From b9854b646961c164486bfc2a8e806c3556c7a437 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 22 Sep 2026 15:19:23 +0000
Subject: [PATCH 1/2] Google Accounts: link the two-step guide in Reset + 2FA
 copy text

The one-shot recovery credentials for Reset + 2FA now end with a short
blurb and an absolute link to /Guide/TwoStepVerification, so the admin
can paste one message instead of writing the setup instructions by hand
each time. Password-only resets are unchanged.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018grYTQkKyEGXcPLxqQKnwF
---
 .../Humans.GoogleIntegration/Views/Google/Accounts.cshtml    | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/Sections/Humans.GoogleIntegration/Views/Google/Accounts.cshtml b/src/Sections/Humans.GoogleIntegration/Views/Google/Accounts.cshtml
index 357f3dc37a..7ea3bd2689 100644
--- a/src/Sections/Humans.GoogleIntegration/Views/Google/Accounts.cshtml
+++ b/src/Sections/Humans.GoogleIntegration/Views/Google/Accounts.cshtml
@@ -276,8 +276,9 @@
 @if (recoveryCreds is not null && !string.IsNullOrEmpty(recoveryCreds.TempPassword))
 {
     var hasBackupCode = !string.IsNullOrEmpty(recoveryCreds.BackupCode);
+    var twoStepGuideUrl = Url.Action("Document", "Guide", new { name = "TwoStepVerification" }, Context.Request.Scheme);
     var clipboardText = hasBackupCode
-        ? $"pw: {recoveryCreds.TempPassword}\n2fa: {recoveryCreds.BackupCode}"
+        ? $"pw: {recoveryCreds.TempPassword}\n2fa: {recoveryCreds.BackupCode}\n\nThe 2fa code is a one-time backup code: use it at the verification step, then set up two-step verification properly so you don't get locked out again. How-to: {twoStepGuideUrl}"
         : $"pw: {recoveryCreds.TempPassword}";
     <div class="modal fade" id="recovery-credentials-modal" tabindex="-1" aria-labelledby="recovery-credentials-modal-label" aria-hidden="true"
          data-bs-backdrop="static" data-bs-keyboard="false">
@@ -296,7 +297,7 @@
                         Hand these to <code>@recoveryCreds.Email</code> securely — they cannot be retrieved again after you close this dialog.
                     </div>
 
-                    <pre id="recovery-credentials-text" class="bg-light p-3 border rounded mb-3 small">@clipboardText</pre>
+                    <pre id="recovery-credentials-text" class="bg-light p-3 border rounded mb-3 small" style="white-space: pre-wrap;">@clipboardText</pre>
 
                     <button type="button" class="btn btn-outline-primary btn-sm" id="copy-recovery-credentials">
                         <i class="fa-solid fa-copy me-1"></i>Copy to clipboard

From c3a809945f73642b6bba7edc81690fc9963fd0e7 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 22 Sep 2026 19:17:03 +0000
Subject: [PATCH 2/2] Docs: Reset + 2FA clipboard contract now carries the
 two-step guide link

The combined-recovery acceptance criterion in workspace-account-provisioning.md
still specified the exact two-line pw/2fa clipboard payload. Update it to the
new payload (credentials, one-time-code blurb, absolute /Guide/TwoStepVerification
link) and note the password-only fallback when no backup code came back.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X9bnuNRMZfUyxdMcJz2FRQ
---
 .../Docs/features/workspace-account-provisioning.md            | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/Sections/Humans.GoogleIntegration/Docs/features/workspace-account-provisioning.md b/src/Sections/Humans.GoogleIntegration/Docs/features/workspace-account-provisioning.md
index b60b18e4d5..0dec7a22bb 100644
--- a/src/Sections/Humans.GoogleIntegration/Docs/features/workspace-account-provisioning.md
+++ b/src/Sections/Humans.GoogleIntegration/Docs/features/workspace-account-provisioning.md
@@ -107,7 +107,10 @@ Nobodies Collective uses Google Workspace for organizational email (@nobodies.te
   ```
   pw: <temp password>
   2fa: <single backup code>
+
+  The 2fa code is a one-time backup code: use it at the verification step, then set up two-step verification properly so you don't get locked out again. How-to: <absolute URL of /Guide/TwoStepVerification>
   ```
+  so the admin can paste one message that carries the credentials and the enrollment how-to. The guide link is absolute (current request scheme + host). When backup-code generation failed (partial success, below) there is no code, and the clipboard falls back to the password-only `pw: <password>` line.
 - Modal text-content is cleared on close so browser back/refresh can't re-expose the secrets
 - Two audit entries recorded on the success path: `WorkspaceAccountPasswordReset` then `WorkspaceAccountBackupCodesGenerated`. The blocked-by-2SV path records `WorkspaceAccountResetBlockedFor2Sv` instead and performs no Workspace mutation.
 - Requires the `admin.directory.user.security` scope on the service account credential