feat(ui): autofocus login fields; keep verification code out of form history #56

2026-05-25T21:53:45Z

developer commented

2026-05-25 21:53:45 +00:00

What

Implements F8-01 (points 1–3 of #43) on the two-step e-mail login screen.

Autofocus the e-mail field on load, and the code field when the code step opens, via a one-line use: action. Focusing fires each input's onfocus, which drops the existing readonly autofill guard, so the field is editable immediately.
Code no longer offered back in a dropdown. The code input now requests autocomplete="one-time-code" instead of new-password.

Why point 3 needed more than "repeat the e-mail trick"

The code field already carried the full e-mail-suppression set (custom name, autocomplete="new-password", autocorrect/autocapitalize/spellcheck=off, the readonly-until-focus Safari trick) since the app-shell landed (b6770d3) — i.e. before this report. new-password is a password-manager hint and does not stop Firefox's form history from saving a plain typed value and offering it back. one-time-code is the semantic token Firefox honours specifically to keep verification codes out of form history (Mozilla bug 1547294). The e-mail field keeps new-password (it must still fend off saved-login autofill).

Tests

Vitest — autofocus on both steps (and the readonly guard dropping) + the code field's one-time-code token.
Playwright — the same, run in Chromium and WebKit (Safari engine); both green locally.
Firefox is owner manual-QA — the e2e matrix has no Firefox project, so the actual form-history dropdown should be verified by hand in Firefox (and Safari). The DOM attribute the fix relies on is asserted above.

Docs

ui/docs/auth-flow.md gains a "Focus and autofill suppression" section.

Closes #44

## What Implements **F8-01** (points 1–3 of #43) on the two-step e-mail login screen. 1. **Autofocus** the e-mail field on load, and the code field when the code step opens, via a one-line `use:` action. Focusing fires each input's `onfocus`, which drops the existing `readonly` autofill guard, so the field is editable immediately. 2. **Code no longer offered back in a dropdown.** The code input now requests `autocomplete="one-time-code"` instead of `new-password`. ## Why point 3 needed more than "repeat the e-mail trick" The code field already carried the full e-mail-suppression set (custom `name`, `autocomplete="new-password"`, `autocorrect/autocapitalize/spellcheck=off`, the readonly-until-focus Safari trick) since the app-shell landed (`b6770d3`) — i.e. *before* this report. `new-password` is a **password-manager** hint and does not stop Firefox's **form history** from saving a plain typed value and offering it back. `one-time-code` is the semantic token Firefox honours specifically to keep verification codes out of form history ([Mozilla bug 1547294](https://bugzilla.mozilla.org/show_bug.cgi?id=1547294)). The e-mail field keeps `new-password` (it must still fend off saved-login autofill). ## Tests - **Vitest** — autofocus on both steps (and the readonly guard dropping) + the code field's `one-time-code` token. - **Playwright** — the same, run in Chromium and **WebKit (Safari engine)**; both green locally. - **Firefox is owner manual-QA** — the e2e matrix has no Firefox project, so the actual form-history dropdown should be verified by hand in Firefox (and Safari). The DOM attribute the fix relies on is asserted above. ## Docs `ui/docs/auth-flow.md` gains a "Focus and autofill suppression" section. Closes #44

developer added 1 commit 2026-05-25 21:53:45 +00:00

feat(ui): autofocus login fields; keep verification code out of form history

Tests · UI / test (push) Waiting to run

Details

Tests · UI / test (pull_request) Successful in 2m51s

Details

3d5b331bd9

The two-step e-mail login now drops the cursor on each step's primary
field as it mounts — the e-mail field on load, the code field once the
e-mail step advances — via a small `use:` action. Focusing fires each
input's onfocus, which clears the readonly autofill guard, so the field
is editable straight away.

The code input now requests `autocomplete="one-time-code"` instead of
`new-password`. The latter is a password-manager hint and does not stop
Firefox saving the typed code to form history (it was offering the
previous code back in a dropdown). `one-time-code` is the semantic token
for a verification code; Firefox honours it specifically to keep the
value out of form history (Mozilla bug 1547294). The e-mail field keeps
`new-password` to fend off saved-login autofill.

Tests: new Vitest cases assert autofocus on both steps and the code
field's `one-time-code` token; a new Playwright case covers the same in
Chromium and WebKit (Safari engine). Firefox form history is owner
manual-QA — there is no Firefox project in the e2e matrix.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

developer requested review from owner 2026-05-25 21:53:49 +00:00

developer referenced this pull request

2026-05-25 21:54:58 +00:00

[F8-01] Экраны входа: автофокус + запрет автоподстановки кода #44

developer referenced this pull request

2026-05-25 22:00:14 +00:00

[F8-01] Экраны входа: автофокус + запрет автоподстановки кода #44

owner approved these changes 2026-05-25 22:09:19 +00:00

developer merged commit b957d17022 into development

2026-05-25 22:11:36 +00:00

developer deleted branch feature/issue-44-login-autofocus-otp

2026-05-25 22:11:36 +00:00