From fb0278c62cbe94f2d7874ec12d7a8a33a84b301d Mon Sep 17 00:00:00 2001
From: clover caruso <git@paperclover.net>
Date: Sun, 4 Oct 2026 23:09:56 -0700
Subject: [PATCH] Preserve Snow Sign On and restore passkey autofill

---
 dashboard/src/auth.rs               |  80 ++++++++++++++---
 dashboard/src/main.rs               |   2 +-
 dashboard/src/shale.rs              |  40 +++++++++
 dashboard/web/pages/MCP.css         |  46 +++++-----
 dashboard/web/pages/MCP.tsx         |  47 +++++-----
 dashboard/web/pages/SignIn.css      |  20 ++---
 dashboard/web/pages/SignIn.tsx      | 133 ++++++++++++++++++++--------
 dashboard/web/styles.css            |   3 -
 nixos/dashboard.nix                 |   7 +-
 readme.md                           |   3 +
 service/samba/service.pkl           |   2 -
 service/shale/readme/issue-forms.js |  23 +++++
 service/shale/service.pkl           |   3 +
 tools/dashboard-auth-test.py        |  20 ++++-
 14 files changed, 308 insertions(+), 121 deletions(-)
 create mode 100644 service/shale/readme/issue-forms.js

diff --git a/dashboard/src/auth.rs b/dashboard/src/auth.rs
index 8aa7c2fe59ecf9200e7654aaf412080c83affcd1..0059d50b74d9a1a085ff6df30af0ad67b909623c 100644
--- a/dashboard/src/auth.rs
+++ b/dashboard/src/auth.rs
@@ -728,7 +728,7 @@ pub async fn route(State(app): State<Arc<App>>, request: Request) -> Result<Resp
     auth.csrf(&headers, &body)?;
     if path == "/auth/password" || path == "/auth/passkey/start" {
         let name = string(&body["username"]).trim().to_lowercase();
-        if name.len() > 254 || name.is_empty() {
+        if name.len() > 254 || (name.is_empty() && path == "/auth/password") {
             return Err(Error::new(400, "Enter your username."));
         }
         auth.limit(&headers, &name)?;
@@ -772,7 +772,10 @@ pub async fn route(State(app): State<Arc<App>>, request: Request) -> Result<Resp
                 ));
             }
             let id = id.unwrap();
-            let session = auth.create_session(&id, "dashboard", &headers, Some(&data))?;
+            let mut session = auth.create_session(&id, "dashboard", &headers, Some(&data))?;
+            if body["remember"] == false {
+                session = session.replace(&format!("; Max-Age={SESSION_TTL}"), "");
+            }
             let next = if !array(&user["requiredActions"]).is_empty() {
                 "/account".into()
             } else {
@@ -782,25 +785,44 @@ pub async fn route(State(app): State<Arc<App>>, request: Request) -> Result<Resp
                 ([("set-cookie", session)], axum::Json(json!({"next":next}))).into_response(),
             );
         }
-        if user["enabled"] != true {
+        if !name.is_empty() && user["enabled"] != true {
             return Err(Error::new(
                 401,
                 "No passkey is available for that username. Try your password.",
             ));
         }
-        let id = id.unwrap();
-        let keys = passkeys(&auth.db.lock().unwrap(), &id)?;
+        let keys = if let Some(id) = &id {
+            passkeys(&auth.db.lock().unwrap(), id)?
+        } else if name.is_empty() {
+            let db = auth.db.lock().unwrap();
+            let mut statement =
+                db.prepare("SELECT id FROM users WHERE json_extract(profile,'$.enabled')=1")?;
+            let ids = statement
+                .query_map([], |r| r.get::<_, String>(0))?
+                .collect::<std::result::Result<Vec<_>, _>>()?;
+            ids.iter()
+                .map(|id| passkeys(&db, id))
+                .collect::<Result<Vec<_>>>()?
+                .into_iter()
+                .flatten()
+                .collect()
+        } else {
+            Vec::new()
+        };
         if keys.is_empty() {
             return Err(Error::new(
                 401,
                 "No passkey is available for that username. Try your password.",
             ));
         }
-        let (options, state) = auth.webauthn.start_passkey_authentication(&keys)?;
+        let (mut options, state) = auth.webauthn.start_passkey_authentication(&keys)?;
+        if name.is_empty() {
+            options.public_key.allow_credentials.clear();
+        }
         let token = issue(
             &auth.db.lock().unwrap(),
             "authentication",
-            json!({"user":id,"csrf":body["csrf"],"state":state,"flow":body["flow"],"next":body["next"]}),
+            json!({"user":id,"csrf":body["csrf"],"state":state,"flow":body["flow"],"next":body["next"],"remember":body["remember"]}),
             300,
         )?;
         return Ok(axum::Json(json!({"options":options,"token":token})).into_response());
@@ -817,6 +839,39 @@ pub async fn route(State(app): State<Arc<App>>, request: Request) -> Result<Resp
         }
         let credential: PublicKeyCredential = serde_json::from_value(body["credential"].clone())
             .map_err(|_| Error::new(400, "The browser couldn't return your passkey. Try again."))?;
+        let id = if let Some(id) = value["user"].as_str() {
+            id.to_owned()
+        } else {
+            let db = auth.db.lock().unwrap();
+            let mut statement = db.prepare(
+                "SELECT user_id,data FROM credentials WHERE kind='webauthn-passwordless'",
+            )?;
+            let rows = statement
+                .query_map([], |r| Ok((r.get::<_, String>(0)?, r.get::<_, String>(1)?)))?
+                .collect::<std::result::Result<Vec<_>, _>>()?;
+            let mut found = None;
+            for (id, data) in rows {
+                let data: Value = serde_json::from_str(&data)?;
+                let passkey: Passkey = serde_json::from_value(data["passkey"].clone())?;
+                if passkey.cred_id().as_slice() == credential.get_credential_id()
+                    && body["credential"]["response"]["userHandle"] == data["handle"]
+                {
+                    if found.is_some() {
+                        return Err(Error::new(
+                            401,
+                            "That passkey couldn't identify your account.",
+                        ));
+                    }
+                    found = Some(id);
+                }
+            }
+            found.ok_or_else(|| {
+                Error::new(
+                    401,
+                    "That passkey couldn't identify your account. Try your password.",
+                )
+            })?
+        };
         let mut state = value["state"].clone();
         let mut allowed: Vec<Credential> =
             serde_json::from_value(state["ast"]["credentials"].clone())?;
@@ -825,9 +880,7 @@ pub async fn route(State(app): State<Arc<App>>, request: Request) -> Result<Resp
             let mut statement = db.prepare(
                 "SELECT data FROM credentials WHERE user_id=? AND kind='webauthn-passwordless'",
             )?;
-            for stored in
-                statement.query_map([string(&value["user"])], |r| r.get::<_, String>(0))?
