From 711da82e08fb0cbbf7927bb4cbf17e2aedb46bea Mon Sep 17 00:00:00 2001
From: SimpleTest <simpletestxxx@gmail.com>
Date: Fri, 21 Aug 2026 02:20:33 +0300
Subject: [PATCH] Preserve direct auth URL fallback

---
 docs/verification.md                               | 13 +++++++++++++
 lib/who_need_help/accounts/user_notifier.ex        |  2 +-
 test/who_need_help/accounts/user_notifier_test.exs |  2 ++
 3 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/docs/verification.md b/docs/verification.md
index f6d24a3..8dac694 100644
--- a/docs/verification.md
+++ b/docs/verification.md
@@ -3399,3 +3399,16 @@ promoted.
   receive the alert channel; the monitor's unit tests cover state-transition,
   recovery, bounded metric parsing, and stale-backup alert behaviour without
   inducing a production outage.
+
+# 2026-08-21 authentication-email direct URL fallback
+
+- The HTML authentication message now contains one clickable action button and
+  one non-clickable, plain-text copy-and-paste URL. This prevents the fallback
+  itself from becoming a second provider-rewritten link.
+- The focused notifier test rendered the multipart message and passed all four
+  test cases. It also asserted that the HTML contains exactly one `href` and
+  that the direct application URL remains visible as text.
+- This does not prove that Brevo leaves the action button unchanged. The
+  provider tracking limitation remains open until a newly delivered production
+  message is inspected. No production or frozen test deployment was changed by
+  this local check.
diff --git a/lib/who_need_help/accounts/user_notifier.ex b/lib/who_need_help/accounts/user_notifier.ex
index eb9bc2e..a6bce22 100644
--- a/lib/who_need_help/accounts/user_notifier.ex
+++ b/lib/who_need_help/accounts/user_notifier.ex
@@ -182,7 +182,7 @@ defmodule WhoNeedHelp.Accounts.UserNotifier do
                   <td style="padding:20px 32px 8px;font-size:12px;line-height:1.5;color:#747a77;">#{escape_html(gettext("If the button does not work, copy and paste this address into your browser:"))}</td>
                 </tr>
                 <tr>
-                  <td style="padding:0 32px 28px;font-size:12px;line-height:1.5;word-break:break-all;"><a href="#{escaped_url}" style="color:#007d6b;">#{escaped_url}</a></td>
+                  <td style="padding:0 32px 28px;font-size:12px;line-height:1.5;word-break:break-all;color:#007d6b;">#{escaped_url}</td>
                 </tr>
               </table>
             </td>
diff --git a/test/who_need_help/accounts/user_notifier_test.exs b/test/who_need_help/accounts/user_notifier_test.exs
index 84248fb..2af2efc 100644
--- a/test/who_need_help/accounts/user_notifier_test.exs
+++ b/test/who_need_help/accounts/user_notifier_test.exs
@@ -23,6 +23,8 @@ defmodule WhoNeedHelp.Accounts.UserNotifierTest do
     assert email.html_body =~ "<title>Sign in to Who Need Help</title>"
     assert email.html_body =~ ~s(href="#{url}")
     assert email.html_body =~ "copy and paste this address into your browser"
+    assert email.html_body =~ ~s(color:#007d6b;">#{url}</td>)
+    assert length(Regex.scan(~r/href=/, email.html_body)) == 1
     refute email.html_body =~ "<img"
     refute email.html_body =~ user.email
   end