Parent issue: https://github.com/sequentech/meta/issues/12617

Summary

Backports the validated login and registration prefill feature from main PR #2905 to release/10.0.

• Captures bounded login_hint__<field> parameters on Voting Portal /login and /enroll routes and forwards them through keycloak-js without replacing OIDC state, nonce, or PKCE.
• Prefills stock declarative registration and optional deferred registration while preserving GET/POST precedence and managed writable-profile boundaries.
• Preserves hints across login-to-registration redirects.
• Exposes dynamic notification attributes and a shared url_encode Handlebars helper.
• Adds unit/browser matrix coverage, operator/developer documentation, and cross-module security hardening.

Stable Backport

This branch replays the nine v10-relevant validated commits from #2905 onto release/10.0. The main-only Release 9.5 migration-note commit is intentionally omitted because the stable v10 branch does not contain the 9.5 release-note page or a current release-notes section. Migration and realm rollout instructions remain in the backported Docusaurus operator/developer documentation.

Security

Hints remain editable, untrusted convenience data. The implementation enforces atomic bounds and encoding validation, scrubs valid and invalid hint parameters from browser history, excludes credentials and unmanaged/read-only/hidden/verification fields, preserves submitted POST values, and removes rendered notification content, recipients, and helper arguments from application and electoral-log telemetry.

Validation

• Voting Portal: 21 focused tests passed; ESLint, Prettier, and production build passed. The build retains 112 existing @sequentech/ui-essentials export warnings.
• Keycloak: full 12-module Maven clean verify passed in 1:00, including 15 voter-enrollment and 22 conditional-authenticator tests.
• Rust: cargo fmt --all -- --check, two focused Windmill tests, two focused sequent-core helper tests, and the established Windmill Clippy gate passed.
• Docusaurus: production build generated static files successfully. It reports an existing system-introduction link to the release 9.4 page absent from this branch; edited pages introduce no broken links.
• Patch hygiene and editor diagnostics are clean for touched files.

Environment Limits

The five live Nightwatch flows require provisioned PREFILL_*_URL realms and were not executed locally. The final Keycloak container image layer remains blocked by Docker Desktop content-store I/O corruption; the complete Maven provider reactor passed locally with standalone Apache Maven.

2026-07-29 Update: rebased on release/10.0 and synced with #2905

Merged the current release/10.0 into this branch and replayed the three new validated commits from #2905. The branch was previously conflicting; it now merges cleanly.

Brought in from release/10.0: the 4-PIN structured credential login (#2909, #2912), the datafix reconciliation process (#2917), and the SonarQube workflow (#2792).

Replayed from #2905:

• 🐞 Fix login hints never reaching the login form — three defects each independently stopped any prefill from reaching the login page. parseLoginHints iterated URLSearchParams.entries() and Map.keys() with for ... of, which the portal's es5 target compiles into indexed loops over an iterator whose length is undefined, so the loop bodies never ran; the Jest suite could not catch it because @swc/jest builds tests for es2022. createLoginUrl / createRegisterUrl return Promise<string> in keycloak-js 26 and were passed unawaited to appendLoginHints, throwing Invalid URL and aborting the redirect; TypeScript reports it, but the Webpack build runs ts-loader with transpileOnly: true. The voting portal login template omitted stock Keycloak's value="${(login.username!'')}".
• ✨ Add per-attribute login hint prefill policy — registration fields declare how they accept a prefilled value through the loginHintPrefillPolicy user profile attribute annotation: EDITABLE (applied when absent, so existing realms are unaffected), READ_ONLY, or IGNORE, with an unrecognised value falling back to IGNORE. READ_ONLY is enforced on the server: a changed value is rejected with loginHintReadOnlyFieldModified and the redisplayed form restores the hint value.
• ✨ Lock a prefilled login username from the login template — the login page is not rendered from the user profile and cannot read the annotation, so login.ftl locks a prefilled username when the realm attribute loginHintUsernamePolicy is READ_ONLY (default EDITABLE). No new authenticator and no browser-flow change. This login lock is presentation-only: Keycloak still authenticates whichever username is submitted, the same guarantee an unprefilled login page gives.

Conflict resolutions

• login.ftl: the username input keeps the release/10.0 structured-credential behaviour (autocomplete="<#if structuredCredential>username<#else>off</#if>" and the structuredCredentialHasError || credentialFieldError invalid state) and gains the login hint value and the usernameReadOnly guard.
• LoginTemplateTest: both branches added this class. The three release/10.0 structured-credential tests are preserved and the two login hint tests are added; all five pass against the merged template.
• DeferredRegistrationUserCreation and its test: additive constant and import conflicts resolved as a union of both sides.

Validation on this branch

• Keycloak: full 12-module Maven clean verify passed, including 24 voter-enrollment tests and 18 sequent-theme tests (5 LoginTemplateTest, 4 StructuredCredentialAssetTest).
• Voting Portal: 21 Jest tests passed; ESLint and Prettier clean. The three touched TypeScript files are byte-identical to their main counterparts.
• Java formatting: Spotless clean across the reactor.

Closes sequentech/meta#12617.