-            {
+            for stored in statement.query_map([&id], |r| r.get::<_, String>(0))? {
                 let stored: Value = serde_json::from_str(&stored?)?;
                 let passkey: Passkey = serde_json::from_value(stored["passkey"].clone())?;
                 if stored["backupUnknown"] == true
@@ -861,7 +914,7 @@ pub async fn route(State(app): State<Arc<App>>, request: Request) -> Result<Resp
                     "That passkey couldn't sign in. Try again or use your password.",
                 )
             })?;
-        let id = string(&value["user"]);
+        let id = id.as_str();
         {
             let db = auth.db.lock().unwrap();
             let user = user(&db, id)?;
@@ -922,7 +975,10 @@ pub async fn route(State(app): State<Arc<App>>, request: Request) -> Result<Resp
                 ));
             }
         }
-        let session = auth.create_session(id, "dashboard", &headers, None)?;
+        let mut session = auth.create_session(id, "dashboard", &headers, None)?;
+        if body.get("remember").unwrap_or(&value["remember"]) == false {
+            session = session.replace(&format!("; Max-Age={SESSION_TTL}"), "");
+        }
         let next =
             if !array(&self::user(&auth.db.lock().unwrap(), id)?["requiredActions"]).is_empty() {
                 "/account".into()
diff --git a/dashboard/src/main.rs b/dashboard/src/main.rs
index 89d4533cb2d7404e857866376e8de5433e2b9b2c..d18c540467f39a4098b81cea4f60d361503fb465 100644
--- a/dashboard/src/main.rs
+++ b/dashboard/src/main.rs
@@ -511,7 +511,7 @@ async fn main() -> std::result::Result<(), Box<dyn std::error::Error>> {
                         request.headers_mut().remove("Studio-Proxy-Token");
                     }
                     let path = request.uri().path().to_owned();
-                    let asset = path.starts_with("/assets/");
+                    let asset = path.starts_with("/assets/") || path.starts_with("/fonts/") || path == "/snowflake.svg";
                     if app.auth.ready()
                         && !mcp::public(&path)
                         && !path.starts_with("/auth/")
diff --git a/dashboard/src/shale.rs b/dashboard/src/shale.rs
index 5e114f75b0f01fbe9ee5c47f5bc01a79e235d907..2ee38bff8766c99f1237f95c71c679bdb77e765f 100644
--- a/dashboard/src/shale.rs
+++ b/dashboard/src/shale.rs
@@ -9,6 +9,26 @@ use rmcp::{
 };
 use scraper::{Html, Selector};
 
+/// Shale rotates the session token while rendering comment deletion forms.
+/// The final deletion form therefore carries the token accepted by every issue form.
+fn issue_csrf(document: &Html) -> Result<Option<String>> {
+    let forms = Selector::parse("ul.timeline li.comment form[method=post]").unwrap();
+    let kind = Selector::parse("input[name=t]").unwrap();
+    let id = Selector::parse("input[name=id]").unwrap();
+    let token = Selector::parse("input[type=hidden][name=csrf_token], input[hidden][name=csrf_token]").unwrap();
+    let last = document.select(&forms).filter(|form| {
+        form.select(&kind).any(|input| input.attr("value") == Some("delete"))
+            && form.select(&id).any(|input| input.attr("value").is_some_and(|value| value.parse::<u64>().is_ok_and(|id| id > 0)))
+    }).last();
+    let Some(form) = last else { return Ok(None) };
+    let tokens: Vec<_> = form.select(&token).collect();
+    match tokens.as_slice() {
+        [input] => input.attr("value").filter(|value| !value.is_empty()).map(|value| Some(value.to_owned()))
+            .ok_or_else(|| Error::new(502, "Shale's issue form changed. Open the issue to edit it.")),
+        _ => Err(Error::new(502, "Shale's issue form changed. Open the issue to edit it.")),
+    }
+}
+
 pub struct Backend {
     pub(crate) origin: url::Url,
     http: reqwest::Client,
@@ -450,6 +470,14 @@ impl ServerHandler for Shale {
                         }
                     }
                 }
+                if matches!(name, "comment_issue" | "set_issue_status") {
+                    if let Some(token) = issue_csrf(&document)? {
+                        if !fields.contains_key("csrf_token") {
+                            return Err(Error::new(502, "Shale's issue form changed. Open the issue to edit it."));
+                        }
+                        fields.insert("csrf_token".to_owned(), token);
+                    }
+                }
                 fields.insert("timezone".to_owned(), "UTC".to_owned());
                 fields.insert("tzoffset".to_owned(), "+00:00".to_owned());
                 post_target
@@ -786,6 +814,18 @@ pub async fn oauth(app: Arc<App>, request: Request) -> Response {
 mod tests {
     use super::*;
     #[test]
+    fn issue_csrf_uses_last_deletion_token_and_refuses_ambiguous_markup() {
+        let initial = "<form method=post><input type=hidden name=t value=status><input type=hidden name=csrf_token value=old></form><form method=post><input type=hidden name=t value=comment><input type=hidden name=csrf_token value=old></form>";
+        assert_eq!(issue_csrf(&Html::parse_document(initial)).unwrap(), None);
+        let deletion = |value: &str| format!("<ul class=timeline><li class=comment><form method=post><input type=hidden name=t value=delete><input type=hidden name=id value=1><input type=hidden name=csrf_token value={value}></form></li></ul>");
+        let page = format!("{initial}{}{}<form method=post><input type=hidden name=csrf_token value=unrelated></form>", deletion("first"), deletion("latest"));
+        assert_eq!(issue_csrf(&Html::parse_document(&page)).unwrap().as_deref(), Some("latest"));
+        for bad in ["<input type=hidden name=csrf_token value=''>", "", "<input type=hidden name=csrf_token value=a><input type=hidden name=csrf_token value=b>"] {
+            let page = format!("{initial}{}<ul class=timeline><li class=comment><form method=post><input type=hidden name=t value=delete><input type=hidden name=id value=1>{bad}</form></li></ul>", deletion("older"));
+            assert!(issue_csrf(&Html::parse_document(&page)).is_err());
+        }
+    }
+    #[test]
     fn repository_names_cannot_change_origin_or_path_segments() {
         let origin = url::Url::parse("https://shale.studio.test").unwrap();
         for name in [
diff --git a/dashboard/web/pages/MCP.css b/dashboard/web/pages/MCP.css
index 0d82f9ac87f0a76a3c4d3a1261c2e737569f5927..6f2c63475ab19412decb6089e2db0613cbe3a690 100644
--- a/dashboard/web/pages/MCP.css
