From 3873b6a5bbe78baba32102186b613d984331144c Mon Sep 17 00:00:00 2001
From: clover caruso <git@paperclover.net>
Date: Mon, 5 Oct 2026 11:13:07 -0700
Subject: [PATCH] Hide guest providers on the password step and add back
 navigation

Show the selected account as a large blue heading. Capture only Astheno numeric error identifiers when token exchange is rejected.

Assisted-by: gpt-6
---
 dashboard/src/guest.rs         | 34 +++++++++++++++++++++++++++-------
 dashboard/web/pages/SignIn.css |  6 +++---
 dashboard/web/pages/SignIn.tsx |  5 +++--
 3 files changed, 33 insertions(+), 12 deletions(-)

diff --git a/dashboard/src/guest.rs b/dashboard/src/guest.rs
index ff3a9d367ebcec95bec221c74f15be407ce9f7e9..e99f2c3e7c24e22ceb78be0d09d2827571908fd1 100644
--- a/dashboard/src/guest.rs
+++ b/dashboard/src/guest.rs
@@ -96,13 +96,13 @@ fn registration(auth: &auth::Store, provider: &str) -> Result<(String, String)>
 }
 
 async fn response_bytes(mut response: reqwest::Response) -> Result<Vec<u8>> {
-    if !response.status().is_success() || response.content_length().is_some_and(|n| n > 65536) {
-        eprintln!(
-            "guest provider response: {} {} status {}",
-            response.url().host_str().unwrap_or_default(),
-            response.url().path(),
-            response.status()
-        );
+    let status = response.status();
+    let endpoint = format!(
+        "{}{}",
+        response.url().host_str().unwrap_or_default(),
+        response.url().path()
+    );
+    if response.content_length().is_some_and(|n| n > 65536) {
         return Err(Error::new(
             502,
             "The provider couldn't complete sign-in. Return to Shale and try again.",
@@ -118,6 +118,26 @@ async fn response_bytes(mut response: reqwest::Response) -> Result<Vec<u8>> {
         }
         data.extend_from_slice(&chunk);
     }
+    if !status.is_success() {
+        let error: Value = serde_json::from_slice(&data).unwrap_or(Value::Null);
+        let code = string(&error["error_description"])
+            .split(':')
+            .next()
+            .unwrap_or_default();
+        let code = if code.starts_with('E')
+            && code.len() <= 8
+            && code[1..].bytes().all(|c| c.is_ascii_digit())
+        {
+            code
+        } else {
+            "unknown"
+        };
+        eprintln!("guest provider response: {endpoint} status {status} code {code}");
+        return Err(Error::new(
+            502,
+            "The provider couldn't complete sign-in. Return to Shale and try again.",
+        ));
+    }
     Ok(data)
 }
 
