fix(web): defer login head scripts to stop the chromium credential-fill race (BUNYIP-294) #302

Merged

nrupard merged 1 commit from fix/BUNYIP-294-defer-login-head-scripts into main

2026-06-30 22:44:54 +02:00

nrupard commented

2026-06-30 22:25:44 +02:00

Owner

What

Add defer to the two third-party CDN <head> scripts in bunyip-web/src/views/layout.rs (Font Awesome kit + htmx) so neither blocks HTML parsing on the hub /login page.

Why

The /login page (public_shell, wrapped in document()) loaded both scripts as render-blocking <script src> tags (no defer/async), so HTML parsing halted at each tag until the third-party CDN responded. Page-ready timing therefore depended on CDN latency. On slow chromium CI the automated credential fill landed before the form had settled, the native POST went out empty, and login_post (auth_pages.rs:553) re-rendered the form with empty fields. mokosh-server's e2e saw "the form kept re-rendering with empty fields after submit" only on chromium; firefox, webkit, and the same run's setup login all passed. The symptom recurred across mokosh PMS-592 and PMS-595, both of which hardened the e2e helper instead of the hub render timing, so the fix belongs here.

defer makes the scripts non-render-blocking and runs them in document order after the parse, before DOMContentLoaded. htmx stays (the declared Maud + htmx stack); only its load timing changes. No CSP change.

Validation

just check-container (fmt + clippy --workspace --all-targets -D warnings + test --workspace --lib) green. The defer empty-attribute maud syntax compiles.

Full confirmation that the chromium e2e flake is gone needs a green run against staging after this deploys. The Playwright trace that would pin the exact input-clearing event cannot currently be downloaded from Forgejo via fj (a separate tooling gap).

Fixes BUNYIP-294. Relates to mokosh PMS-605 / PMS-592 / PMS-595.

## What Add `defer` to the two third-party CDN `<head>` scripts in `bunyip-web/src/views/layout.rs` (Font Awesome kit + htmx) so neither blocks HTML parsing on the hub `/login` page. ## Why The `/login` page (`public_shell`, wrapped in `document()`) loaded both scripts as render-blocking `<script src>` tags (no `defer`/`async`), so HTML parsing halted at each tag until the third-party CDN responded. Page-ready timing therefore depended on CDN latency. On slow chromium CI the automated credential fill landed before the form had settled, the native POST went out empty, and `login_post` (`auth_pages.rs:553`) re-rendered the form with empty fields. mokosh-server's e2e saw "the form kept re-rendering with empty fields after submit" only on chromium; firefox, webkit, and the same run's `setup` login all passed. The symptom recurred across mokosh PMS-592 and PMS-595, both of which hardened the e2e helper instead of the hub render timing, so the fix belongs here. `defer` makes the scripts non-render-blocking and runs them in document order after the parse, before `DOMContentLoaded`. htmx stays (the declared Maud + htmx stack); only its load timing changes. No CSP change. ## Validation `just check-container` (fmt + clippy `--workspace --all-targets -D warnings` + `test --workspace --lib`) green. The `defer` empty-attribute maud syntax compiles. Full confirmation that the chromium e2e flake is gone needs a green run against staging after this deploys. The Playwright trace that would pin the exact input-clearing event cannot currently be downloaded from Forgejo via `fj` (a separate tooling gap). Fixes BUNYIP-294. Relates to mokosh PMS-605 / PMS-592 / PMS-595.

nrupard added 1 commit

2026-06-30 22:25:45 +02:00

fix(web): defer login head scripts to stop the chromium credential-fill race

E2E / Playwright against deployment (pull_request) Successful in 24s

Details

Check / fmt + clippy + build + tests (pull_request) Successful in 19m6s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

c3ddbe209a

The hub /login page (public_shell, wrapped in document()) loaded the Font Awesome kit and htmx as render-blocking <head> scripts (no defer/async), so HTML parsing halted at each tag until the third-party CDN responded. That made page-ready timing depend on CDN latency. On slow chromium CI the automated credential fill landed before the form had settled, the submit POSTed empty, and login_post re-rendered the form with empty fields - mokosh's e2e saw "the form kept re-rendering with empty fields after submit" only on chromium (firefox/webkit and the same run's setup login passed). It recurred across mokosh PMS-592 and PMS-595, which both hardened the e2e helper instead of the hub render timing.

Add defer to both scripts so neither blocks parsing; they execute in document order after the parse, before DOMContentLoaded. htmx stays (the declared Maud + htmx stack); only its load timing changes. No CSP change. Confirmation needs a green chromium e2e against staging after deploy.

#BUNYIP-294

nrupard scheduled this pull request to auto merge when all checks succeed

2026-06-30 22:29:25 +02:00