+++ b/dashboard/web/pages/MCP.css
@@ -1,20 +1,19 @@
-.mcp-page { max-width: 1100px; }
-.mcp-page h2 { font-size: 17px; margin: 0 0 12px; color: var(--text); }
-.mcp-page h3 { font-size: 15px; margin: 0; }
-.mcp-page p { color: var(--text-2); }
-.mcp-navigation { display: flex; flex-wrap: wrap; gap: 4px; border-bottom: 1px solid var(--line); padding-bottom: 12px; margin: 20px 0 24px; }
-.mcp-navigation a { padding: 8px 12px; border-radius: 6px; color: var(--text-2); }
-.mcp-navigation a:hover { background: var(--hover); }
-.mcp-navigation a.active { background: var(--accent-wash); color: var(--accent); }
-.mcp-catalogs { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); gap: 16px; }
-.mcp-catalog-card, .mcp-panel, .mcp-endpoint { border: 1px solid var(--line); border-radius: 10px; padding: 20px; background: var(--surface); }
-.mcp-catalog-card:hover { border-color: var(--accent); }
-.mcp-card-heading, .mcp-section-heading { display: flex; align-items: center; justify-content: space-between; gap: 16px; }
-.mcp-catalog-card p { min-height: 40px; }
-.mcp-card-status { display: grid; gap: 6px; font-size: 12px; color: var(--muted); margin-top: 24px; }
-.mcp-panel, .mcp-endpoint { margin: 20px 0; }
-.mcp-endpoint p { margin: 0 0 16px; }
-.mcp-endpoint .copy { max-width: 100%; }
+/* Settings use the dashboard's controls and flat, divided sections. */
+.mcp-page { max-width: 1000px; }
+.mcp-page h2 { font-size: 14px; font-weight: 600; margin: 0 0 8px; color: var(--text); }
+.mcp-page h3 { font-size: 13px; margin: 0; }
+.mcp-page p { color: var(--text-2); margin: 8px 0; }
+.mcp-page > .segmented { margin-bottom: 8px; }
+.mcp-panel, .mcp-endpoint { padding: 20px 0; border-bottom: 1px solid var(--line); }
+.mcp-section-heading { display: flex; align-items: center; justify-content: space-between; gap: 12px; }
+.mcp-section-heading h2 { margin: 0; flex: none; }
+.mcp-endpoint > p:first-child { margin: 0 0 16px; }
+.mcp-endpoint .copy { max-width: 100%; min-width: 0; overflow-wrap: anywhere; white-space: normal; text-align: left; }
+.mcp-endpoint .muted { font-size: 12px; }
+.mcp-repositories, .mcp-install { margin: 12px 0; }
+.mcp-repositories summary, .mcp-install summary { cursor: pointer; color: var(--text-2); }
+.mcp-install h3 { margin: 12px 0 6px; }
+.mcp-page .mcp-access-modes > label { padding: 6px 0; border: 0; background: none; }
 .mcp-actions { display: flex; flex-wrap: wrap; gap: 8px; }
 .mcp-access { padding: 0; margin: 20px 0; border: 0; min-width: 0; }
 .mcp-access legend { font-weight: 600; margin-bottom: 12px; }
@@ -31,16 +30,15 @@
 .mcp-client > .mcp-actions { align-self: start; }
 .mcp-client p { margin: 6px 0 0; overflow-wrap: anywhere; }
 .mcp-edit-access { grid-column: 1 / -1; }
-.mcp-page table { width: 100%; text-align: left; border-collapse: collapse; }
-.mcp-page th, .mcp-page td { padding: 12px; border-bottom: 1px solid var(--line); overflow-wrap: anywhere; }
+.mcp-page table { margin: 16px 0; }
 .mcp-page form { margin: 16px 0; }
 .mcp-page form > label { display: flex; align-items: center; gap: 12px; }
-.mcp-page input { padding: 8px; }
-.mcp-page form > button { margin-top: 12px; }
+
+.mcp-page form:not(.mcp-actions) > button { margin-top: 12px; }
 .mcp-help { margin: 24px 0; }
 .mcp-help summary { cursor: pointer; }
 .mcp-help li { margin: 12px 0; }
-.mcp-connector { padding: 20px; border: 1px solid var(--line); border-radius: 8px; margin: 16px 0; }
+.mcp-connector { padding: 16px 0; margin: 16px 0; border-top: 1px solid var(--line); }
 .mcp-authorization { min-height: 100%; display: grid; place-items: center; padding: 40px 24px; box-sizing: border-box; }
 .mcp-approval { width: min(100%, 600px); padding: 32px; box-sizing: border-box; background: var(--surface); border: 1px solid var(--line); border-radius: 16px; }
 .mcp-approval-brand { color: var(--accent); font-size: 13px; font-weight: 600; margin-bottom: 28px; }
@@ -56,11 +54,9 @@
 .mcp-approval-actions { display: flex; justify-content: space-between; gap: 16px; padding-top: 24px; border-top: 1px solid var(--line); margin-top: 24px; }
 .mcp-close { background: none; border: 0; color: var(--muted); cursor: pointer; margin-top: 20px; padding: 0; text-decoration: underline; }
 @media (max-width: 760px) {
-  .mcp-catalogs { grid-template-columns: 1fr; }
-  .mcp-catalog-card p { min-height: 0; }
-  .mcp-card-status { margin-top: 16px; }
   .mcp-client { grid-template-columns: 1fr; }
   .mcp-section-heading { flex-wrap: wrap; }
+  .mcp-endpoint .copy { width: 100%; }
   .mcp-repository-list > div { grid-template-columns: 1fr; gap: 4px; }
   .mcp-page form > label { flex-wrap: wrap; }
   .mcp-page input { max-width: 100%; min-width: 0; }
diff --git a/dashboard/web/pages/MCP.tsx b/dashboard/web/pages/MCP.tsx
index 8e6398fb36cde5f1a5423b3c90763906467bcd78..508ce6d7f569c62be383de0b88c5039147cdc299 100644
--- a/dashboard/web/pages/MCP.tsx
+++ b/dashboard/web/pages/MCP.tsx
@@ -1,4 +1,4 @@
-import { A, useParams } from "@solidjs/router";
+import { A, useNavigate, useParams } from "@solidjs/router";
 import { parseResponse } from "hono/client";
 import { createEffect, createResource, createSignal, For, onCleanup, Show } from "solid-js";
 import { api, reason } from "../api.ts";
@@ -7,6 +7,7 @@ import { Checkbox } from "../components/Checkbox.tsx";
 import { Copy } from "../components/Copy.tsx";
 import { showConfirmDialog } from "../components/Dialog.tsx";
 import { Loaded } from "../components/Loaded.tsx";
+import { TabBar } from "../components/TabBar.tsx";
 import { toast } from "../components/Toast.tsx";
 import { MCPAccess } from "./MCPAccess.tsx";
 import type { Access, Catalog } from "../types/mcp.ts";
@@ -20,6 +21,8 @@ const descriptions: Record<Catalog, string> = {
 
 export function MCP() {
   const params = useParams<{ catalog?: string }>();
+  const navigate = useNavigate();
+  createEffect(() => { if (!params.catalog) navigate("/mcp/settings/observability", { replace: true }); });
   const [overview, { refetch, mutate }] = createResource(() => parseResponse(api.mcp.$get()));
   const [shale, { refetch: retryShale }] = createResource(() => params.catalog === "shale",
     () => parseResponse(api.mcp.shale.$get()));
@@ -58,25 +61,17 @@ export function MCP() {
         const catalog = () => data().catalogs.find((catalog) => catalog.id === params.catalog);
         const connections = () => data().connections.filter((connection) => connection.catalog === catalog()?.id);
