gitpane 1.0.0__py3-none-any.whl

gitpane/ui/setting/add_account_dialog.py

@@ -0,0 +1,1005 @@
+"""Add an account for any HTTPS server, or renew the sign-in of a listed one, from one small window.
+
+The window picks the way to sign in from the server address. GitHub, gitlab.com and Bitbucket Cloud refuse the account
+password over Git HTTPS, so for them it offers browser sign-in, with a personal access token checked by the service as
+the other way. Any other server gets a username with a password or token, tested with Git on a repository of that
+server before it is saved. When that test is refused, the window advises the method the server accepts: browser
+sign-in for a server recognised as offering it, otherwise a personal access token and where to create one.
+"""
+
+from __future__ import annotations
+
+import math
+import threading
+from enum import Enum
+from typing import TYPE_CHECKING
+
+from PySide6.QtCore import QDeadlineTimer, QRect, Qt, QTimer, Signal
+from PySide6.QtGui import QTextCursor
+from PySide6.QtWidgets import QApplication, QDialog, QFormLayout, QHBoxLayout, QLabel, QLayout, QLineEdit, QPlainTextEdit, QPushButton, QVBoxLayout, QWidget
+from shiboken6 import isValid
+
+from gitpane.account.authentication import (
+    BITBUCKET_PROVIDER,
+    BROWSER_TIMEOUT_STATUS_SET,
+    BROWSER_TIMEOUT_TEXT,
+    CHECK_FAILED_TEXT,
+    GENERIC_PROVIDER,
+    HTTPS_PREFIX,
+    endpoint_origin,
+    origin_address,
+    provider_for_browser_origin,
+    store_was_refused,
+)
+from gitpane.account.credential_manager import ignore_line
+from gitpane.account.keyring_state import UNKNOWN_KEYRING_READING, KeyringProvider, KeyringReading, KeyringState
+from gitpane.config import BROWSER_SIGN_IN_TIMEOUT_MS, MILLISECONDS_PER_SECOND, SPACING_SM, SharedText, control_height, fit_window
+from gitpane.text.typed_text import typed_value
+from gitpane.thread.weak_signal import hand_over_to_the_page, weak_signal_emitter
+from gitpane.transport.git_refusal import RefusalKind, refusal_kind
+from gitpane.ui.look.fixed_font import body_sized_fixed_font
+from gitpane.ui.widget.busy_indicator import BusyIndicator
+from gitpane.ui.widget.content_growth import ContentGrowthMixin, OpeningFit
+from gitpane.ui.widget.content_measure import LayoutContentMeasure
+from gitpane.ui.widget.dialog_layout import apply_left_aligned_form
+from gitpane.ui.widget.long_text import FRAME_SIDE_COUNT
+from gitpane.ui.widget.result_label import ResultLabel, ResultTone
+from gitpane.ui.window_control.compositor_answer import after_compositor_answer
+
+if TYPE_CHECKING:
+    from collections.abc import Callable
+
+    from gitpane.account.authentication import AccountCheck, AccountSelection, AuthOutcome
+
+ADD_ACCOUNT_WIDTH, ADD_ACCOUNT_HEIGHT = 560, 420
+ADD_ACCOUNT_MIN_WIDTH, ADD_ACCOUNT_MIN_HEIGHT = 400, 280
+# Lines of output the field shows at least when an output arrives: the form grows to give it that height, the rest scrolls.
+ACCOUNT_OUTPUT_LINE_COUNT = 10
+# The output document's margin is counted twice in the field's height: once above its text, once below it.
+DOCUMENT_MARGIN_SIDE_COUNT = 2
+ADD_ACCOUNT_TITLE = "Add account"
+RECONNECT_TITLE = "Reconnect account"
+ADD_BUTTON_TEXT = "Add account"
+RECONNECT_BUTTON_TEXT = "Reconnect"
+SERVER_URL_LABEL = "Server URL"
+SERVICE_NAME_LABEL = "Service name"
+USERNAME_LABEL = "Username"
+PASSWORD_LABEL = "Password or token"
+TOKEN_LABEL = "Personal access token"
+BITBUCKET_EMAIL_LABEL = "Bitbucket API email"
+CHECK_URL_LABEL = "Repository URL to test"
+SERVER_URL_PLACEHOLDER = "https://gitlab.mycompany.example"
+SERVICE_NAME_PLACEHOLDER = "Name of your service (GitHub, GitLab, etc.)"
+CHECK_URL_PLACEHOLDER = "https://gitlab.mycompany.example/group/project.git"
+SERVER_HELP_TEXT = ("Any HTTPS server works, including your company's own server: change the Server URL above. "
+                    "The service name is only used in GitPane's account lists.")
+PASSWORD_HELP_TEXT = ("Before saving the account, GitPane tests the username and password on a repository of this server. "
+                      "Nothing is saved if the server refuses them.")
+CLOUD_HELP_TEXT = ("GitHub, gitlab.com and Bitbucket Cloud do not accept your account password for Git. "
+                   "Sign in with your browser, or use a personal access token created on the service's website.")
+TOKEN_HELP_TEXT = "GitPane checks the personal access token with the service before saving it."
+HELP_TEXT_SEPARATOR = "\n"
+BROWSER_BUTTON_TEXT = "Sign in with browser"
+# Once a token or password field is shown, the browser is the other way to sign in, and its button says so.
+BROWSER_INSTEAD_BUTTON_TEXT = "Sign in with browser instead"
+TOKEN_LINK_TEXT = "Use a token instead"
+SELF_HOSTED_BROWSER_TEXT = ("On this server, sign in with your username and password or a token. Browser sign-in needs an OAuth application "
+                            "installed on the server, so it is offered only if the server refuses passwords and supports it.")
+# Said in orange, with a turning indicator, while the browser has not answered yet: the time left before GitPane stops
+# waiting, updated every second.
+BROWSER_COUNTDOWN_TEXT = "Waiting for browser response {minutes:02d}:{seconds:02d}"
+COUNTDOWN_INTERVAL_MS = 1000
+SECONDS_PER_MINUTE = 60
+TOKEN_WAIT_TEXT = "Checking token…"
+CHECKING_TEXT = "Testing the sign-in on {address}…"
+CHECK_NOTE_TEXT = "The sign-in is tested with {url}."
+# Said in orange when the server's answer says account passwords are refused for Git: not an error, another method is
+# needed, the browser when the server was recognised as offering it, otherwise a personal access token.
+BROWSER_INSTEAD_TEXT = "This server does not accept passwords for Git. Sign in with your browser instead."
+TOKEN_INSTEAD_TEXT = "This server does not accept passwords for Git. Use a personal access token instead."
+TOKEN_PAGE_TEXT = "Create a personal access token at {url}, then enter it above."
+TOKEN_PAGE_GENERIC_TEXT = "Create a personal access token in your account settings on this server, then enter it above."
+CREDENTIALS_REFUSED_TEXT = "The server refused the username or password. Nothing was saved. Check them, or use a personal access token instead."
+# Status line of Add account after the user cancelled a sign-in.
+SIGN_IN_CANCELLED_TEXT = "Sign-in cancelled. Sign in again when ready."
