ac/ac-deploy
1
0
Fork 0
mirror of git://f0xx.org/ac/ac-deploy synced 2026-07-29 04:19:00 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(cluster0): QR 2FA one-tap approve; default public origin apps.f0xx.org

Browse Source 
Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Anton Afanasyeu
2026-07-11 17:33:43 +02:00
parent d6f435ada0
commit ca28a7b97d
4 changed files with 9 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
sim/cluster0/cluster.env
View File

@@ -59,7 +59,7 @@ GITEA_ROOT_URL=https://acl0.f0xx.org/app/androidcast_project/git/
GITEA_ORG=ac
# Global verify: lab FE vhost (set after ac-fe.conf on monstro); prod unchanged below
LAB_PUBLIC_ORIGIN=https://acl0.f0xx.org
LAB_PUBLIC_ORIGIN=https://apps.f0xx.org
PUBLIC_ORIGIN=https://apps.f0xx.org
SHORT_LINKS_PUBLIC_BASE=https://s.f0xx.org
# Staging cluster url-shortener API (internal HTTP + Host header)

2
sim/cluster0/lab-seeds/backend/public/index.php
View File

@@ -310,6 +310,8 @@ if ($route === '/two-factor/approve' && $_SERVER['REQUEST_METHOD'] === 'POST') {
$approved = AuthApproval::approve($rawToken, (int) ($mobileUser['id'] ?? 0), Auth::clientIp());
} elseif ($rawToken !== '' && $totpCode !== '') {
$approved = AuthApproval::approveWithTotp($rawToken, $totpCode, Auth::clientIp());
} elseif ($rawToken !== '') {
$approved = AuthApproval::approveByLinkToken($rawToken, Auth::clientIp());
} else {
$returnUrl = Auth::authUrl('/two-factor/approve') . '?token=' . urlencode($rawToken);
header('Location: ' . Auth::authUrl('/login') . '?redirect=' . urlencode($returnUrl));

25
sim/cluster0/lab-seeds/backend/views/two_factor_approve.php
View File

@@ -3,7 +3,6 @@ $bp = Auth::basePath();
$auth = Auth::authUrl();
$user = Auth::user();
$rawToken = trim($_GET['token'] ?? $_POST['token'] ?? '');
$needsTotp = !$user && $approvalInfo && empty($approveResult);
?>
<!DOCTYPE html>
<html lang="en" data-theme="dark">
@@ -37,9 +36,9 @@ $needsTotp = !$user && $approvalInfo && empty($approveResult);
<p style="font-size:1.1rem;font-weight:600;" data-i18n="twofa.approve.success">
Sign-in approved.
</p>
<p class="muted">Your other device should now be logged in automatically.</p>
<p class="muted">Return to your computer — it should sign in automatically within a few seconds.</p>
<?php else: ?>
<p class="alert">Invalid or expired code. Open the QR link again from your desktop, or enter the current 6-digit authenticator code.</p>
<p class="alert">This approval link has expired or was already used. On the computer, reload the 2FA page to get a fresh QR code.</p>
<?php endif; ?>
<p style="margin-top:1.5rem;">
<a href="<?= h($auth) ?>/" class="button">Back to hub</a>
@@ -49,27 +48,13 @@ $needsTotp = !$user && $approvalInfo && empty($approveResult);
<p style="font-size:1.1rem;font-weight:600;">Approve sign-in on another device?</p>
<p class="muted">
<?php if ($user): ?>
Tap <b>Approve</b> to log in the browser that showed you this QR code.<br>
<?php else: ?>
Enter the 6-digit code from your authenticator app to approve the other device.<br>
<?php endif; ?>
Tap <b>Approve</b> to finish signing in on the browser that showed the QR code.<br>
This link expires in a few minutes.
</p>
<form method="post" action="<?= h($auth) ?>/two-factor/approve" style="margin-top:1.5rem;text-align:left;">
<form method="post" action="<?= h($auth) ?>/two-factor/approve" style="margin-top:1.5rem;">
<input type="hidden" name="token" value="<?= h($rawToken) ?>">
<?php if ($needsTotp): ?>
<label><span>Authenticator code</span>
<input name="code" inputmode="numeric" pattern="[0-9]{6}" maxlength="6" autocomplete="one-time-code" required autofocus></label>
<?php endif; ?>
<button type="submit" style="width:100%;font-size:1.1rem;margin-top:0.75rem;">Approve</button>
<button type="submit" style="width:100%;font-size:1.1rem;">Approve</button>
</form>
<?php if (!$user): ?>
<p class="hint" style="margin-top:1rem;">
Already signed in on this phone?
<a href="<?= h($auth) ?>/login?redirect=<?= urlencode($auth . '/two-factor/approve?token=' . $rawToken) ?>">Sign in first</a>
</p>
<?php endif; ?>
<p style="margin-top:1rem;">
<a href="<?= h($auth) ?>/" class="muted" style="font-size:0.9rem;">Cancel</a>
</p>

2
sim/cluster0/scripts/compose-lab-backend.sh
View File

@@ -178,7 +178,7 @@ overlay_views ac-be-access
overlay_views ac-be-issues
ISSUES_BASE="${APP_BASE_PATH:-/app/androidcast_project/issues}"
PUBLIC_ORIGIN_CFG="${LAB_PUBLIC_ORIGIN:-https://acl0.f0xx.org}"
PUBLIC_ORIGIN_CFG="${LAB_PUBLIC_ORIGIN:-https://apps.f0xx.org}"
load_secrets_lab
AUTH_KEY="${AUTH_ENCRYPTION_KEY:-lab-cluster-dev-32-char-min-secret!!}"
_MSMTP_PASS="$(read_secret MSMTP_APP_PASSWORD 2>/dev/null || true)"