Add the frontend shell, the token system, and a login screen

Two axes on <html>: data-theme for colour, data-style for shape and
density, independent of each other. v1 shipped 12 themes x 3 layout styles
as 36 hand-maintained stylesheets -- 8,300 lines of CSS, 553 custom
properties, 116 !important declarations, and the last fifteen commits in
the repo were print-preview CSS tweaks. Here a theme is a list of colours
and a style is a list of measurements. Every token is semantic: nothing is
named --blue-500, because a theme has to be able to change what blue is.

The release bundle is 209 KB, 87 KB gzipped. v1's was 2.5 MB, a
meaningful share of which was a 638-line dead CalDAV client that kept
reqwest, ical and regex in the dependency list. Feature-gating runway-core
is what that structural fix buys.

One typed API client returning Result<T, ApiError> with a matchable code,
replacing v1's seventeen raw RequestInit call sites across three modules,
each with its own header, error and JSON handling and all returning
Result<T, String>. The session cookie is HttpOnly and this code cannot
read it; asking the server who you are is the only way to find out.

Trunk proxies /api to the backend so the cookie is same-origin in
development exactly as in production, rather than weakening it to
SameSite=None for a local convenience.

And the browser loop the audit called the biggest change between v1 and
v2: e2e/shoot.mjs drives a real Chromium, screenshots every state across
both token axes using the actual controls, and reports whatever the
console said. It found that wasm-opt needed telling bulk-memory is
allowed, and that offering a reference number for a mistyped password
suggests a fault at our end.

This commit is contained in:

connor

2026-08-26 19:13:59 -04:00

parent 2e5bd6ec34

commit 16b1ad9a14

17 changed files with 2484 additions and 1 deletions

									
										Cargo.toml
									
		+4
		
												View File
												
				@@ -64,6 +64,10 @@ quick-xml = "0.42"

				# Frontend

				leptos = "0.8"

				leptos_router = "0.8"

				gloo-net = { version = "0.6", features = ["json"] }

				wasm-bindgen = "0.2"

				web-sys = "0.3"

				console_error_panic_hook = "0.1"

				# CLI

				clap = { version = "4", features = ["derive", "env"] }