snick/order
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects 1 Releases 1 Wiki Activity

- Email 2FA is now optional and disabled by default.

Browse Source 
Existing and new accounts default to 2FA off.
Registration signs users in directly.
Users can enable it under My Account.
Administrators can manage it under Users & Staff.
Verified password-only and opted-in email-code login flows.
PHP/JavaScript checks and browser console passed.
This commit is contained in:
Ty Clifford
2026-06-10 16:40:22 -04:00
parent 34ca1be9b7
commit 45ef31e61f
10 changed files with 74 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+7 -4
View File
@@ -10,7 +10,7 @@ A dependency-light online food ordering system for Fat Bottom Grille at
- Persistent cart and abandoned-cart tracking
- Configurable state, city, and county tax rates
- Pickup checkout with Square Web Payments and Payments API support
- Customer accounts with email verification, email 2FA, captcha, and honeypots
- Customer and staff accounts with optional email 2FA, captcha, and honeypots
- Customer order history, saved pickup details, password changes, and newsletter preferences
- Staff order queue, status history, internal notes, and Square refunds
- Staff roster and role management
@@ -73,14 +73,17 @@ and assets automatically include that subdirectory.
- Email: `admin@fatbottomgrille.com`
- Password: `ChangeMe123!`
Mailgun is disabled by default, so the six-digit sign-in code appears in the
Email 2FA is disabled by default for every account. It can be enabled from
**My Account** or managed by an administrator in **Users & Staff**. When 2FA is
enabled while Mailgun is disabled, the six-digit sign-in code appears in the
browser and is also written to `storage/logs/mail.log`.
Change the initial password from **My Account** before deploying the site.
## Dashboard
Sign in, complete email verification, and open `/admin`.
Sign in and open `/admin`. Accounts that opt into email 2FA complete the
six-digit email check after entering a valid password.
The dashboard controls:
@@ -117,7 +120,7 @@ In **Dashboard > Settings**, enter the Mailgun domain, API key, sender name,
and sender email, then enable Mailgun.
When Mailgun is disabled, messages are stored locally in
`storage/logs/mail.log`. This keeps registration, 2FA, order confirmation, and
`storage/logs/mail.log`. This keeps optional 2FA, order confirmation, and
newsletter workflows testable without an email service.
## SQLite and MySQL/MariaDB