From 8f55b9802b30e2c978ff16d4e9f84baa23ff941f Mon Sep 17 00:00:00 2001
From: Leopere <colin@nixc.us>
Date: Tue, 3 Mar 2026 18:21:50 -0500
Subject: [PATCH] Add Account Security card with direct links to Authelia
 settings

Replaces the generic "Account Settings" button with a dedicated card
containing passkey, TOTP, and password links plus a warning about
enabling 2FA to prevent account compromise.

Made-with: Cursor
---
 .../ss-atlas/templates/pages/dashboard.html   | 24 ++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/docker/ss-atlas/templates/pages/dashboard.html b/docker/ss-atlas/templates/pages/dashboard.html
index 503d718..e6ed1c1 100644
--- a/docker/ss-atlas/templates/pages/dashboard.html
+++ b/docker/ss-atlas/templates/pages/dashboard.html
@@ -115,6 +115,16 @@
     .btn-warning:hover { background: rgba(234,179,8,0.22); color: #eab308; }
     .btn-sm { padding: 0.45rem 0.9rem; font-size: 0.82rem; }
     .divider { border: none; border-top: 1px solid var(--border); margin: 1rem 0; }
+    .security-notice {
+      background: rgba(234, 179, 8, 0.08);
+      border: 1px solid rgba(234, 179, 8, 0.25);
+      border-radius: 8px;
+      padding: 0.85rem 1.1rem;
+      font-size: 0.88rem;
+      line-height: 1.55;
+      color: var(--muted);
+    }
+    .security-notice strong { color: #eab308; }
     .version-badge {
       position: fixed;
       bottom: 0.75rem;
@@ -222,12 +232,24 @@
           {{end}}
         </form>
         {{end}}
-        <a href="{{.AutheliaURL}}" class="btn btn-outline">Account Settings</a>
       </div>
       <p style="color: var(--muted); font-size: 0.8rem; margin-top: 1rem;">
         No refunds for the current billing period. Access continues until the end of your paid month.
       </p>
     </div>
+    <div class="card">
+      <h2>Account Security</h2>
+      <div class="security-notice">
+        <strong>We strongly recommend enabling two-factor authentication.</strong>
+        Accounts involved in system abuse will be removed. Passkeys and TOTP are the
+        best way to ensure your account is never compromised and used without your knowledge.
+      </div>
+      <div class="actions">
+        <a href="{{.AutheliaURL}}/#/settings" class="btn btn-outline btn-sm">Set Up Passkey</a>
+        <a href="{{.AutheliaURL}}/#/settings" class="btn btn-outline btn-sm">Set Up TOTP App</a>
+        <a href="{{.AutheliaURL}}/#/settings" class="btn btn-outline btn-sm">Change Password</a>
+      </div>
+    </div>
     {{else}}
     <div class="card">
       <div class="empty-state">