         return <>
-          <header class="page-head"><div><h1>{catalog()?.name || "MCP"}</h1><p class="sub">{catalog() ? descriptions[catalog()!.id] : "Connect your AI clients and manage their access."}</p></div></header>
-          <nav class="mcp-navigation" aria-label="MCP settings">
-            <A href="/mcp" end>Overview</A>
-            <For each={data().catalogs}>{(catalog) => <A href={`/mcp/settings/${catalog.id}`}>{catalog.name}</A>}</For>
-          </nav>
-          <Show when={!params.catalog}>
-            <div class="mcp-catalogs"><For each={data().catalogs}>{(catalog) => {
-              const count = () => data().connections.filter((connection) => connection.catalog === catalog.id).length;
-              return <A href={`/mcp/settings/${catalog.id}`} class="mcp-catalog-card">
-              <div class="mcp-card-heading"><h2>{catalog.name}</h2><span aria-hidden="true">↗</span></div>
-              <p>{descriptions[catalog.id]}</p>
-              <div class="mcp-card-status"><span>{catalog.id === "shale" ? data().shale ? "Account linked" : "Account not linked" : catalog.id === "agents" ? `${data().machines.filter((machine) => machine.online).length} machines online` : "Services selected per connection"}</span>
-                <span>{count()} {count() === 1 ? "connection" : "connections"}</span></div>
-            </A>; }}</For></div>
-            <p class="muted">Open a connector to copy its installation URL or change a client’s access.</p>
-          </Show>
+          <header class="page-head"><h1>MCP</h1></header>
+          <TabBar label="MCP settings">
+            <For each={data().catalogs}>{(catalog) => <A href={`/mcp/settings/${catalog.id}`} end>{catalog.name}</A>}</For>
+          </TabBar>
           <Show when={params.catalog && !catalog()}><p class="empty">No connector here.</p></Show>
           <Show when={catalog()}>{(current) => <>
-            <section class="mcp-endpoint"><div><h2>Connect a client</h2><p>Paste this URL into your AI client’s MCP settings, then approve access.</p></div><Copy value={current().endpoint} label="connector URL" /></section>
+            <section class="mcp-endpoint">
+              <p>{descriptions[current().id]}</p>
+              <div class="mcp-section-heading"><h2>Connector URL</h2><Copy value={current().endpoint} label="connector URL" /></div>
+              <p class="muted">Add this URL to your AI client’s MCP settings, then approve access.</p>
+            </section>
             <Show when={current().id === "shale"}>
               <section class="mcp-panel"><div class="mcp-section-heading"><h2>Shale account</h2><div class="mcp-actions">
                 <button class="button" disabled={busy()} onClick={linkShale}>{data().shale ? "Relink account" : "Link account"}</button>
@@ -86,30 +81,32 @@ export function MCP() {
               </div></div>
                 <Loaded data={shale} what="Shale repositories" retry={retryShale}>
                   {(account) => <Show when={account().linked} fallback={<p class="muted">Link your Shale account to connect clients.</p>}>
-                    <p><strong>Repository access verified</strong><Show when={data().shale}><span class="muted"> · Linked <Ago t={data().shale!.linkedAt} /></span></Show></p>
-                    <div class="mcp-repository-list"><For each={account().resources}>{(resource) => <div><span>{resource.name}</span><span class="muted">{resource.description}</span></div>}</For></div>
+                    <p class="muted">Account linked<Show when={data().shale}> <Ago t={data().shale!.linkedAt} /></Show></p>
+                    <details class="mcp-repositories"><summary>{account().resources.length} repositories available</summary><div class="mcp-repository-list"><For each={account().resources}>{(resource) => <div><span>{resource.name}</span><span class="muted">{resource.description}</span></div>}</For></div></details>
                     <Show when={!account().resources.length}><p class="muted">Your account has no repositories yet.</p></Show>
                   </Show>}
                 </Loaded>
               </section>
             </Show>
             <Show when={current().id === "agents"}>
+        <section class="mcp-panel">
         <h2>Local machines</h2>
+        <details class="mcp-install"><summary>Install an agent</summary>
         <p>Install on each machine, then enter the pairing code below. The agent starts at login.</p>
         <h3>macOS or Linux</h3>
         <Copy value={`curl -fsSL ${window.location.origin}/agent/install.sh | sh`} label="macOS or Linux install command" />
         <h3>Windows PowerShell</h3>
         <Copy value={`irm ${window.location.origin}/agent/install.ps1 | iex`} label="Windows install command" />
-        <p class="muted">Use your usual terminal, without administrator privileges. Codex or Claude Code must already be installed and signed in.</p>
+        <p class="muted">Use your usual terminal, without administrator privileges. Codex or Claude Code must already be installed and signed in.</p></details>
         <form class="mcp-actions" onSubmit={async (event) => {
           event.preventDefault(); setBusy(true);
           try { await parseResponse(api.mcp.relay.pair.$post({ json: { code: code() } })); setCode(""); await refetch(); }
           catch (error) { toast(reason(error)); }
           finally { setBusy(false); }
-        }}><label>Pairing code <input value={code()} onInput={(event) => setCode(event.currentTarget.value)} maxLength={40} /></label>
+        }}><label>Pairing code <input class="search" value={code()} onInput={(event) => setCode(event.currentTarget.value)} maxLength={40} /></label>
           <button class="button" disabled={!code().trim() || busy()}>Link machine</button></form>
         <Show when={data().machines.length} fallback={<p class="muted">No machines linked yet. Run the installer on a machine to link it.</p>}>
-          <table><thead><tr><th>Machine</th><th>Platform</th><th>Connection</th><th /></tr></thead><tbody>
+          <table class="data"><thead><tr><th>Machine</th><th>Platform</th><th>Connection</th><th /></tr></thead><tbody>
             <For each={data().machines}>{(machine) => <tr><td>{machine.name}</td><td>{machine.platform}</td><td>{machine.online ? "Online" : "Offline"}</td><td>
               <button class="button small" onClick={async () => {
