From 26334ec328ba33b7027c6b76cdee11f2520502d0 Mon Sep 17 00:00:00 2001
From: "Snow Lee (Sungwon)" <snow@runbear.io>
Date: Fri, 31 Jul 2026 18:33:12 +0900
Subject: [PATCH] fix(webapp): auth submit buttons answer to
 button[type=submit] (BEA-53) (#103)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Every server-rendered /auth form shipped a bare <button>. Browsers default
one inside a form to submit, so humans never noticed — but the conventional
automation selector matched nothing, and the e2e suite carried a "form
button" workaround at two call sites to compensate.

All five buttons (sign in, sign up, approve, send reset link, set password)
now carry an explicit type="submit", and both e2e call sites use the
standard selector. Every spec's login() routes through helpers.ts, so a
regression fails the whole run at the first sign-in.

Markup only: authlocal.go styles button by element, not by [type], so the
rendered pages are byte-identical before and after.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 internal/webapp/authcli.go               | 2 +-
 internal/webapp/authlocal.go             | 8 ++++----
 internal/webapp/frontend/e2e/helpers.ts  | 2 +-
 internal/webapp/frontend/e2e/hub.spec.ts | 2 +-
 4 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/internal/webapp/authcli.go b/internal/webapp/authcli.go
index 820088b..32b8665 100644
--- a/internal/webapp/authcli.go
+++ b/internal/webapp/authcli.go
@@ -162,7 +162,7 @@ func (c *CLIAuth) pageAuth(w http.ResponseWriter, r *http.Request, req authReque
 	}
 	authPage(w, req.title, fmt.Sprintf(`<p class="lede">%s</p>
 %s%s
-<form method="post"><button>Approve</button></form>
+<form method="post"><button type="submit">Approve</button></form>
 <p class="alt">%s</p>`,
 		html.EscapeString(req.lede), whoBlock(user, r.URL.RequestURI()), rows(req.detail()...), req.note))
 }
diff --git a/internal/webapp/authlocal.go b/internal/webapp/authlocal.go
index e0c89f8..1964dcc 100644
--- a/internal/webapp/authlocal.go
+++ b/internal/webapp/authlocal.go
@@ -721,7 +721,7 @@ func (a *BuiltinAuth) pageLogin(w http.ResponseWriter, r *http.Request) {
 	if a.Brand != "" {
 		brand = `<p class="alt" style="margin:0 0 14px;color:var(--dim)">` + html.EscapeString(a.Brand) + `</p>`
 	}
-	authPage(w, "Sign in", brand+inviteBanner(next)+cliBanner(next)+fmt.Sprintf(`<form method="post" action="/auth/login?next=%s">%s%s%s<button>Sign in</button></form>
+	authPage(w, "Sign in", brand+inviteBanner(next)+cliBanner(next)+fmt.Sprintf(`<form method="post" action="/auth/login?next=%s">%s%s%s<button type="submit">Sign in</button></form>
 %s<p class="alt"><a href="/auth/reset">Forgot password?</a></p>`,
 		url.QueryEscape(next),
 		field("Email", "email", "email", r.FormValue("email")),
@@ -787,7 +787,7 @@ func (a *BuiltinAuth) pageSignup(w http.ResponseWriter, r *http.Request) {
 	if a.Brand != "" {
 		brand = `<p class="alt" style="margin:0 0 14px;color:var(--dim)">` + html.EscapeString(a.Brand) + `</p>`
 	}
-	authPage(w, "Create account", brand+inviteBanner(next)+cliBanner(next)+fmt.Sprintf(`<form method="post" action="/auth/signup?next=%s">%s%s%s%s%s<button>Sign up</button></form>
+	authPage(w, "Create account", brand+inviteBanner(next)+cliBanner(next)+fmt.Sprintf(`<form method="post" action="/auth/signup?next=%s">%s%s%s%s%s<button type="submit">Sign up</button></form>
 <p class="alt">Have an account? <a href="/auth/login?next=%s">Sign in</a></p>`,
 		url.QueryEscape(next),
 		field("Name", "name", "text", r.FormValue("name")),
@@ -863,7 +863,7 @@ func (a *BuiltinAuth) pageReset(w http.ResponseWriter, r *http.Request) {
 <p class="alt">No email configured on this server? The link is in the server log.</p>`)
 		return
 	}
-	authPage(w, "Reset password", fmt.Sprintf(`<form method="post">%s<button>Send reset link</button></form>
+	authPage(w, "Reset password", fmt.Sprintf(`<form method="post">%s<button type="submit">Send reset link</button></form>
 <p class="alt"><a href="/auth/login">Back to sign in</a></p>`,
 		field("Email", "email", "email", "")))
 }
@@ -900,7 +900,7 @@ func (a *BuiltinAuth) pageResetConfirm(w http.ResponseWriter, r *http.Request) {
 }
 
 func resetForm(token, msg string) string {
-	return fmt.Sprintf(`<form method="post"><input type="hidden" name="token" value=%q>%s%s<button>Set password</button></form>`,
+	return fmt.Sprintf(`<form method="post"><input type="hidden" name="token" value=%q>%s%s<button type="submit">Set password</button></form>`,
 		html.EscapeString(token), newPasswordField("New password (min 8 chars)", "password"), msg)
 }
 
diff --git a/internal/webapp/frontend/e2e/helpers.ts b/internal/webapp/frontend/e2e/helpers.ts
index c67c5a1..165c278 100644
--- a/internal/webapp/frontend/e2e/helpers.ts
+++ b/internal/webapp/frontend/e2e/helpers.ts
@@ -26,7 +26,7 @@ export async function login(page: Page, email: string = ADMIN) {
   await page.waitForURL(/auth\/login/);
   await page.fill('input[name="email"]', email);
   await page.fill('input[name="password"]', PASSWORD);
-  await page.click("form button");
+  await page.click("button[type=submit]");
   await page.waitForSelector("#sidebar");
   sessions.set(email, await page.context().cookies());
 }
diff --git a/internal/webapp/frontend/e2e/hub.spec.ts b/internal/webapp/frontend/e2e/hub.spec.ts
index 68d2bee..22e0ce1 100644
--- a/internal/webapp/frontend/e2e/hub.spec.ts
+++ b/internal/webapp/frontend/e2e/hub.spec.ts
@@ -63,7 +63,7 @@ test("join link accepts an invite after sign-in", async ({ page, browser }) => {
   await p2.waitForURL(/auth\/login/);
   await p2.fill('input[name="email"]', MEMBER);
   await p2.fill('input[name="password"]', PASSWORD);
-  await p2.click("form button");
+  await p2.click("button[type=submit]");
   await expectToast(p2, "you joined");
   await p2.waitForURL(/\/[0-9a-f-]{36}$/); // lands on the org's project
   await ctx.close();