+EMPTY_SERVER_TEXT = "Enter the server URL, for example " + SERVER_URL_PLACEHOLDER + "."
+EMPTY_SERVICE_NAME_TEXT = "Enter the name of your service."
+EMPTY_USERNAME_TEXT = "Enter the username you use on this server."
+EMPTY_PASSWORD_TEXT = "Enter a password or token."
+EMPTY_TOKEN_TEXT = "Enter a personal access token."
+EMPTY_BITBUCKET_EMAIL_TEXT = "Enter the e-mail address of your Bitbucket account."
+URL_SCHEME_SEPARATOR = "://"
+# Settings keeps the account list without a Save: after a sign-in there, the user is told nothing is left to save.
+SIGN_IN_SAVED_TEXT = "It is saved automatically; you can close this window."
+# The keyring is read on a worker thread of this name, so the window never waits on the session bus.
+KEYRING_READ_THREAD_NAME = "gitpane-keyring-read"
+KEYRING_READ_FAILURE_LOG_TEMPLATE = "Reading the state of the keyring failed unexpectedly: {error_class}: {error}"
+
+
+class AddAccountText(Enum):
+    """Texts added to the sign-in form, one member per text so a misspelt name is an error."""
+
+    OUTPUT_NAME = "Sign-in output"
+    """The accessible name of the field that shows the whole output of a failed sign-in."""
+    LIST_SAVE_FAILED = "Signed in and stored securely, but Connected accounts could not be saved."
+    """The sign-in and the secure store worked, but the account list could not be written."""
+    GENERIC_STORE_FAILED = "The password or token could not be saved in the system credential store."
+    """A username + password account passed its test, but the secure store refused to save it."""
+    STORE_FAILED = "Signed in, but the secure store could not save this account."
+    """The service accepted the sign-in, but the secure store refused to save it."""
+    SIGN_IN_FAILED = "Sign-in failed."
+    """The sign-in itself failed, before anything was saved."""
+    SIGN_IN_NOT_STARTED = "Sign-in did not start."
+    """The sign-in was stopped before anything was sent to the credential manager, because the keyring could not store it."""
+    KEYRING_FIRST_SESSION = "This is a known bug of the GNOME keyring in the very first session of a new system or user: log out, log back in, then try again."
+    """Said in orange when the keyring's default collection is not published on the session bus, which happens in the very first session only."""
+    KEYRING_LOCKED = "The GNOME keyring is locked: unlock it when GNOME asks, then try again."
+    """Said in orange when the secure store refused to save while the keyring's default collection is still locked."""
+    KEYRING_NO_DEFAULT_COLLECTION = "The keyring has no default collection to save the account in: create one when the desktop asks for it, or in Passwords and Keys, then try again."
+    """Said in orange when the secure store refused to save while the keyring still has no default collection."""
+    KDE_WALLET_CLOSED = "KDE Wallet is closed: open it when KDE asks, then try again."
+    """Said in orange when KDE Wallet holds the Secret Service and its default wallet is closed."""
+    KDE_WALLET_NO_DEFAULT_WALLET = "KDE Wallet has no default wallet to save the account in: create one when KDE asks for it, or in KWalletManager, then try again."
+    """Said in orange when KDE Wallet holds the Secret Service but no wallet stands for its default one."""
+    KEEPASSXC_LOCKED = "The KeePassXC database is locked: unlock it when KeePassXC asks, then try again."
+    """Said in orange when KeePassXC holds the Secret Service and the database it shares is locked."""
+    KEEPASSXC_NO_SHARED_DATABASE = "KeePassXC shares no database with other applications: open a database and expose one of its groups in its Secret Service settings, then try again."
+    """Said in orange when KeePassXC holds the Secret Service but exposes no group of an open database."""
+    NAMED_KEYRING_LOCKED = "The keyring ({program}) is locked: unlock it when it asks, then try again."
+    """Said in orange when a keyring GitPane names only by its program holds a locked default collection."""
+    NAMED_KEYRING_NO_DEFAULT_COLLECTION = "The keyring ({program}) has no default collection to save the account in: create one, then try again."
+    """Said in orange when a keyring GitPane names only by its program has no default collection."""
+    NAMED_KEYRING_UNPUBLISHED = "The keyring ({program}) does not publish its default collection: check it, then try again."
+    """Said in orange when a keyring other than the GNOME keyring names a default collection absent from the bus."""
+    UNNAMED_KEYRING_LOCKED = "The keyring is locked: unlock it when it asks, then try again."
+    """Said in orange when the program that holds the Secret Service could not be read and its default collection is locked."""
+    UNNAMED_KEYRING_NO_DEFAULT_COLLECTION = "The keyring has no default collection to save the account in: create one, then try again."
+    """Said in orange when the program that holds the Secret Service could not be read and it has no default collection."""
+    UNNAMED_KEYRING_UNPUBLISHED = "The keyring does not publish its default collection: check it, then try again."
+    """Said in orange when the program that holds the Secret Service could not be read and its default collection is absent from the bus."""
+
+
+# The orange sentence of each keyring and state that gives the user something to do. The key comes from the keyring
+# read, and the sentence belongs to this window. The GNOME keyring keeps its own sentences; KDE Wallet and KeePassXC get
+# theirs for the states they are known to give, and the neutral sentence that names them otherwise; any other program
+# is named as read, and a program that could not be read is not named. A state missing from the table (available, no
+# service, unknown) gives no sentence.
+KEYRING_ADVICE_BY_PROVIDER_AND_STATE: dict[tuple[KeyringProvider, KeyringState], AddAccountText] = {
+    (KeyringProvider.GNOME_KEYRING, KeyringState.UNPUBLISHED): AddAccountText.KEYRING_FIRST_SESSION,
+    (KeyringProvider.GNOME_KEYRING, KeyringState.LOCKED): AddAccountText.KEYRING_LOCKED,
+    (KeyringProvider.GNOME_KEYRING, KeyringState.NO_DEFAULT_COLLECTION): AddAccountText.KEYRING_NO_DEFAULT_COLLECTION,
+    (KeyringProvider.KDE_WALLET, KeyringState.LOCKED): AddAccountText.KDE_WALLET_CLOSED,
+    (KeyringProvider.KDE_WALLET, KeyringState.NO_DEFAULT_COLLECTION): AddAccountText.KDE_WALLET_NO_DEFAULT_WALLET,
+    (KeyringProvider.KDE_WALLET, KeyringState.UNPUBLISHED): AddAccountText.NAMED_KEYRING_UNPUBLISHED,
+    (KeyringProvider.KEEPASSXC, KeyringState.LOCKED): AddAccountText.KEEPASSXC_LOCKED,
+    (KeyringProvider.KEEPASSXC, KeyringState.NO_DEFAULT_COLLECTION): AddAccountText.KEEPASSXC_NO_SHARED_DATABASE,
+    (KeyringProvider.KEEPASSXC, KeyringState.UNPUBLISHED): AddAccountText.NAMED_KEYRING_UNPUBLISHED,
+    (KeyringProvider.OTHER, KeyringState.LOCKED): AddAccountText.NAMED_KEYRING_LOCKED,
+    (KeyringProvider.OTHER, KeyringState.NO_DEFAULT_COLLECTION): AddAccountText.NAMED_KEYRING_NO_DEFAULT_COLLECTION,
+    (KeyringProvider.OTHER, KeyringState.UNPUBLISHED): AddAccountText.NAMED_KEYRING_UNPUBLISHED,
+    (KeyringProvider.UNREADABLE, KeyringState.LOCKED): AddAccountText.UNNAMED_KEYRING_LOCKED,
+    (KeyringProvider.UNREADABLE, KeyringState.NO_DEFAULT_COLLECTION): AddAccountText.UNNAMED_KEYRING_NO_DEFAULT_COLLECTION,
+    (KeyringProvider.UNREADABLE, KeyringState.UNPUBLISHED): AddAccountText.UNNAMED_KEYRING_UNPUBLISHED,
+}
+
+
+def keyring_advice(reading: KeyringReading) -> str | None:
+    """Return the orange sentence the form adds for a keyring reading, ready to show, or None when it gives the user nothing to do.
