Auth pages in the SPA (signup, verify, login, reset) #16

New Issue

fable-5 · 2026-07-04T14:52:04+02:00

fable-5 commented

2026-07-04 14:52:04 +02:00

Context

The M1 backend flows need their user-facing pages, localized and matching the plain professional style.

Scope

Build routes /signup, /verify-email, /login, /forgot-password, /reset-password with react-hook-form + shared Zod schemas, inline field errors, success/pending states (e.g. 'check your inbox'), and an auth context that loads /auth/me, guards private routes, and renders the user menu (name, logout) in the top bar. Handle registration_mode=closed (hide signup, show hint on direct visit).

Acceptance criteria

all five flows work end to end against the dev stack in de and en
form errors from the API render at the correct field, localized
authenticated users visiting /login are redirected home; anonymous users hitting a private route land on /login and return after login
Playwright e2e: signup→verify→login→logout journey

Technical notes

ADR 0005, ADR 0012.
Keep forms dependency-light; no UI framework — extend the design tokens from #4.

Dependencies

Depends on #5, #13, #14, #15.

Size: ~2 days

Conventions: English code/comments, clear human-readable code, no hard-coded UI strings (ADR 0012, add de and en), permission checks only via the shared guard (docs/architecture/permissions.md). Read the referenced ADRs before starting.

## Context The M1 backend flows need their user-facing pages, localized and matching the plain professional style. ## Scope Build routes `/signup`, `/verify-email`, `/login`, `/forgot-password`, `/reset-password` with react-hook-form + shared Zod schemas, inline field errors, success/pending states (e.g. 'check your inbox'), and an auth context that loads `/auth/me`, guards private routes, and renders the user menu (name, logout) in the top bar. Handle `registration_mode=closed` (hide signup, show hint on direct visit). ## Acceptance criteria - [ ] all five flows work end to end against the dev stack in `de` and `en` - [ ] form errors from the API render at the correct field, localized - [ ] authenticated users visiting /login are redirected home; anonymous users hitting a private route land on /login and return after login - [ ] Playwright e2e: signup→verify→login→logout journey ## Technical notes - ADR 0005, ADR 0012. - Keep forms dependency-light; no UI framework — extend the design tokens from #4. ## Dependencies Depends on #5, #13, #14, #15. **Size**: ~2 days --- *Conventions: English code/comments, clear human-readable code, no hard-coded UI strings (ADR 0012, add `de` **and** `en`), permission checks only via the shared guard (docs/architecture/permissions.md). Read the referenced ADRs before starting.*

fable-5 added this to the M1 — Accounts & authentication milestone 2026-07-04 14:52:04 +02:00

fable-5 added the

frontend

auth

labels 2026-07-04 14:52:04 +02:00

fable-5 referenced this issue

2026-07-04 14:52:04 +02:00

Account settings: profile, locale, and password change #17

fable-5 referenced this issue

2026-07-04 14:52:05 +02:00

Instance settings foundation and registration-mode admin toggle #19

fable-5 referenced this issue