cesnimda
46 lines
3.8 KiB
Markdown
46 lines
3.8 KiB
Markdown
# UX-001 unified authentication page
|
||
|
||
Updated: 2026-08-09
|
||
|
||
Status: `IMPLEMENTED — NOT VERIFIED`. The unified local/provider presentation, component tests, responsive dark-theme browser smoke, full frontend regression suite and production build pass. Light-theme browser, configured-provider browser, real-provider and production checks remain.
|
||
|
||
## Revalidated behavior
|
||
|
||
- The API local-login endpoint already accepts either email or username. The previous browser form constrained the value to an email, so the UI did not expose the supported username path.
|
||
- `LoginPage` previously separated local, Google and Microsoft sign-in into tabs. The provider components also combined signed-out authentication with signed-in link/unlink account management, which caused profile-oriented status copy to appear in the authentication surface.
|
||
- Google and Microsoft exchanges already use their hardened `/auth/google/exchange` and `/auth/microsoft/exchange` endpoints. Account linking uses distinct authenticated link endpoints. The presentation change does not alter those backend contracts or identity decisions.
|
||
|
||
## Implemented contract
|
||
|
||
- Signed-out users receive one username-or-email/password form, one visual `or` separator, and enabled Google/Microsoft alternatives in the same card.
|
||
- Registration remains a distinct mode and still requires an email-formatted address, password confirmation and the existing registration policy checks.
|
||
- Provider components accept an explicit sign-in presentation that omits `/auth/me`, link/unlink state and linking copy while reusing the existing provider exchange, two-factor challenge and safe return-path behavior.
|
||
- Invalid local credentials remain on the page. Microsoft cancellation produces an error without an exchange or navigation. Synthetic Microsoft and Google provider returns use their exchange endpoints and navigate only after an authenticated response.
|
||
- No tenant, issuer, account-linking, registration, recovery, session or authorization backend behavior changed.
|
||
|
||
## Verification
|
||
|
||
- Focused login components: 13/13 tests.
|
||
- Full frontend: 47/47 suites and 166/166 tests.
|
||
- Production frontend build and TypeScript: pass.
|
||
- `git diff --check`: pass; line-ending notices only.
|
||
- Browser dark-theme smoke: the local form rendered at 375, 768 and 1440 CSS pixels; measured document width matched the viewport at every size. Normal viewport captures show readable controls without clipping. DOM inspection confirmed accessible names for username/email, password, remember-me, recovery and submit controls.
|
||
- Configured provider alternatives, local invalid credentials, Microsoft cancellation/direct return and Google credential return were exercised with mocked services. No real provider token or credential was used.
|
||
|
||
## Remaining gates
|
||
|
||
- The isolated browser did not have an API configuration service, so it displayed the local form and optional-auth banner only. Enabled provider buttons were not exercised in a running browser.
|
||
- The in-app browser exposed the current dark system theme but did not expose page storage for switching the anonymous preference. Light-theme and System-mode browser checks remain under UX-002.
|
||
- Real Google/Microsoft cancellation/return and production smoke require authorized disposable accounts and deployed configuration.
|
||
- Registration, verification, reset and account-recovery lifecycle behavior remains owned by SEC-005A/B; this package did not weaken or reimplement those paths.
|
||
|
||
## Evidence
|
||
|
||
- Screenshots: `docs/audits/evidence/ux-001/`
|
||
- Commands/results: `docs/audits/verification-log.md` V-108–V-110
|
||
- Tests: `job-tracker-ui/src/login-page.test.tsx`
|
||
|
||
## Rollback
|
||
|
||
Revert the UX-001 implementation commit. No schema, dependency, API, identity record or configuration migration is involved. The separate provider tabs and account-oriented card presentation would return; existing provider links and sessions remain unchanged.
|