+
+    The sentence is chosen by the keyring that holds the Secret Service and the state of its default collection, so a
+    KDE user never reads a sentence about the GNOME keyring. A sentence that names the program gets the name as read,
+    shown as plain text by the label. Any state GitPane could not read says nothing rather than something it does not know.
+    """
+    advice = KEYRING_ADVICE_BY_PROVIDER_AND_STATE.get((reading.provider, reading.state))
+    if advice is None:
+        return None
+    return advice.value.format(program=reading.program)
+
+
+def run_keyring_read(read: Callable[[], KeyringReading], hand_over: Callable[[KeyringReading], None], log_line: Callable[[str], None] = ignore_line) -> None:
+    """Read the keyring on the worker thread and hand the reading over to the form's thread, UNKNOWN when the read failed.
+
+    The form always gets an answer, so a sign-in waiting on it is never left waiting. An error nobody expects shows a
+    defect of GitPane, not of the keyring: it is written through ``log_line``, and the answer stays UNKNOWN, which says
+    nothing to the user.
+    """
+    reading = UNKNOWN_KEYRING_READING
+    try:
+        reading = read()
+    except (OSError, ValueError, RuntimeError):
+        reading = UNKNOWN_KEYRING_READING
+    except Exception as error:  # noqa: BLE001 -- the worker must always answer the form; the error is written to the --log journal
+        reading = UNKNOWN_KEYRING_READING
+        log_line(KEYRING_READ_FAILURE_LOG_TEMPLATE.format(error_class=type(error).__name__, error=error))
+    finally:
+        hand_over_to_the_page(hand_over, reading)
+
+
+def sign_in_result_text(outcome: AuthOutcome, *, reconnect: bool, saved_note: bool = False) -> str:
+    """Describe a successful sign-in in the words the user expects: added, renewed, or reconnected.
+
+    saved_note adds the sentence saying the account is already saved and the window can be closed. Only Settings asks
+    for it: the Clone form that also signs in stays open for the clone the user is setting up.
+    """
+    label = outcome.selection.label
+    if reconnect:
+        text = label + " was reconnected."
+    elif outcome.renewed:
+        text = label + " was already connected. Its sign-in was renewed."
+    else:
+        text = label + " was added to Connected accounts."
+        if outcome.became_default:
+            text += " It is now the default account for " + origin_address(outcome.selection.origin) + "."
+    if saved_note:
+        text += " " + SIGN_IN_SAVED_TEXT
+    return text
+
+
+def sign_in_failure_text(outcome: AuthOutcome) -> str:
+    """Say which step failed: the sign-in, the secure store or the account list, never the output of the program that ran.
+
+    That output is shown whole in the form's own output field, under this sentence. A failed Git test of a username +
+    password account is described by ``check_failure_text`` instead. Whether the secure store is the step that failed is
+    decided by ``store_was_refused`` alone, the rule the keyring read after a refusal also follows, so a refusal before
+    any program ran or an account GitPane refused, which never reached the store, says the sign-in failed.
+    """
+    if outcome.stored:
+        return AddAccountText.LIST_SAVE_FAILED.value
+    if not store_was_refused(outcome):
+        return AddAccountText.SIGN_IN_FAILED.value
+    if outcome.selection is not None and outcome.selection.provider == GENERIC_PROVIDER:
+        return AddAccountText.GENERIC_STORE_FAILED.value
+    return AddAccountText.STORE_FAILED.value
+
+
+def outcome_cause(outcome: AuthOutcome) -> str:
+    """Return the prepared cause of a failed exchange, already filtered of secrets, or an empty text when there is none."""
+    if outcome.diagnostic is None:
+        return ""
+    return outcome.diagnostic.cause
+
+
+def check_failure_text(check: AccountCheck) -> str:
+    """Say in plain words why the Git test of a username + password failed, read from the words of the server's answer.
+
+    A plain refusal is the usual answer to a mistyped password, so it asks to check them. Anything else says the test
+    could not be done. An answer saying passwords are not accepted is no error and is told apart by ``passwords_refused``.
+    """
+    if refusal_kind(check.git_output) is RefusalKind.CREDENTIALS_REFUSED:
+        return CREDENTIALS_REFUSED_TEXT
+    return CHECK_FAILED_TEXT.format(url=check.url)
+
+
+def passwords_refused(check: AccountCheck | None) -> bool:
+    """Tell whether the server answered the Git test by saying it refuses account passwords, so only another method can work."""
+    return check is not None and refusal_kind(check.git_output) is RefusalKind.PASSWORD_NOT_ACCEPTED
+
+
+class AddAccountDialog(ContentGrowthMixin, QDialog):
+    """Show the fields that fit the typed server and report what the user asked for; the account controller runs the exchange.
+
+    GitHub, gitlab.com and Bitbucket Cloud get browser sign-in with a button beside it to use a personal access token; any other
+    server gets a username with a password or token. Opened from Settings, which is modal for the whole application,
+    the window is modal over it; opened from a clone form, it is a plain window over that form. In Reconnect mode the
+    server, service name and username of the renewed account are shown and cannot be changed; a clone form fixes the
+    server only.
+
+    While the browser has not answered a browser sign-in, the window counts down the time left in orange beside a
+    turning indicator, so the user is not left wondering whether GitPane froze. Cancel stops the sign-in and keeps the
+    window open; the close button and Escape stop it and close the window: a browser tab the user closed must not keep
+    them waiting until the end of the countdown, which only stays as a limit for a forgotten tab.
+
+    The window's height follows its rows both ways: an output grows it until its field shows ACCOUNT_OUTPUT_LINE_COUNT
+    lines, and a new try or a cancelled sign-in, which hide the field, bring it back to the height it had before. While
+    the output shows, the user cannot make the window shorter than those lines.
+    """
+
+    sign_in_requested = Signal(bool)
+    cancel_requested = Signal()
+    # The number of the keyring read and the KeyringReading it gave, handed over from the worker thread.
