From dea26377c860c49e291d187d7ae33a050aa3bf63 Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Sun, 25 Oct 2026 12:57:08 -1000
Subject: Say when a login fails, and line up the form

A wrong password sent the reader back to the same empty form, which
looked no different from a crash. The redirect now carries a flag the
form reads, the same for an unknown user as for a wrong password, and
the form leaves the flag out of the way back it signs.
---
 custom/extensions/auth-inline.lua | 30 ++++++++++++++++++++++--------
 1 file changed, 22 insertions(+), 8 deletions(-)

(limited to 'custom/extensions/auth-inline.lua')

diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua
index e380733..c4b87f6 100644
--- a/custom/extensions/auth-inline.lua
+++ b/custom/extensions/auth-inline.lua
@@ -437,6 +437,18 @@ function redirect_to(url)
 	html("Location: " .. strip_controls(url) .. "\n")
 end
 
+-- A failed login lands back on the page it came from with this flag, which
+-- the form reads to say so and leaves out of the way back it signs.
+local failed_flag = "login=failed"
+
+local function flag_failure(url)
+	return url .. (url:find("?", 1, true) and "&" or "?") .. failed_flag
+end
+
+local function drop_failure_flag(url)
+	return (url:gsub("[?&]" .. failed_flag .. "$", ""))
+end
+
 function not_found()
 	html("Status: 404 Not Found\n")
 	html("Cache-Control: no-cache, no-store\n\n")
@@ -445,9 +457,8 @@ end
 -- The three actions cgit can ask for follow, and they are the same in both
 -- variants, so a change to one belongs in the other.
 
--- The redirect goes out before the password is checked, so a wrong password
--- and a right one answer with the same status and location and differ only in
--- the cookie.
+-- A wrong password and an unknown user answer alike, so the flag on the way
+-- back says only that the login failed.
 function authenticate_post()
 	local redirect = validate_value("redirect", post["redirect"])
 
@@ -456,8 +467,6 @@ function authenticate_post()
 		return 0
 	end
 
-	redirect_to(redirect)
-
 	local username = post["username"]
 	local password = post["password"]
 	local session = ""
@@ -475,6 +484,7 @@ function authenticate_post()
 	end
 
 	-- A failed login answers with an empty session, which clears the cookie.
+	redirect_to(session == "" and flag_failure(redirect) or redirect)
 	set_cookie(session_cookie, session)
 
 	html("\n")
@@ -502,13 +512,17 @@ end
 -- The form carries a signed redirect token, so the browser lands back on the
 -- page that was asked for.
 function body()
-	local target = cgit["url"]
+	local target = drop_failure_flag(cgit["url"])
+	local failed = target ~= cgit["url"]
 	if not is_safe_redirect(target) then
 		target = cgit["login"]
 	end
 
 	html("<h2>Authentication Required</h2>")
-	html("<form method='post' action='")
+	if failed then
+		html("<p class='login-error' role='alert'>Wrong username or password.</p>")
+	end
+	html("<form class='login' method='post' action='")
 	html_attr(cgit["login"])
 	html("'>")
 	html("<input type='hidden' name='redirect' value='")
@@ -521,7 +535,7 @@ function body()
 	html("<tr><td><label for='password'>Password:</label></td><td>")
 	html("<input id='password' name='password' type='password'")
 	html(" autocomplete='current-password'></td></tr>")
-	html("<tr><td colspan='2'>")
+	html("<tr><td></td><td>")
 	html("<input value='Login' type='submit'></td></tr>")
 	html("</table></form>")
 
-- 
cgit 2.9.2