[marcelo-maciel]

Fixes #1440

What

The issuer of the two-factor otpauth:// URI was a hardcoded "FullStackHero" in EnrollTwoFactorCommandHandler, so every product built on the kit appeared under that name in the user's authenticator app. It now comes from configuration:

"TwoFactorOptions": {
  "Issuer": "FullStackHero"
}

• New TwoFactorOptions (Identity module root, next to TenantGraceOptions), bound with AddOptions<TwoFactorOptions>().BindConfiguration(nameof(TwoFactorOptions)).ValidateDataAnnotations().ValidateOnStart(), the same idiom as JwtOptions. No existing Identity options class covers TOTP (JwtOptions:Issuer is the token issuer, fsh.local, a different concept), so a small dedicated class seemed cleaner than overloading one.
• Issuer defaults to FullStackHero, so nothing changes for current deployments. It is [Required]: a blank issuer would produce otpauth://totp/:user?...&issuer=, which authenticator apps reject, so it fails at startup instead.
• The issuer stays percent-encoded with UrlEncoder.Default in both the label and the issuer= parameter, so Canal Correto becomes Canal%20Correto, Ação becomes A%C3%A7%C3%A3o, and a : or & in the name cannot break the label or the query.
• appsettings.json documents the key next to PasswordPolicy.
• Projects scaffolded with fsh new / dotnet new fsh already got their own display name here, because the template replaces FullStackHero with it; that still applies to both the default and the appsettings.json value. The default-issuer test derives its expectation from TwoFactorOptions for that reason (the brand can contain a space, as in the scaffold smoke job's Smoke Api). What this PR adds is the ability to change it after scaffolding, and for clones and forks of the kit.

Existing enrollments

Only new enrollments get the new issuer. Users who enrolled earlier keep the old label in their app, and their codes keep working because the shared secret is not touched. No migration is needed. A user who wants the new label disables and enrolls again.

Tests

• Identity.Tests/Handlers/EnrollTwoFactorCommandHandlerTests (new): the default is FullStackHero; exact URI with the default issuer, with a custom issuer, and with Canal Correto, Ação and A:B & C (encoded in both positions, and Uri.TryCreate accepts it); unauthenticated caller throws UnauthorizedException; a blank or whitespace issuer fails validation.
• Mutation gate: with the handler mutated to ignore the option ("FullStackHero" hardcoded again, field still read), 4 tests fail (custom issuer + the three encoding cases); with the issuer passed unencoded, the 3 encoding cases fail. Both green with the fix.

Note on the first commit

The first commit (build(deps): move the .NET 10 packages to 10.0.13 for the October advisories) is byte-for-byte the same as fd6e9b0b in #1426. main currently fails restore on NuGet audit (System.Security.Cryptography.Pkcs/Xml and SignalR.Common 10.0.12 advisories under TreatWarningsAsErrors), so this PR carries it to build. It drops out on rebase once #1426 merges.

Docs: fullstackhero/docs#271

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-14T21:28:36.068538Z	e946a68	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.