+    keyring_state_read = Signal(int, object)
+
+    def __init__(self, parent: QWidget | None = None, *, reconnect: AccountSelection | None = None, locked_origin: str = "", service_name: str = "",
+                 service_name_by_origin: dict[str, str] | None = None, known_check_url_by_origin: dict[str, str] | None = None,
+                 browser_timeout_ms: int = BROWSER_SIGN_IN_TIMEOUT_MS) -> None:
+        """Build the form; ``reconnect`` renews that account (``service_name`` is its address's name), ``locked_origin`` fixes the server of a new account.
+
+        ``service_name_by_origin`` holds the names already given to known addresses, so adding a second account to one
+        of them proposes the same name instead of renaming the address by accident. ``known_check_url_by_origin`` holds
+        the repository URL the caller already knows for an address (a remote of the open repository, the URL being
+        cloned): a username + password on that address is tested there, and the window says so instead of asking.
+        ``browser_timeout_ms`` is how long the account service waits for the browser; the countdown starts from it.
+        """
+        super().__init__(parent)
+        self.reconnect = reconnect
+        self.service_name_by_origin = dict(service_name_by_origin or {})
+        self.known_check_url_by_origin = dict(known_check_url_by_origin or {})
+        self.operation_id = ""
+        self.generation = 0
+        self.closed = False
+        self.running = False
+        self.token_mode = False
+        self.browser_timeout_ms = browser_timeout_ms
+        self.browser_waiting = False
+        self.browser_deadline = QDeadlineTimer(browser_timeout_ms)
+        self.countdown_timer = QTimer(self)
+        self.countdown_timer.setInterval(COUNTDOWN_INTERVAL_MS)
+        self.countdown_timer.timeout.connect(self._show_countdown)
+        # The failed Git test of the typed address, kept until the address changes: it decides which method is advised next.
+        self.refused_check: AccountCheck | None = None
+        self.prefilled_service_name = ""
+        # What to do with the keyring reading the running read gives; it may hold the typed secret, so it is dropped as
+        # soon as the answer arrives, the sign-in is cancelled or the window closes.
+        self.keyring_answer: Callable[[KeyringReading], None] | None = None
+        # Only the answer of the latest read is used: a read started for an earlier, cancelled try answers into nothing.
+        self.keyring_read_number = 0
+        # The refused store whose keyring read again is still awaited: Cancel during that read shows this refusal, which
+        # is already known, instead of saying the sign-in was cancelled.
+        self.refused_outcome: AuthOutcome | None = None
+        # True while the form shows the refusal of a credential manager and its install lines, from the try that met
+        # it until anything else is shown; only then may a later search that finds one take that refusal away.
+        self.credential_manager_refusal_shown = False
+        self.server_locked = reconnect is not None or bool(locked_origin)
+        self.account_locked = reconnect is not None
+        self.setModal(False)
+        self.setWindowTitle(RECONNECT_TITLE if reconnect is not None else ADD_ACCOUNT_TITLE)
+        self.resize(ADD_ACCOUNT_WIDTH, ADD_ACCOUNT_HEIGHT)
+        layout = QVBoxLayout(self)
+        layout.setSizeConstraint(QLayout.SizeConstraint.SetNoConstraint)
+        layout.setSpacing(SPACING_SM)
+        self.form = QFormLayout()
+        self.form.setSpacing(SPACING_SM)
+        apply_left_aligned_form(self.form)
+        self.server_edit = self._line_edit(SERVER_URL_LABEL, SERVER_URL_PLACEHOLDER)
+        self.form.addRow(SERVER_URL_LABEL, self.server_edit)
+        self.service_name_edit = self._line_edit(SERVICE_NAME_LABEL, SERVICE_NAME_PLACEHOLDER)
+        self.form.addRow(SERVICE_NAME_LABEL, self.service_name_edit)
+        self.username_edit = self._line_edit(USERNAME_LABEL, "")
+        self.form.addRow(USERNAME_LABEL, self.username_edit)
+        self.check_url_edit = self._line_edit(CHECK_URL_LABEL, CHECK_URL_PLACEHOLDER)
+        self.form.addRow(CHECK_URL_LABEL, self.check_url_edit)
+        self.check_note_label = self._plain_label("")
+        self.form.addRow(self.check_note_label)
+        self.password_label = QLabel(PASSWORD_LABEL)
+        self.password_edit = self._line_edit(PASSWORD_LABEL, "")
+        self.password_edit.setEchoMode(QLineEdit.EchoMode.Password)
+        self.form.addRow(self.password_label, self.password_edit)
+        self.token_page_label = self._plain_label("")
+        self.form.addRow(self.token_page_label)
+        self.bitbucket_email_edit = self._line_edit(BITBUCKET_EMAIL_LABEL, "")
+        self.form.addRow(BITBUCKET_EMAIL_LABEL, self.bitbucket_email_edit)
+        layout.addLayout(self.form)
+        self.help_label = self._plain_label("")
+        layout.addWidget(self.help_label)
+        self.browser_button = QPushButton(BROWSER_BUTTON_TEXT)
+        self.browser_button.setAutoDefault(False)
+        self.browser_button.clicked.connect(lambda: self.sign_in_requested.emit(False))
+        # The token is the other way to sign in on the same services, so its button stands beside the browser's, as an
+        # ordinary button: a flat link-like one did not look clickable.
+        self.token_link_button = QPushButton(TOKEN_LINK_TEXT)
+        self.token_link_button.setAccessibleName(TOKEN_LINK_TEXT)
+        self.token_link_button.setAutoDefault(False)
+        self.token_link_button.clicked.connect(self._token_link_clicked)
+        browser_layout = QHBoxLayout()
+        browser_layout.addWidget(self.browser_button)
+        browser_layout.addWidget(self.token_link_button)
+        browser_layout.addStretch()
+        layout.addLayout(browser_layout)
+        self.add_button = QPushButton(RECONNECT_BUTTON_TEXT if reconnect is not None else ADD_BUTTON_TEXT)
+        self.add_button.setAutoDefault(False)
+        self.add_button.clicked.connect(lambda: self.sign_in_requested.emit(True))
+        self.self_hosted_label = self._plain_label(SELF_HOSTED_BROWSER_TEXT)
+        layout.addWidget(self.self_hosted_label)
+        self.busy_indicator = BusyIndicator()
+        self.status_label = ResultLabel()
+        status_layout = QHBoxLayout()
+        status_layout.addWidget(self.busy_indicator, 0, Qt.AlignmentFlag.AlignTop)
+        status_layout.addWidget(self.status_label, 1)
+        layout.addLayout(status_layout)
+        # The orange sentence about the keyring, under the red line of the step and above the output, shown only
+        # when the keyring explains the failure.
+        self.keyring_label = ResultLabel()
+        self.keyring_label.hide()
+        layout.addWidget(self.keyring_label)
+        # The whole output of a failed sign-in, as the program wrote it once its secrets were filtered: plain text the
+        # user can read, select and copy into a bug report or an assistant. It takes the height given to the window;
+        # while it is hidden, the stretch below takes it back.
+        self.output_edit = QPlainTextEdit()
+        self.output_edit.setReadOnly(True)
+        # A read-only text field only keeps mouse selection: the keyboard selection lets Ctrl+A select it all.
