.getPlayer();
@@ -77,7 +76,7 @@ public class AuthListener implements Listener
         {
             return;
         }
-        boolean correct = plugin.tfaHandler.matchCode(event.getPlayer(), event.getMessage());
+        boolean correct = plugin.tfaHandler.matchCode(event.getPlayer(), event.getMessage().replace(" ", ""));
         event.setCancelled(true);
         if (!correct)
         {

src/main/resources/plugin.yml

@@ -5,5 +5,5 @@ authors: [oskar3123]
 main: eu.oskar3123.spigot2fa.Main
 commands:
   2fa:
-    usage: '/<command> add/remove/<code>'
+    usage: '/<command> activate/remove/<code>'
     description: 'Two-factor authorization command'