@ofidj/generator-fidj 1.7.2 → 1.8.0

package/generators/app/templates/typescript/package.json

@@ -15,7 +15,7 @@
     "privacy:rehearse": "npm run build && node --test test/server.test.mjs"
   },
   "dependencies": {
-    "@ofidj/node": "^3.6.26"
+    "@ofidj/node": "^3.6.30"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",

package/generators/app/templates/typescript/src/content.ts

@@ -437,7 +437,14 @@ function render() {
     askedProvider = true;
     void (async () => {
       if (!(await providerRendersHere())) return;
-      window.location.assign(await oidc.beginLogin());
+      // Being recognised again is the one thing somebody who just signed out did
+      // not ask for, and this shortcut is what made a sign-out undoable by a page
+      // reload. Ending the provider session is what should make that impossible,
+      // and that call can be refused — so here the screen asks rather than
+      // assumes, until somebody signs in again.
+      window.location.assign(
+        await oidc.beginLogin(oidc.signedOutHere() ? { prompt: "login" } : {}),
+      );
     })();
   }
 
@@ -467,17 +474,21 @@ function render() {
     signInPassword = password;
     signInAgreementAccepted = agreement?.checked === true;
     const acceptance = acceptedAgreement(event.currentTarget as HTMLFormElement);
-    if (!acceptance) {
-      failed = true;
-      message = "Please accept the service agreement before continuing.";
-      render();
-      return;
-    }
     const submitter = event.submitter as HTMLButtonElement | null;
     const signup = submitter?.name === "signup";
     // Which door was used. The Fidj one leaves for the provider; the credential
     // one signs in here, which is why it is the app's own form and not Fidj's.
     const throughFidj = submitter?.name === "entry" && submitter.value === "fidj";
+    // Only the credential door is gated here. The Fidj one is about to be asked
+    // the same question on the screen that names this app, where the answer is
+    // recorded with its version — so asking first cost a second click and kept
+    // nothing.
+    if (!throughFidj && !acceptance) {
+      failed = true;
+      message = "Please accept the service agreement before continuing.";
+      render();
+      return;
+    }
     void action(async () => {
       if (oidc && throughFidj) {window.location.assign(await oidc.beginLogin()); return;}
       if (oidc && (!email || !password)) {

package/generators/app/templates/typescript/src/main.ts

@@ -137,9 +137,14 @@ function render() {
     const password = el<HTMLInputElement>("password")?.value || "";
     signInEmail = email;
     signInPassword = password;
-    signInAgreementAccepted = el<HTMLInputElement>("service-agreement").checked;
+    signInAgreementAccepted =
+      el<HTMLInputElement>("service-agreement")?.checked === true;
     const acceptance = acceptedAgreement(event.currentTarget as HTMLFormElement);
-    if (!acceptance) {
+    // Only a credential entry is gated here. When Fidj is the door, it asks for
+    // this app's agreement a moment later, on the screen that names the app,
+    // and records the acceptance with its version — so asking first cost a
+    // second click and kept nothing.
+    if (!oidc && !acceptance) {
       error = "Please accept the service agreement before continuing.";
       render();
       return;

package/generators/app/templates/typescript/src/service-agreement.ts

@@ -20,7 +20,10 @@ export function signInErrorMessage(error: unknown) {
 
 export async function bindAgreement(form: HTMLFormElement | null, title: string, endpoint: string, appId: string, checked = false) {
   if (!form) return;
-  const checkbox = form.querySelector<HTMLInputElement>("#service-agreement")!;
+  // An app whose only door is Fidj carries no agreement block: Fidj asks for
+  // this app's agreement on the screen that names it, and records the version.
+  const checkbox = form.querySelector<HTMLInputElement>("#service-agreement");
+  if (!checkbox) return;
   const read = form.querySelector<HTMLButtonElement>("#read-agreement")!;
   const dialog = form.querySelector<HTMLDialogElement>("#agreement-dialog")!;
   const status = form.querySelector<HTMLElement>("#agreement-status")!;
@@ -130,7 +133,10 @@ export function providerEntry(
   const fidj = hint
     ? `<button class="primary" type="submit" name="entry" value="fidj">Continue as ${escapeText(hint)}</button><button type="button" id="forget-hint" class="quiet">Use a different account</button>`
     : `<button class="${both ? "secondary" : "primary"}" type="submit" name="entry" value="fidj">${isFidjItself ? "Sign in" : "Sign in with Fidj"}</button>`;
-  if (!both) return lead + agreementMarkup() + fidj;
+  // Fidj is the only door: it collects the agreement itself, a moment later, on
+  // the screen that names the app — and records it with its version. Collecting
+  // it here first recorded nothing and asked the same question twice.
+  if (!both) return lead + fidj;
   // Both doors. A remembered address puts Fidj first because it is one tap; no
   // memory puts the form first, because that is what the person came to do.
   const divider = `<div class="signin-divider"><span>or</span></div>`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ofidj/generator-fidj",
-  "version": "1.7.2",
+  "version": "1.8.0",
   "description": "Generate a TypeScript app with Fidj sign-in, live server-side roles and per-app privacy.",
   "homepage": "https://fidj.ovh",
   "bugs": {