+        self.output_edit.setTextInteractionFlags(Qt.TextInteractionFlag.TextSelectableByMouse | Qt.TextInteractionFlag.TextSelectableByKeyboard)
+        self.output_edit.setAccessibleName(AddAccountText.OUTPUT_NAME.value)
+        self.output_edit.hide()
+        layout.addWidget(self.output_edit, 1)
+        self.copy_output_button = QPushButton(SharedText.COPY_DETAILS.value)
+        self.copy_output_button.setAutoDefault(False)
+        self.copy_output_button.clicked.connect(self.copy_output)
+        self.copy_output_button.hide()
+        copy_layout = QHBoxLayout()
+        copy_layout.addWidget(self.copy_output_button)
+        copy_layout.addStretch()
+        layout.addLayout(copy_layout)
+        # The exact text the output field shows, which Copy details copies.
+        self.output_text = ""
+        layout.addStretch()
+        # The confirm button sits just left of Cancel in the bottom-right row, as in every other dialog, whatever the
+        # way to sign in shown above.
+        action_layout = QHBoxLayout()
+        action_layout.addStretch()
+        action_layout.addWidget(self.add_button)
+        self.cancel_button = QPushButton("Cancel")
+        self.cancel_button.setAutoDefault(False)
+        self.cancel_button.clicked.connect(self._cancel_clicked)
+        action_layout.addWidget(self.cancel_button)
+        layout.addLayout(action_layout)
+        self._apply_lock(reconnect, locked_origin, service_name)
+        self.service_name_edit.textEdited.connect(self._service_name_edited)
+        self.server_edit.textChanged.connect(self._server_changed)
+        self.keyring_state_read.connect(self._keyring_state_answered, Qt.ConnectionType.QueuedConnection)
+        self._prefill_service_name()
+        self._update_presentation()
+        self.refresh_metrics()
+        # The form has no scroll area: its own layout, whose minimum counts the output field at its height of
+        # ACCOUNT_OUTPUT_LINE_COUNT lines while it is shown, tells the height its rows need.
+        self.install_content_growth(LayoutContentMeasure(self), OpeningFit.GROW_ONLY, ADD_ACCOUNT_HEIGHT)
+
+    def server_url(self) -> str:
+        """Return the typed server address; one typed without a scheme is taken as HTTPS, anything else is left for the service to check."""
+        text = typed_value(self.server_edit.text())
+        if not text or URL_SCHEME_SEPARATOR in text:
+            return text
+        return HTTPS_PREFIX + text
+
+    def address(self) -> str:
+        """Return the address this window is about, as shown to the user: the renewed account's, else the typed server's, else the typed text."""
+        if self.reconnect is not None:
+            return origin_address(self.reconnect.origin)
+        try:
+            return origin_address(self.server_url())
+        except ValueError:
+            return self.server_url()
+
+    def check_url(self) -> str:
+        """Return the URL of the repository on which the username and password are tested before the account is saved.
+
+        It is the URL the caller already knows for this address when there is one, since the field is then hidden;
+        otherwise it is the typed one.
+        """
+        known_check_url = self.known_check_url()
+        if known_check_url:
+            return known_check_url
+        return typed_value(self.check_url_edit.text())
+
+    def service_name(self) -> str:
+        """Return the typed service name without the blanks around it; a name made only of blanks counts as empty."""
+        return typed_value(self.service_name_edit.text())
+
+    def username(self) -> str:
+        """Return the typed username without the blanks around it."""
+        return typed_value(self.username_edit.text())
+
+    def bitbucket_email(self) -> str:
+        """Return the typed Bitbucket e-mail without the blanks around it."""
+        return typed_value(self.bitbucket_email_edit.text())
+
+    def known_check_url(self) -> str:
+        """Return the repository URL the caller already knows for this address, or an empty text when the user has to type one.
+
+        Only a username + password account is tested with Git, so any other account has none.
+        """
+        if not self.asks_username():
+            return ""
+        origin = self._origin()
+        if not origin:
+            return ""
+        return self.known_check_url_by_origin.get(origin, "")
+
+    def set_known_check_url(self, origin: str, url: str) -> None:
+        """Remember the repository URL to test for this address, learnt after the window opened, and show it if that address is the one shown."""
+        self.known_check_url_by_origin[origin] = url
+        self._update_presentation()
+
+    def asks_check_url(self) -> bool:
+        """Tell whether a repository to test is asked: only for a username + password account, and only when no URL of its address is known."""
+        return self.asks_username() and not self.known_check_url()
+
+    def cloud_provider(self) -> str | None:
+        """Name the online service (GitHub, GitLab or Bitbucket) whose own sign-in fits this address, or None for any other server.
+
+        A username + password account being reconnected keeps its kind whatever its address, so it has none.
+        """
+        if self._generic_reconnect():
+            return None
+        return self._address_provider()
+
+    def browser_provider(self) -> str | None:
+        """Name the service whose browser sign-in fits this address, or None when only a password or token can be used.
+
+        A service account being reconnected on another server has no browser sign-in: only a token can renew it. Any
+        other server offers the browser sign-in of the provider it was recognised as after a refused test, if any.
+        """
+        provider = self.cloud_provider()
+        if provider is None:
+            return self._recognised_browser_provider()
+        if self.reconnect is None:
+            return provider
+        return self.reconnect.provider
+
+    def checks_token(self) -> bool:
+        """Tell whether the typed secret is a service token that the service's API checks before anything is saved."""
+        if self.reconnect is not None:
+            return self.reconnect.provider != GENERIC_PROVIDER
+        return self.cloud_provider() is not None
+
+    def asks_token(self) -> bool:
+        """Tell whether the secret field asks for a personal access token, because the server refuses account passwords or checks the token."""
+        return self.checks_token() or self._address_provider() is not None or passwords_refused(self.refused_check)
+
+    def asks_username(self) -> bool:
+        """Tell whether a username is part of this account: only a username + password account has one."""
+        if self.reconnect is not None:
+            return self.reconnect.provider == GENERIC_PROVIDER
+        return self.cloud_provider() is None
+
+    def asks_bitbucket_email(self) -> bool:
+        """Tell whether a Bitbucket token is being typed, which the Bitbucket API only checks together with the account e-mail."""
+        return self.browser_provider() == BITBUCKET_PROVIDER
+
+    def set_running(self, running: bool, *, token: bool = False) -> None:
+        """Block duplicate submissions and discard the typed password as soon as a sign-in starts or ends.
+
+        A browser sign-in (``token`` false) starts the countdown and the turning indicator; the other ways to sign in
+        show a plain wait text. Every sign-in can be cancelled.
+        """
+        self.running = running
+        self.server_edit.setEnabled(not running and not self.server_locked)
+        for control in (self.service_name_edit, self.username_edit):
+            control.setEnabled(not running and not self.account_locked)
+        for control in (self.check_url_edit, self.password_edit, self.bitbucket_email_edit, self.add_button, self.browser_button, self.token_link_button):
+            control.setEnabled(not running)
+        self.password_edit.clear()
+        self._set_browser_waiting(running and not token)
+        if not running:
+            return
+        self._hide_output()
+        self.show_keyring_note(UNKNOWN_KEYRING_READING)
+        if token:
+            self.status_label.setText(self._wait_text())
+            return
+        self._show_countdown()
+
+    def clear_password(self) -> None:
+        """Drop the typed password or token, for example after a form check refused the request."""
