mirror of
https://github.com/HeyPuter/puter.git
synced 2026-11-13 17:31:08 +00:00
Nariman Jelveh
37dcee78f0
* Move login, signup, account picker, password recovery and 2FA to dashboard-style dialogs The sign-in surfaces were separate UIWindows that opened over each other (login, then a recovery window over it, then a 2FA window over that). They are now screens of one dashboard-style card built on mountDashboardOverlay, the same shell, fields, buttons and status line as the dashboard's account dialogs. Screens replace each other in place, with Back, and keep what was typed. - Page presentation for cover pages and sign-in popups: an opaque page with a centered card, filling the screen on phones and in popups. Dialog presentation elsewhere: dimmed backdrop, centered card, bottom sheet on phones. - Each call site keeps whether it could be dismissed, its promise contract, OIDC gating in popups, Turnstile, the honeypot, bonus codes, the post-signup verification gates, reauth auth_id, and redirect handling. - Keys typed in the card no longer reach the desktop's document shortcuts. - A second sign-in prompt joins the open flow instead of stacking a card. - Server messages render as text; prefilled values are encoded. * Show the signup screen's errors above the provider buttons The status line lived inside the email form, which hides behind the provider buttons (or for good, when only provider signups are open), so an error the screen opened with, like a refused provider signup, was never shown. * Cover the page with a new account's checks when signup was a page Signup as a page (a sign-in popup, /action/signup) closes its card for the email, phone and card checks; they opened as floating windows over an empty backdrop instead of covering the page as they did before. * Give the auth card's Back and close bar a background once it scrolls On a short screen the card's content scrolled under the bare Back and close buttons, which then sat on top of it: the Back chevron covered the edge of a provider button and took its taps. Once the showing screen is scrolled, the bar turns opaque with a divider, as the footer has; at rest nothing changes. * Raise a failed session-cookie sync alert above the sign-in card Signing in waits on this alert with the auth card still up. The card sits above every ordinary window, so the alert opened underneath it and the login spun forever. It now opens in the stay-on-top band. * Keep focus where it is when a second sign-in prompt joins the card A prompt that joins the open auth card focused the screen's first field, so one arriving while the user typed their password sent the rest of it into the username field. It now only brings focus back when it has left the card. * Keep focus in the auth card while its form is busy Submitting disabled the focused field, which dropped focus to the page, so keys pressed while the request was in flight (Delete, Enter, letters) reached the desktop's document shortcuts. * Keep focus in the auth card when its backdrop is pressed A press on the dimmed backdrop (or a page's background) that didn't dismiss the card moved focus to the page, so the next keys went to the desktop's document shortcuts and Tab could leave the card. * Point the Turnstile migration note at the new signup screen UIWindowSignup no longer exists; the widget renders in UI/Auth/UIAuthSignup.js. * Reload after sign-in when only the URL's hash would change On a dashboard tab (/#files) the redirect after a login or signup was the same page with a hash, so location.replace only scrolled: the new account was signed in but the page never reloaded, and the card stayed up, busy, until closed. * Span the screen with the auth bottom sheet on wider phones The card's 400px cap outranked the dashboard sheet's full width, so on phones between 401 and 600px wide the sheet left gaps on both sides. * Return focus to the auth form when a request fails A busy card parks focus on itself while its fields are locked. When the server refused a signup, focus stayed there, so Enter did nothing and the user had to tab back in. Ending busy now hands focus back to the control that had it, once that control is enabled again. * Keep the current account when a login is dismissed mid-request Closing the auth card while its login request was out still signed the browser in to the other account and reloaded once the server answered, though the caller had already been told the user dismissed it. A login that answers after the card closed is now dropped. * Make the auth card's logo a link where it leads somewhere On a cover page the Puter logo was an image with a click handler: no keyboard access, no name for screen readers, no middle-click. It is now a link named Puter. Everywhere else the logo is marked decorative, since the title beside it names the screen. * Return to the login screen when signing in fails after a 2FA code If storing the new session failed after a verified code, the error went to the hidden login screen while the code screen stayed up, busy, with its boxes locked. The card now goes back to the login screen first. * Hand the session cookie back when a login is dismissed mid-request The server sets the session cookie as soon as it accepts a login or a second-factor code. Dropping an answer that arrived after the card closed kept the page on its account while the cookie had moved to the other one, so cookie-gated actions (password, 2FA) applied to that account and the next load picked up its token. The cookie is now synced back to the account the page is signed in as. * Keep padded notices inside the auth page's column On a phone-width page or in a sign-in popup, every direct child of the auth body is stretched to the column's width. The overlay sits outside .dashboard, so it isn't border-box, and the padded error line and bonus notice came out wider than the fields and scrolled the page sideways. * Keep the recovery-code field one size when it takes focus On phones the generic dialog-input and phone input rules outranked the recovery-code field's style until it was focused, so tapping it grew the text from 16-17px to 20px and shifted the screen. The field's rule now carries the same weight as theirs, like the code boxes beside it. * Show the provider buttons' hover in dark mode The hover shade was the sidebar background, which in dark mode is one step off the card's, so Google, Apple and the other sign-in buttons gave no feedback under the pointer. Dark mode now uses the hover shade. * Theme the signup bonus notice with the auth card The notice kept the old signup window's fixed pastel colors, which stood out as a light box on the card in dark mode. It now uses the dashboard's success and danger colors, which follow the color scheme. * Keep a new account's email check from closing without an answer A signup that needs its email confirmed takes the auth card down and waits on the confirmation window, whose ✕ closed it without ever answering. In a sign-in popup reached from the account picker that left an empty popup with nothing to pick. The check now stays until the code is confirmed, like the phone and card checks and the boot-time email check.