3 Commits

Include renames

Author	SHA1	Message	Date
steveandClaude Opus 4.8	3f61f07034	Address Gadfly review on #8: modal focus/close, dim validation, dedup ... Fixes from the PR #27 adversarial review (considered; not graded). Correctness / error-handling - Modal: focus once on mount and attach the keydown listener once (latest onClose/busy via refs), so a parent re-render (e.g. a background refetch) no longer re-fires focus() and steals it from the input being typed in. - Modal takes a `busy` prop; while a save/delete is in flight, Escape and backdrop clicks don't dismiss it (form/delete modals pass busy=pending), so an action can't be interrupted mid-flight and lose its error. - Form validates the *converted* centimeter values against the server's [1cm, 100m] bounds, so sub-cm / over-100m sizes fail client-side with a clear message instead of a generic server error. - displayFromCm rounds imperial to 0.1 ft so an 8 ft garden (244 cm) prefills as "8", not "8.01". Maintainability - Extracted ui/field.ts (useFieldId + fieldControlClass) shared by TextField/TextArea/Select. Added a `danger` Button variant, used by the delete modal; card edit/delete buttons gained focus-visible rings. - useUpdateGarden takes the id in its mutation variables (no dummy 0 during create). GardensPage shares a close handler; dropped a redundant zod annotation; 409 rebase reuses dimString; renamed `del` -> `deletion`. Verified in a browser: 8 ft round-trips to a prefilled "8"; a sub-cm value is rejected client-side with the modal staying open. tsc clean. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi	2026-07-18 19:03:49 -04:00
steveandClaude Opus 4.8	ae1906e169	Address Gadfly review on #6: logout errors, register gating, guard errors ... Fixes from the PR #25 adversarial review (graded 23 real / 5 false positive): Error handling - onLogout wraps mutateAsync in try/catch: a failed logout no longer becomes an unhandled rejection; the user stays put (session still valid) and the button offers "Retry sign out" (5 models flagged this). - Root errorComponent (RouteError): a non-401 /auth/me failure in a beforeLoad guard now shows a recoverable "Try again" screen instead of blanking. - Forms drop noValidate, restoring native required/type=email/minLength checks before hitting the server. Correctness - RegisterPage gates on providers.isPending/isError before rendering, so the form no longer briefly appears (submittable) on an SSO-only server. - TextField id falls back to name then a useId() value, so the label/hint associations hold even if a caller omits both. Maintainability - Single safeRedirectPath (lib/redirect.ts) replaces the duplicated safeRedirect/safeInternalPath (4 models). - Generic ApiError helpers (apiErrorCode, errorMessage) moved to lib/api.ts; LoginPage builds the OIDC URL from the exported API_BASE. - Divider moved to components/ui/. errorMessage doc clarified. Verified again in a real browser: register -> /gardens; Sign out -> /login. tsc --noEmit and vite build clean. Not changed (graded, with rationale): OIDC deep-link redirect isn't preserved (needs backend state threading — follow-up); 60s me staleTime in guards (server is authoritative); the login/register onSubmit catches are the intended react-query pattern (errors render via mutation state). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi	2026-07-18 18:10:00 -04:00
steveandClaude Opus 4.8	622010cd71	Add auth UI: login/register pages, OIDC button, route guard (#6) ... Frontend for pansy auth, rendering whatever /auth/providers reports. - lib/auth.ts: zod-validated User/Providers, a shared meQueryOptions (a 401 resolves to null, not an error) reused by useMe() and the router guard, useProviders(), and useLogin/useRegister/useLogout mutations that prime/clear the me cache (logout also drops non-auth cached data). - lib/queryClient.ts: one QueryClient shared by the React tree and the router context so guard and components hit the same cache. - router.tsx: createRootRouteWithContext with the queryClient; requireAuth (redirects to /login?redirect=<dest>) on gardens/plants/editor, and requireGuest on login/register (bounces authed users away). Login search params (redirect, error) validated as optional; redirect targets are restricted to same-origin paths. - pages/LoginPage: OIDC button (label from providers) linking to /auth/oidc/login, "or" divider, local email/password form, and friendly messages for the OIDC callback ?error= codes. RegisterPage: email + display name + password (min 8), registration-closed and SSO-only handling; auto-login lands on /gardens. - AppShell: auth-aware nav — shows the user's display name + Sign out when logged in, Sign in otherwise; nav links only when authed. - ui/: TextField (16px text to avoid iOS zoom, autocomplete + a11y), Button (+ shared buttonClasses for the OIDC anchor), Alert; AuthCard. Verified in a real browser against the embedded binary: register → auto-login → /gardens; refresh stays in; Sign out → /login; a logged-out /gardens/1 redirects to /login and returns after login; OIDC button renders with the Authentik label when configured. tsc --noEmit clean. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi	2026-07-18 17:49:57 -04:00