+        self.password_edit.clear()
+
+    def show_refusal(self, text: str) -> None:
+        """Say in red what the form still misses; the output and keyring sentence of an earlier try no longer apply and go away."""
+        self._hide_output()
+        self.show_keyring_note(UNKNOWN_KEYRING_READING)
+        self.status_label.show_failure(text)
+
+    def read_keyring_state(self, read: Callable[[], KeyringReading], answer: Callable[[KeyringReading], None], log_line: Callable[[str], None] = ignore_line) -> None:
+        """Read the keyring on a worker thread, then call ``answer`` with the reading on the window's thread.
+
+        The read may wait on the session bus, so it never runs on the window's thread. ``answer`` is kept only until the
+        answer arrives, the sign-in is cancelled or the window closes; an answer arriving after that, or the answer of an
+        earlier read, calls nothing.
+        """
+        self.keyring_read_number += 1
+        read_number = self.keyring_read_number
+        self.keyring_answer = answer
+        emit = weak_signal_emitter(self, lambda dialog: dialog.keyring_state_read)
+
+        def hand_over(reading: KeyringReading) -> None:
+            """Hand the reading over to the window's thread together with the number of the read that gave it."""
+            emit(read_number, reading)
+
+        thread = threading.Thread(target=run_keyring_read, args=(read, hand_over, log_line), name=KEYRING_READ_THREAD_NAME, daemon=True)
+        thread.start()
+
+    def forget_keyring_answer(self) -> None:
+        """Drop what the running keyring read would call, so its late answer does nothing and keeps no typed secret alive."""
+        self.keyring_answer = None
+
+    def show_keyring_note(self, reading: KeyringReading) -> None:
+        """Show in orange the sentence that explains this keyring reading, under the red line, or hide the sentence when the reading gives none."""
+        advice = keyring_advice(reading)
+        if advice is None:
+            self.keyring_label.clear()
+            self.keyring_label.hide()
+            return
+        self.keyring_label.show_warning(advice)
+        self.keyring_label.show()
+
+    def show_keyring_refusal(self, reading: KeyringReading) -> None:
+        """End the wait of a sign-in stopped before anything was sent, because the keyring could not store it, and say why.
+
+        Nothing ran, so there is no output: the red line only says the sign-in did not start, and the orange sentence
+        under it says what to do about the keyring.
+        """
+        self.set_running(False)
+        self._hide_output()
+        self.status_label.show_failure(AddAccountText.SIGN_IN_NOT_STARTED.value)
+        self.show_keyring_note(reading)
+
+    def show_failure(self, outcome: AuthOutcome, keyring_reading: KeyringReading = UNKNOWN_KEYRING_READING) -> None:
+        """End the wait, say in red which step failed and show below it the whole output of the program that ran.
+
+        The status line says the step; the output field shows what the program that ran wrote, the prepared cause exactly
+        as received, already filtered of secrets, never summarised, cut or sorted, so the user can copy it whole. The
+        field stays hidden when there is no output. A cause that is GitPane's own sentence rather than a program's
+        output goes on the status line after the step, with no output field: a refusal before any program ran, or an
+        account the sign-in returned that GitPane refused (signed in as someone else than the account being
+        reconnected). A browser that did not answer in time gets its own short sentence only: the exchange was stopped
+        and nothing changed.
+
+        ``keyring_reading`` is the keyring read again after the secure store refused to save: when it explains the
+        refusal (a collection still locked, not published, or no default collection at all), its sentence, chosen by
+        the keyring that holds the Secret Service, comes in orange between the red line and the output, which does not
+        change. Every other result hides that sentence.
+
+        A failed Git test of a username + password says why in plain words, with Git's own output in the field; without
+        any output from Git, the cause (a time limit, for example) is shown there instead. A server that says it refuses
+        account passwords is no error: the window says in orange which method to use instead and switches to it, keeping
+        the typed username. The browser is only offered, never opened by the window itself.
+        """
+        browser_waited = self.browser_waiting
+        self.set_running(False)
+        self.credential_manager_refusal_shown = False
+        self.show_keyring_note(UNKNOWN_KEYRING_READING)
+        if browser_waited and outcome.status in BROWSER_TIMEOUT_STATUS_SET:
+            self._hide_output()
+            self.status_label.show_failure(BROWSER_TIMEOUT_TEXT)
+            return
+        cause = outcome_cause(outcome)
+        if outcome.check is None:
+            if outcome.refused_before_start or outcome.refused_by_gitpane:
+                self._hide_output()
+                self.status_label.show_failure(sign_in_failure_text(outcome) + (" " + cause if cause else ""))
+                return
+            self.status_label.show_failure(sign_in_failure_text(outcome))
+            # The sentence is shown before the output, so the output's growth measures the final form.
+            self.show_keyring_note(keyring_reading)
+            self._show_output(cause)
+            return
+        self.refused_check = outcome.check
+        if passwords_refused(outcome.check):
+            self.status_label.show_warning(BROWSER_INSTEAD_TEXT if self._recognised_browser_provider() is not None else TOKEN_INSTEAD_TEXT)
+        else:
+            self.status_label.show_failure(check_failure_text(outcome.check))
+        # The fields of the advised method are shown before the output, so the output's growth measures the final form.
+        self._update_presentation()
+        self._show_output(outcome.check.git_output or cause)
+
+    def show_install_text(self, lines: tuple[str, ...]) -> None:
+        """Show, in the output field under the refusal, the install lines of the credential manager the sign-in could not find.
+
+        The install window says the same over the form, but the user reads it, closes it, then installs: the form keeps
+        the lines so they stay in sight until the next try. They are selectable and copyable, so a command can be copied.
+        """
+        self._show_output("\n".join(lines))
+        self.credential_manager_refusal_shown = True
+
+    def clear_credential_manager_refusal(self) -> None:
+        """Take away the refusal of the credential manager, its install lines and Copy details, once a later search found a usable one.
+
+        The form then looks as before the try, so it no longer says signing in is impossible; what the user typed stays.
+        A form that shows something else since, the result of a newer try for example, is left as it is.
+        """
+        if not self.credential_manager_refusal_shown:
+            return
+        self._hide_output()
+        self.show_keyring_note(UNKNOWN_KEYRING_READING)
+        self.status_label.clear()
+
+    def show_cancelled(self) -> None:
+        """End the wait after the user cancelled, so the form is ready for another try."""
+        self.set_running(False)
+        self._hide_output()
+        self.show_keyring_note(UNKNOWN_KEYRING_READING)
+        self.status_label.setText(SIGN_IN_CANCELLED_TEXT)
+
+    def copy_output(self) -> None:
+        """Copy exactly the already-filtered text the output field shows."""
