[web] align branded sign-in page #193

Merged

eleith merged 1 commits from refactor/signin-page into main 2026-11-04 20:49:16 +00:00

Conversation 0 Commits 1 Files Changed 5

+376 -125

eleith-gitea-agent Bot commented 2026-11-04 20:35:43 +00:00

Copy link

Copy source

Summary

• Align sign-in with the standalone branded-card approach used by When/Directory: configured site icon and title, visible heading, responsive spacing, simple back link and existing theme control instead of the public search navbar.
• Use one credentials/OIDC form with consistent pending and error feedback, desktop-only initial focus, and the existing validated navigation-recovery link.
• Keep client-side authentication helpers, provider configuration, server redirect validation and session behavior unchanged. Named credential controls explicitly use POST to prevent pre-hydration GET submissions from putting credentials in the URL; JavaScript is still required, with a noscript notice. No server-action login added.
• Replace the source-AST test with meaningful SSR provider/form/error and real layout/page composition checks. Include a web patch changeset.

Verification

• 38 focused tests passed: sign-in SSR, server provider/redirect handling and auth-client helpers.
• Svelte check: 0 errors, 0 warnings. Full web lint, changeset formatting and staged whitespace passed.
• Production build and the existing native HTTP regression for public configured images with authentication enabled passed (1 selected test; not the whole HTTP suite).
• Hydrated Chrome smoke passed real local credential login and protected /admin access; both providers' submit dispatch, pending state, controlled failures and retry; retained credential drafts; desktop/mobile bounds and no forced mobile focus. No page JavaScript errors.
• Correctness, readability and test reviews: no actionable introduced findings.

Limits

OIDC smoke responses were controlled: no external provider exchange/callback was exercised. Headless Chrome reports no fine pointer, so desktop auto-focus was not exercised. No actual BFCache restoration or assistive-technology announcement check. Dedicated browser automation remains a separate follow-up. The pre-existing unguarded storage-bookkeeping failure path remains unchanged and outside this UI change.

## Summary - Align sign-in with the standalone branded-card approach used by When/Directory: configured site icon and title, visible heading, responsive spacing, simple back link and existing theme control instead of the public search navbar. - Use one credentials/OIDC form with consistent pending and error feedback, desktop-only initial focus, and the existing validated navigation-recovery link. - Keep client-side authentication helpers, provider configuration, server redirect validation and session behavior unchanged. Named credential controls explicitly use POST to prevent pre-hydration GET submissions from putting credentials in the URL; JavaScript is still required, with a noscript notice. No server-action login added. - Replace the source-AST test with meaningful SSR provider/form/error and real layout/page composition checks. Include a web patch changeset. ## Verification - 38 focused tests passed: sign-in SSR, server provider/redirect handling and auth-client helpers. - Svelte check: 0 errors, 0 warnings. Full web lint, changeset formatting and staged whitespace passed. - Production build and the existing native HTTP regression for public configured images with authentication enabled passed (1 selected test; not the whole HTTP suite). - Hydrated Chrome smoke passed real local credential login and protected `/admin` access; both providers' submit dispatch, pending state, controlled failures and retry; retained credential drafts; desktop/mobile bounds and no forced mobile focus. No page JavaScript errors. - Correctness, readability and test reviews: no actionable introduced findings. ## Limits OIDC smoke responses were controlled: no external provider exchange/callback was exercised. Headless Chrome reports no fine pointer, so desktop auto-focus was not exercised. No actual BFCache restoration or assistive-technology announcement check. Dedicated browser automation remains a separate follow-up. The pre-existing unguarded storage-bookkeeping failure path remains unchanged and outside this UI change.

eleith-gitea-agent Bot added 1 commit 2026-11-04 20:35:43 +00:00

[web] align branded sign-in page 79d3e9016e

eleith merged commit 79d3e9016e into main 2026-11-04 20:49:16 +00:00

eleith deleted branch refactor/signin-page 2026-11-04 20:49:16 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

bug

enhancement

No labels

Milestone

No items

No Milestone

Assignees

Clear assignees

eleith-gitea-agent Bot eleith (eleith)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: eleith/luzzle#193