                 try { await parseResponse(api.mcp.relay.machines[":id"].$delete({ param: { id: machine.id } })); await refetch(); }
@@ -124,7 +121,7 @@ export function MCP() {
             catch (error) { toast(reason(error)); }
             finally { setBusy(false); }
           }}>
-            <label>Key name <input value={keyName()} onInput={(event) => setKeyName(event.currentTarget.value)} maxLength={100} /></label>
+            <label>Key name <input class="search" value={keyName()} onInput={(event) => setKeyName(event.currentTarget.value)} maxLength={100} /></label>
             <div class="mcp-resources"><For each={data().machines}>{(machine) => <Checkbox checked={keyMachines().includes(machine.id)} onChange={(checked) => setKeyMachines(checked ? [...keyMachines(), machine.id] : keyMachines().filter((id) => id !== machine.id))}>{machine.name}</Checkbox>}</For></div>
             <Checkbox checked={control()} onChange={setControl}>Allow session control</Checkbox>
             <button class="button" disabled={!keyName().trim() || !keyMachines().length || busy()}>Create key</button>
@@ -142,8 +139,8 @@ export function MCP() {
           <p>Rerun the installer to update the agent or change allowed folders. Unlink removes the machine's access immediately.</p>
         </details>
         <Show when={key()}><section class="mcp-connector"><h3>New API key</h3><p>Copy this key now. It won't be shown again.</p><Copy value={key()} label="API key" /><button class="button secondary" onClick={() => setKey("")}>Dismiss</button></section></Show>
+        </section>
             </Show>
-            <Show when={current().id === "observability"}><section class="mcp-panel"><h2>Service access</h2><p>Choose services when approving a client. Change its selection below at any time.</p><p class="muted">This connector grants read access to logs and traces.</p></section></Show>
             <section class="mcp-panel"><h2>Connected clients</h2>
               <Show when={connections().length} fallback={<p class="muted">No clients connected. Add the connector URL to your AI client to get started.</p>}>
                 <div class="mcp-client-list"><For each={connections()}>{(client) => <article class="mcp-client">
diff --git a/dashboard/web/pages/SignIn.css b/dashboard/web/pages/SignIn.css
index 35ab4fa3446dd871c91bbe8d183d98e3788b1cc6..6dccbaa012e2320eb43676e97a642d0532726fd1 100644
--- a/dashboard/web/pages/SignIn.css
+++ b/dashboard/web/pages/SignIn.css
@@ -1,10 +1,10 @@
-.sign-in-page { min-height: 100dvh; display: grid; align-content: center; justify-items: center; gap: 24px; padding: 24px; }
-.sign-in-brand { font-size: 24px; font-weight: 650; letter-spacing: -.5px; }
-.sign-in-card { width: min(100%, 380px); padding: 28px; }
-.sign-in-card h1 { margin: 0 0 24px; font-size: 22px; }
-.sign-in-card form, .sign-in-card label { display: grid; gap: 8px; }
-.sign-in-card form { gap: 18px; }
-.sign-in-card p { margin: 0; font-size: 13px; line-height: 1.5; }
-.sign-in-card label { color: var(--text-2); font-size: 13px; }
-.sign-in-card input { width: 100%; height: 38px; }
-.sign-in-card button { min-height: 38px; }
+/* The original Keycloak theme stays shared; these adapt its document to the dashboard shell. */
+body { font: 16px "Name Sans", sans-serif; }
+#root { display: contents; }
+.pf-v5-c-login__main button, .pf-v5-c-login__main input { font-family: inherit; }
+.pf-v5-c-login__main input[type="submit"] { cursor: pointer; }
+.pf-v5-c-login__main [aria-disabled="true"], .pf-v5-c-login__main :disabled { opacity: .6; cursor: wait; }
+.pf-v5-c-login__main .checkbox label { position: relative; }
+.pf-v5-c-login__main .checkbox input { display: block; position: absolute; opacity: 0; }
+.pf-v5-c-login__main .checkbox label:has(:focus-visible) { outline: 2px solid var(--primary); }
+.setup-intro { margin-bottom: 1rem; text-align: center; }
diff --git a/dashboard/web/pages/SignIn.tsx b/dashboard/web/pages/SignIn.tsx
index a9bc5b02e32f758c79460de24a4fa4d075cf28e9..1b383a26dfc4bcf6f536102dd9937227923271fb 100644
--- a/dashboard/web/pages/SignIn.tsx
+++ b/dashboard/web/pages/SignIn.tsx
@@ -1,6 +1,7 @@
-import { createResource, createSignal, Show } from "solid-js";
+import { createEffect, createResource, createSignal, onCleanup, onMount, Show } from "solid-js";
 import { authReason, authRequest } from "../auth.ts";
-import "./SignIn.css";
+import theme from "../../../service/keycloak/theme/login/resources/css/styles.css?inline";
+import adjustments from "./SignIn.css?inline";
 
 export function SignIn() {
   const params = new URLSearchParams(window.location.search);
@@ -9,50 +10,106 @@ export function SignIn() {
   const [username, setUsername] = createSignal("");
   const [password, setPassword] = createSignal("");
   const [email, setEmail] = createSignal("");
+  const [remember, setRemember] = createSignal(false);
+  const [visible, setVisible] = createSignal(false);
   const [busy, setBusy] = createSignal(false);
   const [error, setError] = createSignal("");
-  const complete = async (passkey = false) => {
+  const [notice, setNotice] = createSignal("");
+  let conditional: AbortController | undefined;
+  let disposed = false;
+  const body = () => ({ csrf: status()!.csrf, username: username(), password: password(), email: email(), setup,
+    remember: remember(), flow: params.get("flow") ?? "", next: params.get("next") ?? "/" });
+  const passkey = async (automatic = false) => {
     if (!status() || busy()) return;
-    setBusy(true); setError("");
+    conditional?.abort();
+    if (!automatic) { setBusy(true); setError(""); setNotice(""); }
+    const controller = new AbortController();
+    conditional = controller;
+    let selected = false;
     try {
-      const body = { csrf: status()!.csrf, username: username(), password: password(), email: email(), setup,
-        flow: params.get("flow") ?? "", next: params.get("next") ?? "/" };
-      let result: { next: string };
-      if (passkey) {
-        const { options, token } = await authRequest<{ options: { publicKey: PublicKeyCredentialRequestOptionsJSON }; token: string }>("passkey/start", body);
-        const credential = await navigator.credentials.get({ publicKey: PublicKeyCredential.parseRequestOptionsFromJSON(options.publicKey) });
-        if (!(credential instanceof PublicKeyCredential)) throw new Error("Passkey sign-in was canceled. Try again or use your password.");
