feat(web): per-field show/hide password toggle on signup form #294

Merged

YousifShkara merged 2 commits from feat/BUNYIP-282-signup-password-toggle into main

2026-06-30 09:22:47 +02:00

YousifShkara commented

2026-06-30 08:31:55 +02:00

Owner

The /register password and confirm fields now carry an inline eye-icon button that toggles the input's visibility between password and text. Defaults to hidden; the toggle swaps the icon (fa-eye / fa-eye-slash), aria-pressed, and aria-label so the reveal state is announced to assistive tech. Reduces mistyped-password rejections + the "passwords don't match" restart loop on the signup card without changing the server-side validation contract.

New password_field(id, label, autocomplete) helper in bunyip-web/src/handlers/auth_pages.rs emits the input + absolutely-positioned toggle button. A new password_toggle_script() mirrors the existing password_live_validation_script() idempotent-attach pattern (no double-bind on a future htmx swap). The CSP already allows inline scripts on bunyip-web (crate::security), so no policy change.

Scoped strictly to the signup card: login, password reset, change-password, account-delete confirm, and admin Stripe secret inputs still render via the plain field helper and stay typing-blind. A follow-up ticket can extend the helper if signup feedback warrants it.

#BUNYIP-282

The /register password and confirm fields now carry an inline eye-icon button that toggles the input's visibility between `password` and `text`. Defaults to hidden; the toggle swaps the icon (`fa-eye` / `fa-eye-slash`), `aria-pressed`, and `aria-label` so the reveal state is announced to assistive tech. Reduces mistyped-password rejections + the "passwords don't match" restart loop on the signup card without changing the server-side validation contract. New `password_field(id, label, autocomplete)` helper in `bunyip-web/src/handlers/auth_pages.rs` emits the input + absolutely-positioned toggle button. A new `password_toggle_script()` mirrors the existing `password_live_validation_script()` idempotent-attach pattern (no double-bind on a future htmx swap). The CSP already allows inline scripts on bunyip-web (`crate::security`), so no policy change. Scoped strictly to the signup card: login, password reset, change-password, account-delete confirm, and admin Stripe secret inputs still render via the plain `field` helper and stay typing-blind. A follow-up ticket can extend the helper if signup feedback warrants it. #BUNYIP-282

YousifShkara self-assigned this

2026-06-30 08:31:55 +02:00

YousifShkara added 1 commit

2026-06-30 08:31:55 +02:00

feat(web): per-field show/hide password toggle on signup form

E2E / Playwright against deployment (pull_request) Failing after 1m4s

Details

Check / fmt + clippy + build + tests (pull_request) Has been cancelled

Details

fbc3c9361e

The /register password and confirm fields now carry an inline eye-icon button that toggles the input's visibility between `password` and `text`. Defaults to hidden; the toggle swaps the icon (`fa-eye` / `fa-eye-slash`), `aria-pressed`, and `aria-label` so the reveal state is announced to assistive tech. Reduces mistyped-password rejections + the "passwords don't match" restart loop on the signup card without changing the server-side validation contract.

New `password_field(id, label, autocomplete)` helper in `bunyip-web/src/handlers/auth_pages.rs` emits the input + absolutely-positioned toggle button. A new `password_toggle_script()` mirrors the existing `password_live_validation_script()` idempotent-attach pattern (no double-bind on a future htmx swap). The CSP already allows inline scripts on bunyip-web (`crate::security`), so no policy change.

Scoped strictly to the signup card: login, password reset, change-password, account-delete confirm, and admin Stripe secret inputs still render via the plain `field` helper and stay typing-blind. A follow-up ticket can extend the helper if signup feedback warrants it.

#BUNYIP-282

YousifShkara added 1 commit

2026-06-30 08:55:49 +02:00

Merge remote-tracking branch 'origin/main' into feat/BUNYIP-282-signup-password-toggle

E2E / Playwright against deployment (pull_request) Successful in 37s

Details

Check / fmt + clippy + build + tests (pull_request) Successful in 18m5s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

ed2fee7d1b

YousifShkara merged commit 4ff6c73c2e into main

2026-06-30 09:22:47 +02:00