Enable password manager autofill for admin tokens - #873
Open
mincia1110 wants to merge 2 commits into
Open
Conversation
📝 WalkthroughWalkthroughThe dashboard now uses a localized password form for admin authentication. The API verifies submitted tokens through ChangesAdmin token authentication
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant ApiAuthFetch
participant requestAdminToken
participant verifyAdminToken
participant promptForAdminToken
participant BrowserForm
ApiAuthFetch->>requestAdminToken: receive unauthorized response
requestAdminToken->>promptForAdminToken: request admin token
promptForAdminToken->>BrowserForm: show localized password form
BrowserForm-->>promptForAdminToken: submit token or cancel
promptForAdminToken->>verifyAdminToken: verify submitted token
verifyAdminToken-->>promptForAdminToken: accepted, rejected, or unavailable
promptForAdminToken-->>requestAdminToken: return token or null
requestAdminToken-->>ApiAuthFetch: retry authenticated request
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
mincia1110
marked this pull request as ready for review
August 2, 2026 02:16
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d1ee3644b8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs-site/src/content/docs/guides/web-dashboard.md`:
- Around line 32-36: Update the translated dashboard guide pages for ja, ko, ru,
and zh-cn by adding the missing sign-in section immediately after their opening
instructions. Mirror the source guide’s behavior: explain the loopback
exception, require an admin token for remote dashboards, describe the standard
password form and browser/password-manager autofill, and state that the
dashboard retains the token only in memory without localStorage or
sessionStorage persistence.
In `@gui/src/admin-token-dialog.ts`:
- Around line 39-69: Replace the duplicated field-label text in the admin token
dialog with purpose-specific i18n entries: add account and admin-token
field-label keys to all six locale dictionaries, then use the localized values
for accountLabel.textContent and tokenLabel.textContent. Keep
ADMIN_TOKEN_USERNAME only as the readonly username value, and do not reuse
titleText for the token label or hardcoded text for user-visible labels.
In `@gui/tests/admin-token-dialog.test.ts`:
- Around line 56-67: Add a test alongside the existing admin-token dialog tests
that submits an empty or whitespace-only password, verifies the dialog remains
open and the prompt promise is still pending, then submits a valid token and
asserts the promise resolves successfully. Reuse the existing
promptForAdminToken dialog setup and submission interaction symbols.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 708924f4-06db-4671-9dd0-801701333b8e
📒 Files selected for processing (11)
docs-site/src/content/docs/guides/web-dashboard.mdgui/src/admin-token-dialog.tsgui/src/api.tsgui/src/i18n/de.tsgui/src/i18n/en.tsgui/src/i18n/ja.tsgui/src/i18n/ko.tsgui/src/i18n/ru.tsgui/src/i18n/zh.tsgui/tests/admin-token-dialog.test.tsgui/tests/api-auth-memory.test.ts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
window.prompt()admin-token flow with a standard sign-in form that password managers can recognizelocalStorageorsessionStorageWhy
Remote dashboards must authenticate with the raw admin token, but
window.prompt()does not expose the standard form and autocomplete semantics used by browser password managers. This forces operators to copy and paste the credential again after reloads instead of letting their chosen password manager offer save and autofill behavior.The root cause is the prompt primitive itself: it cannot provide stable username/password fields, field names, or
autocomplete="current-password"metadata.Security and privacy
bun run privacy:scanpassesThis PR touches management-credential handling and therefore requests explicit security review.
Validation
bun run test— 6,867 passed, 8 skippedbun run typecheckbun run privacy:scancd gui && bun test tests— 492 passedcd gui && bun run lintcd gui && bun run lint:i18ncd gui && bun run buildcd docs-site && bun run buildSummary by CodeRabbit
New Features
Documentation
Tests