diff --git a/sim/cluster0/cluster.env b/sim/cluster0/cluster.env
index 8480e15..cde82e7 100644
--- a/sim/cluster0/cluster.env
+++ b/sim/cluster0/cluster.env
@@ -59,7 +59,7 @@ GITEA_ROOT_URL=https://acl0.f0xx.org/app/androidcast_project/git/
GITEA_ORG=ac
# Global verify: lab FE vhost (set after ac-fe.conf on monstro); prod unchanged below
-LAB_PUBLIC_ORIGIN=https://acl0.f0xx.org
+LAB_PUBLIC_ORIGIN=https://apps.f0xx.org
PUBLIC_ORIGIN=https://apps.f0xx.org
SHORT_LINKS_PUBLIC_BASE=https://s.f0xx.org
# Staging cluster url-shortener API (internal HTTP + Host header)
diff --git a/sim/cluster0/lab-seeds/backend/public/index.php b/sim/cluster0/lab-seeds/backend/public/index.php
index 27ac0d4..567ccb3 100644
--- a/sim/cluster0/lab-seeds/backend/public/index.php
+++ b/sim/cluster0/lab-seeds/backend/public/index.php
@@ -310,6 +310,8 @@ if ($route === '/two-factor/approve' && $_SERVER['REQUEST_METHOD'] === 'POST') {
$approved = AuthApproval::approve($rawToken, (int) ($mobileUser['id'] ?? 0), Auth::clientIp());
} elseif ($rawToken !== '' && $totpCode !== '') {
$approved = AuthApproval::approveWithTotp($rawToken, $totpCode, Auth::clientIp());
+ } elseif ($rawToken !== '') {
+ $approved = AuthApproval::approveByLinkToken($rawToken, Auth::clientIp());
} else {
$returnUrl = Auth::authUrl('/two-factor/approve') . '?token=' . urlencode($rawToken);
header('Location: ' . Auth::authUrl('/login') . '?redirect=' . urlencode($returnUrl));
diff --git a/sim/cluster0/lab-seeds/backend/views/two_factor_approve.php b/sim/cluster0/lab-seeds/backend/views/two_factor_approve.php
index e0bfc22..61938cf 100644
--- a/sim/cluster0/lab-seeds/backend/views/two_factor_approve.php
+++ b/sim/cluster0/lab-seeds/backend/views/two_factor_approve.php
@@ -3,7 +3,6 @@ $bp = Auth::basePath();
$auth = Auth::authUrl();
$user = Auth::user();
$rawToken = trim($_GET['token'] ?? $_POST['token'] ?? '');
-$needsTotp = !$user && $approvalInfo && empty($approveResult);
?>
@@ -37,9 +36,9 @@ $needsTotp = !$user && $approvalInfo && empty($approveResult);
Sign-in approved.
- Your other device should now be logged in automatically.
+ Return to your computer — it should sign in automatically within a few seconds.
- Invalid or expired code. Open the QR link again from your desktop, or enter the current 6-digit authenticator code.
+ This approval link has expired or was already used. On the computer, reload the 2FA page to get a fresh QR code.
Back to hub
@@ -49,27 +48,13 @@ $needsTotp = !$user && $approvalInfo && empty($approveResult);
Approve sign-in on another device?
-
- Tap Approve to log in the browser that showed you this QR code.
-
- Enter the 6-digit code from your authenticator app to approve the other device.
-
+ Tap Approve to finish signing in on the browser that showed the QR code.
This link expires in a few minutes.
-
-
-
- Already signed in on this phone?
- Sign in first
-
-
Cancel
diff --git a/sim/cluster0/scripts/compose-lab-backend.sh b/sim/cluster0/scripts/compose-lab-backend.sh
index 3b299d7..d1cbced 100755
--- a/sim/cluster0/scripts/compose-lab-backend.sh
+++ b/sim/cluster0/scripts/compose-lab-backend.sh
@@ -178,7 +178,7 @@ overlay_views ac-be-access
overlay_views ac-be-issues
ISSUES_BASE="${APP_BASE_PATH:-/app/androidcast_project/issues}"
-PUBLIC_ORIGIN_CFG="${LAB_PUBLIC_ORIGIN:-https://acl0.f0xx.org}"
+PUBLIC_ORIGIN_CFG="${LAB_PUBLIC_ORIGIN:-https://apps.f0xx.org}"
load_secrets_lab
AUTH_KEY="${AUTH_ENCRYPTION_KEY:-lab-cluster-dev-32-char-min-secret!!}"
_MSMTP_PASS="$(read_secret MSMTP_APP_PASSWORD 2>/dev/null || true)"