feat(account-panel): add authentication dialog - #165
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Account flows need to preserve internal destinations without permitting external redirects. Add a same-origin path sanitizer that rejects non-rooted, protocol-relative, and backslash forms. Login flows can now reuse a narrow, tested return-path boundary.
The existing session actions had no query-driven interface for users to sign in or register. Add code login, password login, registration, cooldown, validation, inline feedback, and safe return navigation. The application shell now hosts the dialog while its closed state remains independent of auth context.
The account dialog should appear as a lightweight layer over the current page. Add restrained backdrop and panel entry motion with the existing application timing language. Reduced-motion users continue to receive the same interface without animation.
e03c8cc to
4c00299
Compare
|
@nighca 老师，已基于最新 main 完成 rebase，CI 已通过 |
![fennoai[bot]](https://avatars.githubusercontent.com/in/1924301?s=60&v=4){kind=small}
There was a problem hiding this comment.
Medium: the async submit path does not check whether the dialog is still mounted after the await. Closing the panel while a login/register request is in flight can still call setSuccess and schedule the redirect, so a dismissed modal may navigate the page later.
Verification gap: I could not run the frontend tests in this workspace because the local node modules are not installed.
Pending authentication can finish after the account dialog has closed. Track dismissal across close and unmount before continuing the async submit flow. Closed dialogs no longer show success state or schedule a delayed navigation.
The async close race lacked a regression case. Resolve a deferred code login after dismissing the dialog and advance the redirect timer. The route now remains unchanged after the abandoned submission completes.
@fennoai 这个问题成立，已经修复。现在账号面板关闭或卸载后会终止异步提交的后续处理，请求随后成功或失败都不会再更新弹窗状态或安排跳转。 |
结论这次修复成立。
我本地尝试跑 |
|
@nighca 老师，目前所有问题均已修复，可以 review 了 |
3 participants
功能说明
?account=login驱动的登录/注册面板，默认提供邮箱验证码免密登录。returnTo。实现方式
account=login时读取会话 Context。shared/navigation，只接受当前 origin 下的绝对站内路径。截图
以下截图统一为 1280 × 720 横屏完整页面。
邮箱验证码登录
密码登录
注册
验证
分支已更新到包含 PR #163 的最新
main，本地重新执行：npm run format:check：通过。npm run lint：通过。npm run typecheck：通过。npm run test：23 个文件、134 项测试通过；包含提交中关闭面板后不再跳转的回归测试。npm run build：通过，Vite 转换 109 个模块。截图与交互使用本地认证桩验证，不代表已完成真实后端联调。
范围边界
Closes #159
关联：#157、PR #163