ac/ac-ms-identity
1
0
Fork 0
mirror of git://f0xx.org/ac/ac-ms-identity synced 2026-07-30 03:38:12 +03:00
Code Issues Packages Projects Releases Wiki Activity
12 Commits 1 Branch 0 Tags
48459cc392adcc02a746e19b71026fb4f987f251
Commit Graph

12 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Anton Afanasyeu
48459cc392 fix(2fa): resolve approve URL from public_origin config 
Use cfg('public_origin') instead of a hardcoded apps host so lab and prod
login QR links match the deployed BE origin.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-07-10 15:36:48 +02:00
Anton Afanasyeu
635cc36dd5 fix(2fa): use shortener QR PNG URL and otpauth fallback 
AuthTwoFactorPage was setting img src to the short link URL (HTML), not
the /api/v1/qr/*.png endpoint. Always expose a PNG via qr_url.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-07-05 19:12:53 +02:00
Anton Afanasyeu
bb03237963 dep submodule update 2026-06-28 21:59:54 +02:00
Anton Afanasyeu
cefde609cb feat(2fa): cross-device approval via QR scan (WhatsApp-style) 
- AuthApproval: mint/approve/consume/poll one-time tokens stored in new
  auth_approvals table (TTL 300s, SHA-256 IP hash for geo audit)
- AuthEmailSchema: add auth_approvals migration; fix missing index on
  auth_attempts (SQLite path)
- AuthTwoFactorPage: QR now encodes /two-factor/approve?token=<T> instead
  of the hub URL; stores raw_token in session for polling; short URL with
  ?src=qr tracking preserved
- Auth: add completeTotpLoginByApproval(), clearPending2fa clears token,
  clientIp() helper (X-Forwarded-For aware)
- bootstrap: require AuthApproval.php

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-27 22:49:39 +02:00
Anton Afanasyeu
835f02153e deps: register internal ac/* submodules under deps/ 2026-06-24 17:45:14 +02:00
Anton Afanasyeu
d50c426303 auth: embed verify-email QR as inline CID image (not remote URL) 
Gmail blocks external QR img URLs; embed PNG via multipart/related while
keeping plain-text fallback URL.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-23 21:33:43 +02:00
Anton Afanasyeu
978831ecaa auth: Gmail relay deliverability — From match, Date, plain verify mail 
Use SMTP username as From on smtp.gmail.com; add Date/Message-ID headers;
verify email plain text only (short link + QR URL line).

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-23 20:14:27 +02:00
Anton Afanasyeu
035bed7512 auth: fix verify-email shorten guard; derive QR image URL from slug 
Use is_callable for ShortLinksRepository; build qr image URL when pack
only has short_url (stale seed compatibility).

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-23 19:08:41 +02:00
Anton Afanasyeu
290109d0f1 auth: embed hosted QR image in verify email instead of PNG attachment 
Gmail blocks short-link + attachment as phishing; use multipart/alternative
HTML with s.f0xx.org/api/v1/qr PNG URL (QR still encodes …&src=qr).

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-23 19:01:27 +02:00
Anton Afanasyeu
a64e5a7d48 auth: verify email with short link + QR PNG attachment 
Multipart SMTP mail attaches verify-email-qr.png; QR encodes s.f0xx.org URL
with src=qr via ShortLinksRepository::shortenForOutboundMail.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-23 18:53:34 +02:00
Anton Afanasyeu
57efa146d9 auth: shorten verify-email URLs via url shortener before send 
Outbound registration mail uses ShortLinksRepository::shortenForOutbound
(s.f0xx.org) with 24h TTL; falls back to long URL if shortener unavailable.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-23 18:37:23 +02:00
Anton Afanasyeu
9c70fcad5f initial 2026-06-23 12:29:30 +02:00