pages: Add /support page with OAuth reset wizard (2/3 split of #1371) - #1374
Open
RudraBJoshi wants to merge 4 commits into
Open
pages: Add /support page with OAuth reset wizard (2/3 split of #1371)#1374RudraBJoshi wants to merge 4 commits into
RudraBJoshi wants to merge 4 commits into
Conversation
New /support page: a topic list (currently just "Password Reset") that deep-links via ?topic=reset straight into a "Let's Reset Your Password" wizard, skipping the topic list -- used by "Forgot your password?" links elsewhere so /support can grow to cover more than password reset later without adding friction. The wizard animates through GitHub ID entry -> school Google OAuth sign-in -> new password, calling Spring's OAuth-verified reset endpoints (/mvc/person/reset/oauth/verify, /mvc/person/reset/oauth/complete). The Google ID token is only relayed raw to the backend; the digit-match/identity check happens server-side, not in this client code. Client-side password checks: 8-character minimum and confirm-match, with inline feedback (styled via the new .password-length validation class, referenced by this code but never previously defined). Exports GOOGLE_CLIENT_ID once from config.js instead of copy-pasting it into every page that needs Google sign-in, and login.md picks up that shared import too. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This was referenced Aug 24, 2026
Ensures any Claude Code session working in this repo automatically sees that .clauderc (one directory up, at the prodsys root) has the project structure, ongoing work, deploy requirements, and known gaps -- CLAUDE.md is auto-loaded into context at session start, .clauderc on its own is not.
Companion to a spring-side fix that force-expires a uid's MVC sessions after /reset/oauth/complete succeeds: that invalidates the account's sessions server-side, but doesn't clear any cookies the browser completing the reset happens to be holding. Call Spring's /logout (best-effort) right before redirecting to /login so this browser's cookies get cleared too. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- showResetOAuthStatus(): build the status message via createElement/ textContent instead of innerHTML string interpolation. - startOAuthReset(): show an inline error if the Google GSI script hasn't loaded, and clear the sign-in container before rendering so re-entering the step doesn't stack a second button. - submitOAuthResetPassword(): route password/mismatch errors through the existing inline validation message instead of alert(). - .support-topic-item <li>: add role="button" tabindex="0" plus a delegated keydown listener, so it's keyboard-activatable. - resetUid/resetNewPassword/resetConfirmPassword: add matching aria-labels (previously placeholder-only accessible names). - Move the inline <style> block and inline style="..." attributes into the same SCSS partial used on pwd-reset-support (elements/forms/support.scss). - login.md's signup Google client id now reads from one shared _config.yml value via Liquid instead of being hardcoded (this branch's login.md already imported GOOGLE_CLIENT_ID from config.js, so this applied cleanly -- p1-forgot-password-button's older variant, which hardcodes a local copy instead of importing, was left alone rather than backported into). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Splitting #1371 into smaller, independently-reviewable PRs across spring/flask/pages. This one covers the support page.
New
/supportpage: a topic list (currently just "Password Reset") that deep-links via?topic=resetstraight into a 3-step wizard (GitHub ID → school Google OAuth → new password), calling Spring's OAuth-verified reset endpoints. The Google ID token is only relayed raw to the backend; the identity check happens server-side. Also exportsGOOGLE_CLIENT_IDonce fromconfig.jsinstead of copy-pasting it, and fixes a referenced-but-never-defined.password-lengthvalidation style.Original PR: #1371