Build approval URLs from the browser Host header (apps.f0xx.org not acl0); allow approve by QR token without a second TOTP on mobile.
Co-authored-by: Cursor <cursoragent@cursor.com>
Honor post-login redirect through password and TOTP steps; approve cross-device sign-in with authenticator code when mobile has no session; reuse pending QR token; fix verify-email URL; purge stale pending registrations.
Co-authored-by: Cursor <cursoragent@cursor.com>
Use cfg('public_origin') instead of a hardcoded apps host so lab and prod
login QR links match the deployed BE origin.
Co-authored-by: Cursor <cursoragent@cursor.com>
AuthTwoFactorPage was setting img src to the short link URL (HTML), not
the /api/v1/qr/*.png endpoint. Always expose a PNG via qr_url.
Co-authored-by: Cursor <cursoragent@cursor.com>
Use SMTP username as From on smtp.gmail.com; add Date/Message-ID headers;
verify email plain text only (short link + QR URL line).
Co-authored-by: Cursor <cursoragent@cursor.com>
Use is_callable for ShortLinksRepository; build qr image URL when pack
only has short_url (stale seed compatibility).
Co-authored-by: Cursor <cursoragent@cursor.com>
Gmail blocks short-link + attachment as phishing; use multipart/alternative
HTML with s.f0xx.org/api/v1/qr PNG URL (QR still encodes …&src=qr).
Co-authored-by: Cursor <cursoragent@cursor.com>
Multipart SMTP mail attaches verify-email-qr.png; QR encodes s.f0xx.org URL
with src=qr via ShortLinksRepository::shortenForOutboundMail.
Co-authored-by: Cursor <cursoragent@cursor.com>
Outbound registration mail uses ShortLinksRepository::shortenForOutbound
(s.f0xx.org) with 24h TTL; falls back to long URL if shortener unavailable.
Co-authored-by: Cursor <cursoragent@cursor.com>