-        result = await authRequest("passkey/finish", { csrf: body.csrf, token, credential: credential.toJSON() });
-      } else result = await authRequest(setup ? "setup" : "password", body);
+      const request = { ...body(), username: automatic ? "" : username() };
+      const { options, token } = await authRequest<{ options: { publicKey: PublicKeyCredentialRequestOptionsJSON }; token: string }>("passkey/start", request);
+      if (controller.signal.aborted || disposed) return;
+      const credential = await navigator.credentials.get({
+        publicKey: PublicKeyCredential.parseRequestOptionsFromJSON(options.publicKey),
+        mediation: automatic ? "conditional" : "optional", signal: controller.signal,
+      });
+      if (!(credential instanceof PublicKeyCredential)) throw new Error("Passkey sign-in was canceled. Try again or use your password.");
+      selected = true; setBusy(true);
+      const result = await authRequest<{ next: string }>("passkey/finish", { csrf: request.csrf, token, remember: remember(), credential: credential.toJSON() });
       window.location.assign(result.next);
     } catch (failure) {
-      setError(authReason(failure));
-    } finally { setBusy(false); }
+      if ((!automatic || selected) && !controller.signal.aborted) setError(authReason(failure));
+    } finally { if (!automatic || selected) setBusy(false); }
   };
+  createEffect(() => {
+    if (!setup && status()) void (async () => {
+      if (await PublicKeyCredential.isConditionalMediationAvailable?.() && !disposed) await passkey(true);
+    })().catch(() => {});
+  });
+  const complete = async () => {
+    if (!status() || busy()) return;
+    conditional?.abort(); setBusy(true); setError(""); setNotice("");
+    try {
+      const result = await authRequest<{ next: string }>(setup ? "setup" : "password", body());
+      window.location.assign(result.next);
+    } catch (failure) { setError(authReason(failure)); }
+    finally { setBusy(false); }
+  };
+  onMount(() => {
+    const title = document.title;
+    document.title = "sso (snow sign on)";
+    onCleanup(() => { document.title = title; });
+  });
+  onCleanup(() => { disposed = true; conditional?.abort(); });
   return (
-    <main class="sign-in-page">
-      <div class="sign-in-brand">snow globe</div>
-      <section class="card sign-in-card">
-        <h1>{setup ? "welcome" : "sign in"}</h1>
-        <Show when={!status.error} fallback={<><p class="error" role="alert">{authReason(status.error)}</p><button class="button" onClick={() => refetch()}>try again</button></>}>
-          <form onSubmit={(event) => { event.preventDefault(); void complete(); }}>
-            <Show when={setup} fallback={
-              <label>username<input class="search" required autocomplete="username webauthn" value={username()} onInput={(event) => setUsername(event.currentTarget.value)} autofocus /></label>
-            }>
-              <p>Your account is <b>{status()?.setup ?? "…"}</b>. Add your email and choose a password.</p>
-              <label>email<input class="search" type="email" required autocomplete="email" value={email()} onInput={(event) => setEmail(event.currentTarget.value)} /></label>
+    <>
+      <style>{theme + adjustments}</style>
+      <main class="pf-v5-c-login__main">
+        <div id="kc-header"><div id="kc-header-wrapper"><div class="kc-logo-text"><span>snow sign on</span></div></div></div>
+        <div class="card-pf">
+          <header><h1 id="kc-page-title">{setup ? "welcome" : "sign in to your account"}</h1></header>
+          <div id="kc-content"><div id="kc-content-wrapper">
+            <Show when={status.error || error()}><div class="alert-error pf-v5-c-alert" role="alert"><span class="pf-v5-c-alert__title">{status.error ? authReason(status.error) : error()}</span></div></Show>
+            <Show when={notice()}><div class="alert-info pf-v5-c-alert" role="status"><span class="pf-v5-c-alert__title">{notice()}</span></div></Show>
+            <Show when={!status.error} fallback={<button class="pf-v5-c-button pf-m-primary pf-m-block" onClick={() => refetch()}>try again</button>}>
+              <div id="kc-form"><div id="kc-form-wrapper">
+                <form id="kc-form-login" onSubmit={(event) => { event.preventDefault(); void complete(); }}>
+                  <Show when={setup} fallback={
+                    <div class="pf-v5-c-form__group">
+                      <label for="username" class="pf-v5-c-form__label">username or email</label>
+                      <input id="username" class="pf-v5-c-form-control" name="username" type="text" required autocomplete="username webauthn" value={username()} onInput={(event) => setUsername(event.currentTarget.value)} autofocus />
+                    </div>
+                  }>
+                    <p class="setup-intro">Your account is <b>{status()?.setup ?? "…"}</b>. Add your email and choose a password.</p>
+                    <div class="pf-v5-c-form__group">
+                      <label for="email" class="pf-v5-c-form__label">email</label>
+                      <input id="email" class="pf-v5-c-form-control" name="email" type="email" required autocomplete="email" value={email()} onInput={(event) => setEmail(event.currentTarget.value)} autofocus />
+                    </div>
+                  </Show>
+                  <div class="pf-v5-c-form__group">
+                    <label for="password" class="pf-v5-c-form__label">{setup ? "choose a password" : "password"}</label>
+                    <div class="pf-v5-c-input-group">
+                      <input id="password" class="pf-v5-c-form-control" name="password" type={visible() ? "text" : "password"} required minLength={setup ? 8 : undefined} maxLength={1024} autocomplete={setup ? "new-password" : "current-password"} value={password()} onInput={(event) => setPassword(event.currentTarget.value)} />
+                      <button class="pf-v5-c-button pf-m-control" type="button" aria-label={visible() ? "Hide password" : "Show password"} aria-controls="password" data-password-toggle onClick={() => setVisible(!visible())}><i aria-hidden="true" /></button>
+                    </div>
+                    <Show when={setup}><span class="pf-v5-c-helper-text__item-text">Use at least 8 characters. You can add a passkey next.</span></Show>
+                  </div>
+                  <Show when={!setup}><div class="pf-v5-c-form__group">