diff --git a/dashboard/web/pages/SignIn.css b/dashboard/web/pages/SignIn.css
index 9f328b5669304c919a02729997af9aefc4558aeb..f3bfd94dc7ebe2072a59f2b5d14ad535733a3560 100644
--- a/dashboard/web/pages/SignIn.css
+++ b/dashboard/web/pages/SignIn.css
@@ -6,9 +6,9 @@ body { font: 16px "Name Sans", sans-serif; }
 .pf-v5-c-login__main [aria-disabled="true"], .pf-v5-c-login__main :disabled { opacity: .6; cursor: wait; }
 .setup-intro { margin-bottom: 1rem; text-align: center; }
 .guest-providers { margin-bottom: 1.5rem; }
-.sign-in-account { display: flex; align-items: center; justify-content: space-between; gap: 1rem; margin-bottom: 1rem; }
-.sign-in-account span { overflow-wrap: anywhere; }
-.sign-in-account button { background: none; border: 0; padding: 0; color: var(--text); text-decoration: underline; cursor: pointer; }
+.sign-in-account { margin-bottom: 1.25rem; }
+.sign-in-account h2 { margin: 0; color: var(--primary); font-size: 28px; line-height: 1.2; font-weight: 500; text-align: center; text-transform: none; overflow-wrap: anywhere; }
+.sign-in-account button { display: inline-flex; align-items: center; gap: .375rem; margin-bottom: .75rem; background: none; border: 0; padding: 0; color: var(--primary); cursor: pointer; }
 .pf-v5-c-login__main .guest-providers a {
   display: grid;
   grid-template-columns: 20px minmax(0, 1fr) 20px;
diff --git a/dashboard/web/pages/SignIn.tsx b/dashboard/web/pages/SignIn.tsx
index 5aefb84278fffce9c8f5388b714dcf7aebdd5e25..53cbac9789ec2c92c3372eb17e96b1d703d32569 100644
--- a/dashboard/web/pages/SignIn.tsx
+++ b/dashboard/web/pages/SignIn.tsx
@@ -1,5 +1,6 @@
 import { createEffect, createResource, createSignal, For, onCleanup, onMount, Show } from "solid-js";
 import { authReason, authRequest } from "../auth.ts";
+import ArrowLeft from "lucide-solid/icons/arrow-left";
 import Stone from "lucide-solid/icons/stone";
 import githubIcon from "../sso/github.svg";
 import theme from "../sso/css/styles.css?inline";
@@ -86,7 +87,7 @@ export function SignIn() {
             <Show when={status.error || error()}><div class="alert-error pf-v5-c-alert" role="alert"><span class="pf-v5-c-alert__title">{status.error ? authReason(status.error) : error()}</span></div></Show>
             <Show when={notice()}><div class="alert-info pf-v5-c-alert" role="status"><span class="pf-v5-c-alert__title">{notice()}</span></div></Show>
             <Show when={!status.error} fallback={<button class="pf-v5-c-button pf-m-primary pf-m-block" onClick={() => refetch()}>try again</button>}>
-              <Show when={!setup && status()?.providers?.length}>
+              <Show when={!setup && !passwordStep() && status()?.providers?.length}>
                 <div id="kc-social-providers" class="guest-providers">
                   <For each={status()?.providers}>{(provider) => <a rel="external" data-provider={provider.id} class="pf-v5-c-button pf-m-primary pf-m-block" href={`/auth/guest/start/${provider.id}?next=${encodeURIComponent(params.get("next") ?? "")}`}>{provider.id === "astheno" ? <Stone size={18} aria-hidden="true" /> : <img src={githubIcon} width="18" height="18" alt="" />}<span>continue with {provider.name}</span></a>}</For>
                 </div>
@@ -94,7 +95,7 @@ export function SignIn() {
               <div id="kc-form"><div id="kc-form-wrapper">
                 <form id="kc-form-login" onSubmit={(event) => { event.preventDefault(); void complete(); }}>
                   <Show when={setup} fallback={
-                    <Show when={!passwordStep()} fallback={<div class="sign-in-account"><span>{username()}</span><button type="button" onClick={() => { setPassword(""); setVisible(false); setError(""); setNotice(""); setPasswordStep(false); }}>change</button><input name="username" type="hidden" autocomplete="username" value={username()} /></div>}>
+                    <Show when={!passwordStep()} fallback={<div class="sign-in-account"><button type="button" onClick={() => { setPassword(""); setVisible(false); setError(""); setNotice(""); setPasswordStep(false); }}><ArrowLeft size={18} aria-hidden="true" />back</button><h2>{username()}</h2><input name="username" type="hidden" autocomplete="username" value={username()} /></div>}>
                     <div class="pf-v5-c-form__group">
                       <label for="username" class="pf-v5-c-form__label">username or email</label>
                       <input id="username" class="pf-v5-c-form-control" name="username" type="text" required autocomplete="username webauthn" value={username()} onInput={(event) => setUsername(event.currentTarget.value)} autofocus ref={(input) => queueMicrotask(() => input.focus())} />
-- 
2.54.0