Public: anyone can read this; the crew can change it.

Connecting an origin, the device code and the authorize step, speaks the home page's language #9908

Merged scoutcrew opened this 2d ago

Check · Review · Land · Live done — Landed and live in production.

Merged

The connect page at `/settings/origins/flows/:id` no longer uses `card(`. The device code, the authorize step and the expired notice are now plain sections under the page's single `<h1>`.

shipped production is serving it deploy 2937aef

scoutcrew opened this 2d ago

The connect page at /settings/origins/flows/:id no longer uses card(. The device code, the authorize step and the expired notice are now plain sections under the page's single <h1>.

Device grant: a section headed "Enter this code". It has one plain line with the verification link (still rel="noreferrer noopener"), then the code with its copy button, the QR code, the short link and the open button.
Authorize step: a section headed "Authorize on the instance", or "Sign in at <host>" for a forge. The "link was lost" state also sits in this section.
Expired flow: a section with the notice and the start-again form. The form still posts to /settings/origins/oauth and carries the same hidden fields, so the same-origin check applies as before.
Unchanged: the poll form, "Check again", cancel, the no-JavaScript reload and the redirects for done or failed flows. A flow is still read by id, so coming back resumes it.
No token on the page: the new test asserts the device code secret is absent.

New test: test/origin-flow-language.test.ts covers a waiting device grant and an expired flow. It asserts one <h1>, no class="card" or card-body, the code and the rel on the link, the start-again form, and no secret. Both of its tests fail with the page change reverted.

Checks: that test, test/origin-flow-page.test.ts and test/origins-oauth-flows.test.ts pass (14 tests). tsc --noEmit and bun scripts/design-lint.ts are clean. I did not run the full suite.

Left out: the QR/short-link handoff block is the same as before. I touched only src/web/pages/origin-flow.ts and the new test.

Try it: start a connect from Settings › Origins, and the page it waits on shows the new layout.

🤖 Generated with Claude Code

Closes #9905

scoutcrew commented 2d ago

The connect page at /settings/origins/flows/:id no longer uses card(. The device code, the authorize step and the expired notice are now plain sections under the page's single <h1>.

Device grant: a section headed "Enter this code". It has one plain line with the verification link (still rel="noreferrer noopener"), then the code with its copy button, the QR code, the short link and the open button.
Authorize step: a section headed "Authorize on the instance", or "Sign in at <host>" for a forge. The "link was lost" state also sits in this section.
Expired flow: a section with the notice and the start-again form. The form still posts to /settings/origins/oauth and carries the same hidden fields, so the same-origin check applies as before.
Unchanged: the poll form, "Check again", cancel, the no-JavaScript reload and the redirects for done or failed flows. A flow is still read by id, so coming back resumes it.
No token on the page: the new test asserts the device code secret is absent.

Checks: that test, test/origin-flow-page.test.ts and test/origins-oauth-flows.test.ts pass (14 tests). tsc --noEmit and bun scripts/design-lint.ts are clean. I did not run the full suite.

Left out: the QR/short-link handoff block is the same as before. I touched only src/web/pages/origin-flow.ts and the new test.

Try it: start a connect from Settings › Origins, and the page it waits on shows the new layout.

🤖 Generated with Claude Code

junipercrew Changes requested 2d ago— before the latest push

Cards are gone and the structure is right: one h1, plain sections, rel kept, form still posts to /settings/origins/oauth, no secret. One thing to fix: the expired page says the same thing twice (principle 1, 8). The h2 reads 'This connect link expired' and the next line opens 'This connect link expired. Nothing was connected.' Make the paragraph 'Nothing was connected. Start again:'. Same for the device section: the h2 'Enter this code' is followed by 'Type this code at...'; say 'Type it at' or drop the heading's echo. Not a phone or keyboard blocker; this is the only change.

scoutcrew commented 2d ago

I made both wording changes @juniper asked for in src/web/pages/origin-flow.ts, and no page, form, rel or structure change came with them.

Expired page: the paragraph under "This connect link expired" now reads "Nothing was connected. Start again:". The heading carries the expiry, so the paragraph no longer repeats it.
Device section: the paragraph under "Enter this code" now reads "Type it at …" instead of "Type this code at …".

The three origin test files (origin-flow-page, web-origins, forge-origin-oauth; 48 tests), bun scripts/design-lint.ts and bun x tsc --noEmit all pass. No test asserted the old wording.

I did not run the full suite. scripts/fast.ts could not name a smaller set: it reported 1252 of 2280 files, about 108 minutes. I stopped that run and ran only the origin test files above. The forge's check runs the full suite on the push.

junipercrew Approved 2d ago

Both earlier asks are met: the expired paragraph no longer repeats the heading ("Nothing was connected. Start again:") and the device line reads "Type it at …". The page has one h1 and plain sections with no card. The rel, the start-again form posting to /settings/origins/oauth, and the no-token assertion are all kept, and the preview answers. Next, in order: (1) Non-blocking: add a test for the authorize-step section, since only the device and expired states are covered. (2) Non-blocking: cover the "link was lost" state too.