Portal sign-in & registration links

The public login page does not accept passwords. Issue a login link for a specific workspace user, or a registration link to allow exactly one invited signup flow. Control panel access via CONTROL_PANEL_ACCESS_TOKEN is unchanged. Use Revoke access on a listed link to invalidate it immediately; opened links then return visitors to the public landing with an explanation.

Primary operator profile (seed / incoming wires): {{ \App\Support\WorkspaceUsers::operatorEmail() }} — configured via WORKSPACE_OPERATOR_EMAIL in .env. If a legacy operator address still appears in lists, run php artisan workspace:sync-operator-email on the server.

@php $__mlFlag = $flags->firstWhere('key', 'magic_login_enabled'); $magicLoginDisabled = $__mlFlag ? ! $__mlFlag->enabled : false; @endphp @if ($magicLoginDisabled)

Magic sign-in is off. The magic_login_enabled toggle under Feature toggles is disabled: existing login links only return visitors to the landing page until you turn it back on.

@endif
@if (session('status'))

{{ session('status') }}

@endif @if (session('issued_magic_token_plain'))

Copy this link now — it will not be shown again.

@php $plain = session('issued_magic_token_plain'); $purpose = session('issued_magic_token_purpose'); $url = $purpose === 'register' ? \App\Services\IssuedMagicTokenService::registrationInviteUrl($plain) : \App\Services\IssuedMagicTokenService::loginMagicUrl($plain); @endphp

{{ $url }}

@endif
@csrf

Recently issued

@forelse ($recentIssuedMagicTokens as $t) @empty @endforelse
Purpose Subject Uses Status Expires Created Access
{{ $t->purpose }} @if ($t->purpose === 'login' && $t->user) {{ $t->user->email }} @else @endif {{ $t->uses_count }} / {{ $t->max_uses }} @if ($t->revoked_at) Revoked @elseif ($t->expires_at && $t->expires_at->isPast()) Expired @elseif ($t->uses_count >= $t->max_uses) Exhausted @else Active @endif {{ $t->expires_at?->toDateTimeString() ?? 'Never' }} {{ $t->created_at?->toDateTimeString() }} @if ($t->revoked_at === null) @else @endif
No tokens issued yet.
@foreach ($recentIssuedMagicTokens as $t) @if ($t->revoked_at === null)

Revoke portal access

{{ $t->purpose === 'login' ? 'Login link' : 'Registration invite' }} @if ($t->label) · {{ $t->label }} @endif

This invalidates the issued URL. Anyone who opens that link afterward is sent to the public landing page and cannot sign in or accept the invite through it.

@if ($t->purpose === 'login' && $t->user)

Subject: {{ $t->user->email }}

@endif
@csrf
@endif @endforeach