Bernard Siebens
addfc61a2c
The MFA pages (manage, TOTP activate/deactivate, recovery codes, security keys,
reauthenticate) are built almost entirely from allauth's `element` primitives, so
they are styled by overriding the elements rather than by rewriting eight page
templates. New allauth pages then inherit the look for free.
- field + img elements were missing entirely, so allauth fell back to bare HTML:
the TOTP secret and recovery-code list rendered as unstyled inputs. The QR now
sits on a white plate -- it is dark modules on a transparent ground, so on the
dark theme it was dark-on-dark and phones could not scan it.
- button now honours the tags allauth sets. They were all flattened to
btn-primary, which made "Deactivate" look exactly as safe as "View".
- the `code` field renders as a daisyUI otp wherever it appears, so the
reauthenticate and activate pages get the same input as the login challenge.
The boxes step aside past six characters: allauth accepts a TOTP code (6) or a
recovery code (8) in that one field.
Fixes a crash: the security-key list does {% load humanize %}, which raised
TemplateSyntaxError because django.contrib.humanize was not installed. That page
500'd on every request; it is now installed and covered by a test.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
156 lines
7.3 KiB
HTML
156 lines
7.3 KiB
HTML
{% load lucide static ui %}
|
|
|
|
{% comment %}
|
|
The page skeleton, with no branding of its own. `_platform_base.html` dresses it
|
|
as RosterChief, `_club_base.html` as a club; the `branding` context processor
|
|
picks between them per tenant.
|
|
{% endcomment %}
|
|
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
|
|
<title>
|
|
{% block title %}RosterChief{% endblock title %}
|
|
</title>
|
|
|
|
{% comment %}
|
|
Apply the stored theme before first paint, otherwise the page flashes the wrong
|
|
colours. Nothing stored means "auto": we set no attribute at all, so daisyUI's
|
|
`dark --prefersdark` follows the OS.
|
|
{% endcomment %}
|
|
<script>
|
|
(() => {
|
|
const stored = localStorage.getItem("theme");
|
|
if (stored) document.documentElement.setAttribute("data-theme", stored);
|
|
})();
|
|
</script>
|
|
|
|
<link rel="stylesheet" href="{% static 'css/app.css' %}"/>
|
|
|
|
{# After the stylesheet: brand overrides (logo urls, club colours) must win. #}
|
|
{% block extra %}{% endblock extra %}
|
|
</head>
|
|
|
|
<body class="min-h-screen bg-base-200">
|
|
<div class="navbar mb-4 border-b border-base-300 bg-base-100 px-6 shadow-sm">
|
|
<div class="my-4 flex-1">
|
|
{% block brand %}{% endblock brand %}
|
|
</div>
|
|
|
|
<button class="btn btn-ghost w-24" type="button" data-theme-toggle aria-label="Theme">
|
|
<span data-theme-icon="light" class="hidden items-center gap-4">{% lucide "sun" size=20 %} light</span>
|
|
<span data-theme-icon="dark" class="hidden items-center gap-4">{% lucide "moon" size=20 %} dark</span>
|
|
<span data-theme-icon="auto" class="hidden items-center gap-4">{% lucide "sun-moon" size=20 %} auto</span>
|
|
</button>
|
|
|
|
{% if user.is_authenticated %}
|
|
<div class="dropdown dropdown-end">
|
|
<div tabindex="0" role="button" class="btn btn-ghost gap-4">{% lucide "circle-user" %}{{ user.get_full_name }}</div>
|
|
<ul tabindex="0" class="menu dropdown-content z-10 mt-2 w-60 rounded-box bg-base-100 p-2 shadow">
|
|
<li>
|
|
<a href="{% url 'mfa_index' %}">{% lucide "shield-check" size=16 %} Two-factor authentication</a>
|
|
</li>
|
|
<li>
|
|
<a href="{% url 'account_change_password' %}">{% lucide "key-round" size=16 %} Change password</a>
|
|
</li>
|
|
<li>
|
|
<a href="{% url 'account_logout' %}">{% lucide "log-out" size=16 %} Sign out</a>
|
|
</li>
|
|
</ul>
|
|
</div>
|
|
{% else %}
|
|
<a class="btn btn-ghost gap-4" href="{% url 'account_login' %}">{% lucide "log-in" size=16 %} Sign in</a>
|
|
{% endif %}
|
|
</div>
|
|
|
|
{% if messages %}
|
|
<div class="mx-auto mt-4 w-full space-y-2 px-4">
|
|
{% for message in messages %}
|
|
{% with alert=message|as_alert %}
|
|
<div class="alert alert-soft {{ alert.css }}" role="alert">
|
|
{% lucide alert.icon size=20 %}
|
|
<div>
|
|
<div class="font-bold">{{ alert.title }}</div>
|
|
<div class="text-sm">{{ alert.body }}</div>
|
|
</div>
|
|
</div>
|
|
{% endwith %}
|
|
{% endfor %}
|
|
</div>
|
|
{% endif %}
|
|
|
|
<main class="mx-auto w-full p-4">
|
|
{% block main %}{% endblock main %}
|
|
</main>
|
|
|
|
<script>
|
|
// The button cycles light -> dark -> auto. "auto" removes the attribute and the
|
|
// stored key rather than writing the OS's current choice: that keeps daisyUI's
|
|
// `dark --prefersdark` following the OS *live*, so the page flips when the OS
|
|
// does. Storing a snapshot would freeze it at whatever the OS was on click.
