feat(auth): add password visibility toggle and remove the unused Organization field

Part 1 — show/hide password: an eye/eye-off button inside the login password input switches its type between password and text. It sits on the right (the input is LTR) with pr-10 clearance so dots never overlap the icon; type=button so a click cannot submit the form, aria-label Show/Hide password, aria-pressed + aria-controls, plus a Persian tooltip.

Part 2 — Organization field removed end-to-end after the audit proved it was a no-op: LoginPage input/state/payload spread (main + dev-mode admin login), api.ts payload type, backend LoginRequest.organization (declared but never forwarded to Casdoor — a bogus org value still logged in successfully), and the casdoor-auth.md flow diagram. The organization actually used remains CASDOOR_ORGANIZATION=inventory for /users/sync.

Verified: api + frontend images rebuilt and redeployed; login works with {username, password}; the served LoginPage chunk contains the toggle and zero org-field leftovers.

This commit is contained in:

whqreza

2026-09-15 16:29:54 +03:30

parent e7f465f74f

commit 593c149478

4 changed files with 31 additions and 32 deletions

docs/casdoor-auth.md

+1 -1

View File

@@ -35,7 +35,7 @@ to re-run).
 ## 2. Login flow (in-page, no redirect)
 ```
 Browser ──► POST /api/v1/auth/login {username, password, organization?}
 Browser ──► POST /api/v1/auth/login {username, password}
               │
               ▼
 Backend  ──► POST http://casdoor:8000/api/login/oauth/access_token