+        QApplication.clipboard().setText(self.output_text)
+
+    def abandon(self) -> None:
+        """Stop accepting any result for this window and drop the typed password, cancelling a running sign-in."""
+        self.closed = True
+        self.generation += 1
+        self.forget_keyring_answer()
+        self.password_edit.clear()
+        if self.running:
+            self.cancel_requested.emit()
+
+    def reject(self) -> None:
+        """Close the window, also from Escape and the close button; a running sign-in is cancelled first and the typed password is never kept."""
+        self.closed = True
+        if self.running:
+            self.cancel_requested.emit()
+        self.forget_keyring_answer()
+        self.password_edit.clear()
+        super().reject()
+
+    def refresh_metrics(self, available: QRect | None = None) -> None:
+        """Size controls for the current font and keep the window inside the usable screen.
+
+        The output field asks at least ACCOUNT_OUTPUT_LINE_COUNT lines of its font, with the document margins above and
+        below them and its frame around them: the window's layout counts that height while the field is shown, so the
+        growth rule gives the form room for those lines when an output arrives, and takes it back when the field hides.
+        """
+        self.output_edit.setFont(body_sized_fixed_font())
+        for control in (self.server_edit, self.service_name_edit, self.username_edit, self.check_url_edit, self.password_edit, self.bitbucket_email_edit, self.add_button,
+                        self.browser_button, self.token_link_button, self.cancel_button, self.copy_output_button):
+            control.setMinimumHeight(control_height(control.fontMetrics().height()))
+        document_margin = math.ceil(self.output_edit.document().documentMargin())
+        output_viewport_height = self.output_edit.fontMetrics().lineSpacing() * ACCOUNT_OUTPUT_LINE_COUNT + DOCUMENT_MARGIN_SIDE_COUNT * document_margin
+        self.output_edit.setMinimumHeight(output_viewport_height + FRAME_SIDE_COUNT * self.output_edit.frameWidth())
+        fit_window(self, ADD_ACCOUNT_MIN_WIDTH, ADD_ACCOUNT_MIN_HEIGHT, available)
+
+    def _show_output(self, text: str) -> None:
+        """Show the whole output in its field, scrolled to its end where a program writes its error, with Copy details under it; an empty text hides both.
+
+        The window follows the field both ways through the common growth rule: it grows, inside the usable area, until
+        the field shows ACCOUNT_OUTPUT_LINE_COUNT lines, the rest of the output scrolling, and takes back its height when
+        the field hides. While the field is shown, the window cannot be made shorter than its rows with those
+        ACCOUNT_OUTPUT_LINE_COUNT lines: the field asks them as its minimum height, and Qt keeps a window at its layout's
+        minimum. Above that, a height the user set by hand stays as long as the content asks for no more at the same width.
+        """
+        if not text:
+            self._hide_output()
+            return
+        # The field is shown before its text is set: a text set on a field that has no size yet stays scrolled to its
+        # middle, whereas once shown, moving the cursor to the end keeps the view there, even when the field grows.
+        self.output_edit.show()
+        self.copy_output_button.show()
+        self.output_text = text
+        self.output_edit.setPlainText(text)
+        self.output_edit.moveCursor(QTextCursor.MoveOperation.End)
+        after_compositor_answer(self, self._scroll_output_to_end)
+
+    def _keyring_state_answered(self, read_number: int, reading: KeyringReading) -> None:
+        """Pass the keyring reading of the latest read to what the sign-in asked, once, unless the window closed meanwhile."""
+        if read_number != self.keyring_read_number:
+            return
+        answer = self.keyring_answer
+        self.keyring_answer = None
+        if answer is None or self.closed:
+            return
+        answer(reading)
+
+    def _scroll_output_to_end(self) -> None:
+        """Put the view back on the end of the output once the form has grown, where a program writes its error.
+
+        Under Wayland the growth waits for the compositor's answer to the show; the form may be gone or the field hidden
+        by a new try by then, and nothing is done.
+        """
+        if not isValid(self) or not self.output_edit.isVisibleTo(self):
+            return
+        self.layout().activate()
+        self.output_edit.moveCursor(QTextCursor.MoveOperation.End)
+
+    def _hide_output(self) -> None:
+        """Empty and hide the output field and its Copy details button, for a new try or a result without output."""
+        self.credential_manager_refusal_shown = False
+        self.output_edit.clear()
+        self.output_edit.hide()
+        self.copy_output_button.hide()
+        self.output_text = ""
+
+    def _generic_reconnect(self) -> bool:
+        """Tell whether this window renews a username + password account."""
+        return self.reconnect is not None and self.reconnect.provider == GENERIC_PROVIDER
+
+    def _origin(self) -> str:
+        """Return the service address this window is about in its stored form, or an empty text while the typed server is not valid."""
+        if self.reconnect is not None:
+            return self.reconnect.origin
+        try:
+            return endpoint_origin(self.server_url())
+        except ValueError:
+            return ""
+
+    def _recognised_browser_provider(self) -> str | None:
+        """Name the provider whose browser sign-in the server offers, as recognised after a refused test of a new account, else None.
+
+        A Reconnect keeps its username + password account, so it never switches to a browser account.
+        """
+        if self.reconnect is not None or self.refused_check is None or not self.refused_check.browser_provider:
+            return None
+        return self.refused_check.browser_provider
+
+    def _address_provider(self) -> str | None:
+        """Name the online service at exactly the typed address, whatever kind of account is being added or renewed."""
+        try:
+            origin = endpoint_origin(self.server_url())
+        except ValueError:
+            return None
+        return provider_for_browser_origin(origin)
+
+    def _wait_text(self) -> str:
+        """Say what a sign-in with a typed secret waits for: the check of a service token, or the Git test of a password."""
+        if self.checks_token():
+            return TOKEN_WAIT_TEXT
+        return CHECKING_TEXT.format(address=self.address())
+
+    def _set_browser_waiting(self, waiting: bool) -> None:
+        """Start or end the browser wait: the countdown and the turning indicator."""
+        self.browser_waiting = waiting
+        if not waiting:
+            self.countdown_timer.stop()
+            self.busy_indicator.stop()
+            return
+        self.browser_deadline = QDeadlineTimer(self.browser_timeout_ms)
+        self.countdown_timer.start()
+        self.busy_indicator.start()
+
+    def _show_countdown(self) -> None:
+        """Show in orange the time left before GitPane stops waiting for the browser, rounded up to the second and never below zero.
+
+        The countdown stops at zero; the indicator keeps turning until the account service reports the end of the wait.
+        """
+        remaining_seconds = math.ceil(self.browser_deadline.remainingTime() / MILLISECONDS_PER_SECOND)
+        if remaining_seconds <= 0:
+            remaining_seconds = 0
+            self.countdown_timer.stop()
+        minutes, seconds = divmod(remaining_seconds, SECONDS_PER_MINUTE)
+        self.status_label.show_warning(BROWSER_COUNTDOWN_TEXT.format(minutes=minutes, seconds=seconds))
+
+    def _apply_lock(self, reconnect: AccountSelection | None, locked_origin: str, service_name: str) -> None:
+        """Show and fix the server, service name and username of the renewed account, or only the server given by the caller."""