|
|
const MODES = ["light", "dark", "auto"];
|
|
const currentMode = () => localStorage.getItem("theme") || "auto";
|
|
|
|
const applyMode = (mode) => {
|
|
if (mode === "auto") {
|
|
localStorage.removeItem("theme");
|
|
document.documentElement.removeAttribute("data-theme");
|
|
} else {
|
|
localStorage.setItem("theme", mode);
|
|
document.documentElement.setAttribute("data-theme", mode);
|
|
}
|
|
|
|
// Show the label for the *chosen* mode, not the resulting colours -- otherwise
|
|
// "auto" would be indistinguishable from whichever theme it resolved to.
|
|
// `hidden` and `inline-flex` are both display utilities, so the visible one
|
|
// must carry exactly one of them: leaving both on would let stylesheet order,
|
|
// not class order, decide who wins.
|
|
document.querySelectorAll("[data-theme-icon]").forEach((label) => {
|
|
const active = label.dataset.themeIcon === mode;
|
|
label.classList.toggle("hidden", !active);
|
|
label.classList.toggle("inline-flex", active);
|
|
});
|
|
document.querySelectorAll("[data-theme-toggle]").forEach((button) => button.setAttribute("aria-label", `Theme: ${mode}`));
|
|
};
|
|
|
|
document.querySelectorAll("[data-theme-toggle]").forEach((button) => {
|
|
button.addEventListener("click", () => applyMode(MODES[(MODES.indexOf(currentMode()) + 1) % MODES.length]));
|
|
});
|
|
|
|
applyMode(currentMode());
|
|
</script>
|
|
|
|
<script>
|
|
// A TOTP code is 6 characters, a recovery code 8, and allauth accepts either in
|
|
// the same field. The boxed otp layout only fits six, so past that we fall back
|
|
// to a plain input rather than letting the text spill out of the boxes. Boxing
|
|
// the field to six and calling it done would lock recovery codes out entirely.
|
|
document.querySelectorAll("[data-otp]").forEach((otp) => {
|
|
const input = otp.querySelector("input");
|
|
if (!input) return;
|
|
|
|
const fit = () => {
|
|
const boxed = input.value.length <= 6;
|
|
otp.classList.toggle("otp", boxed);
|
|
otp.classList.toggle("otp-lg", boxed);
|
|
otp.querySelectorAll("span").forEach((box) => box.classList.toggle("hidden", !boxed));
|
|
input.classList.toggle("input", !boxed);
|
|
input.classList.toggle("input-lg", !boxed);
|
|
};
|
|
|
|
input.addEventListener("input", fit);
|
|
fit();
|
|
});
|
|
</script>
|
|
|
|
{% comment %}
|
|
allauth puts page-level scripts and out-of-form markup here — notably the
|
|
hidden `mfa_login` form the passkey button submits. Without this block that
|
|
form is never rendered and "Sign in with a passkey" is a dead button.
|
|
{% endcomment %}
|
|
{% block extra_body %}{% endblock extra_body %}
|
|
</body>
|
|
</html>
|