@ti-engine/web-framework 1.33.0 → 1.34.0

package/CHANGELOG.md

@@ -2,6 +2,25 @@
 
 This document will contain the list of changes made to the framework. The format is based on the [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) specification.
 
+## Version 1.34.0
+
+* fix(web-app): give the login error element fallback text, so it can never render as an empty box. The message
+  has been unreadable since it was added (CA-95): `x-text-label` resolves
+  `interface.default.login.error-sign-in-failed` out of **this package's** `web-server-labels.json`, and a consuming
+  application configures exactly one labels path — its own — so the key does not resolve there. The directive then
+  falls back to the element's own text content, and the element was empty. The result was a red alert box with
+  nothing in it: visibly broken, and saying nothing to the person who had just failed to sign in. An application
+  that wants it localized adds the key to its own catalogue, which is the same arrangement the Profile and About
+  screens already use.
+* fix(web-app): drop the `error` query parameter from the address bar once the login screen has shown it, via the
+  new `tiToolbox.clearUrlParam( name )` (`history.replaceState`, so no history entry the visitor never navigated
+  to). It is a one-time message, not state: left in place, a refresh replays a sign-in failure that already
+  happened, a bookmark captures it, and the login screen cannot be returned to its blank state without editing the
+  URL by hand. The parameter itself stays, because a top-level browser navigation — an OAuth callback, or a
+  non-HTMX form post — cannot be answered with a body and still leave the visitor on the login page; a redirect is
+  the only way, and a redirect carries no payload. HTMX requests were never affected: they already receive the
+  error through the `ti:error` `HX-Trigger` and touch no query string.
+
 ## Version 1.33.0
 
 * fix(web-handlers)!: refuse an OpenID Connect callback that cannot be completed through the normal error path

package/bin/static/fragments/frame-login.html

@@ -12,12 +12,17 @@
         <!-- Login card -->
         <div class="ti-login-card">
             <!-- Error message -->
+            <!-- The element's own text is the FALLBACK the x-text-label directive falls back to, and it has to be
+                 here: this key lives in the framework's web-server-labels.json, and a consuming application
+                 configures exactly one labels path — its own — so the framework's catalogue is not loaded and the
+                 key does not resolve. An empty element therefore rendered an empty red box: visibly broken, saying
+                 nothing. An application that wants this localized adds the key to its own catalogue. -->
             <div id="ti-error"
                  class="ti-login-error"
                  x-data="tiLoginError"
                  x-bind:class="{ visible: hasError }"
                  role="alert"
-                 x-text-label="interface.default.login.error-sign-in-failed"></div>
+                 x-text-label="interface.default.login.error-sign-in-failed">Sign-in failed. Please try again.</div>
 
             <!--ti-auth-method:local-->
             <!-- Local auth form -->

package/bin/static/scripts/ti-framework.js

@@ -204,6 +204,32 @@ const configureToolbox = () => {
             return new URLSearchParams( window.location.search ).get( name );
         },
 
+        /**
+         * Removes a query parameter from the address bar without reloading or adding a history entry.
+         * <br/>
+         * For a parameter that carries a one-time message: once it has been read and shown, it has done its job, and
+         * leaving it in the URL means a refresh or a bookmark replays a failure that is no longer happening.
+         * `replaceState` rather than `pushState`, so the back button is not left stepping through states the visitor
+         * never navigated to.
+         *
+         * @method
+         * @param {string} name
+         * @public
+         */
+        clearUrlParam( name ) {
+            if ( !window.history || typeof window.history.replaceState !== "function" ) {
+                return;
+            }
+            const url = new URL( window.location.href );
+            if ( !url.searchParams.has( name ) ) {
+                return;
+            }
+            url.searchParams.delete( name );
+            // Keep a bare "?" off the end when the last parameter goes.
+            const search = url.searchParams.toString();
+            window.history.replaceState( null, "", url.pathname + ( search ? "?" + search : "" ) + url.hash );
+        },
+
         /**
          * Used to get the visible box of the document.
          *
@@ -1684,6 +1710,10 @@ const configureLoginError = () => {
         init() {
             const tiToolbox = Alpine.store( "tiToolbox" );
             this.hasError = Boolean( tiToolbox.getUrlParam( "error" ) );
+            // The parameter is a one-time message, not state. Read it, show it, drop it — otherwise a refresh (or a
+            // bookmark, or a shared link) replays a sign-in failure that already happened, and the login screen can
+            // never be returned to its blank state without editing the URL by hand.
+            tiToolbox.clearUrlParam( "error" );
         }
     };
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ti-engine/web-framework",
-  "version": "1.33.0",
+  "version": "1.34.0",
   "description": "A web-framework based on the ti-engine. It provides a customizable ready-to-use web-server microservice and a set of tools for creating web applications. NOTICE: This is still a work in progress and the full architecture, design, and functionality are not available!",
   "keywords": [
     "ti-engine",