+        if reconnect is not None:
+            self.server_edit.setText(reconnect.origin)
+            self.service_name_edit.setText(service_name)
+            self.username_edit.setText(reconnect.label)
+        elif locked_origin:
+            self.server_edit.setText(locked_origin)
+        self.server_edit.setEnabled(not self.server_locked)
+        self.service_name_edit.setEnabled(not self.account_locked)
+        self.username_edit.setEnabled(not self.account_locked)
+
+    def _server_changed(self) -> None:
+        """Start over for a new address: back to its first way of signing in, without the secret typed for the previous one.
+
+        What the last try said stays: its red sentence and its output, which the user may be reading or copying, until
+        the next try or the window closes. Only the orange advice, which follows the way to sign in reset here, and a
+        neutral line said for the previous address go away.
+        """
+        self.token_mode = False
+        self.refused_check = None
+        self.password_edit.clear()
+        if self.status_label.tone is not ResultTone.FAILURE:
+            self.status_label.clear()
+        self._prefill_service_name()
+        self._update_presentation()
+
+    def _service_name_edited(self) -> None:
+        """Remember that the user typed the service name, so a later address change never replaces it."""
+        self.prefilled_service_name = ""
+
+    def _prefill_service_name(self) -> None:
+        """Propose the address's name: the one already saved for it, else the online service's own name.
+
+        Only an empty field or one still holding the previous proposal is written, so a name the user typed is kept; a
+        proposal left untouched goes away with the address it was made for.
+        """
+        if self.account_locked:
+            return
+        current = self.service_name()
+        if current and current != self.prefilled_service_name:
+            return
+        proposal = self._proposed_service_name()
+        self.service_name_edit.setText(proposal)
+        self.prefilled_service_name = proposal
+
+    def _proposed_service_name(self) -> str:
+        """Return the name already given to the typed address, the online service's name, or nothing for an unknown server."""
+        try:
+            origin = endpoint_origin(self.server_url())
+        except ValueError:
+            return ""
+        saved_name = self.service_name_by_origin.get(origin, "")
+        if saved_name:
+            return saved_name
+        return provider_for_browser_origin(origin) or ""
+
+    def _token_link_clicked(self) -> None:
+        """Switch from browser sign-in to a personal access token and move the focus to it.
+
+        A red line here can only come from a browser try, since the link is hidden once a secret field is shown: the
+        click leaves that way to sign in, so what its try said (the red line, the keyring sentence and the credential
+        manager's output) no longer applies to the token and goes away. An orange advice is what pointed to this link,
+        after a server refused an account password: it stays, with Git's output that explains the refusal. The link is
+        disabled while a try runs; any keyring answer still awaited is dropped anyway, as Cancel does, with the refused
+        store it was read for, so it can never show a sentence on a form that has moved on.
+        """
+        self.forget_keyring_answer()
+        self.refused_outcome = None
+        if self.status_label.tone is ResultTone.FAILURE:
+            self._hide_output()
+            self.show_keyring_note(UNKNOWN_KEYRING_READING)
+            self.status_label.clear()
+        self.token_mode = True
+        self._update_presentation()
+        self.password_edit.setFocus()
+
+    def _update_presentation(self) -> None:
+        """Show only the fields and buttons of the way to sign in that fits the address and the account being renewed."""
+        browser_offered = self.browser_provider() is not None
+        # After a plain refusal the password may just be mistyped, so its field stays next to the browser offered by
+        # the recognised server; only a server that refuses passwords puts the browser first.
+        password_kept = self._recognised_browser_provider() is not None and not passwords_refused(self.refused_check)
+        secret_visible = not browser_offered or self.token_mode or password_kept
+        self.browser_button.setVisible(browser_offered)
+        self.browser_button.setText(BROWSER_INSTEAD_BUTTON_TEXT if secret_visible else BROWSER_BUTTON_TEXT)
+        self.token_link_button.setVisible(browser_offered and not secret_visible)
+        self.form.setRowVisible(self.username_edit, self.asks_username())
+        known_check_url = self.known_check_url()
+        self.form.setRowVisible(self.check_url_edit, self.asks_check_url())
+        self.form.setRowVisible(self.check_note_label, bool(known_check_url))
+        self.check_note_label.setText(CHECK_NOTE_TEXT.format(url=known_check_url) if known_check_url else "")
+        self.form.setRowVisible(self.password_edit, secret_visible)
+        self.form.setRowVisible(self.bitbucket_email_edit, secret_visible and self.asks_bitbucket_email())
+        self.add_button.setVisible(secret_visible)
+        secret_label = TOKEN_LABEL if self.asks_token() else PASSWORD_LABEL
+        self.password_label.setText(secret_label)
+        self.password_edit.setAccessibleName(secret_label)
+        token_page_text = self._token_page_text()
+        self.token_page_label.setText(token_page_text)
+        self.form.setRowVisible(self.token_page_label, secret_visible and bool(token_page_text))
+        self.self_hosted_label.setVisible(not browser_offered and not self._generic_reconnect() and self._address_valid())
+        self.help_label.setText(self._help_text())
+        self.browser_button.setDefault(not secret_visible)
+        self.add_button.setDefault(secret_visible)
+
+    def _help_text(self) -> str:
+        """Explain the way to sign in shown: why the online services need a browser or a token, or what a password account is."""
+        if self._address_provider() is not None:
+            return CLOUD_HELP_TEXT
+        if self.checks_token():
+            return TOKEN_HELP_TEXT
+        return SERVER_HELP_TEXT + HELP_TEXT_SEPARATOR + PASSWORD_HELP_TEXT
+
+    def _token_page_text(self) -> str:
+        """Say where to create a personal access token once the server refused the typed password for Git; empty otherwise.
+
+        The page is named when the server was recognised; a server that refuses passwords but was not recognised gets
+        the general advice.
+        """
+        check = self.refused_check
+        if check is None:
+            return ""
+        if check.token_page_url:
+            return TOKEN_PAGE_TEXT.format(url=check.token_page_url)
+        if passwords_refused(check):
+            return TOKEN_PAGE_GENERIC_TEXT
+        return ""
+
+    def _address_valid(self) -> bool:
+        """Tell whether the typed server is an address the service would accept."""
+        try:
+            endpoint_origin(self.server_url())
+        except ValueError:
+            return False
+        return True
+
+    def _cancel_clicked(self) -> None:
+        """Cancel only the running sign-in and keep the window open; with nothing running, close the window."""
+        if self.running:
+            self.cancel_requested.emit()
+            return
+        self.reject()
+
+    def _line_edit(self, accessible_name: str, placeholder: str) -> QLineEdit:
+        """Create one form field whose accessible name matches its visible label."""
+        edit = QLineEdit()
+        edit.setAccessibleName(accessible_name)
+        edit.setPlaceholderText(placeholder)
+        return edit
+
+    def _plain_label(self, text: str) -> QLabel:
+        """Create a wrapping label that shows account and diagnostic text literally."""
+        label = QLabel(text)
+        label.setTextFormat(Qt.TextFormat.PlainText)
+        label.setWordWrap(True)
+        return label