From 48459cc392adcc02a746e19b71026fb4f987f251 Mon Sep 17 00:00:00 2001 From: Anton Afanasyeu Date: Fri, 10 Jul 2026 15:36:48 +0200 Subject: [PATCH] fix(2fa): resolve approve URL from public_origin config Use cfg('public_origin') instead of a hardcoded apps host so lab and prod login QR links match the deployed BE origin. Co-authored-by: Cursor --- src/AuthTwoFactorPage.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/AuthTwoFactorPage.php b/src/AuthTwoFactorPage.php index 94bd70b..d8a5d62 100644 --- a/src/AuthTwoFactorPage.php +++ b/src/AuthTwoFactorPage.php @@ -26,7 +26,8 @@ final class AuthTwoFactorPage { // Store token in session so the poll endpoint can reference it $_SESSION['pending_2fa_approval_token'] = $rawToken; - $approveUrl = 'https://apps.f0xx.org' . $project . '/two-factor/approve?token=' . urlencode($rawToken); + $origin = rtrim((string) cfg('public_origin', 'https://apps.f0xx.org'), '/'); + $approveUrl = $origin . $project . '/two-factor/approve?token=' . urlencode($rawToken); $payload = [ 'long_url' => $approveUrl,