Email workspaceTwo-factor verification code contract
Purpose: deliver the account holder's two-step authentication code. API implementation: App\Mail\TwoFAAlert. Baseline view: resources/views/emails/TwoFAAlert.blade.php. TwoFactorAuthentication sends this email on the non-phone identifier branch; the SMS branch is a different channel and is outside this HTML redesign.
Suggested subject: Verification code. This preserves the current subject.
Suggested preheader: Your two-step authentication code is valid for 5 minutes.
Portable placeholder contract
| Token | Existing Laravel source / derivation | Requirement |
|---|---|---|
| {{logo_url}} | Existing Built app_name PNG | Optional deployment override; concrete project HTTPS logo is the default |
| {{preheader}} | Suggested fixed copy above | Required escaped text |
| {{verification_code}} | $code; TwoFAAlert's string constructor argument, bound as code in Blade | Required string; preserve leading zeros exactly; escape as text |
The original Mailable accepts a string. Do not cast the code to an integer, trim zeros, add digit grouping or substitute an account identifier. The leading-zero fictional fixture is 004827 and must stay 004827 in HTML and plain text.
Content and states
The existing five-minute validity statement remains literal text. No expiry_minutes input or new server configuration is required. The draft adds the plain instruction to enter the code in Built and not share it. It does not claim the code is single use, add a recipient name, show a timestamp or create a new action URL.
There is no button: this notification asks the user to enter a code. The two states are a normal fictional code and a leading-zero fictional code. They test formatting, not new authentication states. No expired-code email is invented.
Integration
Map verification_code explicitly to the existing $code expression; the portable token spelling is not executable Laravel Blade. ready/two-factor-code.txt and populated .txt files carry the same code and five-minute statement. Use the established HTML/text Mailable approach, preserve caller routing/queue behavior and validate any optional image-host override. The header PNG and responsive light/dark shell are shared with the other account drafts; email-client behavior still needs testing.