|
| 1 | +// React login page (Issue #167). |
| 2 | +// |
| 3 | +// Rendered full-screen by <App> when the registry load comes back |
| 4 | +// unauthenticated (401/403) AND the consumer opted into the React |
| 5 | +// login (the backend serves the SPA shell to anonymous users only |
| 6 | +// when DJANGO_ADMIN_REACT["REACT_LOGIN"] is set). It POSTs to |
| 7 | +// /api/v1/login/ via the @dar/data client — which is a thin JSON |
| 8 | +// shell over Django's own authenticate/login (api/views/auth.py). |
| 9 | +// |
| 10 | +// Data-layer rule (CLAUDE.md §7): this page reaches the network only |
| 11 | +// through @dar/data's useApiClient(); it never imports @dar/api. |
| 12 | + |
| 13 | +import { type FormEvent, useState } from 'react'; |
| 14 | + |
| 15 | +import { ApiError, useApiClient } from '@dar/data'; |
| 16 | +import { Button, Card, Input } from '@dar/ui'; |
| 17 | + |
| 18 | +export interface LoginPageProps { |
| 19 | + /** Called after a successful login so the app can re-fetch state. */ |
| 20 | + onSuccess: () => void; |
| 21 | + /** Optional brand title shown above the form. */ |
| 22 | + brandTitle?: string; |
| 23 | +} |
| 24 | + |
| 25 | +export function LoginPage({ onSuccess, brandTitle }: LoginPageProps) { |
| 26 | + const client = useApiClient(); |
| 27 | + const [username, setUsername] = useState(''); |
| 28 | + const [password, setPassword] = useState(''); |
| 29 | + const [error, setError] = useState<string | null>(null); |
| 30 | + const [loading, setLoading] = useState(false); |
| 31 | + |
| 32 | + async function handleSubmit(event: FormEvent<HTMLFormElement>) { |
| 33 | + event.preventDefault(); |
| 34 | + setError(null); |
| 35 | + setLoading(true); |
| 36 | + try { |
| 37 | + await client.login(username, password); |
| 38 | + // Success: hand back to the app to re-fetch the registry. We |
| 39 | + // intentionally do NOT store the returned user here — the |
| 40 | + // registry response is the single source of "who am I". |
| 41 | + onSuccess(); |
| 42 | + } catch (err) { |
| 43 | + // The backend returns one generic 403 for every failure mode |
| 44 | + // (no username / permission enumeration), so we show one generic |
| 45 | + // message regardless of the cause. A non-403 (e.g. network) gets |
| 46 | + // its own message. |
| 47 | + if (err instanceof ApiError && err.status === 403) { |
| 48 | + setError('Invalid credentials or insufficient permissions.'); |
| 49 | + } else if (err instanceof ApiError) { |
| 50 | + setError(err.message); |
| 51 | + } else { |
| 52 | + setError('Could not reach the server. Please try again.'); |
| 53 | + } |
| 54 | + setLoading(false); |
| 55 | + } |
| 56 | + } |
| 57 | + |
| 58 | + return ( |
| 59 | + <div className="flex min-h-screen items-center justify-center bg-gray-50 px-4"> |
| 60 | + <Card className="w-full max-w-sm"> |
| 61 | + <form onSubmit={handleSubmit} className="flex flex-col gap-4 p-2"> |
| 62 | + <h1 className="text-center text-lg font-semibold text-gray-900"> |
| 63 | + {brandTitle ?? 'Sign in'} |
| 64 | + </h1> |
| 65 | + <Input |
| 66 | + label="Username" |
| 67 | + name="username" |
| 68 | + autoComplete="username" |
| 69 | + autoFocus |
| 70 | + required |
| 71 | + value={username} |
| 72 | + onChange={(e) => setUsername(e.target.value)} |
| 73 | + /> |
| 74 | + <Input |
| 75 | + label="Password" |
| 76 | + name="password" |
| 77 | + type="password" |
| 78 | + autoComplete="current-password" |
| 79 | + required |
| 80 | + value={password} |
| 81 | + onChange={(e) => setPassword(e.target.value)} |
| 82 | + error={error ?? undefined} |
| 83 | + /> |
| 84 | + <Button type="submit" variant="primary" loading={loading} disabled={loading}> |
| 85 | + Sign in |
| 86 | + </Button> |
| 87 | + </form> |
| 88 | + </Card> |
| 89 | + </div> |
| 90 | + ); |
| 91 | +} |
0 commit comments