One login everywhere: terminal login rolls out, passphrase reset, and federated sign-in fixed

What changed

One login, everywhere

The monochrome N.E.S.T. terminal login — email + passphrase, passkey (Face ID / Touch ID), Continue with Apple, Continue with Google — is now the front door on:

nest-ops.thephenom.app is next — its migration off the Cognito hosted UI is in progress.

New: self-service passphrase reset

Every terminal login now has a reset passphrase option. Enter your email, get a verification code, set a new passphrase — no admin involvement. Works on nest, dev-nest, analytics, and int-docs.

Fixed: Google / Apple sign-in created duplicate accounts

A pool-wide bug meant signing in with Google or Apple could create a second Cognito identity with a different sub — so your groups, chat identity, and published events didn’t follow you between login methods (issue #523). Two root causes fixed: the Google/Apple identity providers weren’t mapping email_verified (so the auto-linker refused to link), and the linker skipped admin-created accounts. Federated sign-ins now link to your existing account. Already-duplicated accounts can be reconciled on request.

Also shipped

• Chat (nest): every URL is now clickable, pasted Phenom-event links open in-app on the globe, and federated (Apple/Google) users show their real name instead of a relay email or UUID.
• Prod Hasura: the nest-api Worker’s production GraphQL URL was corrected from chat.thephenom.app (which redirect-loops from inside a Cloudflare Worker) to api.thephenom.app — see the api runbook.

For operators

• Reset your own passphrase from any terminal login — pick reset passphrase on the menu.
• Sign in once, use any method — password and Google/Apple now resolve to the same account.
• Questions or a stuck account: reach the team at dev@thephenom.app.