+                    <div id="kc-form-options"><div class="checkbox"><label><input id="rememberMe" name="rememberMe" type="checkbox" checked={remember()} onChange={(event) => setRemember(event.currentTarget.checked)} /> remember me</label></div></div>
+                    <div><span><a href="#" onClick={(event) => { event.preventDefault(); setNotice("Ask Clover for a password reset link."); }}>forgot password?</a></span></div>
+                  </div></Show>
+                  <div id="kc-form-buttons" class="pf-v5-c-form__group">
+                    <input class="pf-v5-c-button pf-m-primary pf-m-block" name="login" id="kc-login" type="submit" value={setup ? "create account" : "Sign In"} disabled={busy() || !status()} aria-busy={busy()} />
+                  </div>
+                </form>
+              </div></div>
+              <Show when={!setup}><a id="authenticateWebAuthnButton" href="#" class="pf-v5-c-button pf-m-secondary pf-m-block" aria-disabled={busy() || !status()} onClick={(event) => { event.preventDefault(); void passkey(); }}>sign in with passkey</a></Show>
             </Show>
-            <label>{setup ? "choose a password" : "password"}<input class="search" type="password" required minLength={setup ? 8 : undefined} maxLength={1024} autocomplete={setup ? "new-password" : "current-password"} value={password()} onInput={(event) => setPassword(event.currentTarget.value)} /></label>
-            <Show when={setup}><p class="muted">Use at least 8 characters. You can add a passkey next.</p></Show>
-            <Show when={error()}><p class="error" role="alert">{error()}</p></Show>
-            <button class="button primary" disabled={busy() || !status()} aria-busy={busy()}>{setup ? "create account" : "sign in"}</button>
-            <Show when={!setup}>
-              <button class="button" type="button" disabled={busy() || !status() || !username().trim()} onClick={() => complete(true)}>use a passkey</button>
-              <p class="muted">Need access or a password reset? Ask Clover for an invitation link.</p>
-            </Show>
-          </form>
-        </Show>
-      </section>
-    </main>
+          </div></div>
+        </div>
+      </main>
+      <div id="credit"><a rel="noopener noreferrer" target="_blank" href="https://www.pixiv.net/en/artworks/109102745">art by 紺屋</a></div>
+    </>
   );
 }
diff --git a/dashboard/web/styles.css b/dashboard/web/styles.css
index d306236776d4f08c2e5e6b00dcb735305cf01534..2928ab59703c33871a885da0c39eabdf9ebb19fb 100644
--- a/dashboard/web/styles.css
+++ b/dashboard/web/styles.css
@@ -316,11 +316,8 @@ button { font: inherit; color: inherit; }
   margin: 0 auto;
   --gutter: 28px;
   padding: 22px var(--gutter) 48px;
-  animation: rise 450ms var(--ease-out) backwards;
 }
 
-@keyframes rise { from { opacity: 0; transform: translateY(8px); } }
-
 .list-page { height: 100%; display: flex; flex-direction: column; padding-bottom: 0; }
 .list-page > * { flex: none; }
 .list-page .summary { display: grid; grid-template-rows: 0fr; opacity: 0; transition: grid-template-rows 350ms var(--ease-out), opacity 200ms; }
diff --git a/nixos/dashboard.nix b/nixos/dashboard.nix
index 8a02b598626d0d0a0be954d20b0ac4fa5a68ba6b..bcdba0ad1b3b646f0ea864cd896fa0a26b78242c 100644
--- a/nixos/dashboard.nix
+++ b/nixos/dashboard.nix
@@ -15,14 +15,17 @@ let
     pname = "home-dashboard-web";
     version = "0.1.0";
     src = lib.fileset.toSource {
-      root = ../dashboard;
+      root = ../.;
       fileset = lib.fileset.unions [
         ../dashboard/web ../dashboard/package.json ../dashboard/pnpm-lock.yaml
         ../dashboard/tsconfig.json ../dashboard/vite.config.ts
+        ../service/keycloak/theme/login/resources/css
+        ../service/keycloak/theme/login/resources/img
       ];
     };
+    sourceRoot = "source/dashboard";
     pnpmDeps = fetchPnpmDeps {
-      inherit (finalAttrs) pname version src;
+      inherit (finalAttrs) pname version src sourceRoot;
       pnpm = pnpm_10;
       fetcherVersion = 3;
       hash = "sha256-xQbdTZIAiwM7Ox+6BsTD57LEJzj10hvqYEpA03W9OGs=";
diff --git a/readme.md b/readme.md
index 409dd683a07826bb84e198912f7774204294b24f..074de7d43a4d9c289afbf77b1767c7bb4d799def 100644
--- a/readme.md
+++ b/readme.md
@@ -130,6 +130,9 @@ accepts `dashboard` and preserves a safety copy before restoring. Invitations re
 expire after 24 hours, and can be revoked. Setup offers optional passkey enrollment.
 Existing passkeys retain the `auth.paperclover.net` RP ID; that host serves related
 origin metadata for Snowglobe. Keycloak remains available for other services.
+The sign-in page shares the original Keycloak theme stylesheet and artwork.
+Passkeys support username-free sign-in and browser autofill; the remember-me
+checkbox chooses between a browser session cookie and a 30-day cookie.
 
 `tools/import-dashboard-auth.py --host root@zenith --output /private/path/accounts.json`
 exports account IDs, groups, password hashes and public passkey credentials without
diff --git a/service/samba/service.pkl b/service/samba/service.pkl
index cd6a913f9b7f628907e166ef705ca49e5a9ae6d8..733352223c595089e7c733c89a48d29f04a316cd 100644
--- a/service/samba/service.pkl
+++ b/service/samba/service.pkl
@@ -23,7 +23,6 @@ container {
   volumes {
     ["/shares/clover"] { src = site.cloverRoot; readOnly = site.cloverReadOnly }
     ["/shares/clover/Media"] { src = site.mediaRoot; readOnly = site.mediaReadOnly }
-    ["/shares/media"] { src = site.mediaRoot; readOnly = site.mediaReadOnly }
   }
 
   env {
@@ -35,7 +34,6 @@ container {
     ["SAMBA_CONF_WORKGROUP"] = "PAPER_CLOVER"
     ["SAMBA_CONF_SERVER_STRING"] = "paper clover's nas"
     ["SAMBA_VOLUME_CONFIG_clover"] = "[clover]; path = /shares/clover; valid users = clo; read only = \(if (site.cloverReadOnly) "yes" else "no"); \(sharePermissions)"
-    ["SAMBA_VOLUME_CONFIG_media"] = "[media]; path = /shares/media; valid users = clo; read only = \(if (site.mediaReadOnly) "yes" else "no"); \(sharePermissions)"
   }
 }
 
diff --git a/service/shale/readme/issue-forms.js b/service/shale/readme/issue-forms.js
new file mode 100644
index 0000000000000000000000000000000000000000..080f192fb94d52625ac9980a6899f1b38638bb4e
--- /dev/null
+++ b/service/shale/readme/issue-forms.js
@@ -0,0 +1,23 @@
+// Shale r1758 rotates the session's CSRF token while rendering each comment's
+// delete form, leaving the surrounding issue forms with the earlier token.
