From 5b316a5617ae22ad2a9d450daaec1ca4211704a1 Mon Sep 17 00:00:00 2001
From: Anton Afanasyeu <a.afanasieff@gmail.com>
Date: Wed, 8 Jul 2026 14:55:52 +0200
Subject: [PATCH] Clarify 2FA QR scan copy and bump identity/platform-php deps.

Phone-camera approval flow wording; sync deps for shortener QR PNG and secure session cookies.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 deps/ac-ms-identity            | 2 +-
 views/two_factor_challenge.php | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/deps/ac-ms-identity b/deps/ac-ms-identity
index d50c426..835f021 160000
--- a/deps/ac-ms-identity
+++ b/deps/ac-ms-identity
@@ -1 +1 @@
-Subproject commit d50c426303a25e1a927067578500d0fa204ae95d
+Subproject commit 835f02153e3a9edf3e31d4c0aa2af7fd88362ba9
diff --git a/views/two_factor_challenge.php b/views/two_factor_challenge.php
index c7e494d..1e5e3b0 100644
--- a/views/two_factor_challenge.php
+++ b/views/two_factor_challenge.php
@@ -43,9 +43,9 @@ if (!isset($twofaQr)) {
   <form class="login-card" method="post" action="<?= h($auth) ?>/two-factor" id="twofa-form">
     <h1 data-i18n="twofa.title">Two-factor authentication</h1>
     <?php if (is_array($twofaQr) && !empty($twofaQr['qr_url'])): ?>
-      <p class="muted" data-i18n="twofa.hint_scan">Scan the QR code with your phone to approve this sign-in, or enter the 6-digit code below.</p>
+      <p class="muted" data-i18n="twofa.hint_scan">Scan with your <strong>phone camera</strong> (not Google Authenticator) to approve this sign-in on another device, or enter the 6-digit code from your authenticator app below.</p>
       <figure class="twofa-qr-wrap" id="twofa-qr-wrap">
-        <img src="<?= h((string) $twofaQr['qr_url']) ?>" width="160" height="160" alt="QR code — scan to approve sign-in on this device" class="twofa-qr">
+        <img src="<?= h((string) $twofaQr['qr_url']) ?>" width="160" height="160" alt="QR code — scan with phone camera to approve sign-in" class="twofa-qr">
         <figcaption class="muted" data-i18n="twofa.qr_caption">
           Phone camera → tap link → Approve
           <?php if (!empty($twofaQr['short_url'])): ?>