screentinker/frontend/js/views
screentinker 1e99582193
Keep every field on screen during first-run setup (#287)
On a fresh install with no users, typing an email address made the password
field disappear.

Identifier-first login asks the server which identity provider an address uses
before offering a credential, so someone whose organization requires its own
IdP is never shown a password box that will be refused. First-run setup opted
out of that by setting `identified = true` up front - there is nobody to
identify, the operator is creating the first account - and then the "editing
the address returns to the identifier step" listener fired on the very first
keystroke, set it back to false, and re-rendered. Password gone, mid-typing.
The same re-render also replaced "Create admin account" on the button with
"Sign in" and then "Next".

Initialising a flag to the right value is not the same as the flow being
inert: any later event could undo it, and one did. The decision now lives in
frontend/js/lib/login-form-state.js as a pure function that ignores
`identified` and `ssoOnlyDomain` entirely when there are no users, so no event
can take a field away. The input listener also returns early during setup,
which additionally stops it spending an org-lookup rate-limit budget that has
nothing to answer.

Two assertions in login-identifier-first.test.js pinned those expressions to
their old address inside login.js. Their intent - "the two drivers must be
combined in one place so they cannot disagree" - is better served by the
extracted module, so they now follow the logic there rather than being
loosened.

Verified: the extracted pre-fix logic returns showPassword=false and
buttonKey=auth.next for setup-plus-one-keystroke, which is the reported
symptom exactly; the new truth table covers it. i18n/login/auth/session/sso
suites go from 108 to 116 passing, none failing.

Not addressed here, and worth its own change: loadAuthConfig() has no error
handling and caches its first result, so a /api/auth/config that fails leaves
needsSetup undefined and the form falls back to the restrictive layout - the
same visible symptom from a different cause.


Claude-Session: https://claude.ai/code/session_014kfhrUPit5MCqxeTQyqr56

Co-authored-by: Dan Walters <dan.walters@bytetinker.net>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-08-18 14:50:54 -05:00
..
activity.js Stop eight dashboard views reporting success for requests the server refused 2026-07-30 21:21:56 -05:00
admin-player-debug.js Add player debug overlay and server-side error telemetry sink 2026-05-15 15:20:42 -05:00
admin.js Escape user-controlled data at the HTML sinks it actually reaches 2026-08-11 11:44:10 -05:00
billing.js Escape user-controlled data at the HTML sinks it actually reaches 2026-08-11 11:44:10 -05:00
content-library.js Escape user-controlled data at the HTML sinks it actually reaches 2026-08-11 11:44:10 -05:00
dashboard.js Opt-in install statistics (#267) 2026-08-13 17:27:10 -05:00
designer.js Escape user-controlled data at the HTML sinks it actually reaches 2026-08-11 11:44:10 -05:00
device-detail.js Check what is IN a cached update, and add a way to throw it away (#274) 2026-08-14 08:37:05 -05:00
force-password-change.js feat(admin): admin-provisioned user creation + first-login gate (#10) 2026-06-05 11:03:56 -05:00
help.js Describe a portrait video wall as portrait, and stop a wall hiding its screens 2026-08-06 09:46:31 -05:00
kiosk.js Stop eight dashboard views reporting success for requests the server refused 2026-07-30 21:21:56 -05:00
layout-editor.js Portrait templates, a canvas that matches the layout, and a playlist mockup 2026-08-05 13:23:15 -05:00
login.js Keep every field on screen during first-run setup (#287) 2026-08-18 14:50:54 -05:00
no-workspace.js feat(signup): optional org-on-create for self-service signups (#12) 2026-06-05 11:16:27 -05:00
onboarding.js Default a video playlist item to the clip's own length (#237) 2026-08-06 09:36:53 -05:00
playlists.js Merge #239: let the playlist preview skip to any item 2026-08-06 09:52:20 -05:00
reports.js Escape user-controlled data at the HTML sinks it actually reaches 2026-08-11 11:44:10 -05:00
schedule.js Merge Japanese localisation (#283) (#285) 2026-08-18 09:23:28 -05:00
settings.js Install statistics: send on opt-in, name a blocked firewall, and add an operator collector (#268) 2026-08-13 19:00:37 -05:00
teams.js Stop eight dashboard views reporting success for requests the server refused 2026-07-30 21:21:56 -05:00
video-wall.js Escape user-controlled data at the HTML sinks it actually reaches 2026-08-11 11:44:10 -05:00
widgets.js Keep the widget editor's Preview isolated, whatever the org setting says 2026-08-11 15:53:57 -05:00
workspace-members.js Escape user-controlled data at the HTML sinks it actually reaches 2026-08-11 11:44:10 -05:00