OSS-OO/laboratory
Watch
1
0
Fork
You've already forked laboratory
 0
Code Issues 3 Pull requests 3 Projects Releases Packages Wiki Activity Actions 2

Identity dock: account switcher Phase A (guided re-login) #20

Merged
ClaudiuSchuster merged 1 commit from oss-oo/account-switcher into main 2026-09-22 23:02:54 +00:00
Conversation 0 Commits 1 Files changed 4 +275 -3
ClaudiuSchuster commented 2026-09-22 23:02:33 +00:00
Owner
Copy link

Phase A of the account switcher (docs/ACCOUNT_SWITCHER.md §7).

What

  • Additive identity dock in the body_outer_pre.tmpl hook template (the abuse banner stays byte-identical — pure addition).
  • Static identity manifest at forgejo-custom/public/assets/identities.json → /assets/identities.json (public metadata only: login, title, avatar path, accent).
  • Click on a non-active identity = honest guided re-login: two-click armed CSRF logout via fetch + X-Csrf-Token, then /user/login with the username prefilled client-side, password focused, toast hint. Forgejo 16.0.5 ignores ?login_name= (verified live) and GET /user/logout is 404 — both documented in §7.
  • Active identity comes server-side: hook template stamps data-signed-in (the v1 API rejects session cookies — caught in local testing).
  • Tooltips use data-tooltip-content + aria-label: Forgejo's tooltip system strips native title attributes.
  • RUNBOOK: dock added to the customization inventory + ops notes (add identity = edit JSON + rsync, template changes need restart).

Local evidence

  • scripts/e2e-local.sh PASS (full stack incl. MCP + registrar round-trip).
  • Browser-tested full flow on the local stack: chip click → arm/confirm → logout → prefilled sign-in; active-state highlighting; avatar fallback; banner gating on signup intact.
Phase A of the account switcher (docs/ACCOUNT_SWITCHER.md §7). **What** - Additive identity dock in the `body_outer_pre.tmpl` hook template (the abuse banner stays byte-identical — pure addition). - Static identity manifest at `forgejo-custom/public/assets/identities.json` → `/assets/identities.json` (public metadata only: login, title, avatar path, accent). - Click on a non-active identity = honest guided re-login: two-click armed CSRF logout via `fetch` + `X-Csrf-Token`, then `/user/login` with the username prefilled client-side, password focused, toast hint. Forgejo 16.0.5 ignores `?login_name=` (verified live) and `GET /user/logout` is 404 — both documented in §7. - Active identity comes server-side: hook template stamps `data-signed-in` (the v1 API rejects session cookies — caught in local testing). - Tooltips use `data-tooltip-content` + `aria-label`: Forgejo's tooltip system strips native `title` attributes. - RUNBOOK: dock added to the customization inventory + ops notes (add identity = edit JSON + rsync, template changes need restart). **Local evidence** - `scripts/e2e-local.sh` PASS (full stack incl. MCP + registrar round-trip). - Browser-tested full flow on the local stack: chip click → arm/confirm → logout → prefilled sign-in; active-state highlighting; avatar fallback; banner gating on signup intact.
Identity dock: account switcher Phase A (guided re-login)
All checks were successful
ci / ci (pull_request) Successful in 3s
Details
21a03c67e7 
Additive hook-template dock in body_outer_pre.tmpl (abuse banner kept
untouched) plus a static identity manifest at /assets/identities.json.
Clicking a non-active identity runs an honest guided re-login: CSRF
logout via fetch (two-click armed), then /user/login with the username
prefilled client-side (16.0.5 ignores ?login_name=, verified live),
password focused, toast hint. Active identity comes server-side via
data-signed-in (the v1 API rejects session cookies). Tooltips use
data-tooltip-content because Forgejo strips native title attributes.
Ops notes in RUNBOOK; engine facts and status in ACCOUNT_SWITCHER §7.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
OSS-OO/laboratory!20
No description provided.