Finish the recovery guard only after the password change, mark the change
in the repository so a late userUpdated event is harmless, keep the form
locked after success, carry from through the reset check-email page,
share the password error texts and focus the continue button.
Refs #1
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
ForgotPasswordScreen with neutral reaction (F12), CheckEmail reset mode on
its own path, recovery link handling and ResetPasswordScreen with the
recovery guard held until the user confirms the success message. Carries
the from parameter between login, register and forgot password. Removes
the route placeholders.
Refs #1
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Fixed-wording tests for the generic credentials error, redacted toString for
login/register state, shared AuthFailure.isRetryable, autofill context
finished even when the router removes the screen, stricter from validation
(encoded and control-character variants), more widget tests.
Refs #1
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
KTO-01 Kriterien 5, 6 und 7 (01b): LoginController/State/Screen replace the
/login placeholder. Generic failure text for wrong email and password,
resend via ResendController (ResendOrigin.login), throttle and offline
banners, autofill hints, double-submit guard, validated from redirect.
Refs #1
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
- expose legal links to screen readers on web
- allow only http(s) legal URLs, prevent double submit
- detect transport errors without runtimeType, keep extra in memory
- ship third-party license text, document decisions
Refs #1
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