+(() => {
+  function normalize(root, initial = false) {
+    const forms = [...root.querySelectorAll('form[method="post" i]')];
+    const tokens = forms.flatMap(form => {
+      if (initial && form.querySelector('input[name="t"]')?.value !== 'delete') return [];
+      const input = form.querySelector('input[name="csrf_token"]');
+      return input?.value ? [input.value] : [];
+    });
+    const token = tokens.at(-1);
+    if (!token) return;
+    for (const input of document.querySelectorAll('form[method="post" i] input[name="csrf_token"]')) {
+      input.value = token;
+    }
+  }
+  function start() {
+    normalize(document, true);
+    document.body.addEventListener('htmx:afterSwap', event => normalize(event.detail.target));
+  }
+  if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', start, { once: true });
+  else start();
+})();
diff --git a/service/shale/service.pkl b/service/shale/service.pkl
index 4553725bde93d6a4658f9a9d3426f2ef47bb8ce0..3ca707cdc9b6400b7a4c11719e09717e4186f395 100644
--- a/service/shale/service.pkl
+++ b/service/shale/service.pkl
@@ -26,6 +26,9 @@ container {
       ["/-/studio-readme/"] = "readme"
     }
     headHtml {
+      ["/*/issues/*"] = """
+        <script defer src="/-/studio-readme/issue-forms.js"></script>
+        """
       ["/snowbound/"] = """
         <script defer src="/-/studio-readme/markdown-it.min.js"></script><script defer src="/-/studio-readme/purify.min.js"></script><script defer src="/-/studio-readme/readme.js"></script>
         """
diff --git a/tools/dashboard-auth-test.py b/tools/dashboard-auth-test.py
index 7a3161accfa7e2005dd05f0a309b0b29755874ef..9b31301c26a97f3dbb5e01c4373497d5ea10c902 100644
--- a/tools/dashboard-auth-test.py
+++ b/tools/dashboard-auth-test.py
@@ -95,7 +95,7 @@ def main():
         def stop():
             server.terminate(); server.wait(timeout=10)
 
-        def request(path, method='GET', body=None, cookies=None, status=200, extra=None, host=origin):
+        def request(path, method='GET', body=None, cookies=None, status=200, extra=None, host=origin, include_headers=False):
             headers = {'Studio-Proxy-Token': proof, 'Host': host.split('://')[1], 'X-Studio-Client-IP': '127.0.0.1'}
             if body is not None: headers.update({'Origin': origin, 'Content-Type': 'application/json'})
             if cookies: headers['Cookie'] = '; '.join(f'{k}={v}' for k, v in cookies.items())
@@ -107,7 +107,7 @@ def main():
             if cookies is not None and 'set-cookie' in fields:
                 cookie = fields['set-cookie']; assert 'Secure; HttpOnly; SameSite=Lax' in cookie and 'Domain=' not in cookie
                 key, value = cookie.split(';', 1)[0].split('=', 1); cookies[key] = value
-            return json.loads(content) if fields.get('content-type', '').startswith('application/json') and content else fields
+            return json.loads(content) if not include_headers and fields.get('content-type', '').startswith('application/json') and content else fields
 
         cookies = {}
         start()
@@ -120,6 +120,10 @@ def main():
             request('/auth/password', 'POST', {**login, 'csrf': 'wrong'}, cookies, 403)
             request('/auth/password', 'POST', {**login, 'password': 'wrong'}, cookies, 401)
             assert request('/auth/password', 'POST', login, cookies)['next'] == '/users'
+            fields = request('/auth/password', 'POST', {**login, 'remember': False}, cookies=cookies, status=200, include_headers=True)
+            assert 'Max-Age=' not in fields['set-cookie']
+            fields = request('/auth/password', 'POST', {**login, 'remember': True}, cookies=cookies, status=200, include_headers=True)
+            assert 'Max-Age=2592000' in fields['set-cookie']
             assert 'admin' in request('/api/me', cookies=cookies)['sections']
             request('/api/users', 'POST', {}, cookies, 403, {'Origin': 'https://evil.example'})
             assert request('/auth/password', 'POST', {**login, 'next': '//evil.example'}, cookies)['next'] == '/'
@@ -147,6 +151,16 @@ def main():
             begin = request('/auth/passkey/start', 'POST', {'csrf': csrf2, 'username': name}, other)
             tampered = assertion(begin, counter=2); tampered['response']['signature'] = b64(b'forged')
             request('/auth/passkey/finish', 'POST', {'csrf':csrf2, 'token':begin['token'], 'credential':tampered}, other, 401)
+            for handle in [None, uuid.uuid4().bytes]:
+                begin = request('/auth/passkey/start', 'POST', {'csrf': csrf2}, other)
+                assert not begin['options']['publicKey'].get('allowCredentials')
+                credential = assertion(begin, counter=2, handle=handle or actor.encode())
+                if handle is None: credential['response'].pop('userHandle')
+                request('/auth/passkey/finish', 'POST', {'csrf':csrf2, 'token':begin['token'], 'credential':credential}, other, 401)
+            begin = request('/auth/passkey/start', 'POST', {'csrf': csrf2, 'remember':False}, other)
+            assert not begin['options']['publicKey'].get('allowCredentials')
+            request('/auth/passkey/finish', 'POST', {'csrf':csrf2, 'token':begin['token'], 'credential':assertion(begin, counter=2)}, other)
+            assert request('/api/me', cookies=other)['name'] == name
             registration = request('/auth/passkey/register', 'POST', {'csrf': csrf}, cookies)
             new_id = os.urandom(32)
             client = json.dumps({'type': 'webauthn.create', 'challenge': registration['options']['publicKey']['challenge'], 'origin': origin, 'crossOrigin': False}).encode()
@@ -186,7 +200,7 @@ def main():
             request('/api/users/' + actor + '/logout', 'POST', {}, cookies, 204)
             request('/api/me', cookies=cookies, status=401)
             request('/auth/file/check', cookies=file_cookies, status=401, host=file)
-            print(json.dumps({'import': 'passed', 'password': 'passed', 'signed_legacy_passkey': 'passed', 'registration': 'passed', 'csrf_and_header_forgery': 'passed', 'file_handoff_replay_and_binding': 'passed', 'invitation_one_use_and_revocation': 'passed', 'restart_and_logout': 'passed'}))
+            print(json.dumps({'import': 'passed', 'password': 'passed', 'signed_legacy_passkey': 'passed', 'username_free_passkey': 'passed', 'remember_me': 'passed', 'registration': 'passed', 'csrf_and_header_forgery': 'passed', 'file_handoff_replay_and_binding': 'passed', 'invitation_one_use_and_revocation': 'passed', 'restart_and_logout': 'passed'}))
         finally:
             if server and server.poll() is None: stop()
             log.close()
-- 
2.54.0